@go-to-k/cdkd 0.296.7 → 0.296.9

package/dist/{program-DEnDp4o0.js → program-DTXVCX29.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displayIdent, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, L as stringifyJsonPayload, M as displayStackName, N as isPasteableIdent, O as cutMarker, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, d as PATTERN_B_NAME_PROPERTIES, f as PATTERN_B_RESOURCE_TYPES, g as generateResourceName, h as explicitNamePropertyFor, i as reserveStdoutForPayload, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, m as derivesPatternBName, n as getLogger, o as runStackBuffered, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_OPTIONS, w as SAFE_MSG_ALTERED_CHAR, x as withSkipPrefix } from "./logger-DAaB7GFO.js";
-import { An as setPasteableVerbFlags, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bt as clientDefaultsFor, Ct as buildForceUnlockCommand, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, F as runDeleteAttempt, Ft as producerRecordKey, G as beginCommandInterruptScope, Gn as retryClassificationText, Ht as AccountIdUnavailableError, It as setPasteableAwsProfile, J as isInterruptedWaitError, Jn as safeStringify, Jt as DeployCancelledError, K as endCommandInterruptScope, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, Mt as injectiveKey, On as withheldTargetClause, Ot as formatLockOwner, Pt as producerCoordinateKey, Qn as markNonRetryable, Qt as LocalStartServiceError, Rt as ambientClientDefaults, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, Tn as quotedOrDescribed, Tt as forceQuitRecoveryClause, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Yt as DynamicReferenceRegionAmbiguousError, Zn as isThrottlingError, Zt as LocalInvokeBuildError$1, _ as VALUE_NOT_SHOWN, _n as SHELL_ACTIVE_WHY, an as ResourceTimeoutError, cn as StackTerminationProtectionError, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, hn as TIMEOUT_FLAG_RESOURCE_TYPE, in as ProvisioningError, it as resourceTypeShown, jt as DEFAULT_STATE_PREFIX, kn as setPasteableRunFlags, mn as withErrorHandling, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as NestedStackChildDirectDestroyError, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, pn as normalizeAwsError, q as interruptWatchListenerCount, rn as PartialFailureError, s as readRecordedPrincipals, sn as StackHasActiveImportsError, t as IAM_PRINCIPAL_NAME, tn as MalformedProducerRecordRefusalError, un as SynthesisError, w as remedyLogicalId, wn as plainOrDescribed, wt as buildLockContentionMessage, xn as isInertUnquoted, yn as commandHole, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
+import { An as setPasteableVerbFlags, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bt as clientDefaultsFor, Ct as buildForceUnlockCommand, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, F as runDeleteAttempt, Ft as producerRecordKey, G as beginCommandInterruptScope, Gn as retryClassificationText, Ht as AccountIdUnavailableError, It as setPasteableAwsProfile, J as isInterruptedWaitError, Jn as safeStringify, Jt as DeployCancelledError, K as endCommandInterruptScope, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, Mt as injectiveKey, On as withheldTargetClause, Ot as formatLockOwner, Pt as producerCoordinateKey, Qn as markNonRetryable, Qt as LocalStartServiceError, Rt as ambientClientDefaults, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, Tn as quotedOrDescribed, Tt as forceQuitRecoveryClause, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Yt as DynamicReferenceRegionAmbiguousError, Zn as isThrottlingError, Zt as LocalInvokeBuildError$1, _ as VALUE_NOT_SHOWN, _n as SHELL_ACTIVE_WHY, an as ResourceTimeoutError, cn as StackTerminationProtectionError, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, hn as TIMEOUT_FLAG_RESOURCE_TYPE, in as ProvisioningError, it as resourceTypeShown, jt as DEFAULT_STATE_PREFIX, kn as setPasteableRunFlags, mn as withErrorHandling, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as NestedStackChildDirectDestroyError, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, pn as normalizeAwsError, q as interruptWatchListenerCount, rn as PartialFailureError, s as readRecordedPrincipals, sn as StackHasActiveImportsError, t as IAM_PRINCIPAL_NAME, tn as MalformedProducerRecordRefusalError, un as SynthesisError, w as remedyLogicalId, wn as plainOrDescribed, wt as buildLockContentionMessage, xn as isInertUnquoted, yn as commandHole, zt as ambientCredentialConfig } from "./iam-policy-targets-BREzwsG6.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as resourcesNamingDeclaredParameter, $a as maskSecretsInError, $i as repairMalformedResourceEntriesForReadOnly, $n as deleteSkipReason, $o as ensureAssetStorage, $r as deployRefusesOrphanRowsReason, $s as derivePartitionAndUrlSuffix, $t as effectiveDeletionPolicy, Ai as refuseMalformedOrphans, Ao as acceptedCreateOnlyDropsOf, As as getDefaultStateBucketName, At as planRollback, Ba as TemplateParser, Bi as refuseMalformedResourceEntriesForImportSave, Bn as CC_BROKEN_REASON, Bo as orphansCarriedFrom, Br as AWS_NO_VALUE, Bs as stateBucketExistenceConfirmed, Bt as updatePartialMessage, C as perType, Ci as malformedScrubResourceEntriesRefusalMessage, Cn as findDestructiveChanges, Co as WHOLE_DYNAMIC_REFERENCE_PATTERN, Cr as callerEnvCredentials, Cs as warnFinchArgvExposure, Dn as ledgerForStack, Do as S3StateBackend, Ds as getDockerImageBySourceHash, Dt as isJournaledOrphan, Ei as refuseDivergentRecordRegionForDestroy, Eo as isLockInfoExpired, Es as AssetManifestLoader, Et as demoteSupersededOrphans, Fa as withRetry, Fi as refuseMalformedResourceAttributesForOrphan, Fo as hasUnverifiableParameterRefusal, Fr as isImpossibleEmptyStoredAttribute, Fs as resolveCaptureObservedState, Ft as inheritProducerRegions, G as cyan, Ga as literalSplitDelimitersOf, Gi as refuseMalformedResourcePropertiesForOrphan, Go as WorkGraph, Gr as withSharedDrainBudget, Gs as MIGRATE_TMP_PREFIX, Gt as orphanRecordsPrintingBag, H as formatResourceLine, Ha as carryLogOnlyValues, Hi as refuseMalformedResourcePropertiesForDestroy, Hn as ccBrokenReason, Ho as AssetPublisher, Hr as isStalePlaceholderArnAttribute, Hs as ssmResolvedValueType, Ht as completedReplayEntries, Ii as refuseMalformedResourceEntries, Io as importableOutputKeys, Ir as carriesDynamicReference, Is as resolveSkipPrefix, J as red, Ja as recordLogOnlyParameterValue, Ji as refuseMalformedResourcesForExport, Jn as slowCcOperationTimeoutMs, Jo as loadPublishableAssetManifest, Jr as JSON_LISTING_HOLE_VALUE, Js as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Jt as ATOMIC_FINAL_SNAPSHOT_TYPES, K as gray, Ka as logOnlyValueCount, Ki as refuseMalformedResourcesForDeploy, Kn as withPrintingSecrets, Ko as buildAssetRedirectMap, Kr as parameterInputsFor, Ks as findLargeInlineResources, Kt as secretNamePrintingBag, Li as refuseMalformedResourceEntriesForDeploy, Lo as importableOutputs, Lr as carriesFetchableDynamicReference, Ls as resolveStateBucketWithDefault, Ma as prefetchCreateOnlyPropertyPaths, Mi as refuseMalformedOrphansForOrphan, Mo as exportNamesCarriedFrom, Mr as isUnboundTemplateParameter, Ms as loadCdkJson, Mt as resolveReplacementOldType, Na as templateResourceTypes, Ni as refuseMalformedOutputs, No as hasReadableExportSet, Nr as parameterTypeMayLoseSecretIdentity, Ns as resolveApp, Nt as findNestedStackTypeChanges, Oi as refuseMalformedOrphanRecords, Oo as rebuildClientForBucketRegion, Os as Synthesizer, Ot as isReplacementOrphan, Pa as describeTypeWithThrottleRetry, Pi as refuseMalformedOutputsForDestroy, Po as hasReasonlessBaselineRefusal, Pr as getAccountInfo, Ps as resolveAutoAssetStorage, Q as reachableDivergentParameters, Qa as errorCauseChain, Qi as repairMalformedOutputsForReadOnly, Qn as deleteIndeterminateGuards, Qo as assertAssetBucketRegion, Qr as UNREADABLE_RESOURCES_MAP_ROW, Qs as canonicalizeRegion, Qt as createPreDeleteFinalSnapshot, Ri as refuseMalformedResourceEntriesForDestroy, Ro as isReadableBag, Rr as isNamelessDynamicReferenceError, Rs as resolveStateBucketWithDefaultAndSource, S as isProtectionValueActive, Si as malformedResourcesWarning, Sn as constructPathOf, So as TEMPLATE_SOURCED_RULES, Sr as applyCallerIdentityCredentials, Ss as runDockerStreaming, St as destroyStackRecordsView, Ti as previewableOrphanRecords, Tn as RollbackInlinePolicyWriters, To as LockManager, Ts as stripControlChars, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as createUnionSecretMasker, Ui as refuseMalformedResourcePropertiesForDrift, Un as wouldReturnToSdkProvider, Uo as isSensitiveAttributeName, Ur as refStateLookupFromResource, Us as CFN_TEMPLATE_BODY_LIMIT, Ut as journaledOrphanPrintingBag, Va as liveMatchesUnresolvedTokenFrame, Vi as refuseMalformedResourceEntriesForOrphan, Vn as ProviderRegistry, Vo as shouldRetainResource, Vr as cfnRefValueFromPhysicalId, Vs as warnDeprecatedNoPrefixCliFlag, Vt as updatePartialReason, W as bold, Wa as hasMaskableValues, Wi as refuseMalformedResourcePropertiesForExport, Wn as isCustomResourceType$1, Wo as stringifyValue, Ws as CFN_TEMPLATE_URL_LIMIT, Wt as maskEventTextWithBoundBags, X as computeParameterTaint, Xa as shareLogOnlyValues, Xi as repairMalformedOrphanRecordsForReadOnly, Xo as AssetModeResolver, Xr as STATE_RESOURCES_MALFORMED, Xs as expectedOwnerParam, Xt as buildFinalSnapshotIdentifier, Y as yellow, Ya as recordLogOnlyValue, Yi as refuseMalformedState, Yn as ccProtectionRegistryTypes, Yo as rewriteTemplateAssetReferences, Yr as STATE_REGION_DIVERGED, Ys as decodeListingKey, Yt as PRE_DELETE_SNAPSHOT_TYPES, Z as namesAnyDeclaredParameter, Za as createSecretMasker, Zi as repairMalformedOrphansForReadOnly, Zn as UNSPECIFIED_SKIP_REASON, Zo as BOOTSTRAP_MARKER_PREFIX, Zr as UNREADABLE_ORPHANS_CONTAINER_ROW, Zs as PARTITION_TABLE, Zt as ccRoutedFinalSnapshotError, _ as makeCanonicalizePropertiesFn, _i as malformedOutputsRefusalMessage, _n as isExportAliasCollision, _o as recordProvenPublicExpression, _r as assertSendableRoleArn, _s as isMalformedEnvKey, a as findNestedTemplateTreeDefect, aa as findActionableSilentDrops, ac as hasPlainPrototype, ai as isReadableResourceEntry, an as extractDeploymentEventError, ao as dynamicReferenceTokens, as as validateContainerRepoName, at as makeSiblingClaimReader, b as recordedProtectionNote, bi as malformedResourceEntriesWarning, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as STATE_SOURCED_CROSS_GENERATION_RULES, br as sendableAssumeRoleCommand, bs as redactedDockerCause, bt as replayRollback, c as renderNestedTemplateTreeDefect, cc as absoluteAssemblyPathEscape, ci as malformedExportSourceWarning, cn as exportAliasCollisionScrubWarning, co as inheritNestedStackParameterAssociations, cs as resolveDockerContextDirectory, ct as displacedOpClause, d as conditionInputsFrom, da as findReplacedReadersOfRecreateTargets, dc as renderAssemblyPathEscape, di as malformedLocalResourcesWarning, dn as secretSafeKeyDisplay, do as identityKeyFor, dr as IntrinsicFunctionResolver, ds as describeDockerFailure, ea as repairMalformedResourcePropertiesForReadOnly, ec as AssemblyReader, ei as displayLogicalId, en as isFinalSnapshotError, eo as maskSecretsInText, es as getBootstrapMarkerKey, et as deleteJournaledOrphans, f as parentSuppliedValues, fa as shownType, fc as resolveAssemblyPath, fi as malformedOrphanRecordsRefusalMessage, fn as exportNameSecretExposure, fo as carriesSecretMask, fr as classifyReplaySecretRegion, fs as dockerSpawnEnvWithSensitive, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, ga as renderStatefulReason, gi as malformedOrphansWarning, gn as collectPublishedOutputNames, go as recordNoEchoAttributeValues, gr as assertFlagRoleArn, gs as isDockerClientEnvKey, gt as withNestedRevertRun, h as keptWholeReasonText, ha as isStatefulRecreateTargetSync, hi as malformedOrphansRefusalMessage, hn as collectDeclaredOutputNames, ho as recordMaskOnlyValuesIn, hr as applyRoleArnIfSet, hs as getDockerCmd, ht as revertedNestedRowIds, i as childTemplateLoader, ia as unreadableResourceEntries, ic as hasOwnKey, ii as isReadableOrphanRecord, in as DeploymentEventsStore, io as DYNAMIC_REFERENCE_TOKEN_SCAN, is as validateAssetBucketName, it as sameJournaledOrphans, ji as refuseMalformedOrphansForDestroy, jo as describeRegionValueKind, jr as coerceParameterTypedValue, js as getLegacyStateBucketName, jt as replacementNeverSwapped, ki as refuseMalformedOrphanRecordsForDestroy, kn as withCreateTokenLedger, ko as splitImportedOps, ks as synthesisStatusMessage, kt as planFailedOps, l as templateIdentity, la as NO_CC_HANDLERS_REASON, lc as describeFileReadFailure, li as malformedLocalOutputsWarning, ln as secretBearing, lo as recordNestedStackParameterExpressions, lr as DiffCalculator, ls as describeDockerCapturedOutput, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, ma as isStatefulRecreateTargetForReplace, mc as resolveBucketRegion, mi as malformedOrphanRowsKeptWarning, mn as noEchoParameterValueSeed, mo as recordMaskOnlyValue, mr as regionLessSecretName, ms as formatDockerLoginError, n as IMPLICIT_DELETE_DEPENDENCIES, na as unpreviewableOrphanRecords, nc as processStackMessages, ni as hasReadableOutputs, nn as unsupportedFinalSnapshotError, no as redactSecretsForState, ns as parseBootstrapMarker, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oc as nullPrototypeRecord, oi as malformedDriftResourcePropertiesWarning, on as WITHHELD_NAME_DISPLAY, oo as isUncertifiedBaselineMaskPosition, os as buildDenyExternalAccessPolicy, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pa as MULTI_REGION_RECREATE_BLOCKED_TYPES, pi as malformedOrphanRecordsWarning, pn as isWholeDynamicReferenceValue, po as provenPublicValue, pr as producerRegionsFromState, ps as finchSecretArgvRefusal, pt as recordDisplacedSkips, q as green, qa as printingCorpusOf, qi as refuseMalformedResourcesForDestroy, qn as CloudControlProvider, qo as createAssetRedirectResolver, qs as uploadCfnTemplate, qt as stateSecretNameNeedles, r as computeImplicitDeleteEdges, ra as unreadableOrphanRecords, rc as defineOwnKey, ri as hasReadableResources, rn as DeploymentEventsReader, ro as scrubResourceRecord, rs as readBootstrapMarkerBody, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as unwrittenCreateOnlyReplacement, sc as ownValue, si as malformedExportNamesWarning, sn as displayTextOrWithheld, so as pathCrossesDottedKey, ss as buildDockerImage, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, ta as repairMalformedResourcesForReadOnly, tc as StageLoadError, ti as hasReadableOrphans, tn as refusesFinalSnapshot, to as markSameGenerationBag, tr as isWaitAbandonedError, ts as isCrossRegionRedirect, tt as isHandledOrphan, u as conditionFingerprint, ua as hasNoCloudControlHandlers, uc as displayAssemblyPath, ui as malformedLocalResourceEntriesWarning, un as secretBearingStateKeyWarning, ur as INTRINSIC_KEYS, us as describeDockerExecFailure, ut as dropSettledNestedJournals, v as withResourceDeadline, vi as malformedOutputsWarning, vn as bindingSkippedOutputs, vo as wholeStringLeavesOf, vr as explicitRoleArnOrThrow, vs as partitionSensitiveEnv, vt as withNestedStackContext, w as readProtection, wi as malformedStateRefusalMessage, wn as formatDestructiveChange, wo as isSingleDynamicReferenceToken, wr as envCredentialsAreAssumedRole, ws as escapeRegExp, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as malformedResourcePropertiesWarning, xn as maskingRetryLogger, xo as STATE_SOURCED_READBACK_RULES, xr as AWS_CREDENTIAL_ENV_KEYS, xs as runDockerForeground, y as recordedProtectionEvidence, yi as malformedRenderedContainersWarning, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as STATE_SOURCED_BASELINE_RULES, yr as isIamRoleArn, ys as redactDockerArgvValues, yt as replayFailedOperations, za as DagBuilder, zi as refuseMalformedResourceEntriesForImport, zo as orphansAfterRollback, zr as keepsSecretReferenceToken, zs as resolveUseCdkBootstrapAssets } from "./deploy-engine-wyaJUA8V.js";
-import { t as getCdkdVersion } from "./version-LalLOhpQ.js";
+import { $ as resourcesNamingDeclaredParameter, $a as createSecretMasker, $i as repairMalformedOutputsForReadOnly, $n as deleteSkipReason, $o as BOOTSTRAP_MARKER_PREFIX, $r as accountArgs, $s as PARTITION_TABLE, $t as effectiveDeletionPolicy, Ai as refuseMalformedOrphanRecordsForDestroy, Ao as rebuildClientForBucketRegion, As as Synthesizer, At as planRollback, Bi as refuseMalformedResourceEntriesForImport, Bn as CC_BROKEN_REASON, Bo as isReadableBag, Br as AWS_NO_VALUE, Bs as resolveStateBucketWithDefaultAndSource, Bt as updatePartialMessage, C as perType, Ci as malformedResourcesWarning, Cn as findDestructiveChanges, Co as STATE_SOURCED_READBACK_RULES, Cr as callerEnvCredentials, Cs as runDockerForeground, Di as refuseDivergentRecordRegionForDestroy, Dn as ledgerForStack, Do as LockManager, Ds as stripControlChars, Dt as isJournaledOrphan, Ei as previewableOrphanRecords, Eo as isSingleDynamicReferenceToken, Es as escapeRegExp, Et as demoteSupersededOrphans, Fa as templateResourceTypes, Fi as refuseMalformedOutputsForDestroy, Fo as hasReadableExportSet, Fr as isImpossibleEmptyStoredAttribute, Fs as resolveApp, Ft as inheritProducerRegions, G as cyan, Ga as createUnionSecretMasker, Gi as refuseMalformedResourcePropertiesForExport, Go as isSensitiveAttributeName, Gr as withSharedDrainBudget, Gs as CFN_TEMPLATE_BODY_LIMIT, Gt as orphanRecordsPrintingBag, H as formatResourceLine, Ha as TemplateParser, Hi as refuseMalformedResourceEntriesForOrphan, Hn as ccBrokenReason, Ho as orphansCarriedFrom, Hr as isStalePlaceholderArnAttribute, Hs as stateBucketExistenceConfirmed, Ht as completedReplayEntries, Ia as describeTypeWithThrottleRetry, Ii as refuseMalformedResourceAttributesForOrphan, Io as hasReasonlessBaselineRefusal, Ir as carriesDynamicReference, Is as resolveAutoAssetStorage, J as red, Ja as logOnlyValueCount, Ji as refuseMalformedResourcesForDestroy, Jn as slowCcOperationTimeoutMs, Jo as buildAssetRedirectMap, Jr as JSON_LISTING_HOLE_VALUE, Js as findLargeInlineResources, Jt as ATOMIC_FINAL_SNAPSHOT_TYPES, K as gray, Ka as hasMaskableValues, Ki as refuseMalformedResourcePropertiesForOrphan, Kn as withPrintingSecrets, Ko as stringifyValue, Kr as parameterInputsFor, Ks as CFN_TEMPLATE_URL_LIMIT, Kt as secretNamePrintingBag, La as withRetry, Li as refuseMalformedResourceEntries, Lo as hasUnverifiableParameterRefusal, Lr as carriesFetchableDynamicReference, Ls as resolveCaptureObservedState, Mi as refuseMalformedOrphansForDestroy, Mo as acceptedCreateOnlyDropsOf, Mr as isUnboundTemplateParameter, Ms as getDefaultStateBucketName, Mt as resolveReplacementOldType, Ni as refuseMalformedOrphansForOrphan, No as describeRegionValueKind, Nr as parameterTypeMayLoseSecretIdentity, Ns as getLegacyStateBucketName, Nt as findNestedStackTypeChanges, Oo as isLockInfoExpired, Os as AssetManifestLoader, Ot as isReplacementOrphan, Pa as prefetchCreateOnlyPropertyPaths, Pi as refuseMalformedOutputs, Po as exportNamesCarriedFrom, Pr as getAccountInfo, Ps as loadCdkJson, Q as reachableDivergentParameters, Qa as shareLogOnlyValues, Qi as repairMalformedOrphansForReadOnly, Qn as deleteIndeterminateGuards, Qo as AssetModeResolver, Qr as UNREADABLE_RESOURCES_MAP_ROW, Qs as expectedOwnerParam, Qt as createPreDeleteFinalSnapshot, Ri as refuseMalformedResourceEntriesForDeploy, Ro as importableOutputKeys, Rr as isNamelessDynamicReferenceError, Rs as resolveSkipPrefix, S as isProtectionValueActive, Si as malformedResourcePropertiesWarning, Sn as constructPathOf, So as STATE_SOURCED_CROSS_GENERATION_RULES, Sr as applyCallerIdentityCredentials, Ss as redactedDockerCause, St as destroyStackRecordsView, Ti as malformedStateRefusalMessage, Tn as RollbackInlinePolicyWriters, To as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ts as warnFinchArgvExposure, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as liveMatchesUnresolvedTokenFrame, Ui as refuseMalformedResourcePropertiesForDestroy, Un as wouldReturnToSdkProvider, Uo as shouldRetainResource, Ur as refStateLookupFromResource, Us as warnDeprecatedNoPrefixCliFlag, Ut as journaledOrphanPrintingBag, Va as DagBuilder, Vi as refuseMalformedResourceEntriesForImportSave, Vn as ProviderRegistry, Vo as orphansAfterRollback, Vr as cfnRefValueFromPhysicalId, Vs as resolveUseCdkBootstrapAssets, Vt as updatePartialReason, W as bold, Wa as carryLogOnlyValues, Wi as refuseMalformedResourcePropertiesForDrift, Wn as isCustomResourceType$1, Wo as AssetPublisher, Ws as ssmResolvedValueType, Wt as maskEventTextWithBoundBags, X as computeParameterTaint, Xa as recordLogOnlyParameterValue, Xi as refuseMalformedState, Xo as loadPublishableAssetManifest, Xr as STATE_RESOURCES_MALFORMED, Xs as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Xt as buildFinalSnapshotIdentifier, Y as yellow, Ya as printingCorpusOf, Yi as refuseMalformedResourcesForExport, Yn as ccProtectionRegistryTypes, Yo as createAssetRedirectResolver, Yr as STATE_REGION_DIVERGED, Ys as uploadCfnTemplate, Yt as PRE_DELETE_SNAPSHOT_TYPES, Z as namesAnyDeclaredParameter, Za as recordLogOnlyValue, Zi as repairMalformedOrphanRecordsForReadOnly, Zn as UNSPECIFIED_SKIP_REASON, Zo as rewriteTemplateAssetReferences, Zr as UNREADABLE_ORPHANS_CONTAINER_ROW, Zs as decodeListingKey, Zt as ccRoutedFinalSnapshotError, _ as makeCanonicalizePropertiesFn, _a as isStatefulRecreateTargetSync, _i as malformedOrphansWarning, _n as isExportAliasCollision, _o as recordMaskOnlyValuesIn, _r as assertSendableRoleArn, _s as getDockerCmd, a as findNestedTemplateTreeDefect, aa as unreadableResourceEntries, ac as defineOwnKey, ai as isReadableOrphanRecord, an as extractDeploymentEventError, ao as scrubResourceRecord, as as readBootstrapMarkerBody, at as makeSiblingClaimReader, b as recordedProtectionNote, bi as malformedRenderedContainersWarning, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as wholeStringLeavesOf, br as sendableAssumeRoleCommand, bs as partitionSensitiveEnv, bt as replayRollback, c as renderNestedTemplateTreeDefect, cc as nullPrototypeRecord, ci as malformedExportNamesWarning, cn as exportAliasCollisionScrubWarning, co as isUncertifiedBaselineMaskPosition, cs as buildDenyExternalAccessPolicy, ct as displacedOpClause, d as conditionInputsFrom, da as NO_CC_HANDLERS_REASON, dc as describeFileReadFailure, di as malformedLocalResourceEntriesWarning, dn as secretSafeKeyDisplay, do as recordNestedStackParameterExpressions, dr as IntrinsicFunctionResolver, ds as describeDockerCapturedOutput, ea as repairMalformedResourceEntriesForReadOnly, ec as canonicalizeRegion, ei as deployRefusesOrphanRowsReason, en as isFinalSnapshotError, eo as errorCauseChain, es as assertAssetBucketRegion, et as deleteJournaledOrphans, f as parentSuppliedValues, fa as hasNoCloudControlHandlers, fc as displayAssemblyPath, fi as malformedLocalResourcesWarning, fn as exportNameSecretExposure, fr as classifyReplaySecretRegion, fs as describeDockerExecFailure, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, ga as isStatefulRecreateTargetForReplace, gc as resolveBucketRegion, gi as malformedOrphansRefusalMessage, gn as collectPublishedOutputNames, go as recordMaskOnlyValue, gr as assertFlagRoleArn, gs as formatDockerLoginError, gt as withNestedRevertRun, h as keptWholeReasonText, ha as MULTI_REGION_RECREATE_BLOCKED_TYPES, hi as malformedOrphanRowsKeptWarning, hn as collectDeclaredOutputNames, ho as provenPublicValue, hr as applyRoleArnIfSet, hs as finchSecretArgvRefusal, ht as revertedNestedRowIds, i as childTemplateLoader, ia as unreadableOrphanRecords, ic as processStackMessages, ii as hasReadableResources, in as DeploymentEventsStore, io as redactSecretsForState, is as parseBootstrapMarker, it as sameJournaledOrphans, ji as refuseMalformedOrphans, jo as splitImportedOps, jr as coerceParameterTypedValue, js as synthesisStatusMessage, jt as replacementNeverSwapped, ki as refuseMalformedOrphanRecords, kn as withCreateTokenLedger, ko as S3StateBackend, ks as getDockerImageBySourceHash, kt as planFailedOps, l as templateIdentity, la as unwrittenCreateOnlyReplacement, lc as ownValue, li as malformedExportSourceWarning, ln as secretBearing, lo as pathCrossesDottedKey, lr as DiffCalculator, ls as buildDockerImage, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, ma as shownType, mc as resolveAssemblyPath, mi as malformedOrphanRecordsWarning, mn as noEchoParameterValueSeed, mo as carriesSecretMask, mr as regionLessSecretName, ms as dockerSpawnEnvWithSensitive, n as IMPLICIT_DELETE_DEPENDENCIES, na as repairMalformedResourcesForReadOnly, nc as AssemblyReader, ni as hasReadableOrphans, nn as unsupportedFinalSnapshotError, no as maskSecretsInText, ns as getBootstrapMarkerKey, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oa as withheldAccountClause, oc as hasOwnKey, oi as isReadableResourceEntry, on as WITHHELD_NAME_DISPLAY, oo as DYNAMIC_REFERENCE_TOKEN_SCAN, os as validateAssetBucketName, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pa as findReplacedReadersOfRecreateTargets, pc as renderAssemblyPathEscape, pi as malformedOrphanRecordsRefusalMessage, pn as isWholeDynamicReferenceValue, po as identityKeyFor, pr as producerRegionsFromState, ps as describeDockerFailure, pt as recordDisplacedSkips, q as green, qa as literalSplitDelimitersOf, qi as refuseMalformedResourcesForDeploy, qn as CloudControlProvider, qo as WorkGraph, qs as MIGRATE_TMP_PREFIX, qt as stateSecretNameNeedles, r as computeImplicitDeleteEdges, ra as unpreviewableOrphanRecords, rc as StageLoadError, ri as hasReadableOutputs, rn as DeploymentEventsReader, ro as markSameGenerationBag, rs as isCrossRegionRedirect, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as findActionableSilentDrops, sc as hasPlainPrototype, si as malformedDriftResourcePropertiesWarning, sn as displayTextOrWithheld, so as dynamicReferenceTokens, ss as validateContainerRepoName, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, ta as repairMalformedResourcePropertiesForReadOnly, tc as derivePartitionAndUrlSuffix, ti as displayLogicalId, tn as refusesFinalSnapshot, to as maskSecretsInError, tr as isWaitAbandonedError, ts as ensureAssetStorage, tt as isHandledOrphan, u as conditionFingerprint, uc as absoluteAssemblyPathEscape, ui as malformedLocalOutputsWarning, un as secretBearingStateKeyWarning, uo as inheritNestedStackParameterAssociations, ur as INTRINSIC_KEYS, us as resolveDockerContextDirectory, ut as dropSettledNestedJournals, v as withResourceDeadline, va as renderStatefulReason, vi as malformedOutputsRefusalMessage, vn as bindingSkippedOutputs, vo as recordNoEchoAttributeValues, vr as explicitRoleArnOrThrow, vs as isDockerClientEnvKey, vt as withNestedStackContext, w as readProtection, wi as malformedScrubResourceEntriesRefusalMessage, wn as formatDestructiveChange, wo as TEMPLATE_SOURCED_RULES, wr as envCredentialsAreAssumedRole, ws as runDockerStreaming, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as malformedResourceEntriesWarning, xn as maskingRetryLogger, xo as STATE_SOURCED_BASELINE_RULES, xr as AWS_CREDENTIAL_ENV_KEYS, xs as redactDockerArgvValues, y as recordedProtectionEvidence, yi as malformedOutputsWarning, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as recordProvenPublicExpression, yr as isIamRoleArn, ys as isMalformedEnvKey, yt as replayFailedOperations, zi as refuseMalformedResourceEntriesForDestroy, zo as importableOutputs, zr as keepsSecretReferenceToken, zs as resolveStateBucketWithDefault } from "./deploy-engine-B-oaHd2t.js";
+import { t as getCdkdVersion } from "./version-Dqnp1Xj8.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2051,6 +2051,7 @@ var ExportIndexStore = class {
 	stateBackend;
 	loadState = { kind: "unloaded" };
 	opts;
+	profile;
 	writeChain = Promise.resolve();
 	clientResolved = false;
 	resolveInFlight = null;
@@ -2060,9 +2061,11 @@ var ExportIndexStore = class {
 		this.prefix = prefix;
 		this.region = region;
 		this.stateBackend = stateBackend;
+		const { profile, ...retry } = opts;
+		this.profile = profile;
 		this.opts = {
 			...DEFAULT_OPTIONS,
-			...opts
+			...retry
 		};
 	}
 	indexKey() {
@@ -2245,7 +2248,11 @@ var ExportIndexStore = class {
 			if (state.outputs === void 0) continue;
 			const region = ref.region ?? this.region;
 			if (!hasReadableExportSet(state)) {
-				this.logger.warn(malformedExportSourceWarning(ref.stackName, region));
+				this.logger.warn(malformedExportSourceWarning(ref.stackName, region, {
+					profile: this.profile,
+					stateBucket: this.bucket,
+					statePrefix: this.prefix
+				}));
 				continue;
 			}
 			const stateModified = state.lastModified ?? 0;
@@ -2414,7 +2421,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CsF7Ia5F.js");
+	providerClasses ??= import("./provider-classes-y-yYsSvB.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2709,7 +2716,7 @@ async function deployCommand(stacks, options) {
 		return {
 			stateBucket,
 			preflightStateBackend,
-			exportIndexStore: new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, preflightStateBackend)
+			exportIndexStore: new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, preflightStateBackend, { profile: options.profile })
 		};
 	})();
 	let deployInterrupted = false;
@@ -2740,6 +2747,11 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		const [result, statePrep] = await Promise.all([synthesizer.synthesize(synthOptions), statePrepPromise]);
 		const { stateBucket, preflightStateBackend, exportIndexStore } = statePrep;
 		synthOptions.stateBucket = stateBucket;
+		const refusalRecovery = {
+			profile: options.profile,
+			stateBucket,
+			statePrefix: options.statePrefix
+		};
 		const { stacks: allStacks } = result;
 		logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
@@ -2925,8 +2937,8 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
 					if (stateForRecreateCheck) {
-						refuseMalformedResourcesForDeploy(stateForRecreateCheck.state, stackInfo.stackName, stackRegion);
-						refuseMalformedResourceEntriesForDeploy(stateForRecreateCheck.state, stackInfo.stackName, stackRegion);
+						refuseMalformedResourcesForDeploy(stateForRecreateCheck.state, stackInfo.stackName, stackRegion, refusalRecovery);
+						refuseMalformedResourceEntriesForDeploy(stateForRecreateCheck.state, stackInfo.stackName, stackRegion, refusalRecovery);
 					}
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
@@ -2997,6 +3009,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					dryRun: options.dryRun,
 					noRollback: !options.rollback,
 					...options.roleArn && { roleArn: options.roleArn },
+					refusalRecovery,
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
 					...migrationGate && { onCurrentStateLoaded: migrationGate },
@@ -4175,38 +4188,38 @@ function indexNestedChildTemplates(template, templatePath) {
 	}
 	return result;
 }
-async function loadStateOrEmpty(stackName, region, stateBackend) {
+async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery) {
 	const result = await stateBackend.getState(stackName, region);
 	if (result) {
 		const unreadable = [];
 		const unreadableContainers = [];
 		const deployRefusals = [];
 		if (repairMalformedResourcesForReadOnly(result.state)) {
-			logger.warn(malformedResourcesWarning(stackName, region));
+			logger.warn(malformedResourcesWarning(stackName, region, refusalRecovery));
 			unreadableContainers.push("resources");
 			deployRefusals.push(DEPLOY_REFUSES_RESOURCES_BAG_REASON);
 		}
 		const dropped = repairMalformedResourceEntriesForReadOnly(result.state);
 		if (dropped.length > 0) {
-			logger.warn(malformedResourceEntriesWarning(stackName, region, dropped));
+			logger.warn(malformedResourceEntriesWarning(stackName, region, dropped, refusalRecovery));
 			for (const id of dropped) unreadable.push(id);
 			deployRefusals.push(deployRefusesResourceEntriesReason(dropped));
 		}
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
 		if (unreadableProps.length > 0) {
-			logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
+			logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps, refusalRecovery));
 			deployRefusals.push(deployRefusesPropertiesReason(unreadableProps));
 		}
 		if (repairMalformedOutputsForReadOnly(result.state)) {
-			logger.warn(malformedOutputsWarning(stackName, region));
+			logger.warn(malformedOutputsWarning(stackName, region, refusalRecovery));
 			deployRefusals.push(DEPLOY_REFUSES_OUTPUTS_REASON);
 		}
 		if (repairMalformedOrphansForReadOnly(result.state)) {
-			logger.warn(malformedOrphansWarning(stackName, region));
+			logger.warn(malformedOrphansWarning(stackName, region, refusalRecovery));
 			unreadableContainers.push("orphans");
 			deployRefusals.push(DEPLOY_REFUSES_ORPHANS_CONTAINER_REASON);
 		}
-		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
+		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region, refusalRecovery));
 		return {
 			state: result.state,
 			unreadable,
@@ -4522,7 +4535,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		for (const id of unpreviewableOrphanRecords(currentState)) unreadableOrphans.push(id);
 		const readableOrphans = previewableOrphanRecords(currentState);
 		if (unreadableOrphans.length > 0) {
-			logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans.map((id) => id ?? ""), false));
+			logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans.map((id) => id ?? ""), false, options.refusalRecovery));
 			deployRefusals.push(deployRefusesDroppedOrphanRowsReason(unreadableOrphans));
 		}
 		let reportedByTheAdoptedPropertiesArm = [];
@@ -4545,14 +4558,14 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			const tornAdopted = repairMalformedResourcePropertiesForReadOnly(stateForDiff);
 			reportedByTheAdoptedPropertiesArm = tornAdopted;
 			if (tornAdopted.length > 0) {
-				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted));
+				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted, options.refusalRecovery));
 				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
 			}
 		}
 		const alreadyReported = new Set(reportedByTheAdoptedPropertiesArm);
 		const previewedRowsTheDeployRefuses = readableOrphans.filter((record) => !isReadableOrphanRecord(record)).map((record) => record.logicalId).filter((logicalId) => !alreadyReported.has(logicalId));
 		if (previewedRowsTheDeployRefuses.length > 0) {
-			logger.warn(malformedOrphanRowsKeptWarning(stackName, region, previewedRowsTheDeployRefuses));
+			logger.warn(malformedOrphanRowsKeptWarning(stackName, region, previewedRowsTheDeployRefuses, options.refusalRecovery));
 			deployRefusals.push(deployRefusesOrphanRowsReason(previewedRowsTheDeployRefuses));
 		}
 	}
@@ -4591,7 +4604,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			}
 		} };
 	}
-	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties, void 0, void 0, maskForLog, void 0, maskedInputs);
+	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties, void 0, void 0, maskForLog, void 0, maskedInputs, options.refusalRecovery);
 	const nestedStackTypeChanges = findNestedStackTypeChanges({
 		changes,
 		stateResources: stateForDiff.resources
@@ -4858,9 +4871,9 @@ function recordedTemplateResources(template, state) {
 	return recorded;
 }
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, refusalRecovery } = args;
 	const attributeHealer = attributeHealerFor?.(stackName, region);
-	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(recordedTemplateResources(template, state)));
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
 	let stackDiff;
@@ -4873,6 +4886,7 @@ async function buildDiffTree(args) {
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			...inheritedSecrets && { inheritedSecrets },
 			...attributeHealer && { attributeHealer },
+			...refusalRecovery && { refusalRecovery },
 			inheritSecretBearingTemplate: false,
 			previewMaskedInputs: !isNestedChild,
 			nestedTemplates
@@ -4943,7 +4957,8 @@ async function buildDiffTree(args) {
 			ancestorTemplatePaths: childAncestorTemplatePaths,
 			isNestedChild: true,
 			parentHasSecretReference: secretBearingAbove,
-			inheritedSecrets: printingSecrets
+			inheritedSecrets: printingSecrets,
+			...refusalRecovery && { refusalRecovery }
 		}));
 	}
 	if (!isNestedChild) {
@@ -4953,15 +4968,16 @@ async function buildDiffTree(args) {
 	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove, printingSecrets));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove, printingSecrets, refusalRecovery));
 	}
 	return node;
 }
-async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets) {
-	const { state, unreadable, unreadableContainers } = await loadStateOrEmpty(stackName, region, stateBackend);
+async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery) {
+	const { state, unreadable, unreadableContainers } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator, {
 		inheritSecretBearingTemplate: parentHasSecretReference,
-		inheritedSecrets
+		inheritedSecrets,
+		...refusalRecovery && { refusalRecovery }
 	});
 	const node = {
 		stackName,
@@ -4980,7 +4996,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery));
 	}
 	return node;
 }
@@ -5355,6 +5371,11 @@ async function diffCommand(stacks, options) {
 			...options.profile && { profile: options.profile }
 		});
 		const diffCalculator = new DiffCalculator();
+		const refusalRecovery = {
+			profile: options.profile,
+			stateBucket,
+			statePrefix: options.statePrefix
+		};
 		const diffProviderRegistry = new ProviderRegistry();
 		registerAllProviders(diffProviderRegistry, providerClasses);
 		const canonicalizeProperties = makeCanonicalizePropertiesFn(diffProviderRegistry);
@@ -5446,7 +5467,8 @@ async function diffCommand(stacks, options) {
 				...options.cfnFallback === false && { cfnFallback: false },
 				previewOrphanAdoption,
 				attributeHealerFor,
-				isNestedChild: false
+				isNestedChild: false,
+				refusalRecovery
 			}));
 		}
 		if (options.json) process.stdout.write(`${stringifyJsonPayload(trees.map(diffTreeToJson))}\n`);
@@ -5879,6 +5901,11 @@ async function scrubCommand(stacks, options) {
 		bucket: stateBucket,
 		prefix: options.statePrefix
 	};
+	const refusalRecovery = {
+		profile: options.profile,
+		stateBucket,
+		statePrefix: options.statePrefix
+	};
 	const stateS3 = new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
@@ -5921,7 +5948,7 @@ async function scrubCommand(stacks, options) {
 	const exportIndexFor = (indexRegion) => {
 		const existing = exportIndexStores.get(indexRegion);
 		if (existing) return existing;
-		const store = new ExportIndexStore(stateS3.s3, stateBucket, options.statePrefix, indexRegion, stateBackend);
+		const store = new ExportIndexStore(stateS3.s3, stateBucket, options.statePrefix, indexRegion, stateBackend, { profile: options.profile });
 		exportIndexStores.set(indexRegion, store);
 		return store;
 	};
@@ -5960,7 +5987,8 @@ async function scrubCommand(stacks, options) {
 				logger,
 				appStacks: allStacks,
 				...nestedChild && { nestedChild },
-				readConsumerRecords: loadConsumerRecords
+				readConsumerRecords: loadConsumerRecords,
+				refusalRecovery
 			});
 		} catch (err) {
 			failures.push({ stackName });
@@ -7145,43 +7173,43 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		if (opts.dryRun) {
 			if (repairMalformedResourcesForReadOnly(state)) {
 				malformedResources = true;
-				logger.warn(malformedResourcesWarning(stack.stackName, region));
+				logger.warn(malformedResourcesWarning(stack.stackName, region, opts.refusalRecovery));
 			}
-		} else if (!hasReadableResources(state)) throw new ScrubRefusalError(malformedStateRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		} else if (!hasReadableResources(state)) throw new ScrubRefusalError(malformedStateRefusalMessage(stack.stackName, region, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		let malformedResourceRows;
 		if (opts.dryRun) {
 			const droppedRows = repairMalformedResourceEntriesForReadOnly(state);
 			if (droppedRows.length > 0) {
 				malformedResourceRows = true;
-				logger.warn(malformedResourceEntriesWarning(stack.stackName, region, droppedRows));
+				logger.warn(malformedResourceEntriesWarning(stack.stackName, region, droppedRows, opts.refusalRecovery));
 			}
 		} else {
 			const unreadableRows = unreadableResourceEntries(state);
-			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedScrubResourceEntriesRefusalMessage(stack.stackName, region, unreadableRows), STATE_RESOURCES_MALFORMED);
+			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedScrubResourceEntriesRefusalMessage(stack.stackName, region, unreadableRows, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		}
 		let malformedOutputs;
 		if (opts.dryRun) {
 			if (repairMalformedOutputsForReadOnly(state)) {
 				malformedOutputs = true;
-				logger.warn(malformedOutputsWarning(stack.stackName, region));
+				logger.warn(malformedOutputsWarning(stack.stackName, region, opts.refusalRecovery));
 			}
-		} else if (!hasReadableOutputs(state)) throw new ScrubRefusalError(malformedOutputsRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		} else if (!hasReadableOutputs(state)) throw new ScrubRefusalError(malformedOutputsRefusalMessage(stack.stackName, region, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		let malformedOrphans;
 		let malformedOrphanRows;
 		if (opts.dryRun) {
 			if (repairMalformedOrphansForReadOnly(state)) {
 				malformedOrphans = true;
-				logger.warn(malformedOrphansWarning(stack.stackName, region));
+				logger.warn(malformedOrphansWarning(stack.stackName, region, opts.refusalRecovery));
 			}
 			const droppedRows = repairMalformedOrphanRecordsForReadOnly(state);
 			if (droppedRows.length > 0) {
 				malformedOrphanRows = true;
-				logger.warn(malformedOrphanRecordsWarning(stack.stackName, region, droppedRows, true));
+				logger.warn(malformedOrphanRecordsWarning(stack.stackName, region, droppedRows, true, opts.refusalRecovery));
 			}
-		} else if (!hasReadableOrphans(state)) throw new ScrubRefusalError(malformedOrphansRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		} else if (!hasReadableOrphans(state)) throw new ScrubRefusalError(malformedOrphansRefusalMessage(stack.stackName, region, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		else {
 			const unreadableRows = unreadableOrphanRecords(state);
-			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedOrphanRecordsRefusalMessage(stack.stackName, region, unreadableRows), STATE_RESOURCES_MALFORMED);
+			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedOrphanRecordsRefusalMessage(stack.stackName, region, unreadableRows, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		}
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
@@ -8303,9 +8331,15 @@ async function driftCommand(stacks, options) {
 	try {
 		const region = namedCliRegion(options.region) ?? "us-east-1";
 		const bucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+		const prefix = options.statePrefix;
 		const stateConfig = {
 			bucket,
-			prefix: options.statePrefix
+			prefix
+		};
+		const refusalRecovery = {
+			profile: options.profile,
+			stateBucket: bucket,
+			statePrefix: prefix
 		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
 			region,
@@ -8363,7 +8397,7 @@ async function driftCommand(stacks, options) {
 			}
 			const stackRegion = ref.region;
 			const scope = stackRegionScope(stackRegion);
-			const report = await runWithStackAwsClients(scope.clients, () => runDriftForStack(ref.stackName, stackRegion, stateBackend, scope.registry, scope.ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair", nestedChildRecord));
+			const report = await runWithStackAwsClients(scope.clients, () => runDriftForStack(ref.stackName, stackRegion, stateBackend, scope.registry, scope.ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair", nestedChildRecord, refusalRecovery));
 			reports.push(report);
 		}
 		if (options.json) writeJsonReport(reports);
@@ -8817,7 +8851,7 @@ function redactDriftChanges(changes, secrets, secretPaths, maskPaths) {
 		maskedPaths
 	};
 }
-async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode, nestedChildRecord) {
+async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode, nestedChildRecord, refusalRecovery) {
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
 	return await withStackName(stackName, async () => {
@@ -8826,12 +8860,12 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 		const logger = getLogger();
 		let unreadablePropertyBags = /* @__PURE__ */ new Set();
 		if (malformedRecordMode === "refuse") {
-			refuseMalformedState(state, stackName, region);
-			refuseMalformedResourceEntries(state, stackName, region);
-			refuseMalformedResourcePropertiesForDrift(state, stackName, region);
+			refuseMalformedState(state, stackName, region, refusalRecovery);
+			refuseMalformedResourceEntries(state, stackName, region, refusalRecovery);
+			refuseMalformedResourcePropertiesForDrift(state, stackName, region, refusalRecovery);
 		} else {
 			if (repairMalformedResourcesForReadOnly(state)) {
-				logger.warn(malformedResourcesWarning(stackName, region));
+				logger.warn(malformedResourcesWarning(stackName, region, refusalRecovery));
 				outcomes.push({
 					kind: "notCompared",
 					logicalId: UNREADABLE_RESOURCES_MAP_ROW,
@@ -8841,7 +8875,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			}
 			const dropped = repairMalformedResourceEntriesForReadOnly(state);
 			if (dropped.length > 0) {
-				logger.warn(malformedResourceEntriesWarning(stackName, region, dropped));
+				logger.warn(malformedResourceEntriesWarning(stackName, region, dropped, refusalRecovery));
 				for (const logicalId of dropped) outcomes.push({
 					kind: "notCompared",
 					logicalId,
@@ -8851,7 +8885,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			}
 			const repaired = repairMalformedResourcePropertiesForReadOnly(state);
 			if (repaired.length > 0) {
-				logger.warn(malformedDriftResourcePropertiesWarning(stackName, region, repaired));
+				logger.warn(malformedDriftResourcePropertiesWarning(stackName, region, repaired, refusalRecovery));
 				unreadablePropertyBags = new Set(repaired);
 			}
 		}
@@ -10576,18 +10610,22 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const stateTargetFor = (logicalId, resourceType) => resourceType === NESTED_STACK_TYPE ? `${stackName}~${logicalId}` : stackName;
 	const skippedStateTargets = /* @__PURE__ */ new Set();
 	const failedStateTargets = /* @__PURE__ */ new Set();
-	const hintCommand = (command, t) => pasteableCommand(command, [{
-		value: t,
-		hole: "stack",
-		opts: { plainIdent: true }
-	}, {
-		flag: "--stack-region",
-		value: regionForState,
-		hole: "region",
-		opts: { plainIdent: true }
-	}]);
+	const hintCommand = (command, t) => pasteableCommand(command, [
+		{
+			value: t,
+			hole: "stack",
+			opts: { plainIdent: true }
+		},
+		{
+			flag: "--stack-region",
+			value: regionForState,
+			hole: "region",
+			opts: { plainIdent: true }
+		},
+		...accountArgs(refusalRecovery)
+	]);
 	const hintFor = (command, targets, label) => [...new Set(targets.map((t) => `\n${label}: ${hintCommand(command, t).command}`))].join("");
-	const hintHolesClause = (targets) => targets.every((t) => hintCommand("cdkd state show", t).withheld.length === 0) ? "" : " A target that is not a plain identifier is printed as a quoted '<stack>' or '<region>' placeholder; list the records as stored with 'cdkd state list --long'.";
+	const hintHolesClause = (targets) => (targets.every((t) => hintCommand("cdkd state show", t).withheld.every((w) => w.hole !== "stack" && w.hole !== "region")) ? "" : " A target that is not a plain identifier is printed as a quoted '<stack>' or '<region>' placeholder; list the records as stored with 'cdkd state list --long'.") + (targets.length === 0 ? "" : ((clause) => clause === "" ? "" : ` ${clause}`)(withheldAccountClause(refusalRecovery, "the command lines below print").trimEnd()));
 	let secretPrincipalRegions;
 	const buildDestroySnapshot = () => {
 		const { imports: _imports, outputReads: _outputReads, ...rest } = state;
@@ -10953,7 +10991,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			const droppableSkipped = journaledOrphanFailures > 0 ? skippedTargets.filter((t) => t !== stackName) : skippedTargets;
 			const skippedCommands = hintFor("cdkd state show", skippedTargets, "Inspect it with") + hintFor("cdkd state orphan", droppableSkipped, "Drop the record with");
 			const dedupedCommands = (lines) => [...new Set(lines.split("\n").filter((l) => l !== ""))].map((l) => `\n${l}`).join("");
-			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. ` + (journaledOrphanFailures > 0 ? `${journaledOrphanFailures} of the failures are resources a failed deploy created that only the rollback journal records: re-run the destroy to retry them. Do not drop this stack's state record — that also deletes the journal, their only record.` : "If the same resource keeps failing, dropping the state record is the last resort: it removes the record without deleting AWS resources.") + skippedClause + hintHolesClause([...failedTargets, ...skippedTargets]) + dedupedCommands(orphanHint + skippedCommands));
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. ` + (journaledOrphanFailures > 0 ? `${journaledOrphanFailures} of the failures are resources a failed deploy created that only the rollback journal records: re-run the destroy to retry them. Do not drop this stack's state record — that also deletes the journal, their only record.` : "If the same resource keeps failing, dropping the state record is the last resort: it removes the record without deleting AWS resources.") + skippedClause + hintHolesClause([...orphanHint === "" ? [] : failedTargets, ...skippedTargets]) + dedupedCommands(orphanHint + skippedCommands));
 		}
 	} finally {
 		try {
@@ -11048,6 +11086,15 @@ async function destroyCommand(stackArgs, options) {
 	});
 	const region = namedCliRegion(options.region) ?? "us-east-1";
 	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const accountRecovery = {
+		profile: options.profile,
+		stateBucket,
+		statePrefix: options.statePrefix
+	};
+	const stateCommandAccount = {
+		args: accountArgs(accountRecovery),
+		clause: withheldAccountClause(accountRecovery, "the command lines below print")
+	};
 	logger.info("Starting stack destruction...");
 	logger.debug("Options:", options);
 	if (options.region) {
@@ -11078,7 +11125,7 @@ async function destroyCommand(stackArgs, options) {
 		});
 		await stateBackend.verifyBucketExists();
 		const lockManager = new LockManager(awsClients.s3, stateConfig);
-		const exportIndexStore = new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, stateBackend);
+		const exportIndexStore = new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, stateBackend, { profile: options.profile });
 		const providerRegistry = new ProviderRegistry();
 		registerAllProviders(providerRegistry, providerClasses);
 		providerRegistry.setCustomResourceResponseBucket(stateBucket);
@@ -11192,7 +11239,7 @@ async function destroyCommand(stackArgs, options) {
 					const refRegion = allStateRefs.find((r) => r.stackName === pattern)?.region ?? region;
 					const stateOnlyResult = await stateBackend.getState(pattern, refRegion);
 					if (stateOnlyResult?.state.parentStack) {
-						const err = new NestedStackChildDirectDestroyError(pattern, stateOnlyResult.state.parentStack, stateOnlyResult.state.parentLogicalId);
+						const err = new NestedStackChildDirectDestroyError(pattern, stateOnlyResult.state.parentStack, stateOnlyResult.state.parentLogicalId, void 0, stateCommandAccount);
 						logger.error(`  ✗ ${err.message}`);
 						totalErrors++;
 					} else if (appStacks.length > 0 && !notInApp.includes(pattern)) notInApp.push(pattern);
@@ -11224,7 +11271,10 @@ async function destroyCommand(stackArgs, options) {
 			if (synthStack?.terminationProtection === true) {
 				if (options.removeProtection) logger.warn(`Stack ${displaySafe(stackName)} has terminationProtection: true — bypassing because --remove-protection set`);
 				else {
-					const err = new StackTerminationProtectionError(stackName);
+					const err = new StackTerminationProtectionError(stackName, void 0, {
+						args: stateCommandAccount.args,
+						clause: withheldAccountClause(accountRecovery, "the command below prints")
+					});
 					logger.error(`  ✗ ${err.message}`);
 					totalErrors++;
 					continue;
@@ -11241,15 +11291,20 @@ async function destroyCommand(stackArgs, options) {
 			} else if (synthRegion && refs.some((r) => r.region === synthRegion)) stackTargetRegion = synthRegion;
 			else {
 				const regions = refs.map((r) => r.region === void 0 ? "(legacy)" : plainOrDescribed(r.region, "region")).join(", ");
-				const orphanOne = pasteableCommand("cdkd state orphan", [{
-					value: stackName,
-					hole: "stack",
-					opts: { plainIdent: true }
-				}, {
-					flag: "--stack-region",
-					hole: "region"
-				}]);
-				throw new Error(`Stack ${quotedOrDescribed(stackName, "stack name")} has state in multiple regions: ${regions}. Remove cdkd's record for ONE region with the command below (fill in the region), or run destroy from a CDK app whose env.region matches one of them.` + withheldTargetClause(orphanOne, "stack", "cdkd state orphan", "This stack's name") + `\nRemove one record with: ${orphanOne.command}`);
+				const orphanOneClause = withheldAccountClause(accountRecovery, "the command below prints").trimEnd();
+				const orphanOne = pasteableCommand("cdkd state orphan", [
+					{
+						value: stackName,
+						hole: "stack",
+						opts: { plainIdent: true }
+					},
+					{
+						flag: "--stack-region",
+						hole: "region"
+					},
+					...stateCommandAccount.args
+				]);
+				throw new Error(`Stack ${quotedOrDescribed(stackName, "stack name")} has state in multiple regions: ${regions}. Remove cdkd's record for ONE region with the command below (fill in the region), or run destroy from a CDK app whose env.region matches one of them.` + withheldTargetClause(orphanOne, "stack", "cdkd state orphan", "This stack's name") + (orphanOneClause === "" ? "" : ` ${orphanOneClause}`) + `\nRemove one record with: ${orphanOne.command}`);
 			}
 			const stateResult = await stateBackend.getState(stackName, stackTargetRegion);
 			if (!stateResult) {
@@ -11257,7 +11312,7 @@ async function destroyCommand(stackArgs, options) {
 				continue;
 			}
 			if (stateResult.state.parentStack) {
-				const err = new NestedStackChildDirectDestroyError(stackName, stateResult.state.parentStack, stateResult.state.parentLogicalId);
+				const err = new NestedStackChildDirectDestroyError(stackName, stateResult.state.parentStack, stateResult.state.parentLogicalId, void 0, stateCommandAccount);
 				logger.error(`  ✗ ${err.message}`);
 				totalErrors++;
 				continue;
@@ -13226,7 +13281,7 @@ async function exportCommand(stackArg, options) {
 				reportDriftBaselineGaps(state, logger, {
 					stackName: resolvedStackName,
 					region: migrationPending ? void 0 : targetRegion
-				}, options.template ? void 0 : template);
+				}, options.template ? void 0 : template, lockRecovery);
 				if (allSynthStacks.length > 0) {
 					const crossRefs = scanCrossStackReferences(allSynthStacks, resolvedStackName);
 					if (crossRefs.length > 0) {
@@ -13318,7 +13373,7 @@ async function exportCommand(stackArg, options) {
 			reportDriftBaselineGaps(state, logger, {
 				stackName: resolvedStackName,
 				region: migrationPending ? void 0 : targetRegion
-			}, options.template ? void 0 : template);
+			}, options.template ? void 0 : template, lockRecovery);
 			if (allSynthStacks.length > 0) {
 				const crossRefs = scanCrossStackReferences(allSynthStacks, resolvedStackName);
 				if (crossRefs.length > 0) {
@@ -14398,12 +14453,12 @@ function refreshWithheldReason(built) {
 		default: throw new Error(`refreshWithheldReason: unhandled WithholdReason ${String(reason)}`);
 	}
 }
-function reportDriftBaselineGaps(state, logger, loaded, template) {
+function reportDriftBaselineGaps(state, logger, loaded, template, recovery) {
 	const stackName = loaded?.stackName ?? state.stackName;
 	const rawRegion = loaded ? loaded.region : state.region;
 	const region = typeof rawRegion === "string" && rawRegion !== "" ? rawRegion : void 0;
 	if (!hasReadableResources(state)) {
-		logger.warn(malformedResourcesWarning(stackName, region));
+		logger.warn(malformedResourcesWarning(stackName, region, recovery));
 		return;
 	}
 	const entries = Object.entries(state.resources);
@@ -15507,10 +15562,17 @@ async function setupStateBackend(options) {
 		region,
 		bucket,
 		prefix,
-		exportIndexStore: new ExportIndexStore(awsClients.s3, bucket, prefix, region, stateBackend),
+		exportIndexStore: new ExportIndexStore(awsClients.s3, bucket, prefix, region, stateBackend, { profile: options.profile }),
 		dispose: () => awsClients.destroy()
 	};
 }
+function renderRecovery(options, setup) {
+	return {
+		profile: options.profile,
+		stateBucket: setup.bucket,
+		statePrefix: setup.prefix
+	};
+}
 function sortRefs(refs) {
 	return refs.slice().sort((a, b) => {
 		if (a.stackName < b.stackName) return -1;
@@ -15638,8 +15700,8 @@ async function stateResourcesCommand(stackName, options) {
 		if (!ref.region) throw legacyRecordRefusal(stackName);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
 		if (!stateResult) throw new Error(`No state found for stack ${formatStackRefSafe(ref)} in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
-		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region));
-		if (options.long || options.json) repairRenderedContainers(stateResult.state, RESOURCES_RENDERED_CONTAINERS, stackName, ref.region, logger);
+		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region, renderRecovery(options, setup)));
+		if (options.long || options.json) repairRenderedContainers(stateResult.state, RESOURCES_RENDERED_CONTAINERS, stackName, ref.region, logger, renderRecovery(options, setup));
 		const resources = stateResult.state.resources;
 		const details = Object.entries(resources).map(([logicalId, entry]) => {
 			const resource = entry ?? {};
@@ -15738,11 +15800,11 @@ async function stateShowCommand(stackName, options) {
 		if (options.showNested) {
 			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state), setup.lockManager, lockInfo);
 			if (options.json) {
-				warnUnreadableTreeNodes(treeWithLocks, logger);
+				warnUnreadableTreeNodes(treeWithLocks, logger, renderRecovery(options, setup));
 				process.stdout.write(`${stringifyJsonPayload(treeToShowJson(treeWithLocks))}\n`);
 				return;
 			}
-			repairTreeForTextRender(treeWithLocks, logger);
+			repairTreeForTextRender(treeWithLocks, logger, renderRecovery(options, setup));
 			const lines = renderTreeWithChildren(treeWithLocks);
 			process.stdout.write(`${lines.join("\n")}\n`);
 			return;
@@ -15754,7 +15816,7 @@ async function stateShowCommand(stackName, options) {
 			})}\n`);
 			return;
 		}
-		repairRecordForTextRender(stateResult.state, stackName, ref.region, logger);
+		repairRecordForTextRender(stateResult.state, stackName, ref.region, logger, renderRecovery(options, setup));
 		process.stdout.write(`${renderStateBlock(stateResult.state, lockInfo, true).join("\n")}\n`);
 	} finally {
 		setup.dispose();
@@ -15789,7 +15851,7 @@ const RENDERED_CONTAINER_ORDER = [
 ];
 const SHOW_RENDERED_CONTAINERS = new Set(RENDERED_CONTAINER_ORDER);
 const RESOURCES_RENDERED_CONTAINERS = /* @__PURE__ */ new Set(["attributes"]);
-function repairRenderedContainers(state, walked, stackName, region, logger) {
+function repairRenderedContainers(state, walked, stackName, region, logger, recovery) {
 	const repaired = /* @__PURE__ */ new Set();
 	const emptyIfUnwalkable = (owner, name) => {
 		if (!walked.has(name)) return;
@@ -15809,19 +15871,19 @@ function repairRenderedContainers(state, walked, stackName, region, logger) {
 		emptyIfUnwalkable(fields, "properties");
 	}
 	if (repaired.size === 0) return;
-	logger.warn(malformedRenderedContainersWarning(stackName, region, RENDERED_CONTAINER_ORDER.filter((name) => repaired.has(name))));
+	logger.warn(malformedRenderedContainersWarning(stackName, region, RENDERED_CONTAINER_ORDER.filter((name) => repaired.has(name)), recovery));
 }
-function repairRecordForTextRender(state, stackName, region, logger) {
-	if (repairMalformedResourcesForReadOnly(state)) logger.warn(malformedResourcesWarning(stackName, region));
-	repairRenderedContainers(state, SHOW_RENDERED_CONTAINERS, stackName, region, logger);
+function repairRecordForTextRender(state, stackName, region, logger, recovery) {
+	if (repairMalformedResourcesForReadOnly(state)) logger.warn(malformedResourcesWarning(stackName, region, recovery));
+	repairRenderedContainers(state, SHOW_RENDERED_CONTAINERS, stackName, region, logger, recovery);
 }
-function repairTreeForTextRender(node, logger) {
-	repairRecordForTextRender(node.state, node.stackName, node.region, logger);
-	for (const child of node.children) repairTreeForTextRender(child, logger);
+function repairTreeForTextRender(node, logger, recovery) {
+	repairRecordForTextRender(node.state, node.stackName, node.region, logger, recovery);
+	for (const child of node.children) repairTreeForTextRender(child, logger, recovery);
 }
-function warnUnreadableTreeNodes(node, logger) {
-	if (!hasReadableResources(node.state)) logger.warn(malformedResourcesWarning(node.stackName, node.region));
-	for (const child of node.children) warnUnreadableTreeNodes(child, logger);
+function warnUnreadableTreeNodes(node, logger, recovery) {
+	if (!hasReadableResources(node.state)) logger.warn(malformedResourcesWarning(node.stackName, node.region, recovery));
+	for (const child of node.children) warnUnreadableTreeNodes(child, logger, recovery);
 }
 function renderStateBlock(state, lockInfo, withLegend) {
 	const lines = [];
@@ -15975,6 +16037,11 @@ async function stateOrphanCommand(stackArgs, options) {
 			}
 			if (!options.yes && !options.force) {
 				const targetList = targets.map((t) => describedStackRef(t)).join(", ");
+				const bannerAccount = {
+					profile: options.profile,
+					stateBucket: setup.bucket,
+					statePrefix: options.statePrefix
+				};
 				const destroyCmd = pasteableCommand("cdkd destroy", [{
 					value: stackName,
 					hole: "stack",
@@ -15982,8 +16049,9 @@ async function stateOrphanCommand(stackArgs, options) {
 						patternMatched: true,
 						plainIdent: true
 					}
-				}]);
-				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.` + (targets.some(refIsDescribed) ? ` ${STATE_LIST_POINTER}` : "") + "\nDelete the actual resources instead with the command below." + withheldTargetClause(destroyCmd, "stack", "cdkd destroy") + `\nDestroy with: ${destroyCmd.command}\n\n`);
+				}, ...accountArgs(bannerAccount)]);
+				const bannerAccountClause = withheldAccountClause(bannerAccount, "the command below prints").trimEnd();
+				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.` + (targets.some(refIsDescribed) ? ` ${STATE_LIST_POINTER}` : "") + "\nDelete the actual resources instead with the command below." + withheldTargetClause(destroyCmd, "stack", "cdkd destroy") + (bannerAccountClause === "" ? "" : ` ${bannerAccountClause}`) + `\nDestroy with: ${destroyCmd.command}\n\n`);
 				if (!await confirmStateOrphanRemoval(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/?`)) {
 					logger.info(safeMsg`Cancelled removal of state for stack: ${plainOrDescribed(stackName, "stack name")}`);
 					continue;
@@ -16051,17 +16119,22 @@ async function stateOrphanResources(stackName, requested, options) {
 				const childRef = childRefs.find((r) => r.region === region) ?? childRefs[0];
 				if (childRef === void 0) continue;
 				const otherRegions = childRefs.length - 1;
-				const childCommand = pasteableCommand("cdkd state orphan", [{
-					value: child,
-					hole: "stack",
-					opts: { plainIdent: true }
-				}, ...childRef.region !== void 0 ? [{
-					flag: "--stack-region",
-					value: childRef.region,
-					hole: "region",
-					opts: { plainIdent: true }
-				}] : []]);
-				throw new Error(`${capitalize(plainOrDescribed(id, "logical id"))} has a nested stack's state record of its own. The child's resources are recorded there, and removing this row would leave that record behind with nothing that removes it. Drop the child's record first (it keeps the child's AWS resources; a child with nested stacks of its own has records under '<child>~<logicalId>' too), then re-run.` + withheldTargetClause(childCommand, "stack", "cdkd state orphan") + (otherRegions > 0 ? ` The child also has records in ${otherRegions} other region(s); 'cdkd state list' shows them, and each needs the same drop.` : "") + `\nDrop the child with: ${childCommand.command}`);
+				const childCommand = pasteableCommand("cdkd state orphan", [
+					{
+						value: child,
+						hole: "stack",
+						opts: { plainIdent: true }
+					},
+					...childRef.region !== void 0 ? [{
+						flag: "--stack-region",
+						value: childRef.region,
+						hole: "region",
+						opts: { plainIdent: true }
+					}] : [],
+					...accountArgs(recovery)
+				]);
+				const accountClause = withheldAccountClause(recovery, "the command below prints").trimEnd();
+				throw new Error(`${capitalize(plainOrDescribed(id, "logical id"))} has a nested stack's state record of its own. The child's resources are recorded there, and removing this row would leave that record behind with nothing that removes it. Drop the child's record first (it keeps the child's AWS resources; a child with nested stacks of its own has records under '<child>~<logicalId>' too), then re-run.` + withheldTargetClause(childCommand, "stack", "cdkd state orphan") + (otherRegions > 0 ? ` The child also has records in ${otherRegions} other region(s); 'cdkd state list' shows them, and each needs the same drop.` : "") + (accountClause === "" ? "" : ` ${accountClause}`) + `\nDrop the child with: ${childCommand.command}`);
 			}
 			clients = new AwsClients({
 				region,
@@ -17724,7 +17797,7 @@ function collectAssetReferences(stateDocument, marker, refs) {
 	};
 	walk(stateDocument);
 }
-async function scanReferencedAssets(stateBackend, marker, logger) {
+async function scanReferencedAssets(stateBackend, marker, logger, account) {
 	const refs = {
 		s3Keys: /* @__PURE__ */ new Set(),
 		imageTags: /* @__PURE__ */ new Set(),
@@ -17743,7 +17816,12 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 			parsed = JSON.parse(body);
 		} catch (error) {
 			const { stack, region } = parseStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX);
-			const inspectHint = isPasteableIdent(stack) && (region === void 0 || isPasteableIdent(region)) ? pasteableCommand("cdkd state show", region === void 0 ? [{
+			const pasteable = isPasteableIdent(stack) && (region === void 0 || isPasteableIdent(region));
+			const recovery = {
+				...account,
+				statePrefix: keyPrefixOf(key, stack, region)
+			};
+			const inspectHint = pasteable ? pasteableCommand("cdkd state show", [...region === void 0 ? [{
 				value: stack,
 				hole: "stack"
 			}] : [{
@@ -17753,9 +17831,13 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 				flag: "--stack-region",
 				value: region,
 				hole: "region"
-			}]).command : void 0;
+			}], ...accountArgs(recovery)]).command : void 0;
+			const accountClause = inspectHint === void 0 ? "" : [withheldAccountClause({
+				...recovery,
+				statePrefix: void 0
+			}, "the command below prints").trimEnd(), keyPrefixHoleSentence(recovery.statePrefix)].filter((part) => part !== "").join(" ");
 			const inspect = inspectHint === void 0 ? "its stack name is not safe to paste into a command, so inspect the object at that key directly" : `see the command below`;
-			throw new CdkdError(`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file (${inspect}), then re-run.` + (inspectHint === void 0 ? "" : `\nInspect it with: ${inspectHint}`), "GC_STATE_UNREADABLE", error);
+			throw new CdkdError(`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file (${inspect}), then re-run.` + (accountClause === "" ? "" : ` ${accountClause}`) + (inspectHint === void 0 ? "" : `\nInspect it with: ${inspectHint}`), "GC_STATE_UNREADABLE", error);
 		}
 		collectAssetReferences(parsed, marker, refs);
 	}
@@ -18000,7 +18082,10 @@ async function gcCommand(options) {
 		let s3Candidates = [];
 		let ecrCandidates = [];
 		if (marker !== null) {
-			const refs = await scanReferencedAssets(stateBackend, marker, logger);
+			const refs = await scanReferencedAssets(stateBackend, marker, logger, {
+				profile: options.profile,
+				stateBucket: bucketName
+			});
 			s3Candidates = await listS3Candidates(awsClients.s3, marker.assetBucket, accountId, refs, cutoffMs, logger);
 			ecrCandidates = await listEcrCandidates(ecrClient, marker.containerRepo, refs, cutoffMs, logger);
 		}
@@ -18070,6 +18155,15 @@ function createGcCommand() {
 	commonOptions.forEach((opt) => cmd.addOption(opt));
 	return cmd;
 }
+function keyPrefixOf(key, stack, region) {
+	const tail = `/${stack}${region === void 0 ? "" : `/${region}`}/${STATE_FILE_SUFFIX.replace(/^\//, "")}`;
+	return key.endsWith(tail) ? key.slice(0, -tail.length) : void 0;
+}
+function keyPrefixHoleSentence(prefix) {
+	const reason = pasteableCommand("cdkd", accountArgs({ statePrefix: prefix })).withheld.find((w) => w.hole === "prefix")?.reason;
+	if (reason === void 0) return "";
+	return `The state prefix of the key above ${reason === "option-shaped" ? `begins with a '-'` : reason === "altered" ? "does not render exactly" : reason === "too-long" ? "is too long to print" : prefix !== void 0 && prefix.includes("/") ? `has a '/'-separated part that is not a plain identifier` : "is not a plain identifier"}, so the command below prints '<prefix>' in its place: replace it whole, quotes included, with that prefix shell-quoted -- the part of the key before '/<stack>/<region>/state.json' ('/<stack>/state.json' for a legacy key), since 'cdkd gc' takes no --state-prefix.`;
+}
 
 //#endregion
 //#region src/cli/commands/publish-assets.ts
@@ -19500,7 +19594,8 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 		logger.debug(`${prefix}: loaded state for ${stackName} (${targetRegion})`);
 		return {
 			state: stateData.state,
-			region: targetRegion
+			region: targetRegion,
+			stateBucket
 		};
 	} finally {
 		resetAwsClients();
@@ -19582,7 +19677,12 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		logger.warn(`${prefix}: cross-stack resolver could not access state bucket '${stateBucket}': ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
-	const exportIndex = new ExportIndexStore(awsClients.s3, stateBucket, opts.statePrefix, consumerRegion, stateBackend);
+	const exportIndex = new ExportIndexStore(awsClients.s3, stateBucket, opts.statePrefix, consumerRegion, stateBackend, { profile: opts.profile });
+	const refusalRecovery = {
+		profile: opts.profile,
+		stateBucket,
+		statePrefix: opts.statePrefix
+	};
 	return {
 		resolver: {
 			async resolveImport(exportName) {
@@ -19630,7 +19730,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 						const recordKey = producerRecordKey(producerStack, recordRegion);
 						if (!warnedMalformedProducers.has(recordKey)) {
 							warnedMalformedProducers.add(recordKey);
-							logger.warn(`${prefix}: ${malformedLocalOutputsWarning(producerStack, recordRegion)}`);
+							logger.warn(`${prefix}: ${malformedLocalOutputsWarning(producerStack, recordRegion, refusalRecovery)}`);
 						}
 						return;
 					}
@@ -19692,10 +19792,15 @@ var S3LocalStateProvider = class {
 		};
 		const loaded = await loadStateForStack(stackName, synthRegion, loadOpts);
 		if (!loaded) return void 0;
-		if (repairMalformedOutputsForReadOnly(loaded.state)) getLogger().warn(malformedLocalOutputsWarning(stackName, loaded.region));
-		if (repairMalformedResourcesForReadOnly(loaded.state)) getLogger().warn(malformedLocalResourcesWarning(stackName, loaded.region));
+		const refusalRecovery = {
+			profile: this.opts.profile,
+			stateBucket: loaded.stateBucket,
+			statePrefix: this.opts.statePrefix
+		};
+		if (repairMalformedOutputsForReadOnly(loaded.state)) getLogger().warn(malformedLocalOutputsWarning(stackName, loaded.region, refusalRecovery));
+		if (repairMalformedResourcesForReadOnly(loaded.state)) getLogger().warn(malformedLocalResourcesWarning(stackName, loaded.region, refusalRecovery));
 		const droppedRows = repairMalformedResourceEntriesForReadOnly(loaded.state);
-		if (droppedRows.length > 0) getLogger().warn(malformedLocalResourceEntriesWarning(stackName, loaded.region, droppedRows));
+		if (droppedRows.length > 0) getLogger().warn(malformedLocalResourceEntriesWarning(stackName, loaded.region, droppedRows, refusalRecovery));
 		const outputs = {};
 		for (const [k, v] of Object.entries(loaded.state.outputs ?? {})) if (typeof v === "string") outputs[k] = v;
 		else if (typeof v === "number" || typeof v === "boolean") outputs[k] = String(v);
@@ -26832,4 +26937,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DEnDp4o0.js.map
+//# sourceMappingURL=program-DTXVCX29.js.map