@go-to-k/cdkd 0.296.8 → 0.296.10

package/dist/{program-CPziYRDp.js → program-CXEHAcOO.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displayIdent, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, L as stringifyJsonPayload, M as displayStackName, N as isPasteableIdent, O as cutMarker, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, d as PATTERN_B_NAME_PROPERTIES, f as PATTERN_B_RESOURCE_TYPES, g as generateResourceName, h as explicitNamePropertyFor, i as reserveStdoutForPayload, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, m as derivesPatternBName, n as getLogger, o as runStackBuffered, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_OPTIONS, w as SAFE_MSG_ALTERED_CHAR, x as withSkipPrefix } from "./logger-DAaB7GFO.js";
-import { An as setPasteableVerbFlags, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bt as clientDefaultsFor, Ct as buildForceUnlockCommand, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, F as runDeleteAttempt, Ft as producerRecordKey, G as beginCommandInterruptScope, Gn as retryClassificationText, Ht as AccountIdUnavailableError, It as setPasteableAwsProfile, J as isInterruptedWaitError, Jn as safeStringify, Jt as DeployCancelledError, K as endCommandInterruptScope, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, Mt as injectiveKey, On as withheldTargetClause, Ot as formatLockOwner, Pt as producerCoordinateKey, Qn as markNonRetryable, Qt as LocalStartServiceError, Rt as ambientClientDefaults, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, Tn as quotedOrDescribed, Tt as forceQuitRecoveryClause, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Yt as DynamicReferenceRegionAmbiguousError, Zn as isThrottlingError, Zt as LocalInvokeBuildError$1, _ as VALUE_NOT_SHOWN, _n as SHELL_ACTIVE_WHY, an as ResourceTimeoutError, cn as StackTerminationProtectionError, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, hn as TIMEOUT_FLAG_RESOURCE_TYPE, in as ProvisioningError, it as resourceTypeShown, jt as DEFAULT_STATE_PREFIX, kn as setPasteableRunFlags, mn as withErrorHandling, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as NestedStackChildDirectDestroyError, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, pn as normalizeAwsError, q as interruptWatchListenerCount, rn as PartialFailureError, s as readRecordedPrincipals, sn as StackHasActiveImportsError, t as IAM_PRINCIPAL_NAME, tn as MalformedProducerRecordRefusalError, un as SynthesisError, w as remedyLogicalId, wn as plainOrDescribed, wt as buildLockContentionMessage, xn as isInertUnquoted, yn as commandHole, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
+import { An as setPasteableVerbFlags, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bt as clientDefaultsFor, Ct as buildForceUnlockCommand, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, F as runDeleteAttempt, Ft as producerRecordKey, G as beginCommandInterruptScope, Gn as retryClassificationText, Ht as AccountIdUnavailableError, It as setPasteableAwsProfile, J as isInterruptedWaitError, Jn as safeStringify, Jt as DeployCancelledError, K as endCommandInterruptScope, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, Mt as injectiveKey, On as withheldTargetClause, Ot as formatLockOwner, Pt as producerCoordinateKey, Qn as markNonRetryable, Qt as LocalStartServiceError, Rt as ambientClientDefaults, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, Tn as quotedOrDescribed, Tt as forceQuitRecoveryClause, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Yt as DynamicReferenceRegionAmbiguousError, Zn as isThrottlingError, Zt as LocalInvokeBuildError$1, _ as VALUE_NOT_SHOWN, _n as SHELL_ACTIVE_WHY, an as ResourceTimeoutError, cn as StackTerminationProtectionError, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, hn as TIMEOUT_FLAG_RESOURCE_TYPE, in as ProvisioningError, it as resourceTypeShown, jt as DEFAULT_STATE_PREFIX, kn as setPasteableRunFlags, mn as withErrorHandling, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as NestedStackChildDirectDestroyError, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, pn as normalizeAwsError, q as interruptWatchListenerCount, rn as PartialFailureError, s as readRecordedPrincipals, sn as StackHasActiveImportsError, t as IAM_PRINCIPAL_NAME, tn as MalformedProducerRecordRefusalError, un as SynthesisError, w as remedyLogicalId, wn as plainOrDescribed, wt as buildLockContentionMessage, xn as isInertUnquoted, yn as commandHole, zt as ambientCredentialConfig } from "./iam-policy-targets-BREzwsG6.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as resourcesNamingDeclaredParameter, $a as maskSecretsInError, $i as repairMalformedResourceEntriesForReadOnly, $n as deleteSkipReason, $o as ensureAssetStorage, $r as deployRefusesOrphanRowsReason, $s as derivePartitionAndUrlSuffix, $t as effectiveDeletionPolicy, Ai as refuseMalformedOrphans, Ao as acceptedCreateOnlyDropsOf, As as getDefaultStateBucketName, At as planRollback, Ba as TemplateParser, Bi as refuseMalformedResourceEntriesForImportSave, Bn as CC_BROKEN_REASON, Bo as orphansCarriedFrom, Br as AWS_NO_VALUE, Bs as stateBucketExistenceConfirmed, Bt as updatePartialMessage, C as perType, Ci as malformedScrubResourceEntriesRefusalMessage, Cn as findDestructiveChanges, Co as WHOLE_DYNAMIC_REFERENCE_PATTERN, Cr as callerEnvCredentials, Cs as warnFinchArgvExposure, Dn as ledgerForStack, Do as S3StateBackend, Ds as getDockerImageBySourceHash, Dt as isJournaledOrphan, Ei as refuseDivergentRecordRegionForDestroy, Eo as isLockInfoExpired, Es as AssetManifestLoader, Et as demoteSupersededOrphans, Fa as withRetry, Fi as refuseMalformedResourceAttributesForOrphan, Fo as hasUnverifiableParameterRefusal, Fr as isImpossibleEmptyStoredAttribute, Fs as resolveCaptureObservedState, Ft as inheritProducerRegions, G as cyan, Ga as literalSplitDelimitersOf, Gi as refuseMalformedResourcePropertiesForOrphan, Go as WorkGraph, Gr as withSharedDrainBudget, Gs as MIGRATE_TMP_PREFIX, Gt as orphanRecordsPrintingBag, H as formatResourceLine, Ha as carryLogOnlyValues, Hi as refuseMalformedResourcePropertiesForDestroy, Hn as ccBrokenReason, Ho as AssetPublisher, Hr as isStalePlaceholderArnAttribute, Hs as ssmResolvedValueType, Ht as completedReplayEntries, Ii as refuseMalformedResourceEntries, Io as importableOutputKeys, Ir as carriesDynamicReference, Is as resolveSkipPrefix, J as red, Ja as recordLogOnlyParameterValue, Ji as refuseMalformedResourcesForExport, Jn as slowCcOperationTimeoutMs, Jo as loadPublishableAssetManifest, Jr as JSON_LISTING_HOLE_VALUE, Js as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Jt as ATOMIC_FINAL_SNAPSHOT_TYPES, K as gray, Ka as logOnlyValueCount, Ki as refuseMalformedResourcesForDeploy, Kn as withPrintingSecrets, Ko as buildAssetRedirectMap, Kr as parameterInputsFor, Ks as findLargeInlineResources, Kt as secretNamePrintingBag, Li as refuseMalformedResourceEntriesForDeploy, Lo as importableOutputs, Lr as carriesFetchableDynamicReference, Ls as resolveStateBucketWithDefault, Ma as prefetchCreateOnlyPropertyPaths, Mi as refuseMalformedOrphansForOrphan, Mo as exportNamesCarriedFrom, Mr as isUnboundTemplateParameter, Ms as loadCdkJson, Mt as resolveReplacementOldType, Na as templateResourceTypes, Ni as refuseMalformedOutputs, No as hasReadableExportSet, Nr as parameterTypeMayLoseSecretIdentity, Ns as resolveApp, Nt as findNestedStackTypeChanges, Oi as refuseMalformedOrphanRecords, Oo as rebuildClientForBucketRegion, Os as Synthesizer, Ot as isReplacementOrphan, Pa as describeTypeWithThrottleRetry, Pi as refuseMalformedOutputsForDestroy, Po as hasReasonlessBaselineRefusal, Pr as getAccountInfo, Ps as resolveAutoAssetStorage, Q as reachableDivergentParameters, Qa as errorCauseChain, Qi as repairMalformedOutputsForReadOnly, Qn as deleteIndeterminateGuards, Qo as assertAssetBucketRegion, Qr as UNREADABLE_RESOURCES_MAP_ROW, Qs as canonicalizeRegion, Qt as createPreDeleteFinalSnapshot, Ri as refuseMalformedResourceEntriesForDestroy, Ro as isReadableBag, Rr as isNamelessDynamicReferenceError, Rs as resolveStateBucketWithDefaultAndSource, S as isProtectionValueActive, Si as malformedResourcesWarning, Sn as constructPathOf, So as TEMPLATE_SOURCED_RULES, Sr as applyCallerIdentityCredentials, Ss as runDockerStreaming, St as destroyStackRecordsView, Ti as previewableOrphanRecords, Tn as RollbackInlinePolicyWriters, To as LockManager, Ts as stripControlChars, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as createUnionSecretMasker, Ui as refuseMalformedResourcePropertiesForDrift, Un as wouldReturnToSdkProvider, Uo as isSensitiveAttributeName, Ur as refStateLookupFromResource, Us as CFN_TEMPLATE_BODY_LIMIT, Ut as journaledOrphanPrintingBag, Va as liveMatchesUnresolvedTokenFrame, Vi as refuseMalformedResourceEntriesForOrphan, Vn as ProviderRegistry, Vo as shouldRetainResource, Vr as cfnRefValueFromPhysicalId, Vs as warnDeprecatedNoPrefixCliFlag, Vt as updatePartialReason, W as bold, Wa as hasMaskableValues, Wi as refuseMalformedResourcePropertiesForExport, Wn as isCustomResourceType$1, Wo as stringifyValue, Ws as CFN_TEMPLATE_URL_LIMIT, Wt as maskEventTextWithBoundBags, X as computeParameterTaint, Xa as shareLogOnlyValues, Xi as repairMalformedOrphanRecordsForReadOnly, Xo as AssetModeResolver, Xr as STATE_RESOURCES_MALFORMED, Xs as expectedOwnerParam, Xt as buildFinalSnapshotIdentifier, Y as yellow, Ya as recordLogOnlyValue, Yi as refuseMalformedState, Yn as ccProtectionRegistryTypes, Yo as rewriteTemplateAssetReferences, Yr as STATE_REGION_DIVERGED, Ys as decodeListingKey, Yt as PRE_DELETE_SNAPSHOT_TYPES, Z as namesAnyDeclaredParameter, Za as createSecretMasker, Zi as repairMalformedOrphansForReadOnly, Zn as UNSPECIFIED_SKIP_REASON, Zo as BOOTSTRAP_MARKER_PREFIX, Zr as UNREADABLE_ORPHANS_CONTAINER_ROW, Zs as PARTITION_TABLE, Zt as ccRoutedFinalSnapshotError, _ as makeCanonicalizePropertiesFn, _i as malformedOutputsRefusalMessage, _n as isExportAliasCollision, _o as recordProvenPublicExpression, _r as assertSendableRoleArn, _s as isMalformedEnvKey, a as findNestedTemplateTreeDefect, aa as findActionableSilentDrops, ac as hasPlainPrototype, ai as isReadableResourceEntry, an as extractDeploymentEventError, ao as dynamicReferenceTokens, as as validateContainerRepoName, at as makeSiblingClaimReader, b as recordedProtectionNote, bi as malformedResourceEntriesWarning, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as STATE_SOURCED_CROSS_GENERATION_RULES, br as sendableAssumeRoleCommand, bs as redactedDockerCause, bt as replayRollback, c as renderNestedTemplateTreeDefect, cc as absoluteAssemblyPathEscape, ci as malformedExportSourceWarning, cn as exportAliasCollisionScrubWarning, co as inheritNestedStackParameterAssociations, cs as resolveDockerContextDirectory, ct as displacedOpClause, d as conditionInputsFrom, da as findReplacedReadersOfRecreateTargets, dc as renderAssemblyPathEscape, di as malformedLocalResourcesWarning, dn as secretSafeKeyDisplay, do as identityKeyFor, dr as IntrinsicFunctionResolver, ds as describeDockerFailure, ea as repairMalformedResourcePropertiesForReadOnly, ec as AssemblyReader, ei as displayLogicalId, en as isFinalSnapshotError, eo as maskSecretsInText, es as getBootstrapMarkerKey, et as deleteJournaledOrphans, f as parentSuppliedValues, fa as shownType, fc as resolveAssemblyPath, fi as malformedOrphanRecordsRefusalMessage, fn as exportNameSecretExposure, fo as carriesSecretMask, fr as classifyReplaySecretRegion, fs as dockerSpawnEnvWithSensitive, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, ga as renderStatefulReason, gi as malformedOrphansWarning, gn as collectPublishedOutputNames, go as recordNoEchoAttributeValues, gr as assertFlagRoleArn, gs as isDockerClientEnvKey, gt as withNestedRevertRun, h as keptWholeReasonText, ha as isStatefulRecreateTargetSync, hi as malformedOrphansRefusalMessage, hn as collectDeclaredOutputNames, ho as recordMaskOnlyValuesIn, hr as applyRoleArnIfSet, hs as getDockerCmd, ht as revertedNestedRowIds, i as childTemplateLoader, ia as unreadableResourceEntries, ic as hasOwnKey, ii as isReadableOrphanRecord, in as DeploymentEventsStore, io as DYNAMIC_REFERENCE_TOKEN_SCAN, is as validateAssetBucketName, it as sameJournaledOrphans, ji as refuseMalformedOrphansForDestroy, jo as describeRegionValueKind, jr as coerceParameterTypedValue, js as getLegacyStateBucketName, jt as replacementNeverSwapped, ki as refuseMalformedOrphanRecordsForDestroy, kn as withCreateTokenLedger, ko as splitImportedOps, ks as synthesisStatusMessage, kt as planFailedOps, l as templateIdentity, la as NO_CC_HANDLERS_REASON, lc as describeFileReadFailure, li as malformedLocalOutputsWarning, ln as secretBearing, lo as recordNestedStackParameterExpressions, lr as DiffCalculator, ls as describeDockerCapturedOutput, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, ma as isStatefulRecreateTargetForReplace, mc as resolveBucketRegion, mi as malformedOrphanRowsKeptWarning, mn as noEchoParameterValueSeed, mo as recordMaskOnlyValue, mr as regionLessSecretName, ms as formatDockerLoginError, n as IMPLICIT_DELETE_DEPENDENCIES, na as unpreviewableOrphanRecords, nc as processStackMessages, ni as hasReadableOutputs, nn as unsupportedFinalSnapshotError, no as redactSecretsForState, ns as parseBootstrapMarker, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oc as nullPrototypeRecord, oi as malformedDriftResourcePropertiesWarning, on as WITHHELD_NAME_DISPLAY, oo as isUncertifiedBaselineMaskPosition, os as buildDenyExternalAccessPolicy, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pa as MULTI_REGION_RECREATE_BLOCKED_TYPES, pi as malformedOrphanRecordsWarning, pn as isWholeDynamicReferenceValue, po as provenPublicValue, pr as producerRegionsFromState, ps as finchSecretArgvRefusal, pt as recordDisplacedSkips, q as green, qa as printingCorpusOf, qi as refuseMalformedResourcesForDestroy, qn as CloudControlProvider, qo as createAssetRedirectResolver, qs as uploadCfnTemplate, qt as stateSecretNameNeedles, r as computeImplicitDeleteEdges, ra as unreadableOrphanRecords, rc as defineOwnKey, ri as hasReadableResources, rn as DeploymentEventsReader, ro as scrubResourceRecord, rs as readBootstrapMarkerBody, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as unwrittenCreateOnlyReplacement, sc as ownValue, si as malformedExportNamesWarning, sn as displayTextOrWithheld, so as pathCrossesDottedKey, ss as buildDockerImage, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, ta as repairMalformedResourcesForReadOnly, tc as StageLoadError, ti as hasReadableOrphans, tn as refusesFinalSnapshot, to as markSameGenerationBag, tr as isWaitAbandonedError, ts as isCrossRegionRedirect, tt as isHandledOrphan, u as conditionFingerprint, ua as hasNoCloudControlHandlers, uc as displayAssemblyPath, ui as malformedLocalResourceEntriesWarning, un as secretBearingStateKeyWarning, ur as INTRINSIC_KEYS, us as describeDockerExecFailure, ut as dropSettledNestedJournals, v as withResourceDeadline, vi as malformedOutputsWarning, vn as bindingSkippedOutputs, vo as wholeStringLeavesOf, vr as explicitRoleArnOrThrow, vs as partitionSensitiveEnv, vt as withNestedStackContext, w as readProtection, wi as malformedStateRefusalMessage, wn as formatDestructiveChange, wo as isSingleDynamicReferenceToken, wr as envCredentialsAreAssumedRole, ws as escapeRegExp, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as malformedResourcePropertiesWarning, xn as maskingRetryLogger, xo as STATE_SOURCED_READBACK_RULES, xr as AWS_CREDENTIAL_ENV_KEYS, xs as runDockerForeground, y as recordedProtectionEvidence, yi as malformedRenderedContainersWarning, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as STATE_SOURCED_BASELINE_RULES, yr as isIamRoleArn, ys as redactDockerArgvValues, yt as replayFailedOperations, za as DagBuilder, zi as refuseMalformedResourceEntriesForImport, zo as orphansAfterRollback, zr as keepsSecretReferenceToken, zs as resolveUseCdkBootstrapAssets } from "./deploy-engine-iXgQFHYR.js";
-import { t as getCdkdVersion } from "./version-Br6yDF8t.js";
+import { $ as resourcesNamingDeclaredParameter, $a as createSecretMasker, $i as repairMalformedOutputsForReadOnly, $n as deleteSkipReason, $o as BOOTSTRAP_MARKER_PREFIX, $r as accountArgs, $s as PARTITION_TABLE, $t as effectiveDeletionPolicy, Ai as refuseMalformedOrphanRecordsForDestroy, Ao as rebuildClientForBucketRegion, As as Synthesizer, At as planRollback, Bi as refuseMalformedResourceEntriesForImport, Bn as CC_BROKEN_REASON, Bo as isReadableBag, Br as AWS_NO_VALUE, Bs as resolveStateBucketWithDefaultAndSource, Bt as updatePartialMessage, C as perType, Ci as malformedResourcesWarning, Cn as findDestructiveChanges, Co as STATE_SOURCED_READBACK_RULES, Cr as callerEnvCredentials, Cs as runDockerForeground, Di as refuseDivergentRecordRegionForDestroy, Dn as ledgerForStack, Do as LockManager, Ds as stripControlChars, Dt as isJournaledOrphan, Ei as previewableOrphanRecords, Eo as isSingleDynamicReferenceToken, Es as escapeRegExp, Et as demoteSupersededOrphans, Fa as templateResourceTypes, Fi as refuseMalformedOutputsForDestroy, Fo as hasReadableExportSet, Fr as isImpossibleEmptyStoredAttribute, Fs as resolveApp, Ft as inheritProducerRegions, G as cyan, Ga as createUnionSecretMasker, Gi as refuseMalformedResourcePropertiesForExport, Go as isSensitiveAttributeName, Gr as withSharedDrainBudget, Gs as CFN_TEMPLATE_BODY_LIMIT, Gt as orphanRecordsPrintingBag, H as formatResourceLine, Ha as TemplateParser, Hi as refuseMalformedResourceEntriesForOrphan, Hn as ccBrokenReason, Ho as orphansCarriedFrom, Hr as isStalePlaceholderArnAttribute, Hs as stateBucketExistenceConfirmed, Ht as completedReplayEntries, Ia as describeTypeWithThrottleRetry, Ii as refuseMalformedResourceAttributesForOrphan, Io as hasReasonlessBaselineRefusal, Ir as carriesDynamicReference, Is as resolveAutoAssetStorage, J as red, Ja as logOnlyValueCount, Ji as refuseMalformedResourcesForDestroy, Jn as slowCcOperationTimeoutMs, Jo as buildAssetRedirectMap, Jr as JSON_LISTING_HOLE_VALUE, Js as findLargeInlineResources, Jt as ATOMIC_FINAL_SNAPSHOT_TYPES, K as gray, Ka as hasMaskableValues, Ki as refuseMalformedResourcePropertiesForOrphan, Kn as withPrintingSecrets, Ko as stringifyValue, Kr as parameterInputsFor, Ks as CFN_TEMPLATE_URL_LIMIT, Kt as secretNamePrintingBag, La as withRetry, Li as refuseMalformedResourceEntries, Lo as hasUnverifiableParameterRefusal, Lr as carriesFetchableDynamicReference, Ls as resolveCaptureObservedState, Mi as refuseMalformedOrphansForDestroy, Mo as acceptedCreateOnlyDropsOf, Mr as isUnboundTemplateParameter, Ms as getDefaultStateBucketName, Mt as resolveReplacementOldType, Ni as refuseMalformedOrphansForOrphan, No as describeRegionValueKind, Nr as parameterTypeMayLoseSecretIdentity, Ns as getLegacyStateBucketName, Nt as findNestedStackTypeChanges, Oo as isLockInfoExpired, Os as AssetManifestLoader, Ot as isReplacementOrphan, Pa as prefetchCreateOnlyPropertyPaths, Pi as refuseMalformedOutputs, Po as exportNamesCarriedFrom, Pr as getAccountInfo, Ps as loadCdkJson, Q as reachableDivergentParameters, Qa as shareLogOnlyValues, Qi as repairMalformedOrphansForReadOnly, Qn as deleteIndeterminateGuards, Qo as AssetModeResolver, Qr as UNREADABLE_RESOURCES_MAP_ROW, Qs as expectedOwnerParam, Qt as createPreDeleteFinalSnapshot, Ri as refuseMalformedResourceEntriesForDeploy, Ro as importableOutputKeys, Rr as isNamelessDynamicReferenceError, Rs as resolveSkipPrefix, S as isProtectionValueActive, Si as malformedResourcePropertiesWarning, Sn as constructPathOf, So as STATE_SOURCED_CROSS_GENERATION_RULES, Sr as applyCallerIdentityCredentials, Ss as redactedDockerCause, St as destroyStackRecordsView, Ti as malformedStateRefusalMessage, Tn as RollbackInlinePolicyWriters, To as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ts as warnFinchArgvExposure, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as liveMatchesUnresolvedTokenFrame, Ui as refuseMalformedResourcePropertiesForDestroy, Un as wouldReturnToSdkProvider, Uo as shouldRetainResource, Ur as refStateLookupFromResource, Us as warnDeprecatedNoPrefixCliFlag, Ut as journaledOrphanPrintingBag, Va as DagBuilder, Vi as refuseMalformedResourceEntriesForImportSave, Vn as ProviderRegistry, Vo as orphansAfterRollback, Vr as cfnRefValueFromPhysicalId, Vs as resolveUseCdkBootstrapAssets, Vt as updatePartialReason, W as bold, Wa as carryLogOnlyValues, Wi as refuseMalformedResourcePropertiesForDrift, Wn as isCustomResourceType$1, Wo as AssetPublisher, Ws as ssmResolvedValueType, Wt as maskEventTextWithBoundBags, X as computeParameterTaint, Xa as recordLogOnlyParameterValue, Xi as refuseMalformedState, Xo as loadPublishableAssetManifest, Xr as STATE_RESOURCES_MALFORMED, Xs as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Xt as buildFinalSnapshotIdentifier, Y as yellow, Ya as printingCorpusOf, Yi as refuseMalformedResourcesForExport, Yn as ccProtectionRegistryTypes, Yo as createAssetRedirectResolver, Yr as STATE_REGION_DIVERGED, Ys as uploadCfnTemplate, Yt as PRE_DELETE_SNAPSHOT_TYPES, Z as namesAnyDeclaredParameter, Za as recordLogOnlyValue, Zi as repairMalformedOrphanRecordsForReadOnly, Zn as UNSPECIFIED_SKIP_REASON, Zo as rewriteTemplateAssetReferences, Zr as UNREADABLE_ORPHANS_CONTAINER_ROW, Zs as decodeListingKey, Zt as ccRoutedFinalSnapshotError, _ as makeCanonicalizePropertiesFn, _a as isStatefulRecreateTargetSync, _i as malformedOrphansWarning, _n as isExportAliasCollision, _o as recordMaskOnlyValuesIn, _r as assertSendableRoleArn, _s as getDockerCmd, a as findNestedTemplateTreeDefect, aa as unreadableResourceEntries, ac as defineOwnKey, ai as isReadableOrphanRecord, an as extractDeploymentEventError, ao as scrubResourceRecord, as as readBootstrapMarkerBody, at as makeSiblingClaimReader, b as recordedProtectionNote, bi as malformedRenderedContainersWarning, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as wholeStringLeavesOf, br as sendableAssumeRoleCommand, bs as partitionSensitiveEnv, bt as replayRollback, c as renderNestedTemplateTreeDefect, cc as nullPrototypeRecord, ci as malformedExportNamesWarning, cn as exportAliasCollisionScrubWarning, co as isUncertifiedBaselineMaskPosition, cs as buildDenyExternalAccessPolicy, ct as displacedOpClause, d as conditionInputsFrom, da as NO_CC_HANDLERS_REASON, dc as describeFileReadFailure, di as malformedLocalResourceEntriesWarning, dn as secretSafeKeyDisplay, do as recordNestedStackParameterExpressions, dr as IntrinsicFunctionResolver, ds as describeDockerCapturedOutput, ea as repairMalformedResourceEntriesForReadOnly, ec as canonicalizeRegion, ei as deployRefusesOrphanRowsReason, en as isFinalSnapshotError, eo as errorCauseChain, es as assertAssetBucketRegion, et as deleteJournaledOrphans, f as parentSuppliedValues, fa as hasNoCloudControlHandlers, fc as displayAssemblyPath, fi as malformedLocalResourcesWarning, fn as exportNameSecretExposure, fr as classifyReplaySecretRegion, fs as describeDockerExecFailure, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, ga as isStatefulRecreateTargetForReplace, gc as resolveBucketRegion, gi as malformedOrphansRefusalMessage, gn as collectPublishedOutputNames, go as recordMaskOnlyValue, gr as assertFlagRoleArn, gs as formatDockerLoginError, gt as withNestedRevertRun, h as keptWholeReasonText, ha as MULTI_REGION_RECREATE_BLOCKED_TYPES, hi as malformedOrphanRowsKeptWarning, hn as collectDeclaredOutputNames, ho as provenPublicValue, hr as applyRoleArnIfSet, hs as finchSecretArgvRefusal, ht as revertedNestedRowIds, i as childTemplateLoader, ia as unreadableOrphanRecords, ic as processStackMessages, ii as hasReadableResources, in as DeploymentEventsStore, io as redactSecretsForState, is as parseBootstrapMarker, it as sameJournaledOrphans, ji as refuseMalformedOrphans, jo as splitImportedOps, jr as coerceParameterTypedValue, js as synthesisStatusMessage, jt as replacementNeverSwapped, ki as refuseMalformedOrphanRecords, kn as withCreateTokenLedger, ko as S3StateBackend, ks as getDockerImageBySourceHash, kt as planFailedOps, l as templateIdentity, la as unwrittenCreateOnlyReplacement, lc as ownValue, li as malformedExportSourceWarning, ln as secretBearing, lo as pathCrossesDottedKey, lr as DiffCalculator, ls as buildDockerImage, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, ma as shownType, mc as resolveAssemblyPath, mi as malformedOrphanRecordsWarning, mn as noEchoParameterValueSeed, mo as carriesSecretMask, mr as regionLessSecretName, ms as dockerSpawnEnvWithSensitive, n as IMPLICIT_DELETE_DEPENDENCIES, na as repairMalformedResourcesForReadOnly, nc as AssemblyReader, ni as hasReadableOrphans, nn as unsupportedFinalSnapshotError, no as maskSecretsInText, ns as getBootstrapMarkerKey, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oa as withheldAccountClause, oc as hasOwnKey, oi as isReadableResourceEntry, on as WITHHELD_NAME_DISPLAY, oo as DYNAMIC_REFERENCE_TOKEN_SCAN, os as validateAssetBucketName, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pa as findReplacedReadersOfRecreateTargets, pc as renderAssemblyPathEscape, pi as malformedOrphanRecordsRefusalMessage, pn as isWholeDynamicReferenceValue, po as identityKeyFor, pr as producerRegionsFromState, ps as describeDockerFailure, pt as recordDisplacedSkips, q as green, qa as literalSplitDelimitersOf, qi as refuseMalformedResourcesForDeploy, qn as CloudControlProvider, qo as WorkGraph, qs as MIGRATE_TMP_PREFIX, qt as stateSecretNameNeedles, r as computeImplicitDeleteEdges, ra as unpreviewableOrphanRecords, rc as StageLoadError, ri as hasReadableOutputs, rn as DeploymentEventsReader, ro as markSameGenerationBag, rs as isCrossRegionRedirect, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as findActionableSilentDrops, sc as hasPlainPrototype, si as malformedDriftResourcePropertiesWarning, sn as displayTextOrWithheld, so as dynamicReferenceTokens, ss as validateContainerRepoName, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, ta as repairMalformedResourcePropertiesForReadOnly, tc as derivePartitionAndUrlSuffix, ti as displayLogicalId, tn as refusesFinalSnapshot, to as maskSecretsInError, tr as isWaitAbandonedError, ts as ensureAssetStorage, tt as isHandledOrphan, u as conditionFingerprint, uc as absoluteAssemblyPathEscape, ui as malformedLocalOutputsWarning, un as secretBearingStateKeyWarning, uo as inheritNestedStackParameterAssociations, ur as INTRINSIC_KEYS, us as resolveDockerContextDirectory, ut as dropSettledNestedJournals, v as withResourceDeadline, va as renderStatefulReason, vi as malformedOutputsRefusalMessage, vn as bindingSkippedOutputs, vo as recordNoEchoAttributeValues, vr as explicitRoleArnOrThrow, vs as isDockerClientEnvKey, vt as withNestedStackContext, w as readProtection, wi as malformedScrubResourceEntriesRefusalMessage, wn as formatDestructiveChange, wo as TEMPLATE_SOURCED_RULES, wr as envCredentialsAreAssumedRole, ws as runDockerStreaming, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as malformedResourceEntriesWarning, xn as maskingRetryLogger, xo as STATE_SOURCED_BASELINE_RULES, xr as AWS_CREDENTIAL_ENV_KEYS, xs as redactDockerArgvValues, y as recordedProtectionEvidence, yi as malformedOutputsWarning, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as recordProvenPublicExpression, yr as isIamRoleArn, ys as isMalformedEnvKey, yt as replayFailedOperations, zi as refuseMalformedResourceEntriesForDestroy, zo as importableOutputs, zr as keepsSecretReferenceToken, zs as resolveStateBucketWithDefault } from "./deploy-engine-CpI6zpP3.js";
+import { t as getCdkdVersion } from "./version-VBHkBg7c.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2421,7 +2421,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CxXTKgEM.js");
+	providerClasses ??= import("./provider-classes-DbpGX0KN.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -8117,6 +8117,7 @@ function canonicalizeIpProtocols(baseline, aws, resourceType) {
 const CC_API_FALLBACK_DENY_LIST = {
 	"AWS::ApiGateway::RestApi": "Body / BodyS3Location are write-only inputs not returned by CC API GetResource; cdkd state preserves them",
 	"AWS::CloudFormation::Stack": "cdkd deploys nested stacks itself: no CloudFormation stack exists, and the physicalId is a cdkd-local placeholder ARN",
+	"AWS::CloudWatch::AnomalyDetector": "the physicalId is a cdkd-derived metric descriptor, not the AnomalyDetectorId Cloud Control's GetResource requires",
 	"AWS::EC2::LaunchTemplate": "CC API returns version-bumped LaunchTemplateData with synthetic LatestVersionNumber that diverges from the CFn input shape"
 };
 
@@ -10610,18 +10611,22 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const stateTargetFor = (logicalId, resourceType) => resourceType === NESTED_STACK_TYPE ? `${stackName}~${logicalId}` : stackName;
 	const skippedStateTargets = /* @__PURE__ */ new Set();
 	const failedStateTargets = /* @__PURE__ */ new Set();
-	const hintCommand = (command, t) => pasteableCommand(command, [{
-		value: t,
-		hole: "stack",
-		opts: { plainIdent: true }
-	}, {
-		flag: "--stack-region",
-		value: regionForState,
-		hole: "region",
-		opts: { plainIdent: true }
-	}]);
+	const hintCommand = (command, t) => pasteableCommand(command, [
+		{
+			value: t,
+			hole: "stack",
+			opts: { plainIdent: true }
+		},
+		{
+			flag: "--stack-region",
+			value: regionForState,
+			hole: "region",
+			opts: { plainIdent: true }
+		},
+		...accountArgs(refusalRecovery)
+	]);
 	const hintFor = (command, targets, label) => [...new Set(targets.map((t) => `\n${label}: ${hintCommand(command, t).command}`))].join("");
-	const hintHolesClause = (targets) => targets.every((t) => hintCommand("cdkd state show", t).withheld.length === 0) ? "" : " A target that is not a plain identifier is printed as a quoted '<stack>' or '<region>' placeholder; list the records as stored with 'cdkd state list --long'.";
+	const hintHolesClause = (targets) => (targets.every((t) => hintCommand("cdkd state show", t).withheld.every((w) => w.hole !== "stack" && w.hole !== "region")) ? "" : " A target that is not a plain identifier is printed as a quoted '<stack>' or '<region>' placeholder; list the records as stored with 'cdkd state list --long'.") + (targets.length === 0 ? "" : ((clause) => clause === "" ? "" : ` ${clause}`)(withheldAccountClause(refusalRecovery, "the command lines below print").trimEnd()));
 	let secretPrincipalRegions;
 	const buildDestroySnapshot = () => {
 		const { imports: _imports, outputReads: _outputReads, ...rest } = state;
@@ -10987,7 +10992,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			const droppableSkipped = journaledOrphanFailures > 0 ? skippedTargets.filter((t) => t !== stackName) : skippedTargets;
 			const skippedCommands = hintFor("cdkd state show", skippedTargets, "Inspect it with") + hintFor("cdkd state orphan", droppableSkipped, "Drop the record with");
 			const dedupedCommands = (lines) => [...new Set(lines.split("\n").filter((l) => l !== ""))].map((l) => `\n${l}`).join("");
-			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. ` + (journaledOrphanFailures > 0 ? `${journaledOrphanFailures} of the failures are resources a failed deploy created that only the rollback journal records: re-run the destroy to retry them. Do not drop this stack's state record — that also deletes the journal, their only record.` : "If the same resource keeps failing, dropping the state record is the last resort: it removes the record without deleting AWS resources.") + skippedClause + hintHolesClause([...failedTargets, ...skippedTargets]) + dedupedCommands(orphanHint + skippedCommands));
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. ` + (journaledOrphanFailures > 0 ? `${journaledOrphanFailures} of the failures are resources a failed deploy created that only the rollback journal records: re-run the destroy to retry them. Do not drop this stack's state record — that also deletes the journal, their only record.` : "If the same resource keeps failing, dropping the state record is the last resort: it removes the record without deleting AWS resources.") + skippedClause + hintHolesClause([...orphanHint === "" ? [] : failedTargets, ...skippedTargets]) + dedupedCommands(orphanHint + skippedCommands));
 		}
 	} finally {
 		try {
@@ -11082,6 +11087,15 @@ async function destroyCommand(stackArgs, options) {
 	});
 	const region = namedCliRegion(options.region) ?? "us-east-1";
 	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const accountRecovery = {
+		profile: options.profile,
+		stateBucket,
+		statePrefix: options.statePrefix
+	};
+	const stateCommandAccount = {
+		args: accountArgs(accountRecovery),
+		clause: withheldAccountClause(accountRecovery, "the command lines below print")
+	};
 	logger.info("Starting stack destruction...");
 	logger.debug("Options:", options);
 	if (options.region) {
@@ -11226,7 +11240,7 @@ async function destroyCommand(stackArgs, options) {
 					const refRegion = allStateRefs.find((r) => r.stackName === pattern)?.region ?? region;
 					const stateOnlyResult = await stateBackend.getState(pattern, refRegion);
 					if (stateOnlyResult?.state.parentStack) {
-						const err = new NestedStackChildDirectDestroyError(pattern, stateOnlyResult.state.parentStack, stateOnlyResult.state.parentLogicalId);
+						const err = new NestedStackChildDirectDestroyError(pattern, stateOnlyResult.state.parentStack, stateOnlyResult.state.parentLogicalId, void 0, stateCommandAccount);
 						logger.error(`  ✗ ${err.message}`);
 						totalErrors++;
 					} else if (appStacks.length > 0 && !notInApp.includes(pattern)) notInApp.push(pattern);
@@ -11258,7 +11272,10 @@ async function destroyCommand(stackArgs, options) {
 			if (synthStack?.terminationProtection === true) {
 				if (options.removeProtection) logger.warn(`Stack ${displaySafe(stackName)} has terminationProtection: true — bypassing because --remove-protection set`);
 				else {
-					const err = new StackTerminationProtectionError(stackName);
+					const err = new StackTerminationProtectionError(stackName, void 0, {
+						args: stateCommandAccount.args,
+						clause: withheldAccountClause(accountRecovery, "the command below prints")
+					});
 					logger.error(`  ✗ ${err.message}`);
 					totalErrors++;
 					continue;
@@ -11275,15 +11292,20 @@ async function destroyCommand(stackArgs, options) {
 			} else if (synthRegion && refs.some((r) => r.region === synthRegion)) stackTargetRegion = synthRegion;
 			else {
 				const regions = refs.map((r) => r.region === void 0 ? "(legacy)" : plainOrDescribed(r.region, "region")).join(", ");
-				const orphanOne = pasteableCommand("cdkd state orphan", [{
-					value: stackName,
-					hole: "stack",
-					opts: { plainIdent: true }
-				}, {
-					flag: "--stack-region",
-					hole: "region"
-				}]);
-				throw new Error(`Stack ${quotedOrDescribed(stackName, "stack name")} has state in multiple regions: ${regions}. Remove cdkd's record for ONE region with the command below (fill in the region), or run destroy from a CDK app whose env.region matches one of them.` + withheldTargetClause(orphanOne, "stack", "cdkd state orphan", "This stack's name") + `\nRemove one record with: ${orphanOne.command}`);
+				const orphanOneClause = withheldAccountClause(accountRecovery, "the command below prints").trimEnd();
+				const orphanOne = pasteableCommand("cdkd state orphan", [
+					{
+						value: stackName,
+						hole: "stack",
+						opts: { plainIdent: true }
+					},
+					{
+						flag: "--stack-region",
+						hole: "region"
+					},
+					...stateCommandAccount.args
+				]);
+				throw new Error(`Stack ${quotedOrDescribed(stackName, "stack name")} has state in multiple regions: ${regions}. Remove cdkd's record for ONE region with the command below (fill in the region), or run destroy from a CDK app whose env.region matches one of them.` + withheldTargetClause(orphanOne, "stack", "cdkd state orphan", "This stack's name") + (orphanOneClause === "" ? "" : ` ${orphanOneClause}`) + `\nRemove one record with: ${orphanOne.command}`);
 			}
 			const stateResult = await stateBackend.getState(stackName, stackTargetRegion);
 			if (!stateResult) {
@@ -11291,7 +11313,7 @@ async function destroyCommand(stackArgs, options) {
 				continue;
 			}
 			if (stateResult.state.parentStack) {
-				const err = new NestedStackChildDirectDestroyError(stackName, stateResult.state.parentStack, stateResult.state.parentLogicalId);
+				const err = new NestedStackChildDirectDestroyError(stackName, stateResult.state.parentStack, stateResult.state.parentLogicalId, void 0, stateCommandAccount);
 				logger.error(`  ✗ ${err.message}`);
 				totalErrors++;
 				continue;
@@ -13987,6 +14009,15 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 		}
 		let resolved;
 		try {
+			const noIdentifier = physicalIdIsNotImportIdentifier(resourceType);
+			if (noIdentifier !== void 0) {
+				blocked.push({
+					logicalId,
+					resourceType,
+					reason: `cdkd cannot export ${resourceType}: ${noIdentifier}, so an IMPORT changeset addressed by it would fail after the stack was locked. Remove the resource from the stack before exporting (it stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh.`
+				});
+				continue;
+			}
 			const measuredRefusal = cfnRefusesImportDespiteRegistry(resourceType);
 			if (!options.skipImportSupportPreflight && measuredRefusal !== void 0) {
 				blocked.push({
@@ -14210,6 +14241,10 @@ const CFN_IMPORT_REFUSED_DESPITE_REGISTRY = /* @__PURE__ */ new Map([["AWS::AppS
 function cfnRefusesImportDespiteRegistry(resourceType) {
 	return CFN_IMPORT_REFUSED_DESPITE_REGISTRY.get(resourceType);
 }
+const PHYSICAL_ID_NOT_IMPORT_IDENTIFIER = /* @__PURE__ */ new Map([["AWS::CloudWatch::AnomalyDetector", "its physicalId is a metric descriptor cdkd derives, not the registry's AnomalyDetectorId, and the CloudWatch API does not return that identifier"]]);
+function physicalIdIsNotImportIdentifier(resourceType) {
+	return PHYSICAL_ID_NOT_IMPORT_IDENTIFIER.get(resourceType);
+}
 async function fetchPrimaryIdentifier(resourceType, cfnClient) {
 	try {
 		const resp = await describeTypeWithThrottleRetry(resourceType, cfnClient);
@@ -16016,6 +16051,11 @@ async function stateOrphanCommand(stackArgs, options) {
 			}
 			if (!options.yes && !options.force) {
 				const targetList = targets.map((t) => describedStackRef(t)).join(", ");
+				const bannerAccount = {
+					profile: options.profile,
+					stateBucket: setup.bucket,
+					statePrefix: options.statePrefix
+				};
 				const destroyCmd = pasteableCommand("cdkd destroy", [{
 					value: stackName,
 					hole: "stack",
@@ -16023,8 +16063,9 @@ async function stateOrphanCommand(stackArgs, options) {
 						patternMatched: true,
 						plainIdent: true
 					}
-				}]);
-				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.` + (targets.some(refIsDescribed) ? ` ${STATE_LIST_POINTER}` : "") + "\nDelete the actual resources instead with the command below." + withheldTargetClause(destroyCmd, "stack", "cdkd destroy") + `\nDestroy with: ${destroyCmd.command}\n\n`);
+				}, ...accountArgs(bannerAccount)]);
+				const bannerAccountClause = withheldAccountClause(bannerAccount, "the command below prints").trimEnd();
+				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.` + (targets.some(refIsDescribed) ? ` ${STATE_LIST_POINTER}` : "") + "\nDelete the actual resources instead with the command below." + withheldTargetClause(destroyCmd, "stack", "cdkd destroy") + (bannerAccountClause === "" ? "" : ` ${bannerAccountClause}`) + `\nDestroy with: ${destroyCmd.command}\n\n`);
 				if (!await confirmStateOrphanRemoval(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/?`)) {
 					logger.info(safeMsg`Cancelled removal of state for stack: ${plainOrDescribed(stackName, "stack name")}`);
 					continue;
@@ -16092,17 +16133,22 @@ async function stateOrphanResources(stackName, requested, options) {
 				const childRef = childRefs.find((r) => r.region === region) ?? childRefs[0];
 				if (childRef === void 0) continue;
 				const otherRegions = childRefs.length - 1;
-				const childCommand = pasteableCommand("cdkd state orphan", [{
-					value: child,
-					hole: "stack",
-					opts: { plainIdent: true }
-				}, ...childRef.region !== void 0 ? [{
-					flag: "--stack-region",
-					value: childRef.region,
-					hole: "region",
-					opts: { plainIdent: true }
-				}] : []]);
-				throw new Error(`${capitalize(plainOrDescribed(id, "logical id"))} has a nested stack's state record of its own. The child's resources are recorded there, and removing this row would leave that record behind with nothing that removes it. Drop the child's record first (it keeps the child's AWS resources; a child with nested stacks of its own has records under '<child>~<logicalId>' too), then re-run.` + withheldTargetClause(childCommand, "stack", "cdkd state orphan") + (otherRegions > 0 ? ` The child also has records in ${otherRegions} other region(s); 'cdkd state list' shows them, and each needs the same drop.` : "") + `\nDrop the child with: ${childCommand.command}`);
+				const childCommand = pasteableCommand("cdkd state orphan", [
+					{
+						value: child,
+						hole: "stack",
+						opts: { plainIdent: true }
+					},
+					...childRef.region !== void 0 ? [{
+						flag: "--stack-region",
+						value: childRef.region,
+						hole: "region",
+						opts: { plainIdent: true }
+					}] : [],
+					...accountArgs(recovery)
+				]);
+				const accountClause = withheldAccountClause(recovery, "the command below prints").trimEnd();
+				throw new Error(`${capitalize(plainOrDescribed(id, "logical id"))} has a nested stack's state record of its own. The child's resources are recorded there, and removing this row would leave that record behind with nothing that removes it. Drop the child's record first (it keeps the child's AWS resources; a child with nested stacks of its own has records under '<child>~<logicalId>' too), then re-run.` + withheldTargetClause(childCommand, "stack", "cdkd state orphan") + (otherRegions > 0 ? ` The child also has records in ${otherRegions} other region(s); 'cdkd state list' shows them, and each needs the same drop.` : "") + (accountClause === "" ? "" : ` ${accountClause}`) + `\nDrop the child with: ${childCommand.command}`);
 			}
 			clients = new AwsClients({
 				region,
@@ -17765,7 +17811,7 @@ function collectAssetReferences(stateDocument, marker, refs) {
 	};
 	walk(stateDocument);
 }
-async function scanReferencedAssets(stateBackend, marker, logger) {
+async function scanReferencedAssets(stateBackend, marker, logger, account) {
 	const refs = {
 		s3Keys: /* @__PURE__ */ new Set(),
 		imageTags: /* @__PURE__ */ new Set(),
@@ -17784,7 +17830,12 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 			parsed = JSON.parse(body);
 		} catch (error) {
 			const { stack, region } = parseStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX);
-			const inspectHint = isPasteableIdent(stack) && (region === void 0 || isPasteableIdent(region)) ? pasteableCommand("cdkd state show", region === void 0 ? [{
+			const pasteable = isPasteableIdent(stack) && (region === void 0 || isPasteableIdent(region));
+			const recovery = {
+				...account,
+				statePrefix: keyPrefixOf(key, stack, region)
+			};
+			const inspectHint = pasteable ? pasteableCommand("cdkd state show", [...region === void 0 ? [{
 				value: stack,
 				hole: "stack"
 			}] : [{
@@ -17794,9 +17845,13 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 				flag: "--stack-region",
 				value: region,
 				hole: "region"
-			}]).command : void 0;
+			}], ...accountArgs(recovery)]).command : void 0;
+			const accountClause = inspectHint === void 0 ? "" : [withheldAccountClause({
+				...recovery,
+				statePrefix: void 0
+			}, "the command below prints").trimEnd(), keyPrefixHoleSentence(recovery.statePrefix)].filter((part) => part !== "").join(" ");
 			const inspect = inspectHint === void 0 ? "its stack name is not safe to paste into a command, so inspect the object at that key directly" : `see the command below`;
-			throw new CdkdError(`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file (${inspect}), then re-run.` + (inspectHint === void 0 ? "" : `\nInspect it with: ${inspectHint}`), "GC_STATE_UNREADABLE", error);
+			throw new CdkdError(`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file (${inspect}), then re-run.` + (accountClause === "" ? "" : ` ${accountClause}`) + (inspectHint === void 0 ? "" : `\nInspect it with: ${inspectHint}`), "GC_STATE_UNREADABLE", error);
 		}
 		collectAssetReferences(parsed, marker, refs);
 	}
@@ -18041,7 +18096,10 @@ async function gcCommand(options) {
 		let s3Candidates = [];
 		let ecrCandidates = [];
 		if (marker !== null) {
-			const refs = await scanReferencedAssets(stateBackend, marker, logger);
+			const refs = await scanReferencedAssets(stateBackend, marker, logger, {
+				profile: options.profile,
+				stateBucket: bucketName
+			});
 			s3Candidates = await listS3Candidates(awsClients.s3, marker.assetBucket, accountId, refs, cutoffMs, logger);
 			ecrCandidates = await listEcrCandidates(ecrClient, marker.containerRepo, refs, cutoffMs, logger);
 		}
@@ -18111,6 +18169,15 @@ function createGcCommand() {
 	commonOptions.forEach((opt) => cmd.addOption(opt));
 	return cmd;
 }
+function keyPrefixOf(key, stack, region) {
+	const tail = `/${stack}${region === void 0 ? "" : `/${region}`}/${STATE_FILE_SUFFIX.replace(/^\//, "")}`;
+	return key.endsWith(tail) ? key.slice(0, -tail.length) : void 0;
+}
+function keyPrefixHoleSentence(prefix) {
+	const reason = pasteableCommand("cdkd", accountArgs({ statePrefix: prefix })).withheld.find((w) => w.hole === "prefix")?.reason;
+	if (reason === void 0) return "";
+	return `The state prefix of the key above ${reason === "option-shaped" ? `begins with a '-'` : reason === "altered" ? "does not render exactly" : reason === "too-long" ? "is too long to print" : prefix !== void 0 && prefix.includes("/") ? `has a '/'-separated part that is not a plain identifier` : "is not a plain identifier"}, so the command below prints '<prefix>' in its place: replace it whole, quotes included, with that prefix shell-quoted -- the part of the key before '/<stack>/<region>/state.json' ('/<stack>/state.json' for a legacy key), since 'cdkd gc' takes no --state-prefix.`;
+}
 
 //#endregion
 //#region src/cli/commands/publish-assets.ts
@@ -26884,4 +26951,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CPziYRDp.js.map
+//# sourceMappingURL=program-CXEHAcOO.js.map