@go-to-k/cdkd 0.298.7 → 0.299.0

package/dist/{program-BgDt3OZh.js → program-BgsCaZFy.js}

@@ -1,9 +1,9 @@
-import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
+import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-Bj7qH5Ph.js";
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
-import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $a as isStatefulRecreateTargetForReplace, $c as warnDeprecatedNoPrefixCliFlag, $i as malformedOrphansRefusalMessage, $n as ledgerForStack, $o as markSameGenerationBag, $r as sendableAssumeRoleCommand, $s as AssetPublisher, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcesForDeploy, Ac as redactDockerArgvValues, Ai as declaresNoEcho, An as journaledOrphanPrintingBag, Ao as maskWholeValue, Ar as deleteIndeterminateGuards, As as LockManager, At as dropFailedHint, Ba as unpreviewableOrphanRecords, Bc as Synthesizer, Bi as hasReadableOutputs, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as carryLogOnlyValues, Bs as splitImportedOps, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForImport, Cc as dockerSpawnEnvWithSensitive, Ci as cfnRefValueFromPhysicalId, Cl as renderAssemblyPathEscape, Cn as collectDeclaredOutputNames, Cr as applyCustomResourceResponseExpiration, Cs as wholeStringLeavesOf, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDrift, Dc as isDockerClientEnvKey, Di as withSharedDrainBudget, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as isMarkedCoordinate, Ds as TEMPLATE_SOURCED_RULES, E as serviceTokenBlockingReason, Ea as refuseMalformedResourcePropertiesForDestroy, Ec as getDockerCmd, El as injectedAwsRegionValue, En as bindingSkippedOutputs, Eo as canonicalCoordinates, Er as slowCcOperationTimeoutMs, Es as STATE_SOURCED_READBACK_RULES, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphansForReadOnly, Fc as escapeRegExp, Fi as UNREADABLE_RESOURCES_MAP_ROW, Fn as secretNamedRecordNeedles, Fs as CrossPrefixScanCache, Ft as sameJournaledOrphans, Gc as resolveApp, Gi as malformedExportNamesWarning, Gn as isFinalSnapshotError, Go as printingCorpusOf, Gr as poisonRenderedSpellingsCollidingIn, Gs as hasReasonlessBaselineRefusal, Gt as isJournaledOrphan, Ha as unreadableResourceEntries, Hc as getDefaultStateBucketName, Hi as isReadableOrphanRecord, Hn as ccRoutedFinalSnapshotError, Ho as hasMaskableValues, Hr as DiffCalculator, Hs as describeRegionValueKind, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOutputsForReadOnly, Ic as stripControlChars, Ii as accountArgs, In as stateSecretNameNeedles, Io as readbackPathFor, Is as applyCrossPrefixScan, It as replayFailedOperations, Ja as NO_CC_HANDLERS_REASON, Jc as resolveSkipPrefix, Ji as malformedLocalResourceEntriesWarning, Jn as maskingRetryLogger, Jo as shareLogOnlyValues, Jr as applyRoleArnIfSet, Js as importableOutputs, Jt as planRollback, Ka as unwrittenCreateOnlyReplacement, Kc as resolveAutoAssetStorage, Ki as malformedExportSourceWarning, Kn as refusesFinalSnapshot, Ko as recordLogOnlyParameterValue, Kr as producerLookupOver, Ks as hasUnverifiableParameterRefusal, Kt as isReplacementOrphan, L as perType, La as repairMalformedResourceEntriesForReadOnly, Lc as stripForDisplay, Li as deployRefusesOrphanRowsReason, Ln as storedSecretNameNeedles, Lo as readsNoEchoSource, Ls as crossPrefixDeniedWarning, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForExport, Mc as runDockerForeground, Mi as STATE_REGION_DIVERGED, Mn as orphanRecordsPrintingBag, Mo as noEchoCoordinatesOf, Mr as deleteSkipReason, Ms as S3StateBackend, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedState, Nc as runDockerStreaming, Ni as STATE_RESOURCES_MALFORMED, Nn as secretNamePrintingBag, No as noEchoLeavesOf, Ns as rebuildClientForBucketRegion, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForExport, Oc as isMalformedEnvKey, Oi as parameterInputsFor, Ol as resolveBucketRegion, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as maskAtCoordinates, Or as RollbackInlinePolicyWriters, Os as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as repairMalformedOrphanRecordsForReadOnly, Pc as warnFinchArgvExposure, Pi as UNREADABLE_ORPHANS_CONTAINER_ROW, Pn as secretNamePrintingBags, Po as noEchoOutputsComparison, Pr as isWaitAbandonedError, Ps as CrossPrefixReadError, Pt as makeForeignHolderScan, Qa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Qc as stateBucketExistenceConfirmed, Qi as malformedOrphanRowsKeptWarning, Qo as maskSecretsInText, Qr as isIamRoleArn, Qs as shouldRetainResource, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourcePropertiesForReadOnly, Rc as AssetManifestLoader, Ri as displayLogicalId, Rn as extractDeploymentEventError, Ro as valueAtCoordinate, Rs as isAccessDenied, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDestroy, Sc as describeDockerFailure, Si as AWS_NO_VALUE, Sl as displayAssemblyPath, Sn as noEchoParameterValueSeed, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as recordProvenPublicExpression, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForOrphan, Tc as formatDockerLoginError, Ti as refStateLookupFromResource, Tl as injectAwsRegion, Tn as isExportAliasCollision, To as TemplateParser, Tr as CloudControlProvider, Ts as STATE_SOURCED_CROSS_GENERATION_RULES, Tt as withNestedRevertRun, Ua as withheldAccountClause, Uc as getLegacyStateBucketName, Ui as isReadableResourceEntry, Un as createPreDeleteFinalSnapshot, Uo as literalSplitDelimitersOf, Ur as INTRINSIC_KEYS, Us as exportNamesCarriedFrom, Ut as recordAfterRollbackUpdate, Va as unreadableOrphanRecords, Vc as synthesisStatusMessage, Vi as hasReadableResources, Vn as buildFinalSnapshotIdentifier, Vo as createUnionSecretMasker, Vs as acceptedCreateOnlyDropsOf, Vt as withStackRecords, Wa as findActionableSilentDrops, Wc as loadCdkJson, Wi as malformedDriftResourcePropertiesWarning, Wn as effectiveDeletionPolicy, Wo as logOnlyValueCount, Wr as IntrinsicFunctionResolver, Ws as hasReadableExportSet, Wt as demoteSupersededOrphans, Xa as findReplacedReadersOfRecreateTargets, Xc as resolveStateBucketWithDefaultAndSource, Xi as malformedOrphanRecordsRefusalMessage, Xn as findDestructiveChanges, Xo as errorCauseChain, Xr as assertSendableRoleArn, Xs as orphansAfterRollback, Xt as recordUnderIdIsNotOwn, Ya as hasNoCloudControlHandlers, Yc as resolveStateBucketWithDefault, Yi as malformedLocalResourcesWarning, Yn as constructPathOf, Yo as createSecretMasker, Yr as assertFlagRoleArn, Ys as isReadableBag, Yt as recheckFailedPlan, Za as shownType, Zc as resolveUseCdkBootstrapAssets, Zi as malformedOrphanRecordsWarning, Zn as formatDestructiveChange, Zo as maskSecretsInError, Zr as explicitRoleArnOrThrow, Zs as orphansCarriedFrom, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOutputs, _c as buildDenyExternalAccessPolicy, _i as isImpossibleEmptyStoredAttribute, _l as hasPlainPrototype, _n as secretSafeKeyDisplay, _o as prefetchCreateOnlyPropertyPaths, _r as TemplateNoEchoReresolver, _s as provenPublicValue, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourcePropertiesWarning, ac as loadPublishableAssetManifest, al as uploadCfnTemplate, as as dynamicReferenceTokens, at as cyan, ba as refuseMalformedResourceEntries, bc as describeDockerCapturedOutput, bi as isNamelessDynamicReferenceError, bl as absoluteAssemblyPathEscape, bn as exportNameSecretExposure, bo as withRetry, bs as recordNoEchoAttributeValues, c as renderNestedTemplateTreeDefect, ca as malformedStateRefusalMessage, cc as BOOTSTRAP_MARKER_PREFIX, cl as expectedOwnerParam, cn as updatePartialMessage, cs as identityKeyFor, ct as red, d as conditionInputsFrom, dc as getBootstrapMarkerKey, di as producerRegionsFromState, dl as derivePartitionAndUrlSuffix, dn as DeploymentEventsStore, dt as namesAnyDeclaredParameter, ea as malformedOrphansWarning, ec as isSensitiveAttributeName, ei as AWS_CREDENTIAL_ENV_KEYS, el as ssmResolvedValueType, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetSync, es as redactSecretsForState, f as parentSuppliedValues, fa as refuseMalformedOrphanRecords, fc as isCrossRegionRedirect, fi as regionLessSecretName, fl as AssemblyReader, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as physicalNameCopiesOf, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForOrphan, gc as validateContainerRepoName, gi as getAccountInfo, gl as hasOwnKey, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as carriesSecretMask, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphansForDestroy, hc as validateAssetBucketName, hi as parameterTypeMayLoseSecretIdentity, hl as defineOwnKey, hn as secretBearing, hr as isCustomResource, hs as splitGetAttStringForm, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedResourceEntriesWarning, ic as createAssetRedirectResolver, il as findLargeInlineResources, is as DYNAMIC_REFERENCE_TOKEN_SCAN, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDestroy, jc as redactedDockerCause, ji as JSON_LISTING_HOLE_VALUE, jn as maskEventTextWithBoundBags, jo as maskedLeafCoordinatesOf, jr as deleteLeftInPlace, js as isLockInfoExpired, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForOrphan, kc as partitionSensitiveEnv, kn as completedReplayEntries, ko as maskReadbackAtCoordinates, kr as UNSPECIFIED_SKIP_REASON, ks as isSingleDynamicReferenceToken, kt as deleteJournaledOrphans, l as templateIdentity, la as previewableOrphanRecords, lc as assertAssetBucketRegion, ll as PARTITION_TABLE, ln as updatePartialReason, ls as inheritNestedStackParameterAssociations, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphans, mc as readBootstrapMarkerBody, mi as isUnboundTemplateParameter, ml as processStackMessages, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as recordPhysicalNameCopy, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsWarning, nc as WorkGraph, ni as callerEnvCredentials, nl as CFN_TEMPLATE_URL_LIMIT, ns as withPhysicalNameCopies, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcesWarning, oc as rewriteTemplateAssetReferences, ol as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, os as isUncertifiedBaselineMaskPosition, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecordsForDestroy, pc as parseBootstrapMarker, pi as coerceParameterTypedValue, pl as StageLoadError, pn as displayTextOrWithheld, pr as ProviderRegistry, pt as resourcesNamingDeclaredParameter, qc as resolveCaptureObservedState, qi as malformedLocalOutputsWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyValue, qr as refuseUnreadableCdkCrossAccountRefs, qs as importableOutputKeys, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedRenderedContainersWarning, rc as buildAssetRedirectMap, ri as envCredentialsAreAssumedRole, rl as MIGRATE_TMP_PREFIX, rn as inheritProducerRegions, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedScrubResourceEntriesRefusalMessage, sc as AssetModeResolver, sl as decodeListingKey, ss as pathCrossesDottedKey, st as green, t as DeployEngine, ta as malformedOutputsRefusalMessage, tc as stringifyValue, ti as applyCallerIdentityCredentials, tl as CFN_TEMPLATE_BODY_LIMIT, tn as findNestedStackTypeChanges, to as renderStatefulReason, tr as withCreateTokenLedger, ts as scrubResourceRecord, u as conditionFingerprint, ua as refuseDivergentRecordRegionForDestroy, uc as ensureAssetStorage, ui as classifyReplaySecretRegion, ul as canonicalizeRegion, un as DeploymentEventsReader, us as recordNestedStackParameterExpressions, ut as computeParameterTaint, va as refuseMalformedOutputsForDestroy, vc as buildDockerImage, vi as carriesDynamicReference, vl as nullPrototypeRecord, vn as carriedExportAliasExposure, vo as templateResourceTypes, vr as readsNoEchoDeleteValues, vs as recordMaskOnlyValue, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImportSave, wc as finchSecretArgvRefusal, wi as isStalePlaceholderArnAttribute, wl as resolveAssemblyPath, wn as collectPublishedOutputNames, wo as DagBuilder, wr as customResourceResponseExpirationWarning, ws as STATE_SOURCED_BASELINE_RULES, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntriesForDeploy, xc as describeDockerExecFailure, xi as keepsSecretReferenceToken, xl as describeFileReadFailure, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordNoEchoParameterFreshValue, xt as nestedChildStackName$1, ya as refuseMalformedResourceAttributesForOrphan, yc as resolveDockerContextDirectory, yi as carriesFetchableDynamicReference, yl as ownValue, yn as exportNameNoEchoParameters, yo as describeTypeWithThrottleRetry, yr as isCustomResourceType$1, ys as recordMaskOnlyValuesIn, yt as dropSettledNestedJournals, za as repairMalformedResourcesForReadOnly, zc as getDockerImageBySourceHash, zi as hasReadableOrphans, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as liveMatchesUnresolvedTokenFrame, zs as isNotImplemented, zt as destroyStackRecordsView } from "./deploy-engine-CO0EOAem.js";
-import { t as getCdkdVersion } from "./version-B3Ymd4cN.js";
+import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, xn as StateError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
+import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
+import { $a as MULTI_REGION_RECREATE_BLOCKED_TYPES, $c as resolveStateBucketWithDefault, $i as malformedOrphanRowsKeptWarning, $o as maskSecretsInText, $r as isIamRoleArn, $s as orphansAfterRollback, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcePropertiesForOrphan, Ac as isDockerClientEnvKey, Al as injectedAwsRegionValue, An as journaledOrphanPrintingBag, Ao as maskReadbackAtCoordinates, Ar as UNSPECIFIED_SKIP_REASON, As as TEMPLATE_SOURCED_RULES, At as dropFailedHint, Ba as repairMalformedResourcesForReadOnly, Bc as stripControlChars, Bi as hasReadableOrphans, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as liveMatchesUnresolvedTokenFrame, Bs as crossPrefixDeniedWarning, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForDestroy, Cc as describeDockerCapturedOutput, Ci as AWS_NO_VALUE, Cl as ownValue, Cn as collectDeclaredOutputNames, Cr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Cs as recordNoEchoAttributeValues, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDestroy, Dc as finchSecretArgvRefusal, Dl as renderAssemblyPathEscape, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as canonicalCoordinates, Dr as slowCcOperationTimeoutMs, Ds as STATE_SOURCED_BASELINE_RULES, E as serviceTokenBlockingReason, Ea as refuseMalformedResourceEntriesForOrphan, Ec as dockerSpawnEnvWithSensitive, Ei as refStateLookupFromResource, El as displayAssemblyPath, En as bindingSkippedOutputs, Eo as TemplateParser, Er as CloudControlProvider, Es as wholeStringLeavesOf, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphanRecordsForReadOnly, Fc as redactedDockerCause, Fi as UNREADABLE_ORPHANS_CONTAINER_ROW, Fn as secretNamedRecordNeedles, Fo as noEchoOutputsComparison, Fr as isWaitAbandonedError, Fs as S3StateBackend, Ft as sameJournaledOrphans, Ga as findActionableSilentDrops, Gc as synthesisStatusMessage, Gi as malformedDriftResourcePropertiesWarning, Gn as isFinalSnapshotError, Go as logOnlyValueCount, Gr as IntrinsicFunctionResolver, Gs as describeRegionValueKind, Gt as isJournaledOrphan, Ha as unreadableOrphanRecords, Hc as AssetManifestLoader, Hi as hasReadableResources, Hn as ccRoutedFinalSnapshotError, Ho as createUnionSecretMasker, Hs as isNotImplemented, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOrphansForReadOnly, Ic as runDockerForeground, Ii as UNREADABLE_RESOURCES_MAP_ROW, In as stateSecretNameNeedles, Is as rebuildClientForBucketRegion, It as replayFailedOperations, Jc as loadCdkJson, Ji as malformedLocalOutputsWarning, Jn as maskingRetryLogger, Jo as recordLogOnlyValue, Jr as refuseUnreadableCdkCrossAccountRefs, Js as hasReasonlessBaselineRefusal, Jt as planRollback, Kc as getDefaultStateBucketName, Ki as malformedExportNamesWarning, Kn as refusesFinalSnapshot, Ko as printingCorpusOf, Kr as poisonRenderedSpellingsCollidingIn, Ks as exportNamesCarriedFrom, Kt as isReplacementOrphan, L as perType, La as repairMalformedOutputsForReadOnly, Lc as runDockerStreaming, Li as accountArgs, Ln as storedSecretNameNeedles, Lo as readbackPathFor, Ls as CrossPrefixReadError, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForDestroy, Mc as partitionSensitiveEnv, Mi as JSON_LISTING_HOLE_VALUE, Ml as resolveBucketRegion, Mn as orphanRecordsPrintingBag, Mo as maskedLeafCoordinatesOf, Mr as deleteLeftInPlace, Ms as isSingleDynamicReferenceToken, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedResourcesForExport, Nc as redactDockerArgvValues, Ni as STATE_REGION_DIVERGED, Nn as secretNamePrintingBag, No as noEchoCoordinatesOf, Nr as deleteSkipReason, Ns as LockManager, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForDrift, Oc as formatDockerLoginError, Oi as withSharedDrainBudget, Ol as resolveAssemblyPath, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as isMarkedCoordinate, Os as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as refuseMalformedState, Pc as redactedCause, Pi as STATE_RESOURCES_MALFORMED, Pn as secretNamePrintingBags, Po as noEchoLeavesOf, Ps as isLockInfoExpired, Pt as makeForeignHolderScan, Qa as shownType, Qc as resolveSkipPrefix, Qi as malformedOrphanRecordsWarning, Qo as maskSecretsInError, Qr as explicitRoleArnOrThrow, Qs as isReadableBag, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourceEntriesForReadOnly, Rc as warnFinchArgvExposure, Ri as deployRefusesOrphanRowsReason, Rn as extractDeploymentEventError, Ro as readsNoEchoSource, Rs as CrossPrefixScanCache, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDeploy, Sc as resolveDockerContextDirectory, Si as keepsSecretReferenceToken, Sl as nullPrototypeRecord, Sn as noEchoParameterValueSeed, Sr as withPrintingSecrets, Ss as recordMaskOnlyValuesIn, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForImportSave, Tc as describeDockerFailure, Ti as isStalePlaceholderArnAttribute, Tl as describeFileReadFailure, Tn as isExportAliasCollision, To as DagBuilder, Tr as customResourceResponseExpirationWarning, Ts as recordProvenPublicExpression, Tt as withNestedRevertRun, Ua as unreadableResourceEntries, Uc as getDockerImageBySourceHash, Ui as isReadableOrphanRecord, Un as createPreDeleteFinalSnapshot, Uo as hasMaskableValues, Ur as DiffCalculator, Us as splitImportedOps, Ut as recordAfterRollbackUpdate, Va as unpreviewableOrphanRecords, Vc as stripForDisplay, Vi as hasReadableOutputs, Vn as buildFinalSnapshotIdentifier, Vo as carryLogOnlyValues, Vs as isAccessDenied, Vt as withStackRecords, Wa as withheldAccountClause, Wc as Synthesizer, Wi as isReadableResourceEntry, Wn as effectiveDeletionPolicy, Wo as literalSplitDelimitersOf, Wr as INTRINSIC_KEYS, Ws as acceptedCreateOnlyDropsOf, Wt as demoteSupersededOrphans, Xa as hasNoCloudControlHandlers, Xc as resolveAutoAssetStorage, Xi as malformedLocalResourcesWarning, Xn as findDestructiveChanges, Xo as createSecretMasker, Xr as assertFlagRoleArn, Xs as importableOutputKeys, Xt as recordUnderIdIsNotOwn, Ya as NO_CC_HANDLERS_REASON, Yc as resolveApp, Yi as malformedLocalResourceEntriesWarning, Yn as constructPathOf, Yo as shareLogOnlyValues, Yr as applyRoleArnIfSet, Ys as hasUnverifiableParameterRefusal, Yt as recheckFailedPlan, Za as findReplacedReadersOfRecreateTargets, Zc as resolveCaptureObservedState, Zi as malformedOrphanRecordsRefusalMessage, Zn as formatDestructiveChange, Zo as errorCauseChain, Zr as assertSendableRoleArn, Zs as importableOutputs, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOrphansForOrphan, _c as readBootstrapMarkerBody, _i as getAccountInfo, _l as StageLoadError, _n as secretSafeKeyDisplay, _r as wouldReturnToSdkProvider, _s as recordPhysicalNameCopy, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourceEntriesWarning, ac as WorkGraph, al as CFN_TEMPLATE_BODY_LIMIT, as as withPhysicalNameCopies, at as cyan, ba as refuseMalformedResourceAttributesForOrphan, bc as buildDenyExternalAccessPolicy, bi as carriesFetchableDynamicReference, bl as hasOwnKey, bn as exportNameSecretExposure, bo as describeTypeWithThrottleRetry, br as isCustomResourceType$1, bs as provenPublicValue, c as renderNestedTemplateTreeDefect, ca as malformedScrubResourceEntriesRefusalMessage, cc as loadPublishableAssetManifest, cl as findLargeInlineResources, cn as updatePartialMessage, cs as dynamicReferenceTokens, ct as red, d as conditionInputsFrom, da as refuseDivergentRecordRegionForDestroy, dc as BOOTSTRAP_MARKER_PREFIX, di as classifyReplaySecretRegion, dl as decodeListingKey, dn as DeploymentEventsStore, ds as identityKeyFor, dt as namesAnyDeclaredParameter, ea as malformedOrphansRefusalMessage, ec as orphansCarriedFrom, ei as sendableAssumeRoleCommand, el as resolveStateBucketWithDefaultAndSource, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetForReplace, er as ledgerForStack, es as markSameGenerationBag, f as parentSuppliedValues, fc as assertAssetBucketRegion, fi as producerRegionsFromState, fl as expectedOwnerParam, fn as WITHHELD_NAME_DISPLAY, fs as inheritNestedStackParameterAssociations, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForDestroy, gc as parseBootstrapMarker, gi as parameterTypeMayLoseSecretIdentity, gl as AssemblyReader, gn as secretBearingStateKeyWarning, gr as isCustomResource, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphans, hc as isCrossRegionRedirect, hi as isUnboundTemplateParameter, hl as derivePartitionAndUrlSuffix, hn as secretBearing, hr as ccBrokenReason, hs as physicalNameCopiesOf, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedRenderedContainersWarning, ic as stringifyValue, ii as envCredentialsAreAssumedRole, il as ssmResolvedValueType, is as scrubResourceRecord, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDeploy, jc as isMalformedEnvKey, ji as declaresNoEcho, jn as maskEventTextWithBoundBags, jo as maskWholeValue, jr as deleteIndeterminateGuards, js as WHOLE_DYNAMIC_REFERENCE_PATTERN, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForExport, kc as getDockerCmd, ki as parameterInputsFor, kl as injectAwsRegion, kn as completedReplayEntries, ko as maskAtCoordinates, kr as RollbackInlinePolicyWriters, ks as STATE_SOURCED_READBACK_RULES, kt as deleteJournaledOrphans, l as templateIdentity, la as malformedStateRefusalMessage, lc as rewriteTemplateAssetReferences, ll as uploadCfnTemplate, ln as updatePartialReason, ls as isUncertifiedBaselineMaskPosition, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphanRecordsForDestroy, mc as getBootstrapMarkerKey, mi as coerceParameterTypedValue, ml as canonicalizeRegion, mn as exportAliasCollisionScrubWarning, mr as ProviderRegistry, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsRefusalMessage, nc as AssetPublisher, ni as applyCallerIdentityCredentials, nl as stateBucketExistenceConfirmed, no as renderStatefulReason, nr as withCreateTokenLedger, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcePropertiesWarning, oc as buildAssetRedirectMap, ol as CFN_TEMPLATE_URL_LIMIT, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecords, pc as ensureAssetStorage, pi as regionLessSecretName, pl as PARTITION_TABLE, pn as displayTextOrWithheld, pr as CC_BROKEN_REASON, ps as recordNestedStackParameterExpressions, pt as resourcesNamingDeclaredParameter, qa as unwrittenCreateOnlyReplacement, qc as getLegacyStateBucketName, qi as malformedExportSourceWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyParameterValue, qr as producerLookupOver, qs as hasReadableExportSet, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedOutputsWarning, rc as isSensitiveAttributeName, ri as callerEnvCredentials, rl as warnDeprecatedNoPrefixCliFlag, rn as inheritProducerRegions, rs as redactSecretsForState, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedResourcesWarning, sc as createAssetRedirectResolver, sl as MIGRATE_TMP_PREFIX, ss as DYNAMIC_REFERENCE_TOKEN_SCAN, st as green, t as DeployEngine, ta as malformedOrphansWarning, tc as shouldRetainResource, ti as AWS_CREDENTIAL_ENV_KEYS, tl as resolveUseCdkBootstrapAssets, tn as findNestedStackTypeChanges, to as isStatefulRecreateTargetSync, u as conditionFingerprint, ua as previewableOrphanRecords, uc as AssetModeResolver, ul as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, un as DeploymentEventsReader, us as pathCrossesDottedKey, ut as computeParameterTaint, va as refuseMalformedOutputs, vc as validateAssetBucketName, vi as isImpossibleEmptyStoredAttribute, vl as processStackMessages, vn as carriedExportAliasExposure, vo as prefetchCreateOnlyPropertyPaths, vr as TemplateNoEchoReresolver, vs as splitGetAttStringForm, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImport, wc as describeDockerExecFailure, wi as cfnRefValueFromPhysicalId, wl as absoluteAssemblyPathEscape, wn as collectPublishedOutputNames, wr as applyCustomResourceResponseExpiration, ws as recordNoEchoParameterFreshValue, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntries, xc as buildDockerImage, xi as isNamelessDynamicReferenceError, xl as hasPlainPrototype, xn as isWholeDynamicReferenceValue, xo as withRetry, xs as recordMaskOnlyValue, xt as nestedChildStackName$1, ya as refuseMalformedOutputsForDestroy, yc as validateContainerRepoName, yi as carriesDynamicReference, yl as defineOwnKey, yn as exportNameNoEchoParameters, yo as templateResourceTypes, yr as readsNoEchoDeleteValues, ys as carriesSecretMask, yt as dropSettledNestedJournals, za as repairMalformedResourcePropertiesForReadOnly, zc as escapeRegExp, zi as displayLogicalId, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as valueAtCoordinate, zs as applyCrossPrefixScan, zt as destroyStackRecordsView } from "./deploy-engine-4K_B3N08.js";
+import { t as getCdkdVersion } from "./version-DUCWZskc.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2561,7 +2561,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-BEIwSimv.js");
+	providerClasses ??= import("./provider-classes-DxHQcC1K.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3386,7 +3386,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
 						state: stateForRecreateCheck?.state ?? {
-							version: 11,
+							version: 12,
 							stackName: stackInfo.stackName,
 							region: stackRegion,
 							resources: {},
@@ -3421,7 +3421,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 						const replacedReaders = await findReplacedReadersOfRecreateTargets({
 							template: stackInfo.template,
 							state: stateForRecreateCheck?.state ?? {
-								version: 11,
+								version: 12,
 								stackName: stackInfo.stackName,
 								region: stackRegion,
 								resources: {},
@@ -4238,10 +4238,10 @@ async function drainTemplateUploads(cleanups, stateBucket, labels) {
 		logger.warn(`Failed to delete ${labels.what} from '${stateBucket}'${labels.when ? ` ${labels.when}` : ""}. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
 	}
 }
-async function retireCloudFormationStack(options) {
+async function prepareCloudFormationStackRetirement(options) {
 	const logger = getLogger();
 	const { cfnStackName, cfnClient, yes, stateBucket, s3ClientOpts, resourceTree } = options;
-	if (resourceTree && resourceTree.stackName !== cfnStackName) throw new Error(`retireCloudFormationStack: caller-supplied resourceTree.stackName='${resourceTree.stackName}' does not match cfnStackName='${cfnStackName}'. The tree's root must be the stack being retired.`);
+	if (resourceTree && resourceTree.stackName !== cfnStackName) throw new Error(`prepareCloudFormationStackRetirement: caller-supplied resourceTree.stackName='${resourceTree.stackName}' does not match cfnStackName='${cfnStackName}'. The tree's root must be the stack being retired.`);
 	logger.info(`[1/4] Inspecting CloudFormation stack '${cfnStackName}'...`);
 	const stack = (await cfnClient.send(new DescribeStacksCommand({ StackName: cfnStackName }))).Stacks?.[0];
 	if (!stack) throw new Error(`CloudFormation stack '${cfnStackName}' not found.`);
@@ -4281,7 +4281,7 @@ async function retireCloudFormationStack(options) {
 	if (!yes) {
 		let proceed = false;
 		try {
-			proceed = await confirmPrompt$6(`Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', then delete the stack? AWS resources will NOT be deleted (cdkd state has been written).`);
+			proceed = await confirmPrompt$6(`Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', and delete the stack once cdkd state is written? AWS resources will NOT be deleted.`);
 		} finally {
 			if (!proceed) await drainTemplateUploads(nestedCleanups, stateBucket, {
 				what: "temporary nested-template upload",
@@ -4289,16 +4289,17 @@ async function retireCloudFormationStack(options) {
 			});
 		}
 		if (!proceed) {
-			logger.info("CloudFormation stack retirement cancelled. cdkd state is unaffected.");
+			logger.info("CloudFormation stack retirement cancelled. The stack is unchanged and will not be deleted.");
 			return { outcome: "cancelled" };
 		}
 	}
+	let templateUpdated = false;
 	if (!modified) {
 		logger.info(`[2/4] Template already has Retain on every resource — skipping UpdateStack.`);
 		await drainTemplateUploads(nestedCleanups, stateBucket, { what: "temporary nested-template upload" });
 	} else {
 		logger.info(`[2/4] Injected DeletionPolicy=Retain and UpdateReplacePolicy=Retain.`);
-		if (newBody.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified template is ${newBody.length} bytes, exceeds the CloudFormation UpdateStack TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has already been written; retire the stack manually with (1) shrink the template, then (2) UpdateStack with Retain policies, (3) DeleteStack — or split the stack and retry.`);
+		if (newBody.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified template is ${newBody.length} bytes, exceeds the CloudFormation UpdateStack TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has not been written; shrink or split the template and retry. ` + MANUAL_RETIREMENT_ROUTE);
 		let updateInput;
 		let s3Cleanup;
 		if (newBody.length <= TEMPLATE_BODY_LIMIT) updateInput = { TemplateBody: newBody };
@@ -4331,29 +4332,100 @@ async function retireCloudFormationStack(options) {
 				updateRan = true;
 			} catch (err) {
 				const msg = describeAwsFailure(err).detail;
-				if (/No updates are to be performed/i.test(msg)) logger.info(`  CloudFormation reports no updates needed — proceeding to delete.`);
-				else throw err;
+				if (/No updates are to be performed/i.test(msg)) logger.info(`  CloudFormation reports no updates needed.`);
+				else throw new RetainUpdateFailedError(cfnStackName, "rejected", err);
+			}
+			if (updateRan) {
+				try {
+					await waitUntilStackUpdateComplete({
+						client: cfnClient,
+						maxWaitTime: 1800,
+						minDelay: 5,
+						maxDelay: 10
+					}, { StackName: cfnStackName });
+				} catch (err) {
+					throw new RetainUpdateFailedError(cfnStackName, "unfinished", err);
+				}
+				templateUpdated = true;
 			}
-			if (updateRan) await waitUntilStackUpdateComplete({
-				client: cfnClient,
-				maxWaitTime: 1800,
-				minDelay: 5,
-				maxDelay: 10
-			}, { StackName: cfnStackName });
 		} finally {
 			await drainTemplateUploads([...s3Cleanup ? [s3Cleanup] : [], ...nestedCleanups], stateBucket, { what: "temporary template upload" });
 		}
 	}
+	return {
+		outcome: "ready",
+		templateUpdated
+	};
+}
+const SUPERSEDED_COPY_HINT = "If that update completes (now or later), CloudFormation may have replaced resources; each superseded copy is RETAINED and managed by neither CloudFormation nor cdkd. Find them in the stack's events: rows whose reason reads \"Requested update requires the creation of a new physical resource\" name the old physical id. A re-run does not report them, because the template then already carries the Retain policies and no update runs.";
+const MANUAL_RETIREMENT_ROUTE = "To retire the stack by hand: (1) UpdateStack with DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource, (2) `cdkd import` without --migrate-from-cloudformation (it reads the physical ids from a same-named CloudFormation stack), (3) DeleteStack. The import must adopt every resource before you delete the stack: check its summary.";
+function describeStackWaiterFailure(error) {
+	if (!(error instanceof Error)) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(error.message);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || !("state" in parsed)) return void 0;
+	const result = parsed;
+	const state = typeof result.state === "string" ? result.state : "FAILURE";
+	const reason = result.reason;
+	const stacks = typeof reason === "object" && reason !== null && "Stacks" in reason ? reason.Stacks : void 0;
+	const stack = Array.isArray(stacks) && typeof stacks[0] === "object" ? stacks[0] : void 0;
+	const status = typeof stack?.StackStatus === "string" ? stack.StackStatus : void 0;
+	const statusReason = typeof stack?.StackStatusReason === "string" ? stack.StackStatusReason : void 0;
+	return `waiter ${state}` + (status ? `, stack status ${status}` : typeof reason === "string" ? `: ${reason}` : "") + (statusReason ? ` (${statusReason})` : "");
+}
+function cfnFailureText(error) {
+	const waiter = describeStackWaiterFailure(error);
+	if (waiter !== void 0 && error instanceof Error) {
+		try {
+			Object.defineProperty(error, "message", {
+				value: waiter,
+				writable: true,
+				configurable: true,
+				enumerable: false
+			});
+			Object.defineProperty(error, "stack", {
+				value: `${error.name}: ${waiter}`,
+				writable: true,
+				configurable: true,
+				enumerable: false
+			});
+		} catch {}
+		return waiter;
+	}
+	const failure = describeAwsFailure(error);
+	if (failure.redacted) getLogger().debug(safeMsg`CloudFormation failure detail: ${failure.detail}`);
+	return failure.summary.replace(/\.+$/, "");
+}
+var RetainUpdateFailedError = class extends Error {
+	cause;
+	constructor(cfnStackName, kind, cause) {
+		const text = cfnFailureText(cause);
+		super(safeMsg`The Retain-policy UpdateStack on CloudFormation stack ${displaySafe(cfnStackName)} ` + (kind === "rejected" ? "was rejected" : "did not complete") + safeMsg`: ${text}. cdkd state has not been written. ` + (kind === "unfinished" ? `${SUPERSEDED_COPY_HINT} ` : "") + "Re-run the same command once the cause is fixed. When the cause is a replacement CloudFormation cannot perform (a custom-named resource whose update requires replacing it), the same update by hand fails too: give that resource no custom name or a new one, or take it out of the stack, then re-run. To retire the stack by hand: (1) UpdateStack with DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource, (2) `cdkd import` without --migrate-from-cloudformation (it reads the physical ids from a same-named CloudFormation stack), (3) DeleteStack. The import must adopt every resource before you delete the stack: check its summary.");
+		this.name = "RetainUpdateFailedError";
+		this.cause = cause;
+	}
+};
+async function deleteRetiredCloudFormationStack(cfnStackName, cfnClient) {
+	const logger = getLogger();
 	logger.info(`[4/4] Deleting CloudFormation stack '${cfnStackName}' (resources retained)...`);
-	await cfnClient.send(new DeleteStackCommand({ StackName: cfnStackName }));
-	await waitUntilStackDeleteComplete({
-		client: cfnClient,
-		maxWaitTime: 1800,
-		minDelay: 5,
-		maxDelay: 10
-	}, { StackName: cfnStackName });
+	try {
+		await cfnClient.send(new DeleteStackCommand({ StackName: cfnStackName }));
+		await waitUntilStackDeleteComplete({
+			client: cfnClient,
+			maxWaitTime: 1800,
+			minDelay: 5,
+			maxDelay: 10
+		}, { StackName: cfnStackName });
+	} catch (err) {
+		const error = /* @__PURE__ */ new Error(safeMsg`CloudFormation stack ${displaySafe(cfnStackName)} was NOT confirmed deleted: ` + safeMsg`${cfnFailureText(err)}. cdkd state is written and correct, and every resource ` + "carries DeletionPolicy=Retain, so deleting the stack deletes no resource. Delete the stack by hand once its cause is resolved (for example an export another stack still imports).");
+		error.cause = err;
+		throw error;
+	}
 	logger.info(`✓ CloudFormation stack '${cfnStackName}' retired. AWS resources are now solely managed by cdkd.`);
-	return { outcome: modified ? "retired" : "no-template-change" };
 }
 async function uploadTemplateForUpdateStack(args) {
 	return uploadCfnTemplate({
@@ -4457,7 +4529,7 @@ async function injectRetainPoliciesRecursiveInternal(templateBody, cfnStackName,
 		if (!childTpl.TemplateBody) throw new Error(`GetTemplate returned no body for nested stack '${logicalId}' (physicalId='${childNode.physicalId}', parent='${cfnStackName}').`);
 		const childResult = await injectRetainPoliciesRecursiveInternal(childTpl.TemplateBody, childNode.stackName, childNode, deps, cleanups);
 		if (childResult.modified) {
-			if (childResult.body.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified nested-stack template for '${logicalId}' is ${childResult.body.length} bytes, exceeds the CloudFormation TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has already been written for the root parent; retire the stack manually with (1) shrink the child template, then (2) UpdateStack with Retain policies on the parent and each child, (3) DeleteStack on the parent.`);
+			if (childResult.body.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified nested-stack template for '${logicalId}' is ${childResult.body.length} bytes, exceeds the CloudFormation TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has not been written; shrink the child template and retry, or retire the stack manually: (1) UpdateStack with Retain policies on the parent and each child, (2) cdkd import, (3) DeleteStack on the parent.`);
 			const uploaded = await uploadCfnTemplate({
 				bucket: deps.stateBucket,
 				body: childResult.body,
@@ -4507,8 +4579,25 @@ async function walkCfnStackTree(stackName, physicalId, cfnClient) {
 		nested
 	};
 }
+function findReplacedCfnResources(before, after, nestedPath = []) {
+	const replaced = [];
+	for (const [logicalId, beforeId] of before.resources) {
+		const afterId = after.resources.get(logicalId);
+		if (afterId !== void 0 && afterId !== beforeId) replaced.push({
+			nestedPath,
+			logicalId,
+			before: beforeId,
+			after: afterId
+		});
+	}
+	for (const [childLogicalId, beforeChild] of before.nested) {
+		const afterChild = after.nested.get(childLogicalId);
+		if (afterChild) replaced.push(...findReplacedCfnResources(beforeChild, afterChild, [...nestedPath, childLogicalId]));
+	}
+	return replaced;
+}
 async function confirmPrompt$6(prompt) {
-	return confirmOrRefuse(prompt, { refusal: "The CloudFormation stack retirement confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes on cdkd import --migrate-from-cloudformation. Alternatively, run it from a real terminal. NOTE cdkd state has already been written: the resources are recorded in cdkd state while the CloudFormation stack is still live, so re-run with -y / --yes (or retire the stack by hand) to finish the migration." });
+	return confirmOrRefuse(prompt, { refusal: "The CloudFormation stack retirement confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes on cdkd import --migrate-from-cloudformation. Alternatively, run it from a real terminal. Nothing has been written yet: cdkd state and the CloudFormation stack are unchanged, so re-running with -y / --yes is the whole recovery." });
 }
 async function tryGetCloudFormationResourceMap(stackName, cfnClient) {
 	const logger = getLogger();
@@ -4707,7 +4796,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 			region,
 			resources: {},
 			outputs: {},
-			version: 11,
+			version: 12,
 			lastModified: Date.now()
 		},
 		unreadable: [],
@@ -19031,7 +19120,7 @@ async function rollbackCommand(stackArg, options) {
 				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 				const next = () => ({
 					...carriedState,
-					version: 11,
+					version: 12,
 					region,
 					resources: { ...stateResources },
 					...orphansAfterRollback(baseState, mintedOrphans),
@@ -20656,46 +20745,54 @@ async function importCommand(stackArg, options) {
 			}
 		}));
 		try {
-			const rows = [];
-			for (const { logicalId, resource } of resources) {
-				if (selectiveMode && !overrides.has(logicalId)) {
-					rows.push({
+			const collectRows = async () => {
+				const collected = [];
+				for (const { logicalId, resource } of resources) {
+					if (selectiveMode && !overrides.has(logicalId)) {
+						collected.push({
+							logicalId,
+							resourceType: resource.Type,
+							outcome: "skipped-out-of-scope",
+							reason: "not in --resource / --resource-mapping (use --auto to include)"
+						});
+						continue;
+					}
+					if (resource.Type === "AWS::CloudFormation::Stack" && migrationTree && migrationTree.nested.has(logicalId) && accountIdForNestedSynth) {
+						collected.push({
+							logicalId,
+							resourceType: resource.Type,
+							outcome: "imported",
+							physicalId: synthesizeNestedStackArn(targetRegion, accountIdForNestedSynth, stackInfo.stackName, logicalId)
+						});
+						continue;
+					}
+					const outcome = await importOne({
 						logicalId,
-						resourceType: resource.Type,
-						outcome: "skipped-out-of-scope",
-						reason: "not in --resource / --resource-mapping (use --auto to include)"
+						resource,
+						stackName: stackInfo.stackName,
+						region: targetRegion,
+						providerRegistry,
+						override: overrides.get(logicalId),
+						overrides
 					});
-					continue;
+					collected.push(outcome);
 				}
-				if (resource.Type === "AWS::CloudFormation::Stack" && migrationTree && migrationTree.nested.has(logicalId) && accountIdForNestedSynth) {
-					rows.push({
-						logicalId,
-						resourceType: resource.Type,
-						outcome: "imported",
-						physicalId: synthesizeNestedStackArn(targetRegion, accountIdForNestedSynth, stackInfo.stackName, logicalId)
-					});
-					continue;
-				}
-				const outcome = await importOne({
-					logicalId,
-					resource,
-					stackName: stackInfo.stackName,
-					region: targetRegion,
-					providerRegistry,
-					override: overrides.get(logicalId),
-					overrides
-				});
-				rows.push(outcome);
-			}
+				return collected;
+			};
+			let rows = await collectRows();
 			printSummary(rows);
 			if (options.recordResourceMapping) writeRecordedMapping(options.recordResourceMapping, rows);
-			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
-			refuseMalformedResourceEntriesForImportSave(stackState, stackInfo.stackName, targetRegion, lockRecovery);
+			const assembleStackState = () => {
+				const assembled = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
+				refuseMalformedResourceEntriesForImportSave(assembled, stackInfo.stackName, targetRegion, lockRecovery);
+				return assembled;
+			};
+			let stackState = assembleStackState();
 			if (options.dryRun) {
 				logger.info("--dry-run: state will NOT be written. Re-run without --dry-run to apply.");
 				return;
 			}
-			const importedRows = rows.filter((r) => r.outcome === "imported");
+			let importedRows = rows.filter((r) => r.outcome === "imported");
 			if (importedRows.length === 0) {
 				logger.warn("No resources were successfully imported. State will not be written.");
 				return;
@@ -20710,8 +20807,54 @@ async function importCommand(stackArg, options) {
 					return;
 				}
 			}
+			let retireCfnStack = false;
+			let nestedReplaced = [];
+			if (migrationCfnStackName) {
+				warnMigrationOrphans(logger, resources.length, importedRows.length);
+				const preparation = await prepareCloudFormationStackRetirement({
+					cfnStackName: migrationCfnStackName,
+					cfnClient: regionClients.cloudFormation,
+					yes: options.yes,
+					stateBucket,
+					...options.profile && { s3ClientOpts: { profile: options.profile } },
+					...migrationTree && { resourceTree: migrationTree }
+				});
+				retireCfnStack = preparation.outcome === "ready";
+				if (preparation.outcome === "ready" && preparation.templateUpdated && migrationTree) {
+					let updatedTree;
+					try {
+						updatedTree = await getCloudFormationResourceTree(migrationCfnStackName, regionClients.cloudFormation);
+					} catch (err) {
+						throw new Error(safeMsg`--migrate-from-cloudformation: the Retain-policy update completed, but ` + safeMsg`re-reading the stack's resources failed: ${cfnFailureText(err)}. ` + `cdkd state was not written and the CloudFormation stack was not deleted. ` + SUPERSEDED_COPY_HINT);
+					}
+					const replaced = findReplacedCfnResources(migrationTree, updatedTree).filter((r) => r.nestedPath.length > 0 || templateLogicalIds.has(r.logicalId) && template.Resources[r.logicalId]?.Type !== "AWS::CloudFormation::Stack");
+					migrationTree = updatedTree;
+					nestedReplaced = replaced.filter((r) => r.nestedPath.length > 0);
+					for (const r of replaced) {
+						const where = r.nestedPath.length > 0 ? safeMsg`nested stack ${r.nestedPath.map((p) => logicalIdShown(p)).join(" > ")}: ` : "";
+						const pinned = r.nestedPath.length === 0 && overrides.has(r.logicalId) && overrides.get(r.logicalId) !== r.before;
+						if (r.nestedPath.length === 0 && overrides.get(r.logicalId) === r.before) overrides.set(r.logicalId, r.after);
+						logger.warn(safeMsg`CloudFormation replaced ${where}${logicalIdShown(r.logicalId)} while applying ` + safeMsg`the Retain policies: the stack now holds ${displaySafe(r.after)}` + (pinned ? safeMsg`; cdkd keeps the physical id you passed with --resource, so ${displaySafe(r.after)} ` + `(kept by DeletionPolicy=Retain) is managed by neither CloudFormation nor cdkd either. ` : `, which cdkd adopts. `) + safeMsg`The replaced ${displaySafe(r.before)} is RETAINED and managed by neither ` + `CloudFormation nor cdkd; delete it yourself once you no longer need it.`);
+					}
+					if (replaced.some((r) => r.nestedPath.length === 0)) {
+						rows = await collectRows();
+						printSummary(rows);
+						stackState = assembleStackState();
+						const adoptedBefore = importedRows.map((r) => r.logicalId);
+						importedRows = rows.filter((r) => r.outcome === "imported");
+						const adoptedNow = new Set(importedRows.map((r) => r.logicalId));
+						if (options.recordResourceMapping) writeRecordedMapping(options.recordResourceMapping, rows);
+						refuseLostReplacedRows(adoptedBefore.filter((id) => !adoptedNow.has(id)), "cdkd state was not written and the CloudFormation stack was not deleted.");
+						if (importedRows.length !== adoptedBefore.length) {
+							logger.warn(safeMsg`--migrate-from-cloudformation: the re-import after the replacement adopts ` + safeMsg`${importedRows.length} resource(s); ${adoptedBefore.length} were confirmed.`);
+							warnMigrationOrphans(logger, resources.length, importedRows.length);
+						}
+					}
+				}
+			}
 			const deployedParameters = !namesAnyDeclaredParameter(stateTemplate) ? void 0 : migrationCfnStackName !== void 0 ? await readDeployedParameters(migrationCfnStackName, regionClients.cloudFormation, logger, displaySafe(migrationCfnStackName)) : await readDeployedParameters(stackInfo.stackName, regionClients.cloudFormation, logger, displaySafe(stackInfo.stackName), { absentStackIsNoSource: true });
-			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger, deployedParameters)), rebuiltLogicalIdsFrom(rows, stateTemplate));
+			const unsafeObservedBaselineLogicalIds = await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger, deployedParameters));
+			await captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds, rebuiltLogicalIdsFrom(rows, stateTemplate));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
@@ -20726,6 +20869,8 @@ async function importCommand(stackArg, options) {
 				parentRegion: targetRegion,
 				parentNestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
 				parentTree: migrationTree,
+				nestedPath: [],
+				replaced: nestedReplaced,
 				stateBackend,
 				lockManager,
 				providerRegistry,
@@ -20736,18 +20881,7 @@ async function importCommand(stackArg, options) {
 				assetRedirect,
 				cfnClient: regionClients.cloudFormation
 			});
-			if (migrationCfnStackName) {
-				const orphaned = resources.length - importedRows.length;
-				if (orphaned > 0) logger.warn(`--migrate-from-cloudformation: ${orphaned} of ${resources.length} template resource(s) were NOT imported into cdkd. After the CloudFormation stack is retired, those resources remain in AWS but are unmanaged by both CloudFormation and cdkd.`);
-				await retireCloudFormationStack({
-					cfnStackName: migrationCfnStackName,
-					cfnClient: regionClients.cloudFormation,
-					yes: options.yes,
-					stateBucket,
-					...options.profile && { s3ClientOpts: { profile: options.profile } },
-					...migrationTree && { resourceTree: migrationTree }
-				});
-			}
+			if (migrationCfnStackName && retireCfnStack) await deleteRetiredCloudFormationStack(migrationCfnStackName, regionClients.cloudFormation);
 		} finally {
 			await lockManager.releaseLock(stackInfo.stackName, targetRegion).catch((err) => {
 				logger.warn(`Failed to release lock: ${describeAwsFailure(err).detail}`);
@@ -21178,12 +21312,13 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 	}
 	if (namesParameter?.failedClosed !== void 0) getLogger().debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every prior observed-baseline refusal recorded without a reason is carried as an unverifiable-parameter refusal.`);
 	return {
-		version: 11,
+		version: 12,
 		stackName,
 		region,
 		resources,
 		outputs: existingState?.outputs ?? {},
 		...existingState ? exportNamesCarriedFrom(existingState) : { exportNames: [] },
+		...existingState?.outputReferenceProvenance !== void 0 && { outputReferenceProvenance: existingState.outputReferenceProvenance },
 		...existingState ? orphansCarriedFrom(existingState) : {},
 		lastModified: Date.now()
 	};
@@ -21462,6 +21597,15 @@ function resolveDiscardsNonInertSubtree(node, conditions, mappings) {
 	}
 	return keys.some((key) => resolveDiscardsNonInertSubtree(record[key], conditions, mappings));
 }
+function warnMigrationOrphans(logger, total, imported, where) {
+	const orphaned = total - imported;
+	if (orphaned <= 0) return;
+	logger.warn(`--migrate-from-cloudformation: ${orphaned} of ${total} template resource(s)${where ? safeMsg` in ${where}` : ""} were NOT imported into cdkd. After the CloudFormation stack is retired, those resources remain in AWS but are unmanaged by both CloudFormation and cdkd.`);
+}
+function refuseLostReplacedRows(lost, written) {
+	if (lost.length === 0) return;
+	throw new Error(safeMsg`--migrate-from-cloudformation: after CloudFormation replaced resources, ` + safeMsg`${lost.map((id) => logicalIdShown(id)).join(", ")} could no longer be imported. ` + `${written} Re-run the same command once the new resource is readable: the re-run runs no update, so it cannot tell the resource was replaced, and a resource it still cannot import is left managed by neither tool after the stack is retired.`);
+}
 function printSummary(rows) {
 	const logger = getLogger();
 	const counts = {
@@ -21495,7 +21639,7 @@ async function confirmPrompt(prompt) {
 	return confirmOrRefuse(prompt, { refusal: "The cdkd import confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the state write, or run the command from a real terminal." });
 }
 function createImportCommand() {
-	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource, resolving each physical id from the template's physical-name property and then from a same-named CloudFormation stack's DescribeStackResources. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to auto-resolve the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also auto-resolve everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / auto-resolution), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the auto-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO auto-resolve every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "After cdkd state is written, retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(importCommand));
+	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource, resolving each physical id from the template's physical-name property and then from a same-named CloudFormation stack's DescribeStackResources. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to auto-resolve the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also auto-resolve everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / auto-resolution), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the auto-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO auto-resolve every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "Retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, write cdkd state from the physical IDs the stack holds after that update, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(importCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -21617,6 +21761,10 @@ async function importNestedStackChildrenRecursive(args) {
 				});
 				rows.push(outcome);
 			}
+			const childPath = [...args.nestedPath, childLogicalId];
+			const childImported = new Set(rows.filter((r) => r.outcome === "imported").map((r) => r.logicalId));
+			refuseLostReplacedRows(args.replaced.filter((r) => r.nestedPath.length === childPath.length && r.nestedPath.every((p, i) => p === childPath[i]) && childTemplateLogicalIds.has(r.logicalId) && !childImported.has(r.logicalId)).map((r) => r.logicalId), safeMsg`cdkd state for nested stack ${displaySafe(childStackName)} was not written ` + "(the parent's and earlier nested stacks' were), and the CloudFormation stack was not deleted; the re-run needs --force.");
+			warnMigrationOrphans(logger, childResources.length, childImported.size, childStackName);
 			const childStackState = buildStackState(childStackName, childRegion, rows, templateParser, childStateTemplate, null, false);
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
@@ -21632,6 +21780,8 @@ async function importNestedStackChildrenRecursive(args) {
 				parentRegion: childRegion,
 				parentNestedTemplates: indexGrandchildTemplatePaths(childStateTemplate, childTemplatePath),
 				parentTree: childTreeNode,
+				nestedPath: [...args.nestedPath, childLogicalId],
+				replaced: args.replaced,
 				stateBackend,
 				lockManager,
 				providerRegistry,
@@ -21681,12 +21831,24 @@ function constructPathField(path) {
 }
 
 //#endregion
-//#region src/cli/commands/local-aws-failure.ts
+//#region src/utils/local-aws-failure.ts
 function describeLocalAwsFailureForWarn(err, operation) {
-	if (err instanceof CdkdError) return displaySafe(err.message);
+	if (err instanceof CdkdError) return withoutTrailingPeriod(displaySafe(err.message));
 	const rendered = describeAwsFailureForWarn(err, operation);
 	if (rendered === describeCredentialLoadFailure(err)) getLogger().debug(safeMsg`${operation}: the AWS SDK's own failure message was: ${thrownText(err)}`);
-	return displaySafe(rendered);
+	return withoutTrailingPeriod(displaySafe(rendered));
+}
+function withoutTrailingPeriod(text) {
+	return text.endsWith(".") && !text.endsWith("..") ? text.slice(0, -1) : text;
+}
+function redactedAwsCause(err, message) {
+	if (!(err instanceof Error)) return void 0;
+	let source = err;
+	if (err instanceof CdkdError) for (let depth = 0; depth < 3 && source.cause instanceof Error && !hasSdkMetadata(source); depth++) source = source.cause;
+	return redactedCause(source, message);
+}
+function hasSdkMetadata(error) {
+	return error.$metadata !== void 0;
 }
 function thrownText(err) {
 	try {
@@ -21707,7 +21869,7 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
 	} catch (err) {
-		logger.warn(`${prefix}: could not resolve state bucket: ${err instanceof Error ? err.message : String(err)}. Falling back.`);
+		logger.warn(`${prefix}: could not resolve state bucket: ${describeLocalAwsFailureForWarn(err, "state bucket resolution")}. Falling back.`);
 		return;
 	}
 	const awsClients = new AwsClients({
@@ -21724,7 +21886,11 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
 		});
-		await stateBackend.verifyBucketExists();
+		try {
+			await stateBackend.verifyBucketExists();
+		} catch (err) {
+			throw new StateError(`${prefix}: could not access state bucket ${displayIdent(stateBucket)}: ${describeStateBucketAccessFailure(err)}.`, redactedAwsCause(err, "S3 HeadBucket (state bucket) failed"));
+		}
 		const refs = (await stateBackend.listStacks()).filter((r) => r.stackName === stackName);
 		if (refs.length === 0) {
 			logger.warn(`${prefix}: no cdkd state found for stack '${stackName}' in bucket '${stateBucket}'. Was it deployed via 'cdkd deploy'? Falling back.`);
@@ -21827,7 +21993,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, canonicalizeRegion(consumerRegion));
 	} catch (err) {
-		logger.warn(`${prefix}: cross-stack resolver could not resolve state bucket: ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
+		logger.warn(`${prefix}: cross-stack resolver could not resolve state bucket: ${describeLocalAwsFailureForWarn(err, "state bucket resolution")}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
 	const clientRegion = canonicalizeRegion(opts.region) || void 0;
@@ -21847,7 +22013,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		await stateBackend.verifyBucketExists();
 	} catch (err) {
 		awsClients.destroy();
-		logger.warn(`${prefix}: cross-stack resolver could not access state bucket '${stateBucket}': ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
+		logger.warn(`${prefix}: cross-stack resolver could not access state bucket ${displayIdent(stateBucket)}: ${describeStateBucketAccessFailure(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
 	const exportIndex = new ExportIndexStore(awsClients.s3, stateBucket, opts.statePrefix, consumerRegion, stateBackend, { profile: opts.profile });
@@ -21943,6 +22109,15 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		}
 	};
 }
+function describeStateBucketAccessFailure(err) {
+	const operation = "S3 HeadBucket (state bucket)";
+	if (!(err instanceof CdkdError) || err.cause === void 0) return describeLocalAwsFailureForWarn(err, operation);
+	const cause = err.cause;
+	if (cause.name === "NotFound" || cause.name === "NoSuchBucket") return describeLocalAwsFailureForWarn(err, operation);
+	const inner = cause.cause;
+	if (!(cause instanceof CdkdError) && inner instanceof Error && (inner.name === "Unknown" || inner.message === "UnknownError")) return describeLocalAwsFailureForWarn(new CdkdError(cause.message, "STATE_ERROR"), operation);
+	return describeLocalAwsFailureForWarn(cause, operation);
+}
 
 //#endregion
 //#region src/local/s3-local-state-provider.ts
@@ -23611,6 +23786,10 @@ async function pullEcrImage(imageUri, options) {
 			if (!identity.Account) throw new LocalInvokeBuildError$1("STS GetCallerIdentity returned no Account. Verify your AWS credentials.");
 			callerAccount = identity.Account;
 			CALLER_IDENTITY_CACHE.set(callerIdentityKey, callerAccount);
+		} catch (err) {
+			if (err instanceof LocalInvokeBuildError$1) throw err;
+			const rendered = describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity (ECR pull)");
+			throw new LocalInvokeBuildError$1(`STS GetCallerIdentity failed while preparing the ECR pull: ${rendered}. Verify your AWS credentials.`, redactedAwsCause(err, "STS GetCallerIdentity failed"));
 		} finally {
 			sts.destroy();
 		}
@@ -23681,8 +23860,8 @@ async function assumeRoleForEcr(roleArn, callerRegion, credentialConfig, logger)
 		};
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
-		const reason = err instanceof Error ? err.message : String(err);
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`, err instanceof Error ? err : void 0);
+		const rendered = describeLocalAwsFailureForWarn(err, "STS AssumeRole (ECR pull)");
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull: ${rendered}. Verify the role exists and its trust policy permits the caller's identity to assume it.`, redactedAwsCause(err, "STS AssumeRole failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -23690,7 +23869,14 @@ async function assumeRoleForEcr(roleArn, callerRegion, credentialConfig, logger)
 async function ecrLogin(client, target) {
 	const { accountId, region, registryHost } = target;
 	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
-	const authData = (await client.send(new GetAuthorizationTokenCommand({}))).authorizationData?.[0];
+	let response;
+	try {
+		response = await client.send(new GetAuthorizationTokenCommand({}));
+	} catch (err) {
+		const rendered = describeLocalAwsFailureForWarn(err, "ECR GetAuthorizationToken");
+		throw new LocalInvokeBuildError$1(`ECR GetAuthorizationToken failed (account=${displayIdent(accountId)}, region=${displayIdent(region)}): ${rendered}. Verify the credentials can call ecr:GetAuthorizationToken.`, redactedAwsCause(err, "ECR GetAuthorizationToken failed"));
+	}
+	const authData = response.authorizationData?.[0];
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError$1("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
@@ -25515,19 +25701,21 @@ async function resolveProfileCredentials(profile) {
 		}),
 		profile
 	});
+	const shownProfile = displayIdent(profile);
+	const ssoHint = isPasteableIdent(profile) ? "run `aws sso login --profile " + profile + "`" : "run `aws sso login` for that profile -- cdkd is not writing the command out, because it cannot vouch that the name as rendered is the one your shell would act on";
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
-			const shownProfile = displayIdent(profile);
-			const ssoHint = isPasteableIdent(profile) ? "run `aws sso login --profile " + profile + "`" : "run `aws sso login` for that profile -- cdkd is not writing the command out, because it cannot vouch that the name as rendered is the one your shell would act on";
-			throw new Error(`--profile ${shownProfile}: credential provider chain resolved without usable credentials. For SSO profiles, ${ssoHint}. For regular profiles, check \`~/.aws/credentials\` / \`~/.aws/config\`.`);
-		}
+		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) throw new CdkdError(`--profile ${shownProfile}: credential provider chain resolved without usable credentials. For SSO profiles, ${ssoHint}. For regular profiles, check \`~/.aws/credentials\` / \`~/.aws/config\`.`, "LOCAL_PROFILE_CREDENTIALS_UNUSABLE");
 		return {
 			accessKeyId: creds.accessKeyId,
 			secretAccessKey: creds.secretAccessKey,
 			...creds.sessionToken && { sessionToken: creds.sessionToken }
 		};
+	} catch (err) {
+		if (err instanceof CdkdError) throw err;
+		const rendered = describeLocalAwsFailureForWarn(err, "--profile credential resolution");
+		throw new CdkdError(`--profile ${shownProfile}: could not resolve the profile's credentials: ${rendered}. For SSO profiles, ${ssoHint}.`, "LOCAL_PROFILE_CREDENTIALS_FAILED", redactedAwsCause(err, "credential resolution failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -25549,12 +25737,16 @@ async function assumeLambdaExecutionRole$1(roleArn, region) {
 			RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`, "LOCAL_START_API_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
 			sessionToken: creds.SessionToken
 		};
+	} catch (err) {
+		if (err instanceof CdkdError) throw err;
+		const rendered = describeLocalAwsFailureForWarn(err, "STS AssumeRole");
+		throw new CdkdError(`--assume-role: STS AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) failed: ${rendered}.`, "LOCAL_START_API_ASSUMEROLE_FAILED", redactedAwsCause(err, "STS AssumeRole failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -25979,7 +26171,7 @@ async function resolveSecretsManager(entry, shape, client) {
 	try {
 		secretString = (await client.send(new GetSecretValueCommand({ SecretId: shape.baseArn }))).SecretString;
 	} catch (err) {
-		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${describeLocalAwsFailureForWarn(err, "SecretsManager GetSecretValue")}.`);
 	}
 	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}). Binary secrets are not supported.`);
 	if (shape.jsonKey === void 0) return secretString;
@@ -26005,7 +26197,7 @@ async function resolveSsm(entry, shape, client) {
 		return value;
 	} catch (err) {
 		if (err instanceof EcsSecretsResolutionError) throw err;
-		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${describeLocalAwsFailureForWarn(err, "SSM GetParameter")}.`);
 	}
 }
 
@@ -26881,8 +27073,12 @@ async function resolvePlaceholderAccount(arn, source) {
 	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${plainIdentOr(arn, VALUE_NOT_SHOWN, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role '<arn>'`);
+		if (!account) throw new CdkdError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${plainIdentOr(arn, VALUE_NOT_SHOWN, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role '<arn>'`, "LOCAL_RUN_TASK_PLACEHOLDER_NO_ACCOUNT");
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
+	} catch (err) {
+		if (err instanceof CdkdError) throw err;
+		const rendered = describeLocalAwsFailureForWarn(err, "STS GetCallerIdentity");
+		throw new CdkdError(`--assume-task-role: STS GetCallerIdentity failed while resolving the task role's account: ${rendered}.`, "LOCAL_RUN_TASK_GET_CALLER_IDENTITY_FAILED", redactedAwsCause(err, "STS GetCallerIdentity failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -26900,12 +27096,16 @@ async function assumeTaskRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-run-task-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`, "LOCAL_RUN_TASK_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
 			sessionToken: creds.SessionToken
 		};
+	} catch (err) {
+		if (err instanceof CdkdError) throw err;
+		const rendered = describeLocalAwsFailureForWarn(err, "STS AssumeRole");
+		throw new CdkdError(`--assume-task-role: STS AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) failed: ${rendered}.`, "LOCAL_RUN_TASK_ASSUMEROLE_FAILED", redactedAwsCause(err, "STS AssumeRole failed"));
 	} finally {
 		sts.destroy();
 	}
@@ -29143,4 +29343,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-BgDt3OZh.js.map
+//# sourceMappingURL=program-BgsCaZFy.js.map