@go-to-k/cdkd 0.298.8 → 0.299.1

package/dist/{program-MMwB_CTT.js → program-w-kAH85e.js}

@@ -1,9 +1,9 @@
-import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
+import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-Bj7qH5Ph.js";
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, xn as StateError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
-import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $a as isStatefulRecreateTargetForReplace, $c as stateBucketExistenceConfirmed, $i as malformedOrphansRefusalMessage, $n as ledgerForStack, $o as markSameGenerationBag, $r as sendableAssumeRoleCommand, $s as AssetPublisher, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcesForDeploy, Ac as redactDockerArgvValues, Ai as declaresNoEcho, An as journaledOrphanPrintingBag, Ao as maskWholeValue, Ar as deleteIndeterminateGuards, As as LockManager, At as dropFailedHint, Ba as unpreviewableOrphanRecords, Bc as getDockerImageBySourceHash, Bi as hasReadableOutputs, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as carryLogOnlyValues, Bs as splitImportedOps, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForImport, Cc as dockerSpawnEnvWithSensitive, Ci as cfnRefValueFromPhysicalId, Cl as displayAssemblyPath, Cn as collectDeclaredOutputNames, Cr as applyCustomResourceResponseExpiration, Cs as wholeStringLeavesOf, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDrift, Dc as isDockerClientEnvKey, Di as withSharedDrainBudget, Dl as injectedAwsRegionValue, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as isMarkedCoordinate, Ds as TEMPLATE_SOURCED_RULES, E as serviceTokenBlockingReason, Ea as refuseMalformedResourcePropertiesForDestroy, Ec as getDockerCmd, El as injectAwsRegion, En as bindingSkippedOutputs, Eo as canonicalCoordinates, Er as slowCcOperationTimeoutMs, Es as STATE_SOURCED_READBACK_RULES, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphansForReadOnly, Fc as warnFinchArgvExposure, Fi as UNREADABLE_RESOURCES_MAP_ROW, Fn as secretNamedRecordNeedles, Fs as CrossPrefixScanCache, Ft as sameJournaledOrphans, Gc as loadCdkJson, Gi as malformedExportNamesWarning, Gn as isFinalSnapshotError, Go as printingCorpusOf, Gr as poisonRenderedSpellingsCollidingIn, Gs as hasReasonlessBaselineRefusal, Gt as isJournaledOrphan, Ha as unreadableResourceEntries, Hc as synthesisStatusMessage, Hi as isReadableOrphanRecord, Hn as ccRoutedFinalSnapshotError, Ho as hasMaskableValues, Hr as DiffCalculator, Hs as describeRegionValueKind, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOutputsForReadOnly, Ic as escapeRegExp, Ii as accountArgs, In as stateSecretNameNeedles, Io as readbackPathFor, Is as applyCrossPrefixScan, It as replayFailedOperations, Ja as NO_CC_HANDLERS_REASON, Jc as resolveCaptureObservedState, Ji as malformedLocalResourceEntriesWarning, Jn as maskingRetryLogger, Jo as shareLogOnlyValues, Jr as applyRoleArnIfSet, Js as importableOutputs, Jt as planRollback, Ka as unwrittenCreateOnlyReplacement, Kc as resolveApp, Ki as malformedExportSourceWarning, Kn as refusesFinalSnapshot, Ko as recordLogOnlyParameterValue, Kr as producerLookupOver, Ks as hasUnverifiableParameterRefusal, Kt as isReplacementOrphan, L as perType, La as repairMalformedResourceEntriesForReadOnly, Lc as stripControlChars, Li as deployRefusesOrphanRowsReason, Ln as storedSecretNameNeedles, Lo as readsNoEchoSource, Ls as crossPrefixDeniedWarning, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForExport, Mc as redactedDockerCause, Mi as STATE_REGION_DIVERGED, Mn as orphanRecordsPrintingBag, Mo as noEchoCoordinatesOf, Mr as deleteSkipReason, Ms as S3StateBackend, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedState, Nc as runDockerForeground, Ni as STATE_RESOURCES_MALFORMED, Nn as secretNamePrintingBag, No as noEchoLeavesOf, Ns as rebuildClientForBucketRegion, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForExport, Oc as isMalformedEnvKey, Oi as parameterInputsFor, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as maskAtCoordinates, Or as RollbackInlinePolicyWriters, Os as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as repairMalformedOrphanRecordsForReadOnly, Pc as runDockerStreaming, Pi as UNREADABLE_ORPHANS_CONTAINER_ROW, Pn as secretNamePrintingBags, Po as noEchoOutputsComparison, Pr as isWaitAbandonedError, Ps as CrossPrefixReadError, Pt as makeForeignHolderScan, Qa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Qc as resolveUseCdkBootstrapAssets, Qi as malformedOrphanRowsKeptWarning, Qo as maskSecretsInText, Qr as isIamRoleArn, Qs as shouldRetainResource, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourcePropertiesForReadOnly, Rc as stripForDisplay, Ri as displayLogicalId, Rn as extractDeploymentEventError, Ro as valueAtCoordinate, Rs as isAccessDenied, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDestroy, Sc as describeDockerFailure, Si as AWS_NO_VALUE, Sl as describeFileReadFailure, Sn as noEchoParameterValueSeed, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as recordProvenPublicExpression, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForOrphan, Tc as formatDockerLoginError, Ti as refStateLookupFromResource, Tl as resolveAssemblyPath, Tn as isExportAliasCollision, To as TemplateParser, Tr as CloudControlProvider, Ts as STATE_SOURCED_CROSS_GENERATION_RULES, Tt as withNestedRevertRun, Ua as withheldAccountClause, Uc as getDefaultStateBucketName, Ui as isReadableResourceEntry, Un as createPreDeleteFinalSnapshot, Uo as literalSplitDelimitersOf, Ur as INTRINSIC_KEYS, Us as exportNamesCarriedFrom, Ut as recordAfterRollbackUpdate, Va as unreadableOrphanRecords, Vc as Synthesizer, Vi as hasReadableResources, Vn as buildFinalSnapshotIdentifier, Vo as createUnionSecretMasker, Vs as acceptedCreateOnlyDropsOf, Vt as withStackRecords, Wa as findActionableSilentDrops, Wc as getLegacyStateBucketName, Wi as malformedDriftResourcePropertiesWarning, Wn as effectiveDeletionPolicy, Wo as logOnlyValueCount, Wr as IntrinsicFunctionResolver, Ws as hasReadableExportSet, Wt as demoteSupersededOrphans, Xa as findReplacedReadersOfRecreateTargets, Xc as resolveStateBucketWithDefault, Xi as malformedOrphanRecordsRefusalMessage, Xn as findDestructiveChanges, Xo as errorCauseChain, Xr as assertSendableRoleArn, Xs as orphansAfterRollback, Xt as recordUnderIdIsNotOwn, Ya as hasNoCloudControlHandlers, Yc as resolveSkipPrefix, Yi as malformedLocalResourcesWarning, Yn as constructPathOf, Yo as createSecretMasker, Yr as assertFlagRoleArn, Ys as isReadableBag, Yt as recheckFailedPlan, Za as shownType, Zc as resolveStateBucketWithDefaultAndSource, Zi as malformedOrphanRecordsWarning, Zn as formatDestructiveChange, Zo as maskSecretsInError, Zr as explicitRoleArnOrThrow, Zs as orphansCarriedFrom, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOutputs, _c as buildDenyExternalAccessPolicy, _i as isImpossibleEmptyStoredAttribute, _l as hasOwnKey, _n as secretSafeKeyDisplay, _o as prefetchCreateOnlyPropertyPaths, _r as TemplateNoEchoReresolver, _s as provenPublicValue, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourcePropertiesWarning, ac as loadPublishableAssetManifest, al as findLargeInlineResources, as as dynamicReferenceTokens, at as cyan, ba as refuseMalformedResourceEntries, bc as describeDockerCapturedOutput, bi as isNamelessDynamicReferenceError, bl as ownValue, bn as exportNameSecretExposure, bo as withRetry, bs as recordNoEchoAttributeValues, c as renderNestedTemplateTreeDefect, ca as malformedStateRefusalMessage, cc as BOOTSTRAP_MARKER_PREFIX, cl as decodeListingKey, cn as updatePartialMessage, cs as identityKeyFor, ct as red, d as conditionInputsFrom, dc as getBootstrapMarkerKey, di as producerRegionsFromState, dl as canonicalizeRegion, dn as DeploymentEventsStore, dt as namesAnyDeclaredParameter, ea as malformedOrphansWarning, ec as isSensitiveAttributeName, ei as AWS_CREDENTIAL_ENV_KEYS, el as warnDeprecatedNoPrefixCliFlag, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetSync, es as redactSecretsForState, f as parentSuppliedValues, fa as refuseMalformedOrphanRecords, fc as isCrossRegionRedirect, fi as regionLessSecretName, fl as derivePartitionAndUrlSuffix, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as physicalNameCopiesOf, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForOrphan, gc as validateContainerRepoName, gi as getAccountInfo, gl as defineOwnKey, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as carriesSecretMask, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphansForDestroy, hc as validateAssetBucketName, hi as parameterTypeMayLoseSecretIdentity, hl as processStackMessages, hn as secretBearing, hr as isCustomResource, hs as splitGetAttStringForm, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedResourceEntriesWarning, ic as createAssetRedirectResolver, il as MIGRATE_TMP_PREFIX, is as DYNAMIC_REFERENCE_TOKEN_SCAN, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDestroy, jc as redactedCause, ji as JSON_LISTING_HOLE_VALUE, jn as maskEventTextWithBoundBags, jo as maskedLeafCoordinatesOf, jr as deleteLeftInPlace, js as isLockInfoExpired, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForOrphan, kc as partitionSensitiveEnv, kl as resolveBucketRegion, kn as completedReplayEntries, ko as maskReadbackAtCoordinates, kr as UNSPECIFIED_SKIP_REASON, ks as isSingleDynamicReferenceToken, kt as deleteJournaledOrphans, l as templateIdentity, la as previewableOrphanRecords, lc as assertAssetBucketRegion, ll as expectedOwnerParam, ln as updatePartialReason, ls as inheritNestedStackParameterAssociations, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphans, mc as readBootstrapMarkerBody, mi as isUnboundTemplateParameter, ml as StageLoadError, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as recordPhysicalNameCopy, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsWarning, nc as WorkGraph, ni as callerEnvCredentials, nl as CFN_TEMPLATE_BODY_LIMIT, ns as withPhysicalNameCopies, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcesWarning, oc as rewriteTemplateAssetReferences, ol as uploadCfnTemplate, os as isUncertifiedBaselineMaskPosition, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecordsForDestroy, pc as parseBootstrapMarker, pi as coerceParameterTypedValue, pl as AssemblyReader, pn as displayTextOrWithheld, pr as ProviderRegistry, pt as resourcesNamingDeclaredParameter, qc as resolveAutoAssetStorage, qi as malformedLocalOutputsWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyValue, qr as refuseUnreadableCdkCrossAccountRefs, qs as importableOutputKeys, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedRenderedContainersWarning, rc as buildAssetRedirectMap, ri as envCredentialsAreAssumedRole, rl as CFN_TEMPLATE_URL_LIMIT, rn as inheritProducerRegions, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedScrubResourceEntriesRefusalMessage, sc as AssetModeResolver, sl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ss as pathCrossesDottedKey, st as green, t as DeployEngine, ta as malformedOutputsRefusalMessage, tc as stringifyValue, ti as applyCallerIdentityCredentials, tl as ssmResolvedValueType, tn as findNestedStackTypeChanges, to as renderStatefulReason, tr as withCreateTokenLedger, ts as scrubResourceRecord, u as conditionFingerprint, ua as refuseDivergentRecordRegionForDestroy, uc as ensureAssetStorage, ui as classifyReplaySecretRegion, ul as PARTITION_TABLE, un as DeploymentEventsReader, us as recordNestedStackParameterExpressions, ut as computeParameterTaint, va as refuseMalformedOutputsForDestroy, vc as buildDockerImage, vi as carriesDynamicReference, vl as hasPlainPrototype, vn as carriedExportAliasExposure, vo as templateResourceTypes, vr as readsNoEchoDeleteValues, vs as recordMaskOnlyValue, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImportSave, wc as finchSecretArgvRefusal, wi as isStalePlaceholderArnAttribute, wl as renderAssemblyPathEscape, wn as collectPublishedOutputNames, wo as DagBuilder, wr as customResourceResponseExpirationWarning, ws as STATE_SOURCED_BASELINE_RULES, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntriesForDeploy, xc as describeDockerExecFailure, xi as keepsSecretReferenceToken, xl as absoluteAssemblyPathEscape, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordNoEchoParameterFreshValue, xt as nestedChildStackName$1, ya as refuseMalformedResourceAttributesForOrphan, yc as resolveDockerContextDirectory, yi as carriesFetchableDynamicReference, yl as nullPrototypeRecord, yn as exportNameNoEchoParameters, yo as describeTypeWithThrottleRetry, yr as isCustomResourceType$1, ys as recordMaskOnlyValuesIn, yt as dropSettledNestedJournals, za as repairMalformedResourcesForReadOnly, zc as AssetManifestLoader, zi as hasReadableOrphans, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as liveMatchesUnresolvedTokenFrame, zs as isNotImplemented, zt as destroyStackRecordsView } from "./deploy-engine-HKmcD4Kn.js";
-import { t as getCdkdVersion } from "./version-n6UXfuUI.js";
+import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, xn as StateError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
+import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
+import { $a as NO_CC_HANDLERS_REASON, $c as resolveApp, $i as malformedLocalResourceEntriesWarning, $n as ledgerForStack, $o as shareLogOnlyValues, $r as sendableAssumeRoleCommand, $s as hasUnverifiableParameterRefusal, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourceEntriesForOrphan, Ac as dockerSpawnEnvWithSensitive, Ai as refStateLookupFromResource, Al as displayAssemblyPath, An as journaledOrphanPrintingBag, Ao as TemplateParser, Ar as deleteIndeterminateGuards, As as wholeStringLeavesOf, At as dropFailedHint, Ba as repairMalformedOrphansForReadOnly, Bc as runDockerForeground, Bi as UNREADABLE_RESOURCES_MAP_ROW, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bs as rebuildClientForBucketRegion, C as recordRetainedForReadoption, Ca as refuseMalformedOutputsForDestroy, Cc as validateContainerRepoName, Ci as carriesDynamicReference, Cl as defineOwnKey, Cn as collectDeclaredOutputNames, Co as templateResourceTypes, Cr as applyCustomResourceResponseExpiration, Cs as carriesSecretMask, D as withResourceDeadline, Da as refuseMalformedResourceEntriesForDestroy, Dc as describeDockerCapturedOutput, Di as AWS_NO_VALUE, Dl as ownValue, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Ds as recordNoEchoAttributeValues, E as serviceTokenBlockingReason, Ea as refuseMalformedResourceEntriesForDeploy, Ec as resolveDockerContextDirectory, Ei as keepsSecretReferenceToken, El as nullPrototypeRecord, En as bindingSkippedOutputs, Er as slowCcOperationTimeoutMs, Es as recordMaskOnlyValuesIn, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as refuseMalformedResourcesForDeploy, Fc as isMalformedEnvKey, Fi as declaresNoEcho, Fn as secretNamedRecordNeedles, Fo as maskWholeValue, Fs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ft as sameJournaledOrphans, Ga as unpreviewableOrphanRecords, Gc as stripForDisplay, Gi as hasReadableOutputs, Gn as isFinalSnapshotError, Go as carryLogOnlyValues, Gr as poisonRenderedSpellingsCollidingIn, Gs as isAccessDenied, Gt as isJournaledOrphan, Ha as repairMalformedResourceEntriesForReadOnly, Hc as warnFinchArgvExposure, Hi as deployRefusesOrphanRowsReason, Hn as ccRoutedFinalSnapshotError, Ho as readsNoEchoSource, Hr as DiffCalculator, Hs as CrossPrefixScanCache, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as refuseMalformedResourcesForDestroy, Ic as partitionSensitiveEnv, Ii as JSON_LISTING_HOLE_VALUE, Il as resolveBucketRegion, In as stateSecretNameNeedles, Io as maskedLeafCoordinatesOf, Is as isSingleDynamicReferenceToken, It as replayFailedOperations, Ja as withheldAccountClause, Jc as Synthesizer, Ji as isReadableResourceEntry, Jn as maskingRetryLogger, Jo as literalSplitDelimitersOf, Jr as applyRoleArnIfSet, Js as acceptedCreateOnlyDropsOf, Jt as planRollback, Ka as unreadableOrphanRecords, Kc as AssetManifestLoader, Ki as hasReadableResources, Kn as refusesFinalSnapshot, Ko as createUnionSecretMasker, Kr as producerLookupOver, Ks as isNotImplemented, Kt as isReplacementOrphan, L as perType, La as refuseMalformedResourcesForExport, Lc as redactDockerArgvValues, Li as STATE_REGION_DIVERGED, Ln as storedSecretNameNeedles, Lo as noEchoCoordinatesOf, Ls as LockManager, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcePropertiesForDrift, Mc as formatDockerLoginError, Mi as withSharedDrainBudget, Ml as resolveAssemblyPath, Mn as orphanRecordsPrintingBag, Mo as isMarkedCoordinate, Mr as deleteSkipReason, Ms as STATE_SOURCED_CROSS_GENERATION_RULES, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedResourcePropertiesForExport, Nc as getDockerCmd, Ni as parameterInputsFor, Nl as injectAwsRegion, Nn as secretNamePrintingBag, No as maskAtCoordinates, Ns as STATE_SOURCED_READBACK_RULES, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourceEntriesForImport, Oc as describeDockerExecFailure, Oi as cfnRefValueFromPhysicalId, Ol as absoluteAssemblyPathEscape, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Or as RollbackInlinePolicyWriters, Os as recordNoEchoParameterFreshValue, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as refuseMalformedResourcePropertiesForOrphan, Pc as isDockerClientEnvKey, Pl as injectedAwsRegionValue, Pn as secretNamePrintingBags, Po as maskReadbackAtCoordinates, Pr as isWaitAbandonedError, Ps as TEMPLATE_SOURCED_RULES, Pt as makeForeignHolderScan, Qc as loadCdkJson, Qi as malformedLocalOutputsWarning, Qo as recordLogOnlyValue, Qr as isIamRoleArn, Qs as hasReasonlessBaselineRefusal, Qt as resolveReplacementOldType, R as readProtection, Ra as refuseMalformedState, Rc as redactedCause, Ri as STATE_RESOURCES_MALFORMED, Rn as extractDeploymentEventError, Ro as noEchoLeavesOf, Rs as isLockInfoExpired, S as keptForReadoption, Sa as refuseMalformedOutputs, Sc as validateAssetBucketName, Si as isImpossibleEmptyStoredAttribute, Sl as processStackMessages, Sn as noEchoParameterValueSeed, So as prefetchCreateOnlyPropertyPaths, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as splitGetAttStringForm, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntries, Tc as buildDockerImage, Ti as isNamelessDynamicReferenceError, Tl as hasPlainPrototype, Tn as isExportAliasCollision, To as withRetry, Tr as CloudControlProvider, Ts as recordMaskOnlyValue, Tt as withNestedRevertRun, Ua as repairMalformedResourcePropertiesForReadOnly, Uc as escapeRegExp, Ui as displayLogicalId, Un as createPreDeleteFinalSnapshot, Uo as valueAtCoordinate, Ur as INTRINSIC_KEYS, Us as applyCrossPrefixScan, Ut as recordAfterRollbackUpdate, Va as repairMalformedOutputsForReadOnly, Vc as runDockerStreaming, Vi as accountArgs, Vn as buildFinalSnapshotIdentifier, Vo as readbackPathFor, Vs as CrossPrefixReadError, Vt as withStackRecords, Wa as repairMalformedResourcesForReadOnly, Wc as stripControlChars, Wi as hasReadableOrphans, Wn as effectiveDeletionPolicy, Wo as liveMatchesUnresolvedTokenFrame, Wr as IntrinsicFunctionResolver, Ws as crossPrefixDeniedWarning, Wt as demoteSupersededOrphans, Xc as getDefaultStateBucketName, Xi as malformedExportNamesWarning, Xn as findDestructiveChanges, Xo as printingCorpusOf, Xr as assertSendableRoleArn, Xs as exportNamesCarriedFrom, Xt as recordUnderIdIsNotOwn, Ya as findActionableSilentDrops, Yc as synthesisStatusMessage, Yi as malformedDriftResourcePropertiesWarning, Yn as constructPathOf, Yo as logOnlyValueCount, Yr as assertFlagRoleArn, Ys as describeRegionValueKind, Yt as recheckFailedPlan, Za as unwrittenCreateOnlyReplacement, Zc as getLegacyStateBucketName, Zi as malformedExportSourceWarning, Zn as formatDestructiveChange, Zo as recordLogOnlyParameterValue, Zr as explicitRoleArnOrThrow, Zs as hasReadableExportSet, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOrphanRecords, _c as ensureAssetStorage, _i as regionLessSecretName, _l as PARTITION_TABLE, _n as secretSafeKeyDisplay, _r as TemplateNoEchoReresolver, _s as recordNestedStackParameterExpressions, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedOrphansWarning, ac as shouldRetainResource, ai as keepHeldTokenProvenance, al as resolveUseCdkBootstrapAssets, ao as isStatefulRecreateTargetSync, at as cyan, ba as refuseMalformedOrphansForDestroy, bc as parseBootstrapMarker, bi as parameterTypeMayLoseSecretIdentity, bl as AssemblyReader, bn as exportNameSecretExposure, c as renderNestedTemplateTreeDefect, ca as malformedRenderedContainersWarning, cc as stringifyValue, ci as recordedReferenceRegions, cl as ssmResolvedValueType, cn as updatePartialMessage, cs as scrubResourceRecord, ct as red, d as conditionInputsFrom, da as malformedResourcesWarning, dc as createAssetRedirectResolver, dl as MIGRATE_TMP_PREFIX, dn as DeploymentEventsStore, ds as DYNAMIC_REFERENCE_TOKEN_SCAN, dt as namesAnyDeclaredParameter, ea as malformedLocalResourcesWarning, ec as importableOutputKeys, ei as AWS_CREDENTIAL_ENV_KEYS, el as resolveAutoAssetStorage, en as orphanDeleteNeedsIdentity, eo as hasNoCloudControlHandlers, es as createSecretMasker, f as parentSuppliedValues, fa as malformedScrubResourceEntriesRefusalMessage, fc as loadPublishableAssetManifest, fl as findLargeInlineResources, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as dynamicReferenceTokens, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, gc as assertAssetBucketRegion, gi as producerRegionsFromState, gl as expectedOwnerParam, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as inheritNestedStackParameterAssociations, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseDivergentRecordRegionForDestroy, hc as BOOTSTRAP_MARKER_PREFIX, hi as classifyReplaySecretRegion, hl as decodeListingKey, hn as secretBearing, hr as isCustomResource, hs as identityKeyFor, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedOrphansRefusalMessage, ic as orphansCarriedFrom, il as resolveStateBucketWithDefaultAndSource, io as isStatefulRecreateTargetForReplace, is as markSameGenerationBag, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcePropertiesForDestroy, jc as finchSecretArgvRefusal, jl as renderAssemblyPathEscape, jn as maskEventTextWithBoundBags, jo as canonicalCoordinates, jr as deleteLeftInPlace, js as STATE_SOURCED_BASELINE_RULES, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourceEntriesForImportSave, kc as describeDockerFailure, ki as isStalePlaceholderArnAttribute, kl as describeFileReadFailure, kn as completedReplayEntries, ko as DagBuilder, kr as UNSPECIFIED_SKIP_REASON, ks as recordProvenPublicExpression, kt as deleteJournaledOrphans, l as templateIdentity, la as malformedResourceEntriesWarning, lc as WorkGraph, ll as CFN_TEMPLATE_BODY_LIMIT, ln as updatePartialReason, ls as withPhysicalNameCopies, lt as yellow, m as isSecretBearingReferenceString, ma as previewableOrphanRecords, mc as AssetModeResolver, mi as classifyRecordedSecretRegion, ml as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as pathCrossesDottedKey, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOrphanRecordsWarning, nc as isReadableBag, ni as callerEnvCredentials, nl as resolveSkipPrefix, no as shownType, ns as maskSecretsInError, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedOutputsRefusalMessage, oc as AssetPublisher, ol as stateBucketExistenceConfirmed, oo as renderStatefulReason, ot as gray, p as readRecordedConditionVerdicts, pa as malformedStateRefusalMessage, pc as rewriteTemplateAssetReferences, pl as uploadCfnTemplate, pn as displayTextOrWithheld, pr as ProviderRegistry, ps as isUncertifiedBaselineMaskPosition, pt as resourcesNamingDeclaredParameter, qa as unreadableResourceEntries, qc as getDockerImageBySourceHash, qi as isReadableOrphanRecord, qn as unsupportedFinalSnapshotError, qo as hasMaskableValues, qr as refuseUnreadableCdkCrossAccountRefs, qs as splitImportedOps, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedOrphanRowsKeptWarning, rc as orphansAfterRollback, ri as envCredentialsAreAssumedRole, rl as resolveStateBucketWithDefault, rn as inheritProducerRegions, ro as MULTI_REGION_RECREATE_BLOCKED_TYPES, rs as maskSecretsInText, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedOutputsWarning, sc as isSensitiveAttributeName, si as recordedOutputReferenceRegions, sl as warnDeprecatedNoPrefixCliFlag, ss as redactSecretsForState, st as green, t as DeployEngine, ta as malformedOrphanRecordsRefusalMessage, tc as importableOutputs, ti as applyCallerIdentityCredentials, tl as resolveCaptureObservedState, tn as findNestedStackTypeChanges, to as findReplacedReadersOfRecreateTargets, tr as withCreateTokenLedger, ts as errorCauseChain, u as conditionFingerprint, ua as malformedResourcePropertiesWarning, uc as buildAssetRedirectMap, ul as CFN_TEMPLATE_URL_LIMIT, un as DeploymentEventsReader, ut as computeParameterTaint, va as refuseMalformedOrphanRecordsForDestroy, vc as getBootstrapMarkerKey, vi as coerceParameterTypedValue, vl as canonicalizeRegion, vn as carriedExportAliasExposure, vr as readsNoEchoDeleteValues, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceAttributesForOrphan, wc as buildDenyExternalAccessPolicy, wi as carriesFetchableDynamicReference, wl as hasOwnKey, wn as collectPublishedOutputNames, wo as describeTypeWithThrottleRetry, wr as customResourceResponseExpirationWarning, ws as provenPublicValue, wt as revertedNestedRowIds, xa as refuseMalformedOrphansForOrphan, xc as readBootstrapMarkerBody, xi as getAccountInfo, xl as StageLoadError, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordPhysicalNameCopy, xt as nestedChildStackName$1, ya as refuseMalformedOrphans, yc as isCrossRegionRedirect, yi as isUnboundTemplateParameter, yl as derivePartitionAndUrlSuffix, yn as exportNameNoEchoParameters, yr as isCustomResourceType$1, ys as physicalNameCopiesOf, yt as dropSettledNestedJournals, za as repairMalformedOrphanRecordsForReadOnly, zc as redactedDockerCause, zi as UNREADABLE_ORPHANS_CONTAINER_ROW, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as noEchoOutputsComparison, zs as S3StateBackend, zt as destroyStackRecordsView } from "./deploy-engine-CZUhJ1IZ.js";
+import { t as getCdkdVersion } from "./version-DMqEiJIt.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2561,7 +2561,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes--iMwAb7q.js");
+	providerClasses ??= import("./provider-classes-Xrt4DIC7.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3386,7 +3386,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
 						state: stateForRecreateCheck?.state ?? {
-							version: 11,
+							version: 12,
 							stackName: stackInfo.stackName,
 							region: stackRegion,
 							resources: {},
@@ -3421,7 +3421,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 						const replacedReaders = await findReplacedReadersOfRecreateTargets({
 							template: stackInfo.template,
 							state: stateForRecreateCheck?.state ?? {
-								version: 11,
+								version: 12,
 								stackName: stackInfo.stackName,
 								region: stackRegion,
 								resources: {},
@@ -4238,10 +4238,10 @@ async function drainTemplateUploads(cleanups, stateBucket, labels) {
 		logger.warn(`Failed to delete ${labels.what} from '${stateBucket}'${labels.when ? ` ${labels.when}` : ""}. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
 	}
 }
-async function retireCloudFormationStack(options) {
+async function prepareCloudFormationStackRetirement(options) {
 	const logger = getLogger();
 	const { cfnStackName, cfnClient, yes, stateBucket, s3ClientOpts, resourceTree } = options;
-	if (resourceTree && resourceTree.stackName !== cfnStackName) throw new Error(`retireCloudFormationStack: caller-supplied resourceTree.stackName='${resourceTree.stackName}' does not match cfnStackName='${cfnStackName}'. The tree's root must be the stack being retired.`);
+	if (resourceTree && resourceTree.stackName !== cfnStackName) throw new Error(`prepareCloudFormationStackRetirement: caller-supplied resourceTree.stackName='${resourceTree.stackName}' does not match cfnStackName='${cfnStackName}'. The tree's root must be the stack being retired.`);
 	logger.info(`[1/4] Inspecting CloudFormation stack '${cfnStackName}'...`);
 	const stack = (await cfnClient.send(new DescribeStacksCommand({ StackName: cfnStackName }))).Stacks?.[0];
 	if (!stack) throw new Error(`CloudFormation stack '${cfnStackName}' not found.`);
@@ -4281,7 +4281,7 @@ async function retireCloudFormationStack(options) {
 	if (!yes) {
 		let proceed = false;
 		try {
-			proceed = await confirmPrompt$6(`Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', then delete the stack? AWS resources will NOT be deleted (cdkd state has been written).`);
+			proceed = await confirmPrompt$6(`Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', and delete the stack once cdkd state is written? AWS resources will NOT be deleted.`);
 		} finally {
 			if (!proceed) await drainTemplateUploads(nestedCleanups, stateBucket, {
 				what: "temporary nested-template upload",
@@ -4289,16 +4289,17 @@ async function retireCloudFormationStack(options) {
 			});
 		}
 		if (!proceed) {
-			logger.info("CloudFormation stack retirement cancelled. cdkd state is unaffected.");
+			logger.info("CloudFormation stack retirement cancelled. The stack is unchanged and will not be deleted.");
 			return { outcome: "cancelled" };
 		}
 	}
+	let templateUpdated = false;
 	if (!modified) {
 		logger.info(`[2/4] Template already has Retain on every resource — skipping UpdateStack.`);
 		await drainTemplateUploads(nestedCleanups, stateBucket, { what: "temporary nested-template upload" });
 	} else {
 		logger.info(`[2/4] Injected DeletionPolicy=Retain and UpdateReplacePolicy=Retain.`);
-		if (newBody.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified template is ${newBody.length} bytes, exceeds the CloudFormation UpdateStack TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has already been written; retire the stack manually with (1) shrink the template, then (2) UpdateStack with Retain policies, (3) DeleteStack — or split the stack and retry.`);
+		if (newBody.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified template is ${newBody.length} bytes, exceeds the CloudFormation UpdateStack TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has not been written; shrink or split the template and retry. ` + MANUAL_RETIREMENT_ROUTE);
 		let updateInput;
 		let s3Cleanup;
 		if (newBody.length <= TEMPLATE_BODY_LIMIT) updateInput = { TemplateBody: newBody };
@@ -4331,29 +4332,100 @@ async function retireCloudFormationStack(options) {
 				updateRan = true;
 			} catch (err) {
 				const msg = describeAwsFailure(err).detail;
-				if (/No updates are to be performed/i.test(msg)) logger.info(`  CloudFormation reports no updates needed — proceeding to delete.`);
-				else throw err;
+				if (/No updates are to be performed/i.test(msg)) logger.info(`  CloudFormation reports no updates needed.`);
+				else throw new RetainUpdateFailedError(cfnStackName, "rejected", err);
+			}
+			if (updateRan) {
+				try {
+					await waitUntilStackUpdateComplete({
+						client: cfnClient,
+						maxWaitTime: 1800,
+						minDelay: 5,
+						maxDelay: 10
+					}, { StackName: cfnStackName });
+				} catch (err) {
+					throw new RetainUpdateFailedError(cfnStackName, "unfinished", err);
+				}
+				templateUpdated = true;
 			}
-			if (updateRan) await waitUntilStackUpdateComplete({
-				client: cfnClient,
-				maxWaitTime: 1800,
-				minDelay: 5,
-				maxDelay: 10
-			}, { StackName: cfnStackName });
 		} finally {
 			await drainTemplateUploads([...s3Cleanup ? [s3Cleanup] : [], ...nestedCleanups], stateBucket, { what: "temporary template upload" });
 		}
 	}
+	return {
+		outcome: "ready",
+		templateUpdated
+	};
+}
+const SUPERSEDED_COPY_HINT = "If that update completes (now or later), CloudFormation may have replaced resources; each superseded copy is RETAINED and managed by neither CloudFormation nor cdkd. Find them in the stack's events: rows whose reason reads \"Requested update requires the creation of a new physical resource\" name the old physical id. A re-run does not report them, because the template then already carries the Retain policies and no update runs.";
+const MANUAL_RETIREMENT_ROUTE = "To retire the stack by hand: (1) UpdateStack with DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource, (2) `cdkd import` without --migrate-from-cloudformation (it reads the physical ids from a same-named CloudFormation stack), (3) DeleteStack. The import must adopt every resource before you delete the stack: check its summary.";
+function describeStackWaiterFailure(error) {
+	if (!(error instanceof Error)) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(error.message);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || !("state" in parsed)) return void 0;
+	const result = parsed;
+	const state = typeof result.state === "string" ? result.state : "FAILURE";
+	const reason = result.reason;
+	const stacks = typeof reason === "object" && reason !== null && "Stacks" in reason ? reason.Stacks : void 0;
+	const stack = Array.isArray(stacks) && typeof stacks[0] === "object" ? stacks[0] : void 0;
+	const status = typeof stack?.StackStatus === "string" ? stack.StackStatus : void 0;
+	const statusReason = typeof stack?.StackStatusReason === "string" ? stack.StackStatusReason : void 0;
+	return `waiter ${state}` + (status ? `, stack status ${status}` : typeof reason === "string" ? `: ${reason}` : "") + (statusReason ? ` (${statusReason})` : "");
+}
+function cfnFailureText(error) {
+	const waiter = describeStackWaiterFailure(error);
+	if (waiter !== void 0 && error instanceof Error) {
+		try {
+			Object.defineProperty(error, "message", {
+				value: waiter,
+				writable: true,
+				configurable: true,
+				enumerable: false
+			});
+			Object.defineProperty(error, "stack", {
+				value: `${error.name}: ${waiter}`,
+				writable: true,
+				configurable: true,
+				enumerable: false
+			});
+		} catch {}
+		return waiter;
+	}
+	const failure = describeAwsFailure(error);
+	if (failure.redacted) getLogger().debug(safeMsg`CloudFormation failure detail: ${failure.detail}`);
+	return failure.summary.replace(/\.+$/, "");
+}
+var RetainUpdateFailedError = class extends Error {
+	cause;
+	constructor(cfnStackName, kind, cause) {
+		const text = cfnFailureText(cause);
+		super(safeMsg`The Retain-policy UpdateStack on CloudFormation stack ${displaySafe(cfnStackName)} ` + (kind === "rejected" ? "was rejected" : "did not complete") + safeMsg`: ${text}. cdkd state has not been written. ` + (kind === "unfinished" ? `${SUPERSEDED_COPY_HINT} ` : "") + "Re-run the same command once the cause is fixed. When the cause is a replacement CloudFormation cannot perform (a custom-named resource whose update requires replacing it), the same update by hand fails too: give that resource no custom name or a new one, or take it out of the stack, then re-run. To retire the stack by hand: (1) UpdateStack with DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource, (2) `cdkd import` without --migrate-from-cloudformation (it reads the physical ids from a same-named CloudFormation stack), (3) DeleteStack. The import must adopt every resource before you delete the stack: check its summary.");
+		this.name = "RetainUpdateFailedError";
+		this.cause = cause;
+	}
+};
+async function deleteRetiredCloudFormationStack(cfnStackName, cfnClient) {
+	const logger = getLogger();
 	logger.info(`[4/4] Deleting CloudFormation stack '${cfnStackName}' (resources retained)...`);
-	await cfnClient.send(new DeleteStackCommand({ StackName: cfnStackName }));
-	await waitUntilStackDeleteComplete({
-		client: cfnClient,
-		maxWaitTime: 1800,
-		minDelay: 5,
-		maxDelay: 10
-	}, { StackName: cfnStackName });
+	try {
+		await cfnClient.send(new DeleteStackCommand({ StackName: cfnStackName }));
+		await waitUntilStackDeleteComplete({
+			client: cfnClient,
+			maxWaitTime: 1800,
+			minDelay: 5,
+			maxDelay: 10
+		}, { StackName: cfnStackName });
+	} catch (err) {
+		const error = /* @__PURE__ */ new Error(safeMsg`CloudFormation stack ${displaySafe(cfnStackName)} was NOT confirmed deleted: ` + safeMsg`${cfnFailureText(err)}. cdkd state is written and correct, and every resource ` + "carries DeletionPolicy=Retain, so deleting the stack deletes no resource. Delete the stack by hand once its cause is resolved (for example an export another stack still imports).");
+		error.cause = err;
+		throw error;
+	}
 	logger.info(`✓ CloudFormation stack '${cfnStackName}' retired. AWS resources are now solely managed by cdkd.`);
-	return { outcome: modified ? "retired" : "no-template-change" };
 }
 async function uploadTemplateForUpdateStack(args) {
 	return uploadCfnTemplate({
@@ -4457,7 +4529,7 @@ async function injectRetainPoliciesRecursiveInternal(templateBody, cfnStackName,
 		if (!childTpl.TemplateBody) throw new Error(`GetTemplate returned no body for nested stack '${logicalId}' (physicalId='${childNode.physicalId}', parent='${cfnStackName}').`);
 		const childResult = await injectRetainPoliciesRecursiveInternal(childTpl.TemplateBody, childNode.stackName, childNode, deps, cleanups);
 		if (childResult.modified) {
-			if (childResult.body.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified nested-stack template for '${logicalId}' is ${childResult.body.length} bytes, exceeds the CloudFormation TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has already been written for the root parent; retire the stack manually with (1) shrink the child template, then (2) UpdateStack with Retain policies on the parent and each child, (3) DeleteStack on the parent.`);
+			if (childResult.body.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified nested-stack template for '${logicalId}' is ${childResult.body.length} bytes, exceeds the CloudFormation TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has not been written; shrink the child template and retry, or retire the stack manually: (1) UpdateStack with Retain policies on the parent and each child, (2) cdkd import, (3) DeleteStack on the parent.`);
 			const uploaded = await uploadCfnTemplate({
 				bucket: deps.stateBucket,
 				body: childResult.body,
@@ -4507,8 +4579,25 @@ async function walkCfnStackTree(stackName, physicalId, cfnClient) {
 		nested
 	};
 }
+function findReplacedCfnResources(before, after, nestedPath = []) {
+	const replaced = [];
+	for (const [logicalId, beforeId] of before.resources) {
+		const afterId = after.resources.get(logicalId);
+		if (afterId !== void 0 && afterId !== beforeId) replaced.push({
+			nestedPath,
+			logicalId,
+			before: beforeId,
+			after: afterId
+		});
+	}
+	for (const [childLogicalId, beforeChild] of before.nested) {
+		const afterChild = after.nested.get(childLogicalId);
+		if (afterChild) replaced.push(...findReplacedCfnResources(beforeChild, afterChild, [...nestedPath, childLogicalId]));
+	}
+	return replaced;
+}
 async function confirmPrompt$6(prompt) {
-	return confirmOrRefuse(prompt, { refusal: "The CloudFormation stack retirement confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes on cdkd import --migrate-from-cloudformation. Alternatively, run it from a real terminal. NOTE cdkd state has already been written: the resources are recorded in cdkd state while the CloudFormation stack is still live, so re-run with -y / --yes (or retire the stack by hand) to finish the migration." });
+	return confirmOrRefuse(prompt, { refusal: "The CloudFormation stack retirement confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes on cdkd import --migrate-from-cloudformation. Alternatively, run it from a real terminal. Nothing has been written yet: cdkd state and the CloudFormation stack are unchanged, so re-running with -y / --yes is the whole recovery." });
 }
 async function tryGetCloudFormationResourceMap(stackName, cfnClient) {
 	const logger = getLogger();
@@ -4707,7 +4796,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 			region,
 			resources: {},
 			outputs: {},
-			version: 11,
+			version: 12,
 			lastModified: Date.now()
 		},
 		unreadable: [],
@@ -6994,12 +7083,15 @@ var ScrubResolvers = class {
 		this.pinned.set(target, scoped);
 		return scoped;
 	}
+	forRecordedRegion(region) {
+		return this.primary.resolverForRecordedRegion(region);
+	}
 };
 function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignProducerRegions, stackRegion, secrets) {
 	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} cannot re-resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => displayIdent(r)).join(", ")}), so it may have been resolved in one of those rather than in ${displayIdent(stackRegion)}. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
 }
-function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets) {
-	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin} in the region its ARN names (${displayIdent(region)}): ${maskSecretsInText(describeAwsFailure(cause).detail, secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
+function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets, recorded = false) {
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin} in ${recorded ? "the region its state record names" : "the region its ARN names"} (${displayIdent(region)}): ${maskSecretsInText(describeAwsFailure(cause).detail, secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
 }
 const DYNAMIC_REFERENCE_OPENING = "{{resolve:";
 const SECRET_REFERENCE_OPENINGS = [
@@ -7023,7 +7115,16 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 	const shownStackName = displayStackName(stackName);
 	const tokens = dynamicReferenceTokens(leaf);
 	if (isAssembledSecretReference(leaf, tokens.filter(isSecretReferenceToken))) return leaf;
-	const verdicts = tokens.map((token) => [token, classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions)]);
+	const verdicts = tokens.map((token) => {
+		const verdict = classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions);
+		const recorded = regionLessSecretName(token) === void 0 ? void 0 : ctx.recordedRegions?.get(token);
+		return [token, !(recorded !== void 0 && (canonicalizeRegion(recorded) !== canonicalizeRegion(ctx.stackRegion) || verdict.kind === "ambiguous")) ? verdict : {
+			kind: "named-region",
+			secretName: regionLessSecretName(token),
+			region: recorded,
+			recorded: true
+		}];
+	});
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion, ctx.recordedSecretValues);
 	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return leaf;
 	const localTokens = [];
@@ -7034,7 +7135,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 		if (at < 0) throw new ScrubRefusalError(`Scrub of ${shownStackName} could not locate a scanned dynamic reference in ${ctx.origin}, in the value it was scanned from. Refusing rather than resolving it in ${displayIdent(ctx.stackRegion)}, which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "SCRUB_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
 		if (verdict.kind === "named-region") {
-			const resolver = ctx.resolvers.forRegion(verdict.region);
+			const resolver = "recorded" in verdict ? ctx.resolvers.forRecordedRegion(verdict.region) : ctx.resolvers.forRegion(verdict.region);
 			try {
 				out += await resolver.resolveDynamicReferences(token, {
 					template: { Resources: {} },
@@ -7042,7 +7143,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 					recordedSecretValues: ctx.recordedSecretValues
 				});
 			} catch (err) {
-				throw unresolvableForeignScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.region, err, ctx.recordedSecretValues);
+				throw unresolvableForeignScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.region, err, ctx.recordedSecretValues, "recorded" in verdict);
 			}
 		} else {
 			out += token;
@@ -7955,7 +8056,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues,
-					origin: `resource ${maskedIdent(logicalId, recordedSecretValues)}`
+					origin: `resource ${maskedIdent(logicalId, recordedSecretValues)}`,
+					recordedRegions: recordedReferenceRegions(state.resources?.[logicalId])
 				});
 				const resourceContext = resolverContext(recordedSecretValues);
 				await resolveCrossStackReads(resolveInput, resourceContext, crossStackReadOrigin("resource", "logical id", logicalId, recordedSecretValues));
@@ -8012,7 +8114,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues,
-					origin: `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)}`
+					origin: `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)}`,
+					recordedRegions: recordedReferenceRegions(record.state)
 				});
 				const orphanContext = resolverContext(recordedSecretValues);
 				for (const [bagName, bagValue] of Object.entries(resolveInput)) {
@@ -8096,7 +8199,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues: outputSecrets,
-					origin: `output ${maskedIdent(name, outputSecrets)}`
+					origin: `output ${maskedIdent(name, outputSecrets)}`,
+					recordedRegions: recordedOutputReferenceRegions(state, name)
 				});
 				const valueContext = resolverContext(outputSecrets);
 				await resolveCrossStackReads(valueSource, valueContext, crossStackReadOrigin("output", "output name", name, outputSecrets), { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
@@ -8238,7 +8342,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const scrubbed = secrets || templateProps ? scrubResourceRecord(positioned, ownSecrets, void 0, STATE_SOURCED_CROSS_GENERATION_RULES) : record;
 			const plan = noEchoPlans.byLogicalId.get(logicalId);
 			const migrationNeedles = scrubMigrationNeedles(plan, noEchoPublicTokens);
-			const written = applyScrubNoEcho(migrationNeedles === void 0 ? scrubbed : scrubResourceRecord(scrubbed, migrationNeedles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES), record, plan);
+			const migrated = migrationNeedles === void 0 ? scrubbed : scrubResourceRecord(scrubbed, migrationNeedles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES);
+			const written = keepHeldTokenProvenance(applyScrubNoEcho(migrated, record, plan));
 			if (JSON.stringify(written) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = written;
 		}
@@ -8247,7 +8352,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const needles = new Map(allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 			for (const [plaintext, expression] of own ?? []) needles.set(plaintext, expression);
 			if (needles.size === 0) return record;
-			const scrubbed = scrubResourceRecord(record.state, needles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES);
+			const scrubbed = keepHeldTokenProvenance(scrubResourceRecord(record.state, needles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES));
 			if (JSON.stringify(scrubbed) === JSON.stringify(record.state)) return record;
 			recordsChanged++;
 			return {
@@ -9551,6 +9656,9 @@ var DriftSecretResolvers = class {
 		this.pinned.set(target, scoped);
 		return scoped;
 	}
+	forRecordedRegion(region) {
+		return this.primary.resolverForRecordedRegion(region);
+	}
 };
 var DriftSecretRefusalError = class DriftSecretRefusalError extends CdkdError {
 	driftSecretRefusal = true;
@@ -9602,9 +9710,10 @@ function regionAmbiguousDriftSecretError(logicalId, propertyPath, secretName, fo
 	const where = propertyPath === "" ? "" : ` property '${propertyPath}'`;
 	return new DriftSecretRefusalError(`${logicalId}${where}: the secret reference '${secretName}' carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so cdkd would compare against — and with --revert WRITE — the WRONG secret. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd drift'.`, "DRIFT_SECRET_REGION_AMBIGUOUS");
 }
-function refuseUnprovenDriftSecret(leaf, propertyPath, logicalId, consumerRegion, evidence) {
+function refuseUnprovenDriftSecret(leaf, propertyPath, logicalId, consumerRegion, evidence, recordedRegions) {
 	if (evidence.complete) return;
 	for (const token of dynamicReferenceTokens(leaf)) {
+		if (recordedRegions?.has(token) === true) continue;
 		const name = classifyReplaySecretRegion(token, consumerRegion, evidence.regions).kind === "local" ? regionLessSecretName(token) : void 0;
 		if (name === void 0) continue;
 		const where = propertyPath === "" ? "" : ` property '${propertyPath}'`;
@@ -9658,17 +9767,17 @@ async function driftProducerRegionEvidence(state, stackName, region, stateBacken
 	const inherited = await driftProducerRegionEvidence(parent.state, parentName, parentRegion, stateBackend, depth + 1);
 	return inheritProducerRegions(own, inherited);
 }
-async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx) {
-	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyReplaySecretRegion(token, consumerRegion, producerRegions)]);
+async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx, recordedRegions) {
+	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyRecordedSecretRegion(token, consumerRegion, producerRegions, recordedRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousDriftSecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, consumerRegion);
-	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
 		const at = leaf.indexOf(token, cursor);
 		if (at < 0) throw new DriftSecretRefusalError(`${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`}: could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${consumerRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "DRIFT_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
-		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : resolvers.primary;
+		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? resolvers.forRecordedRegion(verdict.region) : resolvers.primary;
 		out += await resolver.resolveDynamicReferences(token, ctx);
 		cursor = at + token.length;
 	}
@@ -9677,6 +9786,7 @@ async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerR
 async function resolveStateSecretExpressions(props, resolvers, secrets, options) {
 	if (!containsDynamicReference$1(props)) return props;
 	const { secretPaths, onUnresolved, producerRegions, logicalId, consumerRegion } = options;
+	const recordedRegions = recordedReferenceRegions(options.record);
 	const ctx = {
 		template: { Resources: {} },
 		resources: {},
@@ -9685,8 +9795,8 @@ async function resolveStateSecretExpressions(props, resolvers, secrets, options)
 	const walk = async (v, path) => {
 		if (typeof v === "string") {
 			if (!v.includes("{{resolve:")) return v;
-			refuseUnprovenDriftSecret(v, path, logicalId, consumerRegion, producerRegions);
-			const resolved = await resolveDriftLeafByRegion(v, path, logicalId, consumerRegion, producerRegions.regions, resolvers, ctx);
+			refuseUnprovenDriftSecret(v, path, logicalId, consumerRegion, producerRegions, recordedRegions);
+			const resolved = await resolveDriftLeafByRegion(v, path, logicalId, consumerRegion, producerRegions.regions, resolvers, ctx, recordedRegions);
 			const survivors = survivingDynamicReferences(resolved).filter((t) => v.includes(t));
 			if (survivors.length > 0) onUnresolved?.(survivors, path);
 			if (carriesRecordedSecret(resolved, secrets)) secretPaths?.add(path);
@@ -10008,6 +10118,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 						onUnresolved: noteUnresolved,
 						logicalId,
 						consumerRegion: region,
+						record: resource,
 						producerRegions
 					});
 					if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolvers, secrets, {
@@ -10015,6 +10126,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 						onUnresolved: noteUnresolved,
 						logicalId,
 						consumerRegion: region,
+						record: resource,
 						producerRegions
 					});
 				} catch (err) {
@@ -10753,12 +10865,14 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							onUnresolved: noteUnresolved,
 							logicalId: outcome.logicalId,
 							consumerRegion: report.region,
+							record: stateResource,
 							producerRegions: revertProducerRegions
 						});
 						if (stateResource.observedProperties !== void 0) await resolveStateSecretExpressions(stateResource.properties ?? {}, revertSecretResolvers, secrets, {
 							onUnresolved: noteUnresolved,
 							logicalId: outcome.logicalId,
 							consumerRegion: report.region,
+							record: stateResource,
 							producerRegions: revertProducerRegions
 						});
 					} catch (err) {
@@ -19031,7 +19145,7 @@ async function rollbackCommand(stackArg, options) {
 				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 				const next = () => ({
 					...carriedState,
-					version: 11,
+					version: 12,
 					region,
 					resources: { ...stateResources },
 					...orphansAfterRollback(baseState, mintedOrphans),
@@ -20656,46 +20770,54 @@ async function importCommand(stackArg, options) {
 			}
 		}));
 		try {
-			const rows = [];
-			for (const { logicalId, resource } of resources) {
-				if (selectiveMode && !overrides.has(logicalId)) {
-					rows.push({
-						logicalId,
-						resourceType: resource.Type,
-						outcome: "skipped-out-of-scope",
-						reason: "not in --resource / --resource-mapping (use --auto to include)"
-					});
-					continue;
-				}
-				if (resource.Type === "AWS::CloudFormation::Stack" && migrationTree && migrationTree.nested.has(logicalId) && accountIdForNestedSynth) {
-					rows.push({
+			const collectRows = async () => {
+				const collected = [];
+				for (const { logicalId, resource } of resources) {
+					if (selectiveMode && !overrides.has(logicalId)) {
+						collected.push({
+							logicalId,
+							resourceType: resource.Type,
+							outcome: "skipped-out-of-scope",
+							reason: "not in --resource / --resource-mapping (use --auto to include)"
+						});
+						continue;
+					}
+					if (resource.Type === "AWS::CloudFormation::Stack" && migrationTree && migrationTree.nested.has(logicalId) && accountIdForNestedSynth) {
+						collected.push({
+							logicalId,
+							resourceType: resource.Type,
+							outcome: "imported",
+							physicalId: synthesizeNestedStackArn(targetRegion, accountIdForNestedSynth, stackInfo.stackName, logicalId)
+						});
+						continue;
+					}
+					const outcome = await importOne({
 						logicalId,
-						resourceType: resource.Type,
-						outcome: "imported",
-						physicalId: synthesizeNestedStackArn(targetRegion, accountIdForNestedSynth, stackInfo.stackName, logicalId)
+						resource,
+						stackName: stackInfo.stackName,
+						region: targetRegion,
+						providerRegistry,
+						override: overrides.get(logicalId),
+						overrides
 					});
-					continue;
+					collected.push(outcome);
 				}
-				const outcome = await importOne({
-					logicalId,
-					resource,
-					stackName: stackInfo.stackName,
-					region: targetRegion,
-					providerRegistry,
-					override: overrides.get(logicalId),
-					overrides
-				});
-				rows.push(outcome);
-			}
+				return collected;
+			};
+			let rows = await collectRows();
 			printSummary(rows);
 			if (options.recordResourceMapping) writeRecordedMapping(options.recordResourceMapping, rows);
-			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
-			refuseMalformedResourceEntriesForImportSave(stackState, stackInfo.stackName, targetRegion, lockRecovery);
+			const assembleStackState = () => {
+				const assembled = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
+				refuseMalformedResourceEntriesForImportSave(assembled, stackInfo.stackName, targetRegion, lockRecovery);
+				return assembled;
+			};
+			let stackState = assembleStackState();
 			if (options.dryRun) {
 				logger.info("--dry-run: state will NOT be written. Re-run without --dry-run to apply.");
 				return;
 			}
-			const importedRows = rows.filter((r) => r.outcome === "imported");
+			let importedRows = rows.filter((r) => r.outcome === "imported");
 			if (importedRows.length === 0) {
 				logger.warn("No resources were successfully imported. State will not be written.");
 				return;
@@ -20710,8 +20832,54 @@ async function importCommand(stackArg, options) {
 					return;
 				}
 			}
+			let retireCfnStack = false;
+			let nestedReplaced = [];
+			if (migrationCfnStackName) {
+				warnMigrationOrphans(logger, resources.length, importedRows.length);
+				const preparation = await prepareCloudFormationStackRetirement({
+					cfnStackName: migrationCfnStackName,
+					cfnClient: regionClients.cloudFormation,
+					yes: options.yes,
+					stateBucket,
+					...options.profile && { s3ClientOpts: { profile: options.profile } },
+					...migrationTree && { resourceTree: migrationTree }
+				});
+				retireCfnStack = preparation.outcome === "ready";
+				if (preparation.outcome === "ready" && preparation.templateUpdated && migrationTree) {
+					let updatedTree;
+					try {
+						updatedTree = await getCloudFormationResourceTree(migrationCfnStackName, regionClients.cloudFormation);
+					} catch (err) {
+						throw new Error(safeMsg`--migrate-from-cloudformation: the Retain-policy update completed, but ` + safeMsg`re-reading the stack's resources failed: ${cfnFailureText(err)}. ` + `cdkd state was not written and the CloudFormation stack was not deleted. ` + SUPERSEDED_COPY_HINT);
+					}
+					const replaced = findReplacedCfnResources(migrationTree, updatedTree).filter((r) => r.nestedPath.length > 0 || templateLogicalIds.has(r.logicalId) && template.Resources[r.logicalId]?.Type !== "AWS::CloudFormation::Stack");
+					migrationTree = updatedTree;
+					nestedReplaced = replaced.filter((r) => r.nestedPath.length > 0);
+					for (const r of replaced) {
+						const where = r.nestedPath.length > 0 ? safeMsg`nested stack ${r.nestedPath.map((p) => logicalIdShown(p)).join(" > ")}: ` : "";
+						const pinned = r.nestedPath.length === 0 && overrides.has(r.logicalId) && overrides.get(r.logicalId) !== r.before;
+						if (r.nestedPath.length === 0 && overrides.get(r.logicalId) === r.before) overrides.set(r.logicalId, r.after);
+						logger.warn(safeMsg`CloudFormation replaced ${where}${logicalIdShown(r.logicalId)} while applying ` + safeMsg`the Retain policies: the stack now holds ${displaySafe(r.after)}` + (pinned ? safeMsg`; cdkd keeps the physical id you passed with --resource, so ${displaySafe(r.after)} ` + `(kept by DeletionPolicy=Retain) is managed by neither CloudFormation nor cdkd either. ` : `, which cdkd adopts. `) + safeMsg`The replaced ${displaySafe(r.before)} is RETAINED and managed by neither ` + `CloudFormation nor cdkd; delete it yourself once you no longer need it.`);
+					}
+					if (replaced.some((r) => r.nestedPath.length === 0)) {
+						rows = await collectRows();
+						printSummary(rows);
+						stackState = assembleStackState();
+						const adoptedBefore = importedRows.map((r) => r.logicalId);
+						importedRows = rows.filter((r) => r.outcome === "imported");
+						const adoptedNow = new Set(importedRows.map((r) => r.logicalId));
+						if (options.recordResourceMapping) writeRecordedMapping(options.recordResourceMapping, rows);
+						refuseLostReplacedRows(adoptedBefore.filter((id) => !adoptedNow.has(id)), "cdkd state was not written and the CloudFormation stack was not deleted.");
+						if (importedRows.length !== adoptedBefore.length) {
+							logger.warn(safeMsg`--migrate-from-cloudformation: the re-import after the replacement adopts ` + safeMsg`${importedRows.length} resource(s); ${adoptedBefore.length} were confirmed.`);
+							warnMigrationOrphans(logger, resources.length, importedRows.length);
+						}
+					}
+				}
+			}
 			const deployedParameters = !namesAnyDeclaredParameter(stateTemplate) ? void 0 : migrationCfnStackName !== void 0 ? await readDeployedParameters(migrationCfnStackName, regionClients.cloudFormation, logger, displaySafe(migrationCfnStackName)) : await readDeployedParameters(stackInfo.stackName, regionClients.cloudFormation, logger, displaySafe(stackInfo.stackName), { absentStackIsNoSource: true });
-			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger, deployedParameters)), rebuiltLogicalIdsFrom(rows, stateTemplate));
+			const unsafeObservedBaselineLogicalIds = await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger, deployedParameters));
+			await captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds, rebuiltLogicalIdsFrom(rows, stateTemplate));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
@@ -20726,6 +20894,8 @@ async function importCommand(stackArg, options) {
 				parentRegion: targetRegion,
 				parentNestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
 				parentTree: migrationTree,
+				nestedPath: [],
+				replaced: nestedReplaced,
 				stateBackend,
 				lockManager,
 				providerRegistry,
@@ -20736,18 +20906,7 @@ async function importCommand(stackArg, options) {
 				assetRedirect,
 				cfnClient: regionClients.cloudFormation
 			});
-			if (migrationCfnStackName) {
-				const orphaned = resources.length - importedRows.length;
-				if (orphaned > 0) logger.warn(`--migrate-from-cloudformation: ${orphaned} of ${resources.length} template resource(s) were NOT imported into cdkd. After the CloudFormation stack is retired, those resources remain in AWS but are unmanaged by both CloudFormation and cdkd.`);
-				await retireCloudFormationStack({
-					cfnStackName: migrationCfnStackName,
-					cfnClient: regionClients.cloudFormation,
-					yes: options.yes,
-					stateBucket,
-					...options.profile && { s3ClientOpts: { profile: options.profile } },
-					...migrationTree && { resourceTree: migrationTree }
-				});
-			}
+			if (migrationCfnStackName && retireCfnStack) await deleteRetiredCloudFormationStack(migrationCfnStackName, regionClients.cloudFormation);
 		} finally {
 			await lockManager.releaseLock(stackInfo.stackName, targetRegion).catch((err) => {
 				logger.warn(`Failed to release lock: ${describeAwsFailure(err).detail}`);
@@ -21178,12 +21337,13 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 	}
 	if (namesParameter?.failedClosed !== void 0) getLogger().debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every prior observed-baseline refusal recorded without a reason is carried as an unverifiable-parameter refusal.`);
 	return {
-		version: 11,
+		version: 12,
 		stackName,
 		region,
 		resources,
 		outputs: existingState?.outputs ?? {},
 		...existingState ? exportNamesCarriedFrom(existingState) : { exportNames: [] },
+		...existingState?.outputReferenceProvenance !== void 0 && { outputReferenceProvenance: existingState.outputReferenceProvenance },
 		...existingState ? orphansCarriedFrom(existingState) : {},
 		lastModified: Date.now()
 	};
@@ -21462,6 +21622,15 @@ function resolveDiscardsNonInertSubtree(node, conditions, mappings) {
 	}
 	return keys.some((key) => resolveDiscardsNonInertSubtree(record[key], conditions, mappings));
 }
+function warnMigrationOrphans(logger, total, imported, where) {
+	const orphaned = total - imported;
+	if (orphaned <= 0) return;
+	logger.warn(`--migrate-from-cloudformation: ${orphaned} of ${total} template resource(s)${where ? safeMsg` in ${where}` : ""} were NOT imported into cdkd. After the CloudFormation stack is retired, those resources remain in AWS but are unmanaged by both CloudFormation and cdkd.`);
+}
+function refuseLostReplacedRows(lost, written) {
+	if (lost.length === 0) return;
+	throw new Error(safeMsg`--migrate-from-cloudformation: after CloudFormation replaced resources, ` + safeMsg`${lost.map((id) => logicalIdShown(id)).join(", ")} could no longer be imported. ` + `${written} Re-run the same command once the new resource is readable: the re-run runs no update, so it cannot tell the resource was replaced, and a resource it still cannot import is left managed by neither tool after the stack is retired.`);
+}
 function printSummary(rows) {
 	const logger = getLogger();
 	const counts = {
@@ -21495,7 +21664,7 @@ async function confirmPrompt(prompt) {
 	return confirmOrRefuse(prompt, { refusal: "The cdkd import confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the state write, or run the command from a real terminal." });
 }
 function createImportCommand() {
-	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource, resolving each physical id from the template's physical-name property and then from a same-named CloudFormation stack's DescribeStackResources. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to auto-resolve the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also auto-resolve everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / auto-resolution), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the auto-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO auto-resolve every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "After cdkd state is written, retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(importCommand));
+	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource, resolving each physical id from the template's physical-name property and then from a same-named CloudFormation stack's DescribeStackResources. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to auto-resolve the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also auto-resolve everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / auto-resolution), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the auto-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO auto-resolve every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "Retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, write cdkd state from the physical IDs the stack holds after that update, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(importCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -21617,6 +21786,10 @@ async function importNestedStackChildrenRecursive(args) {
 				});
 				rows.push(outcome);
 			}
+			const childPath = [...args.nestedPath, childLogicalId];
+			const childImported = new Set(rows.filter((r) => r.outcome === "imported").map((r) => r.logicalId));
+			refuseLostReplacedRows(args.replaced.filter((r) => r.nestedPath.length === childPath.length && r.nestedPath.every((p, i) => p === childPath[i]) && childTemplateLogicalIds.has(r.logicalId) && !childImported.has(r.logicalId)).map((r) => r.logicalId), safeMsg`cdkd state for nested stack ${displaySafe(childStackName)} was not written ` + "(the parent's and earlier nested stacks' were), and the CloudFormation stack was not deleted; the re-run needs --force.");
+			warnMigrationOrphans(logger, childResources.length, childImported.size, childStackName);
 			const childStackState = buildStackState(childStackName, childRegion, rows, templateParser, childStateTemplate, null, false);
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
@@ -21632,6 +21805,8 @@ async function importNestedStackChildrenRecursive(args) {
 				parentRegion: childRegion,
 				parentNestedTemplates: indexGrandchildTemplatePaths(childStateTemplate, childTemplatePath),
 				parentTree: childTreeNode,
+				nestedPath: [...args.nestedPath, childLogicalId],
+				replaced: args.replaced,
 				stateBackend,
 				lockManager,
 				providerRegistry,
@@ -29193,4 +29368,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-MMwB_CTT.js.map
+//# sourceMappingURL=program-w-kAH85e.js.map