@go-to-k/cdkd 0.302.3 → 0.303.0

package/dist/{program-DSbJoNKe.js → program-TEYrbsKm.js}

@@ -1,10 +1,9 @@
-import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-B_CEQGE1.js";
-import { $ as stringifyJsonPayload, A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, Q as safeMsg, V as STACK_REF_MAX_CODE_POINTS, W as cutMarker, Y as isPasteableIdent, Z as plainIdentOr, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, b as derivesPatternBName, c as isStdoutReservedForPayload, d as runStackBuffered, et as terminalSafe, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, q as displaySafe, s as getLogger, tt as truncateCodePoints, x as explicitNamePropertyFor, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-e_ddrDDo.js";
-import { $t as ambientCredentialConfig, An as withErrorHandling, Bn as plainOrDescribed, Bt as formatLockOperation, Cn as StackTerminationProtectionError, D as VALUE_NOT_SHOWN, E as assertRegionMatch, Fn as commandHole, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as setPasteableRunFlags, Gt as DEFAULT_STATE_PREFIX, Hn as shellBoundedDisplay, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kn as setPasteableVerbFlags, Kt as injectiveKey, Ln as isInertUnquoted, Lt as buildLockContentionMessage, Nn as SHELL_ACTIVE_WHY, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as pasteableCommand, Rt as forceQuitRecoveryClause, Sn as StackHasActiveImportsError, T as RESOURCE_NOT_FOUND, Tn as SynthesisError, Un as shellQuote, Vn as quotedOrDescribed, Vt as formatLockOwner, Wn as withheldTargetClause, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as NestedStackChildDirectDestroyError, _r as isThrottlingError, ar as stripForDisplay, bn as ResourceTimeoutError, cn as DeployCancelledError, dn as IntrinsicResolutionRefusalError, en as clientDefaultsFor, fn as LocalInvokeBuildError$1, fr as isRetryableTransientError, ft as logicalIdShown, gn as MalformedProducerRecordRefusalError, gr as isMarkedNonRetryable, in as CdkdError, ir as stripControlChars, it as isInterruptedWaitError, jn as TIMEOUT_FLAG_RESOURCE_TYPE, kn as normalizeAwsError, lr as isAmbiguousOutcomeError, mr as retryClassificationText, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, pn as LocalStartServiceError, pr as isTransientServerError, rr as escapeRegExp, rt as interruptWatchListenerCount, s as readRecordedPrincipals, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as DynamicReferenceRegionAmbiguousError, vn as PartialFailureError, vr as markNonRetryable, wn as StateError, xn as ResourceUpdateNotSupportedError, yn as ProvisioningError, zt as formatLockExpiry } from "./iam-policy-targets-OtGPguLH.js";
-import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as pendingRequestCount, $a as refuseMalformedOutputs, $c as absoluteAssemblyPathEscape, $i as isImpossibleEmptyStoredAttribute, $n as noEchoExactEchoLeavesOf, $o as prefetchCreateOnlyPropertyPaths, $r as applyCustomResourceResponseExpiration, $s as buildDockerImage, $t as nameGenerationCarriedFrom, A as inheritedProvenanceForChildDiff, Aa as malformedLocalResourceEntriesWarning, Ac as resolveUseCdkBootstrapAssets, Ai as refuseUnreadableCdkCrossAccountRefs, Ao as NO_CC_HANDLERS_REASON, As as orphansAfterRollback, At as replayRollback, B as conditionFingerprint, Ba as malformedResourceEntriesWarning, Bc as decodeListingKey, Bi as sendableAssumeRoleCommand, Bn as yellow, Bs as loadPublishableAssetManifest, Bt as replacementNeverSwapped, Ca as hasReadableResources, Cc as loadCdkJson, Cn as bindingSkippedOutputs, Co as unreadableOrphanRecords, Cr as ledgerForStack, Cs as exportNamesCarriedFrom, Ct as sameJournaledOrphans, D as IMPLICIT_DELETE_DEPENDENCIES, Da as malformedExportNamesWarning, Dc as resolveSkipPrefix, Dn as constructPathOf, Dr as DeploymentEventsReader, Ds as importableOutputKeys, Ea as malformedDriftResourcePropertiesWarning, Ec as resolveCaptureObservedState, En as maskingRetryLogger, Eo as findActionableSilentDrops, Es as hasUnverifiableParameterRefusal, F as findNestedTemplateTreeDefect, Fa as malformedOrphansRefusalMessage, Fc as CFN_TEMPLATE_URL_LIMIT, Fi as applyRoleArnIfSet, Fn as bold, Fo as isStatefulRecreateTargetForReplace, Fs as isSensitiveAttributeName, Ft as isReplacementOrphan, G as withResourceDeadline, Ga as previewableOrphanRecords, Gc as AssemblyReader, Gi as classifyRecordedSecretRegion, Gn as removeSuperseded, Gr as wouldReturnToSdkProvider, Gs as ensureAssetStorage, H as parentSuppliedValues, Ha as malformedResourcesWarning, Hc as PARTITION_TABLE, Hi as applyCallerIdentityCredentials, Hn as deleteSupersededEntry, Hr as ProviderRegistry, Hs as AssetModeResolver, Ht as seedsDeleteFirstGuard, I as isAbsoluteAssetPath, Ia as malformedOrphansWarning, Ic as MIGRATE_TMP_PREFIX, Ii as assertFlagRoleArn, In as cyan, Io as isStatefulRecreateTargetSync, Is as stringifyValue, It as planFailedOps, J as keptWholeReasonText, Ja as refuseMalformedOrphanRecords, Jc as defineOwnKey, Ji as regionLessSecretName, Jn as supersededHolderOf, Jr as readsNoEchoDeleteValues, Js as parseBootstrapMarker, K as diffSecurity, Ka as refuseDivergentRecordRegionForDestroy, Kc as StageLoadError, Ki as classifyReplaySecretRegion, Kn as supersededAfterRollback, Ks as getBootstrapMarkerKey, Kt as inheritProducerRegions, L as listNestedTemplateRows, La as malformedOutputsRefusalMessage, Lc as findLargeInlineResources, Li as assertSendableRoleArn, Ln as gray, Lo as renderStatefulReason, Ls as WorkGraph, Lt as planRollback, M as findServiceTokenRefusals, Ma as malformedOrphanRecordsRefusalMessage, Mc as warnDeprecatedNoPrefixCliFlag, Mo as findReplacedReadersOfRecreateTargets, Ms as shouldRetainResource, Mt as recordAfterRollbackUpdate, N as serviceTokenBlockingReason, Na as malformedOrphanRecordsWarning, Nc as ssmResolvedValueType, Ni as recordedOutputReferenceRegions, Nn as withStackRecords, No as shownType, Ns as stackInstanceIdCarriedFrom, Nt as demoteSupersededOrphans, O as computeImplicitDeleteEdges, Oa as malformedExportSourceWarning, Oc as resolveStateBucketWithDefault, Oi as resolveDynamicReferences, On as findDestructiveChanges, Oo as unwrittenCreateOnlyReplacement, Or as DeploymentEventsStore, Os as importableOutputs, P as childTemplateLoader, Pa as malformedOrphanRowsKeptWarning, Pc as CFN_TEMPLATE_BODY_LIMIT, Pi as recordedReferenceRegions, Po as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ps as AssetPublisher, Pt as isJournaledOrphan, Q as planOrphanAdoption, Qa as refuseMalformedOrphansForOrphan, Qc as ownValue, Qi as getAccountInfo, Qn as noEchoComparisonForTemplate, Qr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Qs as buildDenyExternalAccessPolicy, Qt as updatePartialReason, R as renderNestedTemplateTreeDefect, Ra as malformedOutputsWarning, Rc as uploadCfnTemplate, Ri as explicitRoleArnOrThrow, Rn as green, Rs as buildAssetRedirectMap, Rt as recheckFailedPlan, Sa as hasReadableOutputs, Sc as getLegacyStateBucketName, Sn as isExportAliasCollision, So as unpreviewableOrphanRecords, Ss as describeRegionValueKind, St as makeForeignHolderScan, Ta as isReadableResourceEntry, Tc as resolveAutoAssetStorage, Tn as DEFAULT_RESOURCE_WARN_AFTER_MS, To as withheldAccountClause, Tr as withCreateTokenLedger, Ts as hasReasonlessBaselineRefusal, U as readRecordedConditionVerdicts, Ua as malformedScrubResourceEntriesRefusalMessage, Uc as canonicalizeRegion, Ui as callerEnvCredentials, Un as holdsSupersededResources, Ur as ccBrokenReason, Us as BOOTSTRAP_MARKER_PREFIX, Ut as orphanNeedsIdentity, V as conditionInputsFrom, Va as malformedResourcePropertiesWarning, Vc as expectedOwnerParam, Vi as AWS_CREDENTIAL_ENV_KEYS, Vn as addSuperseded, Vr as CC_BROKEN_REASON, Vs as rewriteTemplateAssetReferences, Vt as resolveReplacementOldType, Wa as malformedStateRefusalMessage, Wc as derivePartitionAndUrlSuffix, Wi as envCredentialsAreAssumedRole, Wn as isSupersededResourceRecord, Wr as isCustomResource, Ws as assertAssetBucketRegion, Wt as findNestedStackTypeChanges, X as makeCanonicalizePropertiesFn, Xa as refuseMalformedOrphans, Xc as hasPlainPrototype, Xi as isUnboundTemplateParameter, Xn as withoutSuperseded, Xs as validateAssetBucketName, Y as mergeNoChangeOutputs, Ya as refuseMalformedOrphanRecordsForDestroy, Yc as hasOwnKey, Yi as coerceParameterTypedValue, Yn as supersededResourcesOf, Yr as isCustomResourceType$1, Ys as readBootstrapMarkerBody, Z as makeSiblingClaimReader, Za as refuseMalformedOrphansForDestroy, Zc as nullPrototypeRecord, Zi as parameterTypeMayLoseSecretIdentity, Zn as noEchoAttributeNamesOf, Zr as withPrintingSecrets, Zs as validateContainerRepoName, Zt as updatePartialMessage, _a as UNREADABLE_RESOURCES_MAP_ROW, _c as AssetManifestLoader, _n as exportNameSecretExposure, _o as repairMalformedOrphansForReadOnly, _r as createPreDeleteFinalSnapshot, _s as isNotImplemented, _t as dropFailedCommands, a as isProtectionValueActive, aa as cfnRefValueFromPhysicalId, ac as finchSecretArgvRefusal, ai as UNSPECIFIED_SKIP_REASON, al as injectedAwsRegionValue, an as computeParameterTaint, ao as refuseMalformedResourceEntriesForImport, ar as namingSecretsWithRecordedNoEcho, at as displacedPhysicalIdShown, ba as displayLogicalId, bc as synthesisStatusMessage, bi as IntrinsicFunctionResolver, bn as collectDeclaredOutputNames, bo as repairMalformedResourcePropertiesForReadOnly, br as refusesFinalSnapshot, bs as splitImportedOps, bt as journaledOrphanLines, cc as isDockerClientEnvKey, ci as deleteSkipReason, cn as resourcesNamingDeclaredParameter, co as refuseMalformedResourcePropertiesForDestroy, cr as secretNamePrintingBags, cs as LockManager, ct as nestedChildStackName$1, dc as redactDockerArgvValues, dn as exportAliasCollisionScrubWarning, do as refuseMalformedResourcePropertiesForOrphan, dr as stateSecretNameNeedles, ds as rebuildClientForBucketRegion, dt as revertedNestedRowIds, ea as carriesDynamicReference, ec as resolveDockerContextDirectory, ei as customResourceResponseExpirationWarning, el as describeFileReadFailure, en as nameGenerationHighWaterOf, eo as refuseMalformedOutputsForDestroy, er as noEchoParameterNamesOf, es as templateResourceTypes, et as resolvePendingCloudControlRequests, fa as declaresNoEcho, fc as redactedCause, fn as secretBearing, fo as refuseMalformedResourcesForDeploy, fr as storedSecretNameNeedles, fs as CrossPrefixReadError, ft as withNestedRevertRun, ga as UNREADABLE_ORPHANS_CONTAINER_ROW, gc as warnFinchArgvExposure, gn as exportNameNoEchoParameters, go as repairMalformedOrphanRecordsForReadOnly, gr as ccRoutedFinalSnapshotError, gs as isAccessDenied, gt as deleteJournaledOrphans, ha as STATE_RESOURCES_MALFORMED, hc as runDockerStreaming, hn as carriedExportAliasExposure, ho as refuseMalformedState, hr as buildFinalSnapshotIdentifier, hs as crossPrefixDeniedWarning, ht as withNestedStackContext, i as PROTECTION_PROPERTY_BY_TYPE, ia as AWS_NO_VALUE, ic as dockerSpawnEnvWithSensitive, ii as RollbackInlinePolicyWriters, il as injectAwsRegion, in as retiredNameGenerationsLeaving, io as refuseMalformedResourceEntriesForDestroy, ir as maskEventTextWithBoundBags, it as displacedOpClause, j as deferredServiceTokenWarning, ja as malformedLocalResourcesWarning, jc as stateBucketExistenceConfirmed, ji as keepHeldTokenProvenance, jn as destroyStackRecordsView, jo as hasNoCloudControlHandlers, js as orphansCarriedFrom, jt as removeProtectionTypeList, k as crossStackOutputProvenanceSource, ka as malformedLocalOutputsWarning, kc as resolveStateBucketWithDefaultAndSource, ki as producerLookupOver, kn as formatDestructiveChange, kr as extractDeploymentEventError, ks as isReadableBag, kt as replayFailedOperations, la as withSharedDrainBudget, lc as isMalformedEnvKey, ln as WITHHELD_NAME_DISPLAY, lo as refuseMalformedResourcePropertiesForDrift, ls as isLockInfoExpired, lt as recordDisplacedSkips, ma as STATE_REGION_DIVERGED, mc as runDockerForeground, mn as secretSafeKeyDisplay, mo as refuseMalformedResourcesForExport, mr as PRE_DELETE_SNAPSHOT_TYPES, ms as applyCrossPrefixScan, mt as getCurrentNestedStackContext, n as recordedProtectionEvidence, na as isNamelessDynamicReferenceError, nc as describeDockerExecFailure, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, nn as retiredAfterRollback, no as refuseMalformedResourceEntries, nr as completedReplayEntries, ns as withRetry, nt as recordRetainedForReadoption, o as perType, oa as isStalePlaceholderArnAttribute, oc as formatDockerLoginError, oi as deleteIndeterminateGuards, on as namesAnyDeclaredParameter, oo as refuseMalformedResourceEntriesForImportSave, or as orphanRecordsPrintingBag, os as DagBuilder, ot as dropSettledNestedJournals, pa as JSON_LISTING_HOLE_VALUE, pc as redactedDockerCause, pn as secretBearingStateKeyWarning, po as refuseMalformedResourcesForDestroy, pr as ATOMIC_FINAL_SNAPSHOT_TYPES, ps as CrossPrefixScanCache, pt as collectNestedChildUnaddressed, q as isSecretBearingReferenceString, qc as processStackMessages, qi as producerRegionsFromState, qn as supersededHeldByOtherTypeWarning, qr as TemplateNoEchoReresolver, qs as isCrossRegionRedirect, r as recordedProtectionNote, ra as keepsSecretReferenceToken, rc as describeDockerFailure, rl as resolveAssemblyPath, rn as retiredNameGenerationsAfter, ro as refuseMalformedResourceEntriesForDeploy, rr as journaledOrphanPrintingBag, rt as NESTED_PENDING_PARENT_REASON, s as readProtection, sa as refStateLookupFromResource, sc as getDockerCmd, si as deleteLeftInPlace, sl as resolveBucketRegion, sn as reachableDivergentParameters, so as refuseMalformedResourceEntriesForOrphan, sr as secretNamePrintingBag, ss as TemplateParser, t as DeployEngine, ta as carriesFetchableDynamicReference, tc as describeDockerCapturedOutput, ti as CloudControlProvider, tl as displayAssemblyPath, tn as nameScopeOf, to as refuseMalformedResourceAttributesForOrphan, tr as createReadOnlyAttributeHealerFactory, ts as describeTypeWithThrottleRetry, tt as keptForRetainedRecord, ua as parameterInputsFor, uc as partitionSensitiveEnv, ui as isWaitAbandonedError, un as displayTextOrWithheld, uo as refuseMalformedResourcePropertiesForExport, ur as secretNamedRecordNeedles, us as S3StateBackend, va as accountArgs, vc as getDockerImageBySourceHash, vi as DiffCalculator, vn as isWholeDynamicReferenceValue, vo as repairMalformedOutputsForReadOnly, vr as effectiveDeletionPolicy, vs as stackInstanceIdOf, vt as dropFailedHint, wa as isReadableOrphanRecord, wc as resolveApp, wn as DEFAULT_RESOURCE_TIMEOUT_MS, wo as unreadableResourceEntries, ws as hasReadableExportSet, wt as formatResourceLine, xa as hasReadableOrphans, xc as getDefaultStateBucketName, xi as poisonRenderedSpellingsCollidingIn, xn as collectPublishedOutputNames, xo as repairMalformedResourcesForReadOnly, xr as unsupportedFinalSnapshotError, xs as acceptedCreateOnlyDropsOf, xt as loadJournaledOrphans, ya as deployRefusesOrphanRowsReason, yc as Synthesizer, yi as INTRINSIC_KEYS, yn as noEchoParameterValueSeed, yo as repairMalformedResourceEntriesForReadOnly, yr as isFinalSnapshotError, ys as withStackInstanceIdWithheld, yt as isHandledOrphan, z as templateIdentity, za as malformedRenderedContainersWarning, zc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zi as isIamRoleArn, zn as red, zs as createAssetRedirectResolver, zt as recordUnderIdIsNotOwn } from "./deploy-engine-D9SDE-Pj.js";
-import { $ as recordLogOnlyParameterValue, Cn as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ct as DYNAMIC_REFERENCE_TOKEN_SCAN, Dt as pathCrossesDottedKey, Et as isUncertifiedBaselineMaskPosition, F as redactForState, G as carryLogOnlyValues, It as recordNestedStackParameterExpressions, Jt as physicalNameCopiesOf, Ot as identityKeyFor, Q as printingCorpusOf, S as liveMatchesUnresolvedTokenFrame, Tn as isSingleDynamicReferenceToken, Tt as dynamicReferenceTokens, X as literalSplitDelimitersOf, Xt as recordPhysicalNameCopy, Y as hasMaskableValues, Z as logOnlyValueCount, _n as recordMaskOnlyValuesIn, a as maskReadbackAtCoordinates, at as errorCauseChain, b as valueAtCoordinate, bn as recordProvenPublicExpression, bt as withPhysicalNameCopies, ct as maskSecretsInText, d as noEchoOutputsComparison, g as readsNoEchoSource, gn as recordMaskOnlyValue, h as readbackPathFor, i as maskAtCoordinates, it as createSecretMasker, kt as inheritNestedStackParameterAssociations, l as noEchoCoordinatesOf, nn as carriesSecretMask, nt as shareLogOnlyValues, o as maskWholeValue, pn as provenPublicValue, q as createUnionSecretMasker, r as isMarkedCoordinate, rt as unionOfSecretBags, s as maskedLeafCoordinatesOf, st as maskSecretsInError, t as canonicalCoordinates, tn as splitGetAttStringForm, tt as recordLogOnlyValue, u as noEchoLeavesOf, v as recordedNoEchoValuesOf, vn as recordNoEchoAttributeValues, vt as scrubResourceRecord, xn as wholeStringLeavesOf, yn as recordNoEchoParameterFreshValue } from "./secret-redaction-BHWS-PZK.js";
-import { t as getCdkdVersion } from "./version-DDpKuzTw.js";
+import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-BJ7dmM_T.js";
+import { $ as stringifyJsonPayload, A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, Q as safeMsg, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, W as cutMarker, Y as isPasteableIdent, Z as plainIdentOr, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, b as derivesPatternBName, c as isStdoutReservedForPayload, d as runStackBuffered, et as terminalSafe, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, q as displaySafe, s as getLogger, tt as truncateCodePoints, x as explicitNamePropertyFor, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-w5_iao51.js";
+import { An as StateError, Cn as NestedStackChildDirectDestroyError, Cr as markNonRetryable, Dn as ResourceUpdateNotSupportedError, E as isMarkedNotGone, En as ResourceTimeoutError, Fn as normalizeAwsError, Gt as formatLockExpiry, Ht as buildForceUnlockCommand, I as remedyLogicalId, In as withErrorHandling, Jn as shellBoundedDisplay, Kn as plainOrDescribed, Kt as formatLockOperation, Ln as TIMEOUT_FLAG_RESOURCE_TYPE, Mn as formatError, O as assertRegionMatch, On as StackHasActiveImportsError, Qn as setPasteableVerbFlags, Qt as injectiveKey, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Un as isInertUnquoted, Ut as buildLockContentionMessage, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Wt as forceQuitRecoveryClause, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Yn as shellQuote, Z as runDeleteAttempt, Zn as setPasteableRunFlags, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp, ct as endCommandInterruptScope, en as producerCoordinateKey, fn as CrossAccountSecretRefusalError, gn as DynamicReferenceRegionAmbiguousError, in as ambientClientDefaults, jn as SynthesisError, k as VALUE_NOT_SHOWN, kn as StackTerminationProtectionError, lr as stripControlChars, lt as interruptWatchListenerCount, mn as DeployCancelledError, mr as isAmbiguousOutcomeError, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as setPasteableAwsProfile, on as clientDefaultsFor, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, s as readRecordedPrincipals, sn as credentialFingerprint, st as beginCommandInterruptScope, t as IAM_PRINCIPAL_NAME, tn as producerRecordKey, un as CdkdError, ur as stripForDisplay, ut as isInterruptedWaitError, vn as LocalInvokeBuildError$1, vr as isTransientServerError, vt as logicalIdShown, wn as PartialFailureError, xr as isMarkedNonRetryable, yn as LocalStartServiceError, yr as retryClassificationText, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-NZn9Idzv.js";
+import { a as setAssumedRoleCredentials, d as formatAuthority, i as getPreAssumeEnvCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as runInStackAwsScope } from "./aws-client-defaults-BX9Y_fKp.js";
+import { $ as pendingRequestCount, $a as malformedLocalResourcesWarning, $c as importableOutputKeys, $i as keepHeldTokenProvenance, $l as resolveApp, $n as destroyStackRecordsView, $o as hasNoCloudControlHandlers, $s as logOnlyValueCount, $t as seedsDeleteFirstGuard, A as inheritedProvenanceForChildDiff, Ac as recordProvenPublicExpression, Ai as deleteSkipReason, Al as describeDockerCapturedOutput, An as isWholeDynamicReferenceValue, Ao as refuseMalformedResourcePropertiesForDestroy, Ar as secretNamePrintingBags, As as canonicalCoordinates, At as readRefactorMarkerOnce, Au as ownValue, B as conditionFingerprint, Ba as accountArgs, Bc as applyCrossPrefixScan, Bi as DiffCalculator, Bl as redactDockerArgvValues, Bn as findDestructiveChanges, Bo as repairMalformedOutputsForReadOnly, Br as effectiveDeletionPolicy, Bs as readbackPathFor, Bt as replayFailedOperations, Ca as carriesFetchableDynamicReference, Cc as splitGetAttStringForm, Ci as CloudControlProvider, Cl as parseBootstrapMarker, Cn as exportAliasCollisionScrubWarning, Co as refuseMalformedResourceAttributesForOrphan, Cr as createReadOnlyAttributeHealerFactory, Cs as describeTypeWithThrottleRetry, Ct as sameJournaledOrphans, Cu as describeJsonParseFailure, D as IMPLICIT_DELETE_DEPENDENCIES, Da as cfnRefValueFromPhysicalId, Dc as recordMaskOnlyValuesIn, Di as UNSPECIFIED_SKIP_REASON, Dl as buildDenyExternalAccessPolicy, Dn as carriedExportAliasExposure, Do as refuseMalformedResourceEntriesForImport, Dr as namingSecretsWithRecordedNoEcho, Du as hasOwnKey, Ea as AWS_NO_VALUE, Ec as recordMaskOnlyValue, Ei as RollbackInlinePolicyWriters, El as validateContainerRepoName, En as secretSafeKeyDisplay, Eo as refuseMalformedResourceEntriesForDestroy, Er as maskEventTextWithBoundBags, Eu as defineOwnKey, F as findNestedTemplateTreeDefect, Fa as JSON_LISTING_HOLE_VALUE, Fc as isLockInfoExpired, Fl as formatDockerLoginError, Fn as bindingSkippedOutputs, Fo as refuseMalformedResourcesForDestroy, Fr as ATOMIC_FINAL_SNAPSHOT_TYPES, Fs as maskedLeafCoordinatesOf, Ft as updateRefactorMarker, Fu as resolveAssemblyPath, G as withResourceDeadline, Ga as hasReadableResources, Gc as withStackInstanceIdWithheld, Gl as warnFinchArgvExposure, Gn as rollbackOrphanIds, Go as unreadableOrphanRecords, Gr as ledgerForStack, Gt as isJournaledOrphan, H as parentSuppliedValues, Ha as displayLogicalId, Hc as isAccessDenied, Hi as IntrinsicFunctionResolver, Hl as redactedDockerCause, Hn as findRefactorHints, Ho as repairMalformedResourcePropertiesForReadOnly, Hr as refusesFinalSnapshot, Hs as recordedNoEchoValuesOf, Ht as removeProtectionTypeList, I as isAbsoluteAssetPath, Ia as STATE_REGION_DIVERGED, Ic as S3StateBackend, Il as getDockerCmd, In as DEFAULT_RESOURCE_TIMEOUT_MS, Io as refuseMalformedResourcesForExport, Ir as PRE_DELETE_SNAPSHOT_TYPES, Is as noEchoCoordinatesOf, It as hasPendingMovesOut, Iu as injectAwsRegion, J as keptWholeReasonText, Ja as malformedDriftResourcePropertiesWarning, Jc as describeRegionValueKind, Jl as Synthesizer, Jn as looselyEqual, Jo as findActionableSilentDrops, Jt as planRollback, K as diffSecurity, Ka as isReadableOrphanRecord, Kc as splitImportedOps, Kl as AssetManifestLoader, Kn as withMovedTo, Ko as unreadableResourceEntries, Ks as redactForState, Kt as isReplacementOrphan, L as listNestedTemplateRows, La as STATE_RESOURCES_MALFORMED, Lc as rebuildClientForBucketRegion, Ll as isDockerClientEnvKey, Ln as DEFAULT_RESOURCE_WARN_AFTER_MS, Lo as refuseMalformedState, Lr as buildFinalSnapshotIdentifier, Ls as noEchoLeavesOf, Lt as pendingMovesOutOf, Lu as injectedAwsRegionValue, M as findServiceTokenRefusals, Ma as parameterInputsFor, Mc as WHOLE_DYNAMIC_REFERENCE_PATTERN, Mi as isWaitAbandonedError, Ml as describeDockerFailure, Mn as collectDeclaredOutputNames, Mo as refuseMalformedResourcePropertiesForExport, Mr as secretNamedRecordNeedles, Ms as maskAtCoordinates, Mt as refactorMarkerRefusalMessage, Mu as describeFileReadFailure, N as serviceTokenBlockingReason, Nc as isSingleDynamicReferenceToken, Nl as dockerSpawnEnvWithSensitive, Nn as collectPublishedOutputNames, No as refuseMalformedResourcePropertiesForOrphan, Nr as stateSecretNameNeedles, Ns as maskReadbackAtCoordinates, Nt as refuseRefactorMarker, Nu as displayAssemblyPath, O as computeImplicitDeleteEdges, Oa as isStalePlaceholderArnAttribute, Oc as recordNoEchoAttributeValues, Oi as deleteIndeterminateGuards, Ol as buildDockerImage, On as exportNameNoEchoParameters, Oo as refuseMalformedResourceEntriesForImportSave, Or as orphanRecordsPrintingBag, Os as DagBuilder, Ou as hasPlainPrototype, P as childTemplateLoader, Pa as declaresNoEcho, Pc as LockManager, Pl as finchSecretArgvRefusal, Pn as isExportAliasCollision, Po as refuseMalformedResourcesForDeploy, Pr as storedSecretNameNeedles, Ps as maskWholeValue, Pt as sameMove, Pu as renderAssemblyPathEscape, Q as planOrphanAdoption, Qa as malformedLocalResourceEntriesWarning, Qc as hasUnverifiableParameterRefusal, Qi as refuseUnreadableCdkCrossAccountRefs, Ql as loadCdkJson, Qo as NO_CC_HANDLERS_REASON, Qs as literalSplitDelimitersOf, Qt as resolveReplacementOldType, R as renderNestedTemplateTreeDefect, Ra as UNREADABLE_ORPHANS_CONTAINER_ROW, Rc as CrossPrefixReadError, Rl as isMalformedEnvKey, Rn as maskingRetryLogger, Ro as repairMalformedOrphanRecordsForReadOnly, Rr as ccRoutedFinalSnapshotError, Rs as noEchoOutputsComparison, Rt as pendingMovesRefusalMessage, Sa as carriesDynamicReference, Sc as recordPhysicalNameCopy, Si as customResourceResponseExpirationWarning, Sl as isCrossRegionRedirect, Sn as displayTextOrWithheld, So as refuseMalformedOutputsForDestroy, Sr as noEchoParameterNamesOf, Ss as templateResourceTypes, St as makeForeignHolderScan, Su as processStackMessages, Ta as keepsSecretReferenceToken, Tc as provenPublicValue, Tl as validateAssetBucketName, Tn as secretBearingStateKeyWarning, To as refuseMalformedResourceEntriesForDeploy, Tr as journaledOrphanPrintingBag, Tu as utf8ByteLength, U as readRecordedConditionVerdicts, Ua as hasReadableOrphans, Uc as isNotImplemented, Ui as poisonRenderedSpellingsCollidingIn, Ul as runDockerForeground, Un as hintSidesOf, Uo as repairMalformedResourcesForReadOnly, Ur as unsupportedFinalSnapshotError, Us as valueAtCoordinate, Ut as recordAfterRollbackUpdate, V as conditionInputsFrom, Va as deployRefusesOrphanRowsReason, Vc as crossPrefixDeniedWarning, Vi as INTRINSIC_KEYS, Vl as redactedCause, Vn as formatDestructiveChange, Vo as repairMalformedResourceEntriesForReadOnly, Vr as isFinalSnapshotError, Vs as readsNoEchoSource, Vt as replayRollback, Wa as hasReadableOutputs, Wc as stackInstanceIdOf, Wl as runDockerStreaming, Wn as movedToHint, Wo as unpreviewableOrphanRecords, Ws as liveMatchesUnresolvedTokenFrame, Wt as demoteSupersededOrphans, X as makeCanonicalizePropertiesFn, Xa as malformedExportSourceWarning, Xc as hasReadableExportSet, Xi as resolveDynamicReferences, Xl as getDefaultStateBucketName, Xn as parseMappingFile, Xo as unwrittenCreateOnlyReplacement, Xr as DeploymentEventsStore, Xs as createUnionSecretMasker, Xt as recordUnderIdIsNotOwn, Y as mergeNoChangeOutputs, Ya as malformedExportNamesWarning, Yc as exportNamesCarriedFrom, Yl as synthesisStatusMessage, Yn as mappingPairs, Yr as DeploymentEventsReader, Ys as carryLogOnlyValues, Yt as recheckFailedPlan, Z as makeSiblingClaimReader, Za as malformedLocalOutputsWarning, Zc as hasReasonlessBaselineRefusal, Zi as producerLookupOver, Zl as getLegacyStateBucketName, Zn as proposeRenames, Zr as extractDeploymentEventError, Zs as hasMaskableValues, Zt as replacementNeverSwapped, _a as coerceParameterTypedValue, _c as inheritNestedStackParameterAssociations, _i as isCustomResourceType$1, _l as AssetModeResolver, _n as computeParameterTaint, _o as refuseMalformedOrphanRecordsForDestroy, _r as supersededResourcesOf, _t as dropFailedCommands, _u as PARTITION_TABLE, a as isProtectionValueActive, aa as assertSendableRoleArn, ac as createSecretMasker, al as stackInstanceIdCarriedFrom, ao as malformedOutputsRefusalMessage, ar as gray, as as renderStatefulReason, at as displacedPhysicalIdShown, au as resolveUseCdkBootstrapAssets, ba as getAccountInfo, bc as physicalNameCopiesOf, bi as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, bl as ensureAssetStorage, bn as resourcesNamingDeclaredParameter, bo as refuseMalformedOrphansForOrphan, br as noEchoComparisonForTemplate, bt as journaledOrphanLines, bu as AssemblyReader, ca as sendableAssumeRoleCommand, cc as maskSecretsInText, cl as timePhase, cn as updatePartialMessage, co as malformedResourceEntriesWarning, cr as yellow, ct as nestedChildStackName$1, cu as ssmResolvedValueType, da as callerEnvCredentials, di as ccBrokenReason, dl as stringifyValue, dn as nameGenerationHighWaterOf, do as malformedScrubResourceEntriesRefusalMessage, dr as holdsSupersededResources, dt as revertedNestedRowIds, du as MIGRATE_TMP_PREFIX, ec as printingCorpusOf, el as importableOutputs, en as orphanNeedsIdentity, eo as malformedOrphanRecordsRefusalMessage, es as findReplacedReadersOfRecreateTargets, et as resolvePendingCloudControlRequests, eu as resolveAutoAssetStorage, fa as envCredentialsAreAssumedRole, fc as DYNAMIC_REFERENCE_TOKEN_SCAN, fi as isCustomResource, fl as WorkGraph, fn as nameScopeOf, fo as malformedStateRefusalMessage, fr as isSupersededResourceRecord, ft as withNestedRevertRun, fu as findLargeInlineResources, ga as regionLessSecretName, gc as identityKeyFor, gi as readsNoEchoDeleteValues, gl as rewriteTemplateAssetReferences, gn as withNameGenerationReached, go as refuseMalformedOrphanRecords, gr as supersededHolderOf, gt as deleteJournaledOrphans, gu as expectedOwnerParam, ha as producerRegionsFromState, hc as pathCrossesDottedKey, hi as TemplateNoEchoReresolver, hl as loadPublishableAssetManifest, hn as retiredNameGenerationsLeaving, hr as supersededHeldByOtherTypeWarning, ht as withNestedStackContext, hu as decodeListingKey, i as PROTECTION_PROPERTY_BY_TYPE, ia as assertFlagRoleArn, ic as unionOfSecretBags, il as shouldRetainResource, io as malformedOrphansWarning, ir as cyan, is as isStatefulRecreateTargetSync, it as displacedOpClause, iu as resolveStateBucketWithDefaultAndSource, j as deferredServiceTokenWarning, ja as withSharedDrainBudget, jc as wholeStringLeavesOf, jl as describeDockerExecFailure, jn as noEchoParameterValueSeed, jo as refuseMalformedResourcePropertiesForDrift, js as isMarkedCoordinate, jt as refactorMarkerMovesOf, ju as absoluteAssemblyPathEscape, k as crossStackOutputProvenanceSource, ka as refStateLookupFromResource, kc as recordNoEchoParameterFreshValue, ki as deleteLeftInPlace, kl as resolveDockerContextDirectory, kn as exportNameSecretExposure, ko as refuseMalformedResourceEntriesForOrphan, kr as secretNamePrintingBag, ks as TemplateParser, kt as readRefactorMarker, ku as nullPrototypeRecord, la as AWS_CREDENTIAL_ENV_KEYS, lc as scrubResourceRecord, li as CC_BROKEN_REASON, ll as AssetPublisher, ln as updatePartialReason, lo as malformedResourcePropertiesWarning, lr as addSuperseded, lt as recordDisplacedSkips, lu as CFN_TEMPLATE_BODY_LIMIT, ma as classifyReplaySecretRegion, mc as isUncertifiedBaselineMaskPosition, ml as createAssetRedirectResolver, mn as retiredNameGenerationsAfter, mo as refuseDivergentRecordRegionForDestroy, mr as supersededAfterRollback, mt as getCurrentNestedStackContext, mu as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, n as recordedProtectionEvidence, na as recordedReferenceRegions, nc as recordLogOnlyValue, nl as orphansAfterRollback, no as malformedOrphanRowsKeptWarning, ns as MULTI_REGION_RECREATE_BLOCKED_TYPES, nt as recordRetainedForReadoption, nu as resolveSkipPrefix, o as perType, oa as explicitRoleArnOrThrow, oc as errorCauseChain, ol as PhaseClock, oo as malformedOutputsWarning, or as green, ot as dropSettledNestedJournals, ou as stateBucketExistenceConfirmed, pa as classifyRecordedSecretRegion, pc as dynamicReferenceTokens, pi as wouldReturnToSdkProvider, pl as buildAssetRedirectMap, pn as retiredAfterRollback, po as previewableOrphanRecords, pr as removeSuperseded, pt as collectNestedChildUnaddressed, pu as uploadCfnTemplate, q as isSecretBearingReferenceString, qa as isReadableResourceEntry, qc as acceptedCreateOnlyDropsOf, ql as getDockerImageBySourceHash, qn as isPairableType, qo as withheldAccountClause, qr as withCreateTokenLedger, qt as planFailedOps, r as recordedProtectionNote, ra as applyRoleArnIfSet, rc as shareLogOnlyValues, rl as orphansCarriedFrom, rn as inheritProducerRegions, ro as malformedOrphansRefusalMessage, rr as bold, rs as isStatefulRecreateTargetForReplace, rt as NESTED_PENDING_PARENT_REASON, ru as resolveStateBucketWithDefault, s as readProtection, sa as isIamRoleArn, sc as maskSecretsInError, sl as renderPhaseTimings, so as malformedRenderedContainersWarning, sr as red, su as warnDeprecatedNoPrefixCliFlag, t as DeployEngine, ta as recordedOutputReferenceRegions, tc as recordLogOnlyParameterValue, tl as isReadableBag, tn as findNestedStackTypeChanges, to as malformedOrphanRecordsWarning, tr as withStackRecords, ts as shownType, tt as keptForRetainedRecord, tu as resolveCaptureObservedState, ua as applyCallerIdentityCredentials, uc as withPhysicalNameCopies, ui as ProviderRegistry, ul as isSensitiveAttributeName, un as nameGenerationCarriedFrom, uo as malformedResourcesWarning, ur as deleteSupersededEntry, uu as CFN_TEMPLATE_URL_LIMIT, va as isUnboundTemplateParameter, vc as recordNestedStackParameterExpressions, vl as BOOTSTRAP_MARKER_PREFIX, vn as namesAnyDeclaredParameter, vo as refuseMalformedOrphans, vr as withoutSuperseded, vt as dropFailedHint, vu as canonicalizeRegion, wa as isNamelessDynamicReferenceError, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, wl as readBootstrapMarkerBody, wn as secretBearing, wo as refuseMalformedResourceEntries, wr as completedReplayEntries, ws as withRetry, wt as formatResourceLine, wu as parseFailureDebugDetail, xa as isImpossibleEmptyStoredAttribute, xi as applyCustomResourceResponseExpiration, xl as getBootstrapMarkerKey, xn as WITHHELD_NAME_DISPLAY, xo as refuseMalformedOutputs, xr as noEchoExactEchoLeavesOf, xs as prefetchCreateOnlyPropertyPaths, xt as loadJournaledOrphans, xu as StageLoadError, ya as parameterTypeMayLoseSecretIdentity, yi as withPrintingSecrets, yl as assertAssetBucketRegion, yn as reachableDivergentParameters, yo as refuseMalformedOrphansForDestroy, yr as noEchoAttributeNamesOf, yt as isHandledOrphan, yu as derivePartitionAndUrlSuffix, z as templateIdentity, za as UNREADABLE_RESOURCES_MAP_ROW, zc as CrossPrefixScanCache, zl as partitionSensitiveEnv, zn as constructPathOf$1, zo as repairMalformedOrphansForReadOnly, zr as createPreDeleteFinalSnapshot, zt as refusePendingMovesOut, zu as resolveBucketRegion } from "./deploy-engine-Bx98Q92J.js";
+import { t as getCdkdVersion } from "./version-BhQymxXT.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -21,12 +20,13 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { BatchDeleteImageCommand, DeleteRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
-import { promisify } from "node:util";
+import { isDeepStrictEqual, promisify } from "node:util";
 import graphlib from "graphlib";
 import { Command, InvalidArgumentError, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
-import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
+import { Document, Pair, Scalar, YAMLError, YAMLMap, YAMLSeq, isScalar, parse, parseDocument, stringify, visit } from "yaml";
+import { emitKeypressEvents } from "node:readline";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, recordAssumedRole, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { createServer } from "node:net";
@@ -130,7 +130,7 @@ function parseResourceTimeoutToken(flagName) {
 		try {
 			ms = parseDuration(durationPart);
 		} catch (err) {
-			const inner = err instanceof Error ? err.message : String(err);
+			const inner = describeAwsFailure(err).detail;
 			throw new Error(`Invalid ${flagName} value "${raw}": ${inner}`);
 		}
 		acc.perTypeMs[typePart] = ms;
@@ -249,7 +249,7 @@ const allowUnaddressedOption = new Option("--allow-unaddressed", "Exit 0 even wh
 const noCfnFallbackOption = new Option("--no-cfn-fallback", "Do not fall back to CloudFormation (ListExports / stack outputs) when an Fn::ImportValue / Fn::GetStackOutput reference is not found in cdkd state (default: fall back, so producers still managed by CloudFormation can be referenced)");
 const annotationMessageOptions = [new Option("--strict", "Do not proceed with stacks carrying warning annotations").default(false), new Option("--ignore-errors", "Ignore error annotations from stack synthesis, which will likely produce an invalid deployment").default(false)];
 const deployOptions = [
-	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
+	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(20).argParser((value) => parseInt(value, 10)),
 	new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
 	new Option("--asset-publish-concurrency <number>", "Maximum concurrent asset publish operations (S3 uploads + ECR push)").default(8).argParser((value) => parseInt(value, 10)),
 	new Option("--image-build-concurrency <number>", "Maximum concurrent Docker image builds").default(4).argParser((value) => parseInt(value, 10)),
@@ -2261,14 +2261,6 @@ function mapsEqual(a, b) {
 	}
 	return true;
 }
-function describeParseFailure(err, bytes) {
-	const raw = err instanceof Error ? err.message : String(err);
-	const at = /at position (\d+)/.exec(raw);
-	return `invalid JSON${at ? ` at code-unit position ${at[1]}` : ""}; ${bytes} byte(s) read`;
-}
-function utf8ByteLength(body) {
-	return Buffer.byteLength(body, "utf8");
-}
 function describeIndexVersion(value) {
 	return typeof value === "number" ? String(value) : `a non-numeric value (${typeof value})`;
 }
@@ -2348,7 +2340,7 @@ var ExportIndexStore = class {
 		if (this.loadState.kind === "loaded") return new Map(this.loadState.entries);
 		const outcome = await this.loadPersisted();
 		if (outcome.kind === "missing") return void 0;
-		if (outcome.kind === "corrupt") throw new Error(`Exports index at ${this.indexKey()} could not be parsed (${describeParseFailure(outcome.error, outcome.bytes)}). Its contents were NOT examined.`);
+		if (outcome.kind === "corrupt") throw new Error(`Exports index at ${this.indexKey()} could not be parsed (${describeJsonParseFailure(outcome.error, outcome.bytes)}). Its contents were NOT examined.`);
 		return new Map(outcome.entries);
 	}
 	async patchEntry(exportName, entry, opts = {}) {
@@ -2434,7 +2426,7 @@ var ExportIndexStore = class {
 				return;
 			}
 			if (outcome.kind === "corrupt") {
-				this.logger.warn(`Exports index corrupt (${outcome.error instanceof Error ? outcome.error.message : String(outcome.error)}); rebuilding from state.json files`);
+				this.logger.warn(`Exports index corrupt (${describeJsonParseFailure(outcome.error, outcome.bytes)}); rebuilding from state.json files`);
 				await this.rebuild();
 				return;
 			}
@@ -2718,7 +2710,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CDtquwkU.js");
+	providerClasses ??= import("./provider-classes-g1s3vsUl.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3226,7 +3218,10 @@ var CrossPrefixGuard = class {
 //#endregion
 //#region src/cli/commands/deploy.ts
 async function deployCommand(stacks, options) {
+	const runClock = new PhaseClock("run", { fromProcessStart: true });
+	runClock.lap("node startup + module load");
 	const providerClasses = await loadProviderClasses();
+	runClock.lap("provider load");
 	const logger = getLogger();
 	if (options.verbose) {
 		logger.setLevel("debug");
@@ -3296,6 +3291,19 @@ async function deployCommand(stacks, options) {
 			})
 		};
 	})();
+	const callerIdentityPromise = (async () => {
+		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+		const stsClient = new STSClient({
+			...awsClientDefaults(),
+			region
+		});
+		try {
+			return await stsClient.send(new GetCallerIdentityCommand({}));
+		} finally {
+			stsClient.destroy();
+		}
+	})();
+	callerIdentityPromise.catch(() => void 0);
 	let deployInterrupted = false;
 	const topLevelSigintHandler = () => {
 		if (deployInterrupted) {
@@ -3322,7 +3330,9 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
 			deferMacroExpansion: true
 		};
-		const [result, statePrep] = await Promise.all([synthesizer.synthesize(synthOptions), statePrepPromise]);
+		runClock.lap("config, region, credentials");
+		const [result, statePrep] = await Promise.all([timePhase("run", "synth (beside the state bucket prep)", () => synthesizer.synthesize(synthOptions)), timePhase("run", "state bucket prep (beside synth)", () => statePrepPromise)]);
+		runClock.lap("synth + state bucket prep");
 		const { stateBucket, preflightStateBackend, exportIndexStore } = statePrep;
 		preflightBackendForCleanup = preflightStateBackend;
 		synthOptions.stateBucket = stateBucket;
@@ -3410,14 +3420,11 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		const stackRegions = new Map(await Promise.all(targetStacks.map(async (s) => [s, await regionForStack(s.stackName, s.region)])));
 		refuseStackNameRegionCollisions(sameNamedAppStacks, (s) => stackRegions.get(s) ?? s.region, selectedSet);
 		const crossPrefixGuard = new CrossPrefixGuard(preflightStateBackend, { readOnly: options.dryRun === true });
+		runClock.lap("stack selection, stack regions");
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
-		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const stsClient = new STSClient({
-			...awsClientDefaults(),
-			region
-		});
-		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
-		stsClient.destroy();
+		runClock.lap("macro expansion");
+		const accountId = (await callerIdentityPromise).Account;
+		runClock.lap("caller identity");
 		const assetPublisher = new AssetPublisher();
 		const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
 		const autoAssetStorage = resolveAutoAssetStorage(options.autoAssetStorage);
@@ -3644,7 +3651,8 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					...approveDeployment && {
 						requireApproval,
 						approveDeployment
-					}
+					},
+					...stackInfo.terminationProtection === true && { terminationProtection: true }
 				};
 				const stackDeployEngine = new DeployEngine(stackStateBackend, stackLockManager, dagBuilder, diffCalculator, stackProviderRegistry, deployEngineOptions, stackRegion, exportIndexStore);
 				const deployResult = await withNestedStackContext({
@@ -3727,12 +3735,13 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			if (reach.unmatched.length > 0) throw new CdkdError(reach.errorMessage, "PIN_CC_API_INVALID");
 			for (const partial of reach.partial) logger.info(`--pin-cc-api ${partial.logicalId}: applies to ${partial.appliesTo.join(", ")}; not declared by ${partial.absentFrom.join(", ")}`);
 		}
+		runClock.lap("work graph build, recreate checks");
 		await workGraph.execute({
 			"asset-build": options.imageBuildConcurrency,
 			"asset-publish": options.assetPublishConcurrency,
 			stack: options.stackConcurrency
 		}, async (node) => {
-			if (node.type === "asset-build" || node.type === "asset-publish") await assetPublisher.executeNode(node);
+			if (node.type === "asset-build" || node.type === "asset-publish") await timePhase("run", node.type, () => assetPublisher.executeNode(node), node.id);
 			else {
 				const { stack: stackInfo } = node.data;
 				if (!bufferStackOutput) {
@@ -3746,10 +3755,12 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		});
 		if (totalUnaddressed > 0 && !options.allowUnaddressed) throw new PartialFailureError(`Deploy left ${totalUnaddressed} resource(s) unaddressed, so they may still exist in AWS. The two cases differ in what happens next: a DELETE the provider could not issue KEEPS its state record, so the next 'cdkd deploy' re-attempts it, while a replacement's surviving predecessor is NOT tracked and will never be retried — delete it by hand. ` + (totalCrossPrefixKept > 0 ? "A replacement kept because another state prefix records the stack, or the check could not run, keeps its old resource and applies no new value — resolve the pair, or let the check run, and re-deploy. " : "") + "The per-stack summaries above give the breakdown, and each resource's own warning names its cause and remedy. " + (cancelledStacks > 0 ? `Note ${cancelledStacks} stack(s) were also cancelled and never deployed, so the template is not fully applied beyond the resources named above. ` : "") + `Pass --allow-unaddressed to exit 0 instead.`);
 	} finally {
+		runClock.lap("assets + stacks, summary");
 		unforwardSigterm();
 		process.removeListener("SIGINT", topLevelSigintHandler);
 		awsClients.destroy();
 		preflightBackendForCleanup?.destroyClient();
+		for (const line of renderPhaseTimings()) logger.info(line);
 	}
 }
 function createDeployCommand() {
@@ -4255,7 +4266,7 @@ function buildCustomTags() {
 		tag: "!GetAtt",
 		resolve(value) {
 			const dot = value.indexOf(".");
-			if (dot < 0) throw new Error(`!GetAtt requires '<LogicalId>.<Attribute>'; got '${value}'`);
+			if (dot < 0) throw new Error(`${GETATT_SHAPE_REFUSAL}; got '${value}'`);
 			return { "Fn::GetAtt": [value.slice(0, dot), value.slice(dot + 1)] };
 		},
 		identify: () => false
@@ -4298,6 +4309,28 @@ function buildCustomTags() {
 	return tags;
 }
 const CUSTOM_TAGS = buildCustomTags();
+const GETATT_SHAPE_REFUSAL = "!GetAtt requires '<LogicalId>.<Attribute>'";
+const YAML_ALIAS_EXHAUSTION = "Excessive alias count indicates a resource exhaustion attack";
+function describeYamlFinding(err) {
+	if (err instanceof YAMLError) {
+		const at = err.linePos?.[0];
+		const where = at ? ` at line ${at.line}, column ${at.col}` : "";
+		if (err.code === "TAG_RESOLVE_FAILED" && err.message.startsWith(GETATT_SHAPE_REFUSAL)) return `${GETATT_SHAPE_REFUSAL}${where}`;
+		return `${err.name} ${err.code}${where}`;
+	}
+	if (err instanceof Error) return err.message === YAML_ALIAS_EXHAUSTION ? `${err.name}: ${YAML_ALIAS_EXHAUSTION}` : err.name || "Error";
+	return describeAwsFailure(err).detail;
+}
+function parseYamlTemplate(body) {
+	const doc = parseDocument(body, { customTags: CUSTOM_TAGS });
+	const logger = getLogger();
+	for (const warning of doc.warnings) {
+		logger.debug(safeMsg`Template YAML warning: ${parseFailureDebugDetail(warning)}`);
+		logger.warn(safeMsg`Template YAML warning: ${describeYamlFinding(warning)}`);
+	}
+	if (doc.errors.length > 0) throw doc.errors[0];
+	return doc.toJS();
+}
 function parseCfnTemplate(text) {
 	const format = detectTemplateFormat(text);
 	const body = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
@@ -4305,12 +4338,14 @@ function parseCfnTemplate(text) {
 	if (format === "json") try {
 		parsed = JSON.parse(body);
 	} catch (err) {
-		throw new Error(`Template is not valid JSON. Cause: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(safeMsg`Template failed to parse as JSON: ${parseFailureDebugDetail(err)}`);
+		throw new Error(`Template is not valid JSON. Cause: ${describeJsonParseFailure(err, utf8ByteLength(body))}`);
 	}
 	else try {
-		parsed = parse(body, { customTags: CUSTOM_TAGS });
+		parsed = parseYamlTemplate(body);
 	} catch (err) {
-		throw new Error(`Template is not valid YAML. Cause: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(safeMsg`Template failed to parse as YAML: ${parseFailureDebugDetail(err)}`);
+		throw new Error(`Template is not valid YAML. Cause: ${describeYamlFinding(err)}`);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`Template root is not an object.`);
 	return parsed;
@@ -4606,7 +4641,7 @@ function injectRetainPolicies(templateBody, cfnStackName) {
 	try {
 		parsed = parseCfnTemplate(templateBody);
 	} catch (err) {
-		throw new Error(`Template for '${cfnStackName}' is not a valid CloudFormation template. cdkd's --migrate-from-cloudformation flow supports both JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Cause: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Template for '${cfnStackName}' is not a valid CloudFormation template. cdkd's --migrate-from-cloudformation flow supports both JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Cause: ${describeAwsFailure(err).detail}`);
 	}
 	if (!("Resources" in parsed) || typeof parsed["Resources"] !== "object" || parsed["Resources"] === null || Array.isArray(parsed["Resources"])) throw new Error(`Template for '${cfnStackName}' has no Resources section — refusing to retire.`);
 	const modified = injectRetainPoliciesOnParsedResources(parsed["Resources"]);
@@ -4675,7 +4710,7 @@ async function injectRetainPoliciesRecursiveInternal(templateBody, cfnStackName,
 	try {
 		parsed = parseCfnTemplate(templateBody);
 	} catch (err) {
-		throw new Error(`Template for '${cfnStackName}' is not a valid CloudFormation template. cdkd's --migrate-from-cloudformation flow supports both JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Cause: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Template for '${cfnStackName}' is not a valid CloudFormation template. cdkd's --migrate-from-cloudformation flow supports both JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Cause: ${describeAwsFailure(err).detail}`);
 	}
 	if (!("Resources" in parsed) || typeof parsed["Resources"] !== "object" || parsed["Resources"] === null || Array.isArray(parsed["Resources"])) throw new Error(`Template for '${cfnStackName}' has no Resources section — refusing to retire.`);
 	const resources = parsed["Resources"];
@@ -4916,7 +4951,9 @@ function indexNestedChildTemplates(template, templatePath) {
 	return result;
 }
 async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery) {
+	const refactorMarker = readRefactorMarkerOnce(stateBackend);
 	const result = await stateBackend.getState(stackName, region);
+	const markerRefusal = refactorMarkerRefusalMessage(await refactorMarker, stackName, region, "cdkd deploy");
 	if (result) {
 		const unreadable = [];
 		const unreadableContainers = [];
@@ -4946,15 +4983,19 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 			unreadableContainers.push("orphans");
 			deployRefusals.push(DEPLOY_REFUSES_ORPHANS_CONTAINER_REASON);
 		}
+		if (hasPendingMovesOut(result.state)) deployRefusals.push(pendingMovesRefusalMessage(result.state, stackName, region, "cdkd deploy"));
+		if (markerRefusal !== void 0) deployRefusals.push(markerRefusal);
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region, refusalRecovery));
 		return {
 			state: result.state,
 			unreadable,
 			unreadableContainers,
-			deployRefusals
+			deployRefusals,
+			found: true
 		};
 	}
 	return {
+		found: false,
 		state: {
 			stackName,
 			region,
@@ -4965,7 +5006,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 		},
 		unreadable: [],
 		unreadableContainers: [],
-		deployRefusals: []
+		deployRefusals: markerRefusal === void 0 ? [] : [markerRefusal]
 	};
 }
 function tokenValueForComparison(token, declaredType) {
@@ -5754,7 +5795,7 @@ function healerUnderRecordPrintingBag(healer, resources, namingSecrets) {
 async function buildDiffTree(args) {
 	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, producerLookup, consumerAccount, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, inheritedDerivedNames, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict, refusalRecovery, inheritedReferenceProvenance, inheritedSecretTokens } = args;
 	const unboundHealer = attributeHealerFor?.(stackName, region);
-	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
+	const { state, unreadable, unreadableContainers, deployRefusals, found } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const attributeHealer = unboundHealer;
 	const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(recordedTemplateResources(template, state)));
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
@@ -5811,6 +5852,7 @@ async function buildDiffTree(args) {
 		destructiveChanges: findDestructiveChanges(stackName, changes.values(), stateAfterAdoption.resources, effectiveTemplate),
 		children: []
 	};
+	if (found && !isNestedChild && node.blocking.length === 0) node.refactorSides = hintSidesOf(changes.values(), rollbackOrphanIds(state.orphans));
 	if (!recursive) return node;
 	const templateChildIds = /* @__PURE__ */ new Set();
 	for (const [logicalId, resource] of Object.entries(effectiveTemplate.Resources ?? {})) {
@@ -6000,13 +6042,15 @@ function diffTreeToJson(node) {
 	for (const change of node.changes.values()) {
 		if (change.changeType === "NO_CHANGE") continue;
 		const ccApi = node.ccApiRoutes.get(change.logicalId);
+		const movedTo = change.changeType === "DELETE" ? node.refactorHints?.get(change.logicalId) : void 0;
 		changes.push({
 			logicalId: change.logicalId,
 			changeType: change.changeType,
 			resourceType: change.resourceType,
 			...change.propertyChanges && change.propertyChanges.length > 0 ? { propertyChanges: change.propertyChanges } : {},
 			...change.attributeChanges && change.attributeChanges.length > 0 ? { attributeChanges: change.attributeChanges } : {},
-			...ccApi && ccApi.length > 0 ? { ccApi } : {}
+			...ccApi && ccApi.length > 0 ? { ccApi } : {},
+			...movedTo !== void 0 && { movedTo }
 		});
 	}
 	return {
@@ -6026,11 +6070,12 @@ function diffTreeToJson(node) {
 		unreadable: node.unreadable,
 		unreadableContainers: node.unreadableContainers,
 		unreadableOrphans: node.unreadableOrphans,
-		destructiveChanges: node.destructiveChanges.map(({ logicalId, resourceType, constructPath, impact }) => ({
+		destructiveChanges: node.destructiveChanges.map(({ logicalId, resourceType, constructPath, impact, movedTo }) => ({
 			logicalId,
 			resourceType,
 			...constructPath !== void 0 && { constructPath },
-			impact
+			impact,
+			...movedTo !== void 0 && { movedTo }
 		})),
 		children: node.children.map(diffTreeToJson)
 	};
@@ -6079,7 +6124,7 @@ function renderDiffValue(own, filtered, indent, isNewSide) {
 	}
 	return (JSON.stringify(filtered, null, 2) ?? "undefined").replace(/\n/g, `\n${indent}`);
 }
-function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans) {
+function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans, refactorHints) {
 	let createCount = 0;
 	let updateCount = 0;
 	let deleteCount = 0;
@@ -6118,7 +6163,10 @@ function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans) {
 			break;
 		case "DELETE":
 			deleteCount++;
-			logFn(`  [-] ${logicalId} (${change.resourceType})`);
+			{
+				const movedTo = refactorHints?.get(logicalId);
+				logFn(`  [-] ${logicalId} (${change.resourceType})` + (movedTo !== void 0 ? movedToHint(movedTo) : ""));
+			}
 	}
 	return {
 		create: createCount,
@@ -6182,7 +6230,7 @@ function renderDiffTree(node, isRoot, logFn) {
 	const hasChanges = nodeHasChanges(node);
 	if (hasChanges || node.blocking.length > 0) logFn(isRoot ? `\nStack ${stripForDisplay(node.stackName)}:` : `\nNested stack: ${stripForDisplay(node.displayName)}`);
 	if (hasChanges) {
-		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes, node.adoptedOrphans);
+		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes, node.adoptedOrphans, node.refactorHints);
 		const outputs = renderOutputChangeLines(node.outputChanges, logFn);
 		logFn(`\n${create} to create, ${update} to update, ${del} to delete`);
 		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
@@ -6394,6 +6442,7 @@ async function diffCommand(stacks, options) {
 			suppressLegacyNotice: true
 		});
 		const trees = [];
+		const treeEnvs = [];
 		const producerLookup = producerLookupOver(allStacks);
 		const sharedNames = new Set(targetStacks.map((s) => s.stackName).filter((name, i, names) => names.indexOf(name) !== i));
 		for (const stackInfo of targetStacks) {
@@ -6424,7 +6473,20 @@ async function diffCommand(stacks, options) {
 				isNestedChild: false,
 				refusalRecovery
 			}));
+			treeEnvs.push(`${stackInfo.account ?? ""}/${stackRegion}`);
 		}
+		const hints = findRefactorHints(trees.flatMap((tree, i) => tree.refactorSides === void 0 ? [] : [{
+			id: String(i),
+			stackName: tree.stackName,
+			env: treeEnvs[i],
+			...tree.refactorSides
+		}]));
+		trees.forEach((tree, i) => {
+			const forTree = hints.get(String(i));
+			if (forTree === void 0) return;
+			tree.refactorHints = forTree;
+			tree.destructiveChanges = withMovedTo(tree.destructiveChanges, forTree);
+		});
 		let securityDifferences = 0;
 		let securityBroadening = false;
 		if (securityOnly) for (const tree of trees) {
@@ -11995,6 +12057,12 @@ async function purgeStateHistoryIfOptedIn(ctx, stackName, region) {
 	if (ctx.purgeStateHistory === true) await ctx.stateBackend.purgeDeletedStateHistory(stackName, region);
 }
 const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
+function maskedSnapshotLogger(logger, mask) {
+	return {
+		info: (message) => logger.info(mask(message)),
+		debug: (message) => logger.debug(mask(message))
+	};
+}
 function recordDestroyEvent(recorder, event) {
 	recorder?.record(maskEventTextWithBoundBags(event));
 }
@@ -12032,6 +12100,9 @@ async function releaseRegistryMarkerAfterDestroy(ctx, stackName, region, logger)
 		logger.warn(safeMsg`Could not delete the stack registry marker of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). It names this state prefix, which no longer ` + `records the stack, so a deploy under another prefix treats it as stale.`);
 	}
 }
+function holdsSameResourcesAs(snapshot, current) {
+	return isDeepStrictEqual(snapshot.resources, current.resources) && isDeepStrictEqual(snapshot.supersededResources, current.supersededResources);
+}
 async function runDestroyForStack(stackName, state, ctx) {
 	const stackRegion = state.region;
 	if (!stackRegion || stackRegion === ctx.baseRegion) return destroyStackInRegion(stackName, state, ctx, void 0);
@@ -12103,6 +12174,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 	refuseMalformedResourcePropertiesForDestroy(state, stackName, regionForState, refusalRecovery);
 	refuseMalformedOrphansForDestroy(state, stackName, regionForState, refusalRecovery);
 	refuseMalformedOrphanRecordsForDestroy(state, stackName, regionForState, refusalRecovery);
+	refusePendingMovesOut(state, stackName, regionForState, "cdkd destroy");
 	let journalAtEntry;
 	try {
 		journalAtEntry = { journal: await ctx.stateBackend.loadRollbackJournal(stackName, regionForState) };
@@ -12169,7 +12241,9 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 				refuseMalformedResourceEntriesForDestroy(recheck.state, stackName, regionForState, refusalRecovery);
 				refuseMalformedOrphansForDestroy(recheck.state, stackName, regionForState, refusalRecovery);
 				refuseMalformedOrphanRecordsForDestroy(recheck.state, stackName, regionForState, refusalRecovery);
+				refusePendingMovesOut(recheck.state, stackName, regionForState, "cdkd destroy");
 			}
+			refuseRefactorMarker(await readRefactorMarker(ctx.stateBackend), stackName, regionForState, "cdkd destroy");
 			const recheckResources = recheck ? Object.keys(recheck.state.resources).length : 0;
 			const recheckOrphans = recheck ? (recheck.state.orphans ?? []).length : 0;
 			const recheckRead = await loadJournaledOrphans(ctx.stateBackend, stackName, regionForState, recheck?.state.orphans, journaledOrphans.unreadable === true ? { warn: () => void 0 } : logger);
@@ -12301,6 +12375,23 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		},
 		onAcquireFailure: restoreBaseRegionAndClients
 	});
+	try {
+		const [current, marker] = await Promise.all([ctx.stateBackend.getState(stackName, regionForState), readRefactorMarker(ctx.stateBackend)]);
+		if (current === null || !holdsSameResourcesAs(state, current.state)) throw new CdkdError(safeMsg`cdkd destroy refused stack ${stackName} (${regionForState}): its state ` + "changed after it was read (another command wrote it while this one waited for confirmation), so nothing was deleted. Re-run cdkd destroy.", "STATE_CHANGED");
+		if (current.state.terminationProtection === true && ctx.removeProtection !== true) throw new StackTerminationProtectionError(stackName, void 0, {
+			args: accountArgs(refusalRecovery),
+			clause: withheldAccountClause(refusalRecovery, "the command below prints")
+		}, {
+			command: ctx.stateDestroy === true ? "cdkd state destroy" : "cdkd destroy",
+			stackRegion: regionForState
+		});
+		refusePendingMovesOut(current.state, stackName, regionForState, "cdkd destroy");
+		refuseRefactorMarker(marker, stackName, regionForState, "cdkd destroy");
+	} catch (error) {
+		await lock.release({ failureMessage: "Failed to release lock after a state re-check refusal" });
+		restoreBaseRegionAndClients();
+		throw error;
+	}
 	if (needsStrongRefCheck) {
 		const releaseThenUnregister = async () => {
 			await lock.release({ failureMessage: "Failed to release lock after strong-ref refusal/failure" });
@@ -12545,7 +12636,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 					if (policy === "Snapshot" && ctx.skipFinalSnapshot !== true) {
 						if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType) && resource.provisionedBy !== "cc-api") finalSnapshotIdentifier = buildFinalSnapshotIdentifier(resource.physicalId, resource.resourceType);
 						else if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType)) throw ccRoutedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
-						else if (PRE_DELETE_SNAPSHOT_TYPES.has(resource.resourceType)) await createPreDeleteFinalSnapshot(resource.resourceType, resource.physicalId, logicalId, destroyAwsClients ?? ctx.baseAwsClients, logger);
+						else if (PRE_DELETE_SNAPSHOT_TYPES.has(resource.resourceType)) await createPreDeleteFinalSnapshot(resource.resourceType, resource.physicalId, logicalId, destroyAwsClients ?? ctx.baseAwsClients, maskedSnapshotLogger(logger, createUnionSecretMasker([printingBagOf(logicalId)])));
 						else throw unsupportedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
 					}
 					const provider = destroyProviderRegistry.getProviderFor({
@@ -12675,7 +12766,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 				} catch (error) {
 					renderer.removeTask(logicalId);
 					const msg = describeAwsFailure(error).detail;
-					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && !isMarkedNonRetryable(error) && !isWaitAbandonedError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
+					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && !isMarkedNonRetryable(error) && !isWaitAbandonedError(error) && !isMarkedNotGone(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${displaySafe(logicalId)} already deleted, removing from state`);
 						result.deletedCount++;
 						recordDestroyEvent(ctx.eventRecorder, {
@@ -13270,6 +13361,18 @@ async function destroyCommand(stackArgs, options) {
 				logger.warn(`No state found for stack ${displaySafe(stackName)}, skipping`);
 				continue;
 			}
+			if (synthStack?.terminationProtection !== true && stateResult.state.terminationProtection === true) {
+				if (options.removeProtection) logger.warn(safeMsg`Stack ${stackName} was deployed with terminationProtection: true — bypassing because --remove-protection set`);
+				else {
+					const err = new StackTerminationProtectionError(stackName, void 0, {
+						args: stateCommandAccount.args,
+						clause: withheldAccountClause(accountRecovery, "the command below prints")
+					}, { command: "cdkd destroy" });
+					logger.error(safeMsg`  ✗ ${asIsMessage(err.message)}`);
+					totalErrors++;
+					continue;
+				}
+			}
 			if (stateResult.state.parentStack) {
 				const err = new NestedStackChildDirectDestroyError(stackName, stateResult.state.parentStack, stateResult.state.parentLogicalId, void 0, stateCommandAccount);
 				logger.error(`  ✗ ${err.message}`);
@@ -13539,6 +13642,160 @@ async function dropFailedJournalEntry(args) {
 	}
 }
 
+//#endregion
+//#region src/cli/interactive-select.ts
+const ARM_DELAY_MS = 50;
+const FILTER_CHAR = /^[\p{L}\p{N}\p{P}\p{S} ]$/u;
+function isInteractiveTerminal(streams) {
+	return streams.input.isTTY === true && typeof streams.input.setRawMode === "function" && streams.output.isTTY === true;
+}
+function filterItems(items, filter) {
+	const needle = filter.toLowerCase();
+	return needle === "" ? [...items] : items.filter((i) => i.label.toLowerCase().includes(needle));
+}
+function renderSelectFrame(title, visible, cursor, filter, pageSize) {
+	const lines = [title];
+	if (filter !== "") lines.push(`  filter: ${filter}`);
+	if (visible.length === 0) lines.push("  (no match)");
+	else {
+		const start = Math.min(Math.max(0, cursor - Math.floor(pageSize / 2)), Math.max(0, visible.length - pageSize));
+		const end = Math.min(visible.length, start + pageSize);
+		if (start > 0) lines.push(`  ... ${start} more above`);
+		for (let i = start; i < end; i++) lines.push(`${i === cursor ? "> " : "  "}${visible[i].label}`);
+		if (end < visible.length) lines.push(`  ... ${visible.length - end} more below`);
+	}
+	lines.push("  (up/down move, type to filter, Enter select, Esc back, Ctrl+C quit)");
+	return lines;
+}
+function fitToWidth(line, columns) {
+	if (typeof columns !== "number" || columns < 2) return line;
+	const chars = [...line];
+	return chars.length < columns ? line : `${chars.slice(0, columns - 2).join("")}…`;
+}
+function selectFromList(title, items, streams) {
+	const { input, output } = streams;
+	const rows = typeof output.rows === "number" && output.rows > 0 ? output.rows : 24;
+	const pageSize = Math.max(3, Math.min(15, rows - 5));
+	let filter = "";
+	let cursor = 0;
+	let drawn = 0;
+	const erase = () => {
+		if (drawn > 0) output.write(`\x1b[${drawn}F\x1b[0J`);
+		drawn = 0;
+	};
+	const draw = () => {
+		erase();
+		const lines = renderSelectFrame(title, filterItems(items, filter), cursor, filter, pageSize).map((line) => fitToWidth(line, output.columns));
+		output.write(`${lines.join("\n")}\n`);
+		drawn = lines.length;
+	};
+	return new Promise((resolve, reject) => {
+		emitKeypressEvents(input);
+		input.setRawMode?.(true);
+		input.resume();
+		let armed = false;
+		const armTimer = setTimeout(() => {
+			armed = true;
+		}, streams.armDelayMs ?? ARM_DELAY_MS);
+		const finish = (result) => {
+			clearTimeout(armTimer);
+			input.removeListener("keypress", onKey);
+			input.setRawMode?.(false);
+			input.pause();
+			erase();
+			resolve(result);
+		};
+		const onKey = (str, key) => {
+			if (!armed) return;
+			const visible = filterItems(items, filter);
+			const name = key?.name;
+			if (key?.ctrl === true && (name === "c" || name === "d")) return finish({ kind: "quit" });
+			if (name === "escape") return finish({ kind: "back" });
+			if (name === "return" || name === "enter") {
+				const picked = visible[cursor];
+				if (picked !== void 0) return finish({
+					kind: "picked",
+					value: picked.value
+				});
+				return;
+			}
+			if (name === "up" || key?.ctrl === true && name === "p") cursor = visible.length === 0 ? 0 : (cursor - 1 + visible.length) % visible.length;
+			else if (name === "down" || key?.ctrl === true && name === "n") cursor = visible.length === 0 ? 0 : (cursor + 1) % visible.length;
+			else if (name === "backspace") {
+				filter = filter.slice(0, -1);
+				cursor = 0;
+			} else if (typeof str === "string" && key?.ctrl !== true && key?.meta !== true && FILTER_CHAR.test(str)) {
+				filter += str;
+				cursor = 0;
+			} else return;
+			draw();
+		};
+		input.on("keypress", onKey);
+		try {
+			draw();
+		} catch (error) {
+			clearTimeout(armTimer);
+			input.removeListener("keypress", onKey);
+			input.setRawMode?.(false);
+			input.pause();
+			reject(error);
+		}
+	});
+}
+
+//#endregion
+//#region src/cli/commands/state-browse.ts
+const VIEW_ITEMS = [
+	{
+		label: "Resources (logical id, type, physical id)",
+		value: "resources"
+	},
+	{
+		label: "Resources with dependencies and attributes",
+		value: "resources-long"
+	},
+	{
+		label: "Full state record (cdkd state show)",
+		value: "show"
+	},
+	{
+		label: "Back to the stack list",
+		value: "back"
+	}
+];
+function nonInteractiveBrowseRefusal() {
+	return new CdkdError("cdkd state browse needs an interactive terminal. Without one, use cdkd state list, cdkd state resources <stack> and cdkd state show <stack>.", "NON_INTERACTIVE");
+}
+async function runStateBrowse(deps) {
+	if (!isInteractiveTerminal(deps.streams)) throw nonInteractiveBrowseRefusal();
+	const refs = await deps.listStacks();
+	if (refs.length === 0) {
+		deps.streams.output.write("No stacks in the state bucket.\n");
+		return;
+	}
+	const stackItems = refs.map((ref) => ({
+		label: deps.label(ref),
+		value: ref
+	}));
+	for (;;) {
+		const stack = await selectFromList("Select a stack:", stackItems, deps.streams);
+		if (stack.kind !== "picked") return;
+		for (;;) {
+			const title = `${deps.label(stack.value)}:`;
+			const view = await selectFromList(title, VIEW_ITEMS, deps.streams);
+			if (view.kind === "quit") return;
+			if (view.kind === "back" || view.value === "back") break;
+			deps.streams.output.write(`\n${title}\n`);
+			try {
+				await deps.printView(view.value, stack.value);
+			} catch (error) {
+				deps.reportError(error);
+			}
+			deps.streams.output.write("\n");
+		}
+	}
+}
+
 //#endregion
 //#region src/deployment/public-ssm-proof.ts
 var PublicSsmProver = class {
@@ -18173,59 +18430,63 @@ async function stateResourcesCommand(stackName, options) {
 	if (options.json) reserveStdoutForPayload();
 	const setup = await setupStateBackend(options);
 	try {
-		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw legacyRecordRefusal(stackName);
-		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
-		if (!stateResult) throw new Error(`No state found for stack ${formatStackRefSafe(ref)} in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
-		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region, renderRecovery(options, setup)));
-		if (options.long || options.json) repairRenderedContainers(stateResult.state, RESOURCES_RENDERED_CONTAINERS, stackName, ref.region, logger, renderRecovery(options, setup));
-		const resources = stateResult.state.resources;
-		const details = Object.entries(resources).map(([logicalId, entry]) => {
-			const resource = entry ?? {};
-			return {
-				logicalId,
-				resourceType: resource.resourceType,
-				physicalId: resource.physicalId,
-				dependencies: resource.dependencies ?? [],
-				attributes: resource.attributes ?? {}
-			};
-		}).sort((a, b) => a.logicalId.localeCompare(b.logicalId));
-		if (options.json) {
-			process.stdout.write(`${stringifyJsonPayload(details)}\n`);
-			return;
-		}
-		if (details.length === 0) return;
-		if (options.long) {
-			const lines = [];
-			for (const detail of details) {
-				lines.push(stripForDisplay(detail.logicalId));
-				lines.push(`  Type: ${formatAttributeValue(detail.resourceType)}`);
-				lines.push(`  PhysicalID: ${formatAttributeValue(detail.physicalId)}`);
-				lines.push(`  Dependencies: ${formatDependencyList(detail.dependencies)}`);
-				const attrEntries = Object.entries(detail.attributes);
-				if (attrEntries.length === 0) lines.push("  Attributes: (none)");
-				else {
-					lines.push("  Attributes:");
-					for (const [k, v] of attrEntries) lines.push(`    ${stripForDisplay(k)}: ${formatAttributeValue(v)}`);
-				}
-				lines.push("");
-			}
-			if (lines[lines.length - 1] === "") lines.pop();
-			process.stdout.write(`${lines.join("\n")}\n`);
-			return;
-		}
-		const rows = details.map((d) => ({
-			logicalId: stripForDisplay(d.logicalId),
-			resourceType: formatAttributeValue(d.resourceType),
-			physicalId: formatAttributeValue(d.physicalId)
-		}));
-		const idWidth = Math.max(...rows.map((r) => r.logicalId.length));
-		const typeWidth = Math.max(...rows.map((r) => r.resourceType.length));
-		for (const row of rows) process.stdout.write(`${row.logicalId.padEnd(idWidth)}  ${row.resourceType.padEnd(typeWidth)}  ${row.physicalId}\n`);
+		await printStackResources(stackName, options, setup);
 	} finally {
 		setup.dispose();
 	}
 }
+async function printStackResources(stackName, options, setup) {
+	const logger = getLogger();
+	const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
+	if (!ref.region) throw legacyRecordRefusal(stackName);
+	const stateResult = await setup.stateBackend.getState(stackName, ref.region);
+	if (!stateResult) throw new Error(`No state found for stack ${formatStackRefSafe(ref)} in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
+	if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region, renderRecovery(options, setup)));
+	if (options.long || options.json) repairRenderedContainers(stateResult.state, RESOURCES_RENDERED_CONTAINERS, stackName, ref.region, logger, renderRecovery(options, setup));
+	const resources = stateResult.state.resources;
+	const details = Object.entries(resources).map(([logicalId, entry]) => {
+		const resource = entry ?? {};
+		return {
+			logicalId,
+			resourceType: resource.resourceType,
+			physicalId: resource.physicalId,
+			dependencies: resource.dependencies ?? [],
+			attributes: resource.attributes ?? {}
+		};
+	}).sort((a, b) => a.logicalId.localeCompare(b.logicalId));
+	if (options.json) {
+		process.stdout.write(`${stringifyJsonPayload(details)}\n`);
+		return;
+	}
+	if (details.length === 0) return;
+	if (options.long) {
+		const lines = [];
+		for (const detail of details) {
+			lines.push(stripForDisplay(detail.logicalId));
+			lines.push(`  Type: ${formatAttributeValue(detail.resourceType)}`);
+			lines.push(`  PhysicalID: ${formatAttributeValue(detail.physicalId)}`);
+			lines.push(`  Dependencies: ${formatDependencyList(detail.dependencies)}`);
+			const attrEntries = Object.entries(detail.attributes);
+			if (attrEntries.length === 0) lines.push("  Attributes: (none)");
+			else {
+				lines.push("  Attributes:");
+				for (const [k, v] of attrEntries) lines.push(`    ${stripForDisplay(k)}: ${formatAttributeValue(v)}`);
+			}
+			lines.push("");
+		}
+		if (lines[lines.length - 1] === "") lines.pop();
+		process.stdout.write(`${lines.join("\n")}\n`);
+		return;
+	}
+	const rows = details.map((d) => ({
+		logicalId: stripForDisplay(d.logicalId),
+		resourceType: formatAttributeValue(d.resourceType),
+		physicalId: formatAttributeValue(d.physicalId)
+	}));
+	const idWidth = Math.max(...rows.map((r) => r.logicalId.length));
+	const typeWidth = Math.max(...rows.map((r) => r.resourceType.length));
+	for (const row of rows) process.stdout.write(`${row.logicalId.padEnd(idWidth)}  ${row.resourceType.padEnd(typeWidth)}  ${row.physicalId}\n`);
+}
 function formatAttributeValue(value) {
 	if (value === null) return "null";
 	if (value === void 0) return "undefined";
@@ -18270,34 +18531,38 @@ async function stateShowCommand(stackName, options) {
 	if (options.json) reserveStdoutForPayload();
 	const setup = await setupStateBackend(options);
 	try {
-		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw legacyRecordRefusal(stackName);
-		const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
-		if (!stateResult) throw new Error(`No state found for stack ${formatStackRefSafe(ref)} in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
-		if (options.showNested) {
-			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state, renderRecovery(options, setup)), setup.lockManager, lockInfo);
-			if (options.json) {
-				warnUnreadableTreeNodes(treeWithLocks, logger, renderRecovery(options, setup));
-				process.stdout.write(`${stringifyJsonPayload(treeToShowJson(treeWithLocks))}\n`);
-				return;
-			}
-			repairTreeForTextRender(treeWithLocks, logger, renderRecovery(options, setup));
-			const lines = renderTreeWithChildren(treeWithLocks);
-			process.stdout.write(`${lines.join("\n")}\n`);
-			return;
-		}
+		await printStackShow(stackName, options, setup);
+	} finally {
+		setup.dispose();
+	}
+}
+async function printStackShow(stackName, options, setup) {
+	const logger = getLogger();
+	const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
+	if (!ref.region) throw legacyRecordRefusal(stackName);
+	const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
+	if (!stateResult) throw new Error(`No state found for stack ${formatStackRefSafe(ref)} in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
+	if (options.showNested) {
+		const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state, renderRecovery(options, setup)), setup.lockManager, lockInfo);
 		if (options.json) {
-			process.stdout.write(`${stringifyJsonPayload({
-				state: withStackInstanceIdWithheld(stateResult.state),
-				lock: lockInfo
-			})}\n`);
+			warnUnreadableTreeNodes(treeWithLocks, logger, renderRecovery(options, setup));
+			process.stdout.write(`${stringifyJsonPayload(treeToShowJson(treeWithLocks))}\n`);
 			return;
 		}
-		repairRecordForTextRender(stateResult.state, stackName, ref.region, logger, renderRecovery(options, setup));
-		process.stdout.write(`${renderStateBlock(stateResult.state, lockInfo, true).join("\n")}\n`);
-	} finally {
-		setup.dispose();
+		repairTreeForTextRender(treeWithLocks, logger, renderRecovery(options, setup));
+		const lines = renderTreeWithChildren(treeWithLocks);
+		process.stdout.write(`${lines.join("\n")}\n`);
+		return;
+	}
+	if (options.json) {
+		process.stdout.write(`${stringifyJsonPayload({
+			state: withStackInstanceIdWithheld(stateResult.state),
+			lock: lockInfo
+		})}\n`);
+		return;
 	}
+	repairRecordForTextRender(stateResult.state, stackName, ref.region, logger, renderRecovery(options, setup));
+	process.stdout.write(`${renderStateBlock(stateResult.state, lockInfo, true).join("\n")}\n`);
 }
 const SKIPPED_DIGEST_PREVIEW_LEN = 12;
 const UNSERIALIZABLE = "(unserializable)";
@@ -18715,6 +18980,20 @@ function createStateOrphanCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+async function protectedRootOf(stackName, state, region, backend) {
+	let name = stackName;
+	let record = state;
+	const seen = /* @__PURE__ */ new Set();
+	for (let depth = 0; record !== void 0 && depth < 32; depth++) {
+		if (record.terminationProtection === true) return name;
+		const parent = record.parentStack;
+		if (typeof parent !== "string" || parent === "" || seen.has(parent)) return void 0;
+		seen.add(name);
+		const parentRegion = typeof record.parentRegion === "string" ? record.parentRegion : region;
+		name = parent;
+		record = (await backend.getState(parent, parentRegion))?.state;
+	}
+}
 async function stateDestroyCommand(stackArgs, options) {
 	if (options.all) throw new CdkdError(`cdkd state destroy no longer accepts --all: it destroyed every stack in the state bucket, which every CDK app deployed to this account shares, so one command reached across apps. Name each stack to destroy: cdkd state destroy ${commandHole("stacks...")} (cdkd state list shows them), or run cdkd destroy --all from the CDK app, which destroys only that app's top-level stacks (cdkd destroy '**' destroys its CDK Stage stacks too).`, "STATE_DESTROY_ALL_REMOVED");
 	const providerClasses = await loadProviderClasses();
@@ -18789,6 +19068,24 @@ async function stateDestroyCommand(stackArgs, options) {
 					logger.warn(safeMsg`No state found for stack ${displayStackName(stackName)}` + (ref.region ? safeMsg` in ${displayIdent(ref.region)}` : "") + ", skipping");
 					continue;
 				}
+				const protectedRoot = await protectedRootOf(stackName, stateResult.state, refRegion, setup.stateBackend);
+				if (protectedRoot !== void 0) {
+					if (options.removeProtection === true) logger.warn(safeMsg`Stack ${displayStackName(protectedRoot)} was deployed with terminationProtection: true — bypassing because --remove-protection set`);
+					else {
+						const recovery = renderRecovery(options, setup);
+						const err = new StackTerminationProtectionError(stackName, void 0, {
+							args: accountArgs(recovery),
+							clause: withheldAccountClause(recovery, "the command below prints")
+						}, {
+							command: "cdkd state destroy",
+							stackRegion: refRegion,
+							...protectedRoot !== stackName && { root: protectedRoot }
+						});
+						logger.error(safeMsg`  ✗ ${asIsMessage(err.message)}`);
+						totalErrors++;
+						continue;
+					}
+				}
 				if (runInterrupted()) {
 					stoppedEarly = true;
 					break;
@@ -18835,6 +19132,7 @@ async function stateDestroyCommand(stackArgs, options) {
 						statePrefix: options.statePrefix,
 						skipConfirmation: options.yes,
 						removeProtection: options.removeProtection === true,
+						stateDestroy: true,
 						skipFinalSnapshot: options.skipFinalSnapshot === true,
 						resolveSecretDerivedPrincipals: {},
 						stackDestroy: true,
@@ -18889,7 +19187,7 @@ async function stateDestroyCommand(stackArgs, options) {
 	}
 }
 function createStateDestroyCommand() {
-	const cmd = new Command("destroy").description("Destroy a stack's AWS resources and remove its state record without requiring the CDK app. For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'.").argument("[stacks...]", "Stack name(s) to destroy (physical CloudFormation names)").addOption(new Option("--all").hideHelp()).option("--remove-protection", `Bypass deletion protection on protected resources by flipping the per-resource protection flag off in-place before delete. Covers ${removeProtectionTypeList()}.`, false).addOption(stackRegionOption$1()).addHelpText("after", [
+	const cmd = new Command("destroy").description("Destroy a stack's AWS resources and remove its state record without requiring the CDK app. For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'.").argument("[stacks...]", "Stack name(s) to destroy (physical CloudFormation names)").addOption(new Option("--all").hideHelp()).option("--remove-protection", `Destroy a stack deployed with terminationProtection: true, and bypass deletion protection on protected resources by flipping the per-resource protection flag off in-place before delete. Covers ${removeProtectionTypeList()}.`, false).addOption(stackRegionOption$1()).addHelpText("after", [
 		"",
 		"Examples:",
 		"  cdkd state destroy MyStack",
@@ -19366,7 +19664,9 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 					refreshed++;
 				} catch (err) {
 					failed++;
-					logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + safeMsg`readCurrentState failed — ${describeAwsFailure(err).detail}`);
+					if (err instanceof SyntaxError) logger.debug(safeMsg`readCurrentState parse failure for ${displayIdent(logicalId)}: ${parseFailureDebugDetail(err)}`);
+					const detail = err instanceof SyntaxError ? "SyntaxError (its text is withheld: a parse error quotes the body it read)" : describeAwsFailure(err).detail;
+					logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + safeMsg`readCurrentState failed — ${detail}`);
 				}
 			}));
 			await Promise.all(tasks);
@@ -19418,9 +19718,55 @@ function createStateRefreshObservedCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+async function stateBrowseCommand(options) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	const streams = {
+		input: process.stdin,
+		output: process.stdout
+	};
+	if (!isInteractiveTerminal(streams)) throw nonInteractiveBrowseRefusal();
+	const setup = await setupStateBackend(options);
+	try {
+		await runStateBrowse(stateBrowseDeps(setup, options, streams));
+	} finally {
+		setup.dispose();
+	}
+}
+function stateBrowseDeps(setup, options, streams) {
+	return {
+		streams,
+		listStacks: async () => sortRefs(await setup.stateBackend.listStacks()),
+		label: formatStackRefSafe,
+		printView: async (view, ref) => {
+			if (!ref.region) throw legacyRecordRefusal(ref.stackName);
+			const base = {
+				...options,
+				stackRegion: ref.region,
+				json: false
+			};
+			if (view === "show") await printStackShow(ref.stackName, {
+				...base,
+				showNested: false
+			}, setup);
+			else await printStackResources(ref.stackName, {
+				...base,
+				long: view === "resources-long"
+			}, setup);
+		},
+		reportError: (error) => getLogger().error(formatError(error))
+	};
+}
+function createStateBrowseCommand() {
+	const cmd = new Command("browse").description("Pick a stack with the keyboard and view its resources or state record (needs a terminal)").action(withErrorHandling(stateBrowseCommand));
+	[...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(deprecatedRegionOption);
+	return cmd;
+}
 function createStateCommand() {
 	const cmd = new Command("state").description("Manage cdkd state stored in S3");
 	cmd.addCommand(createStateInfoCommand());
+	cmd.addCommand(createStateBrowseCommand());
 	cmd.addCommand(createStateListCommand());
 	cmd.addCommand(createStateResourcesCommand());
 	cmd.addCommand(createStateShowCommand());
@@ -20265,7 +20611,8 @@ function printRunEvents(stackName, region, runId, events) {
 			const headShown = safeText(head);
 			const laterShows = rest.some((line) => safeText(line) !== "");
 			const message = !e.error.message ? "" : headShown !== "" ? `: ${headShown}` : laterShows ? "" : `: ${UNRENDERABLE}`;
-			logger.info(`      ${red(`${name}${code}${message}`)}${reqId}`);
+			const line = rest.length === 0 && headShown.startsWith(`${name}. `) ? `${name}${e.error.awsErrorCode === e.error.name ? "" : code}${headShown.slice(name.length)}` : `${name}${code}${message}`;
+			logger.info(`      ${red(line)}${reqId}`);
 			for (const line of rest) {
 				const shown = safeText(line);
 				if (shown !== "") logger.info(red(safeMsg`          ${shown}`));
@@ -20518,7 +20865,8 @@ async function scanReferencedAssets(stateBackend, marker, logger, account) {
 				statePrefix: void 0
 			}, "the command below prints").trimEnd(), keyPrefixHoleSentence(recovery.statePrefix)].filter((part) => part !== "").join(" ");
 			const inspect = inspectHint === void 0 ? "its stack name is not safe to paste into a command, so inspect the object at that key directly" : `see the command below`;
-			throw new CdkdError(`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file (${inspect}), then re-run.` + (accountClause === "" ? "" : ` ${accountClause}`) + (inspectHint === void 0 ? "" : `\nInspect it with: ${inspectHint}`), "GC_STATE_UNREADABLE", error);
+			logger.debug(safeMsg`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} failed to parse: ${displaySafe(describeAwsFailure(error).detail, { asciiOnly: true }) || "<unrenderable>"}`);
+			throw new CdkdError(`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file (${inspect}), then re-run.` + (accountClause === "" ? "" : ` ${accountClause}`) + (inspectHint === void 0 ? "" : `\nInspect it with: ${inspectHint}`), "GC_STATE_UNREADABLE");
 		}
 		collectAssetReferences(parsed, marker, refs);
 	}
@@ -20847,87 +21195,1435 @@ function keyPrefixHoleSentence(prefix) {
 }
 
 //#endregion
-//#region src/cli/commands/publish-assets.ts
-async function publishAssetsCommand(stacks, options) {
-	const logger = getLogger();
-	if (options.verbose) logger.setLevel("debug");
-	warnIfDeprecatedRegion(options);
-	const rawNamedRegion = rawCliRegion(options.region);
-	foldRegionOption(options);
-	await applyRoleArnIfSet({
-		roleArn: options.roleArn,
-		region: options.region
-	});
-	const app = resolveApp(options.app);
-	if (!app) throw new Error("No app command specified. Use --app, set CDKD_APP env var, or add \"app\" to cdk.json");
-	logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
-	const synthesizer = new Synthesizer();
-	const context = parseContextOptions(options.context);
-	const synthOptions = {
-		app,
-		output: options.output,
-		...options.region && { region: options.region },
-		...options.profile && { profile: options.profile },
-		...Object.keys(context).length > 0 && { context }
-	};
-	const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
-	logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
-	const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
-	let targetStacks;
-	if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
-	if (options.all) targetStacks = allStacks;
-	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns, { dedupe: "identity" });
-	else if (allStacks.length === 1) targetStacks = allStacks;
-	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
-	if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
-	const effectiveRegion = await resolveEffectiveRegion(options);
-	exportInferredRegionForSdk(effectiveRegion);
-	const baseRegion = effectiveRegion.region;
-	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const stsClient = new STSClient({
-		...ambientClientDefaults(),
-		region: baseRegion
-	});
-	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
-	stsClient.destroy();
-	const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
-	let markerAccess;
-	const getModeResolver = async () => {
-		if (markerAccess !== void 0) return markerAccess?.resolver ?? null;
-		let bucket;
-		try {
-			bucket = await resolveStateBucketWithDefault(options.stateBucket, baseRegion, legacyStateBucketFallbackRegion(effectiveRegion));
-		} catch {
-			logger.info("No cdkd state bucket found — publishing to the asset-manifest destinations (CDK bootstrap storage) verbatim. Run 'cdkd bootstrap' to opt into cdkd-owned asset storage that 'cdk gc' never touches.");
-			markerAccess = null;
-			return null;
+//#region src/state/logical-id-rename.ts
+function applyLogicalIdRenames(state, renames, template) {
+	const byFrom = /* @__PURE__ */ new Map();
+	const targets = /* @__PURE__ */ new Set();
+	for (const { from, to } of renames) {
+		if (!hasOwnKey(state.resources, from)) throw new Error(`Logical ID ${from} is not in the stack's state`);
+		if (hasOwnKey(state.resources, to)) throw new Error(`Logical ID ${to} is already in the stack's state`);
+		if (byFrom.has(from) || targets.has(to) || from === to) throw new Error(`Logical ID ${from} -> ${to} is named more than once`);
+		byFrom.set(from, to);
+		targets.add(to);
+	}
+	const retiredBefore = state.retiredNameGenerations ?? {};
+	const resources = {};
+	const leaving = [];
+	for (const [logicalId, record] of Object.entries(state.resources)) {
+		const to = byFrom.get(logicalId);
+		if (to === void 0) {
+			defineOwnKey(resources, logicalId, rewriteRecordReferences(record, byFrom));
+			continue;
 		}
-		const markerClients = new AwsClients({
-			region: baseRegion,
-			...options.profile && { profile: options.profile }
-		});
-		const backend = new S3StateBackend(markerClients.s3, {
-			bucket,
-			prefix: options.statePrefix
-		}, {
-			region: baseRegion,
-			...options.profile && { profile: options.profile }
+		leaving.push({
+			logicalId,
+			record
 		});
-		const resolver = new AssetModeResolver(backend, accountId, { ...options.profile && { profile: options.profile } });
-		markerAccess = {
-			resolver,
-			regionFor: stackRegionResolver({
-				effective: effectiveRegion,
-				probe: backend,
-				logger,
-				siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
-			}),
-			dispose: () => markerClients.destroy()
-		};
-		return resolver;
+		const constructPath = constructPathOf(template, to);
+		const retiredTo = hasOwnKey(retiredBefore, to) ? retiredBefore[to] : void 0;
+		const moved = withNameGenerationReached({
+			...rewriteRecordReferences(record, byFrom),
+			...constructPath !== void 0 && { constructPath }
+		}, to, retiredTo);
+		defineOwnKey(resources, to, moved);
+	}
+	const { skippedOutputs: _dropped, ...rest } = state;
+	const retired = retiredNameGenerationsAfter(state, leaving);
+	return {
+		...rest,
+		...stackInstanceIdCarriedFrom(state),
+		resources,
+		...retired,
+		...Array.isArray(state.supersededResources) && { supersededResources: state.supersededResources.map((entry) => {
+			if (entry === null || typeof entry !== "object") return entry;
+			const to = byFrom.get(entry.logicalId);
+			return {
+				...entry,
+				...to !== void 0 && { logicalId: to },
+				state: rewriteRecordReferences(entry.state, byFrom)
+			};
+		}) },
+		...Array.isArray(state.orphans) && { orphans: state.orphans.map((entry) => entry === null || typeof entry !== "object" ? entry : {
+			...entry,
+			state: rewriteRecordReferences(entry.state, byFrom)
+		}) },
+		lastModified: Date.now()
 	};
-	const regionForStack = async (stack) => {
-		if (stack.region) return stack.region;
+}
+function constructPathOf(template, logicalId) {
+	const resources = template.Resources ?? {};
+	if (!hasOwnKey(resources, logicalId)) return void 0;
+	const metadata = resources[logicalId].Metadata;
+	if (metadata === null || typeof metadata !== "object") return void 0;
+	const path = metadata["aws:cdk:path"];
+	return typeof path === "string" ? path : void 0;
+}
+function rewriteRecordReferences(record, renames) {
+	if (record === null || typeof record !== "object" || !hasPlainPrototype(record)) return record;
+	const out = { ...record };
+	if (Array.isArray(record.dependencies)) {
+		const seen = /* @__PURE__ */ new Set();
+		out.dependencies = [];
+		for (const dependency of record.dependencies) {
+			const renamed = typeof dependency === "string" ? renames.get(dependency) ?? dependency : dependency;
+			if (typeof renamed === "string") {
+				if (seen.has(renamed)) continue;
+				seen.add(renamed);
+			}
+			out.dependencies.push(renamed);
+		}
+	}
+	if (record.properties !== void 0) out.properties = renameReferencesInValue(record.properties, renames);
+	if (record.attributes !== void 0) out.attributes = renameReferencesInValue(record.attributes, renames);
+	return out;
+}
+function renameReferencesInValue(value, renames) {
+	if (Array.isArray(value)) return value.map((item) => renameReferencesInValue(item, renames));
+	if (value === null || typeof value !== "object" || !hasPlainPrototype(value)) return value;
+	const entries = Object.entries(value);
+	if (entries.length === 1) {
+		const [key, arg] = entries[0];
+		if (key === "Ref" && typeof arg === "string") return { Ref: renames.get(arg) ?? arg };
+		if (key === "Fn::GetAtt") return { "Fn::GetAtt": renameGetAttArgument(arg, renames) };
+		if (key === "Fn::Sub") return { "Fn::Sub": renameSubArgument(arg, renames) };
+	}
+	const out = {};
+	for (const [key, item] of entries) defineOwnKey(out, key, renameReferencesInValue(item, renames));
+	return out;
+}
+function renameGetAttArgument(arg, renames) {
+	if (Array.isArray(arg) && arg.length >= 1 && typeof arg[0] === "string") {
+		const [target, ...rest] = arg;
+		return [renames.get(target) ?? target, ...rest.map((item) => renameReferencesInValue(item, renames))];
+	}
+	if (typeof arg === "string") {
+		const dot = arg.indexOf(".");
+		if (dot > 0) {
+			const target = arg.slice(0, dot);
+			const renamed = renames.get(target);
+			if (renamed !== void 0) return `${renamed}${arg.slice(dot)}`;
+		}
+		return arg;
+	}
+	return renameReferencesInValue(arg, renames);
+}
+function renameSubArgument(arg, renames) {
+	if (typeof arg === "string") return renameSubTemplate(arg, renames, /* @__PURE__ */ new Set());
+	if (Array.isArray(arg) && arg.length >= 1 && typeof arg[0] === "string") {
+		const variables = arg[1];
+		const shadowed = new Set(variables !== null && typeof variables === "object" && !Array.isArray(variables) ? Object.keys(variables) : []);
+		return [renameSubTemplate(arg[0], renames, shadowed), ...arg.slice(1).map((item) => renameReferencesInValue(item, renames))];
+	}
+	return renameReferencesInValue(arg, renames);
+}
+function renameSubTemplate(template, renames, shadowed) {
+	return template.replace(/\$\{([^}]*)\}/g, (whole, inner) => {
+		if (inner.startsWith("!")) return whole;
+		const dot = inner.indexOf(".");
+		const target = dot === -1 ? inner : inner.slice(0, dot);
+		if (shadowed.has(target) || shadowed.has(inner)) return whole;
+		const renamed = renames.get(target);
+		if (renamed === void 0) return whole;
+		return `\${${renamed}${dot === -1 ? "" : inner.slice(dot)}}`;
+	});
+}
+function removeMovedRecords(state, moves) {
+	const leavingIds = /* @__PURE__ */ new Set();
+	for (const { from } of moves) {
+		if (!hasOwnKey(state.resources, from)) throw new Error(`Logical ID ${from} is not in the source stack's state`);
+		leavingIds.add(from);
+	}
+	const resources = {};
+	const leaving = [];
+	for (const [logicalId, record] of Object.entries(state.resources)) {
+		if (leavingIds.has(logicalId)) {
+			leaving.push({
+				logicalId,
+				record
+			});
+			continue;
+		}
+		defineOwnKey(resources, logicalId, withoutDependencies(record, leavingIds));
+	}
+	const { skippedOutputs: _dropped, ...rest } = state;
+	return {
+		...rest,
+		...stackInstanceIdCarriedFrom(state),
+		resources,
+		...retiredNameGenerationsAfter(state, leaving),
+		...Array.isArray(state.orphans) && { orphans: state.orphans.map((entry) => entry === null || typeof entry !== "object" ? entry : {
+			...entry,
+			state: withoutDependencies(entry.state, leavingIds)
+		}) },
+		lastModified: Date.now()
+	};
+}
+function insertMovedRecords(state, moved, template) {
+	const renamesBySource = /* @__PURE__ */ new Map();
+	for (const m of moved) {
+		const group = renamesBySource.get(m.source) ?? /* @__PURE__ */ new Map();
+		group.set(m.from, m.to);
+		renamesBySource.set(m.source, group);
+	}
+	const resources = {};
+	for (const [logicalId, record] of Object.entries(state.resources)) defineOwnKey(resources, logicalId, record);
+	const retired = state.retiredNameGenerations ?? {};
+	for (const { to, record, source } of moved) {
+		if (hasOwnKey(state.resources, to) || hasOwnKey(resources, to)) throw new Error(`Logical ID ${to} is already in the destination stack's state`);
+		const group = renamesBySource.get(source);
+		const coMoved = new Set(group.values());
+		const renamed = rewriteRecordReferences(record, group);
+		const kept = renamed !== null && typeof renamed === "object" && Array.isArray(renamed.dependencies) ? {
+			...renamed,
+			dependencies: renamed.dependencies.filter((dep) => typeof dep !== "string" || coMoved.has(dep))
+		} : renamed;
+		const constructPath = constructPathOf(template, to);
+		defineOwnKey(resources, to, withNameGenerationReached({
+			...kept,
+			...constructPath !== void 0 && { constructPath }
+		}, to, hasOwnKey(retired, to) ? retired[to] : void 0));
+	}
+	const { skippedOutputs: _dropped, ...rest } = state;
+	return {
+		...rest,
+		...stackInstanceIdCarriedFrom(state),
+		resources,
+		lastModified: Date.now()
+	};
+}
+function withoutDependencies(record, drop) {
+	if (record === null || typeof record !== "object" || !Array.isArray(record.dependencies)) return record;
+	return {
+		...record,
+		dependencies: record.dependencies.filter((dep) => typeof dep !== "string" || !drop.has(dep))
+	};
+}
+
+//#endregion
+//#region src/utils/deferred-interrupts.ts
+async function withDeferredInterrupts(fn, onDeferred) {
+	let held;
+	const hold = (signal) => {
+		if (held === void 0) {
+			held = signal;
+			onDeferred(signal);
+		}
+	};
+	process.on("SIGINT", hold);
+	process.on("SIGTERM", hold);
+	let result;
+	try {
+		result = await fn();
+	} finally {
+		process.removeListener("SIGINT", hold);
+		process.removeListener("SIGTERM", hold);
+	}
+	if (held !== void 0) throw new CdkdError(`Interrupted (${held}) after the state writes finished; they are complete.`, "INTERRUPTED");
+	return result;
+}
+
+//#endregion
+//#region src/cli/commands/refactor-move.ts
+const rowKey = (stack, region, logicalId) => JSON.stringify([
+	stack,
+	region,
+	logicalId
+]);
+const location = (stack, logicalId) => `${stack}.${logicalId}`;
+async function planMoves(plans, envOf, overrides) {
+	const planAt = (stack, region) => plans.find((p) => p.stackName === stack && p.region === region);
+	const result = {
+		moves: [],
+		differing: [],
+		refused: [],
+		ambiguous: []
+	};
+	const takenFrom = /* @__PURE__ */ new Set();
+	const takenTo = /* @__PURE__ */ new Set();
+	const candidates = [];
+	const move = (source, from, dest, to, resourceType, origin) => ({
+		fromStack: source.stackName,
+		fromRegion: source.region,
+		from,
+		toStack: dest.stackName,
+		toRegion: dest.region,
+		to,
+		resourceType,
+		source: origin
+	});
+	for (const o of overrides) {
+		const source = planAt(o.fromStack, o.region);
+		const dest = planAt(o.toStack, o.region);
+		const refuse = (reason) => {
+			result.refused.push({
+				fromStack: o.fromStack,
+				from: o.from,
+				toStack: o.toStack,
+				to: o.to,
+				reason
+			});
+		};
+		if (source === void 0 || dest === void 0) {
+			refuse("both stacks must be selected and hold cdkd state; a refactor never creates a stack");
+			continue;
+		}
+		if (envOf(source) !== o.env || envOf(dest) !== o.env) {
+			refuse("the two stacks are not both in the mapping environment's account and region");
+			continue;
+		}
+		const d = source.unpaired.deletes.find((x) => x.logicalId === o.from);
+		const c = dest.unpaired.creates.find((x) => x.logicalId === o.to);
+		if (d === void 0) refuse(`${o.from} is not a resource ${o.fromStack}'s state holds and its template no longer declares`);
+		else if (c === void 0) refuse(`${o.to} is not a resource ${o.toStack}'s template declares and its state does not hold`);
+		else if (d.resourceType !== c.resourceType) refuse(`the types differ (${d.resourceType} and ${c.resourceType})`);
+		else if (!isPairableType(d.resourceType)) refuse(`cdkd refactor cannot move a ${d.resourceType} resource`);
+		else if (takenFrom.has(rowKey(o.fromStack, source.region, o.from)) || takenTo.has(rowKey(o.toStack, dest.region, o.to))) refuse("the mapping names one of these locations more than once");
+		else {
+			takenFrom.add(rowKey(o.fromStack, source.region, o.from));
+			takenTo.add(rowKey(o.toStack, dest.region, o.to));
+			candidates.push(move(source, o.from, dest, o.to, d.resourceType, "override"));
+		}
+	}
+	const envs = new Set(plans.map(envOf));
+	for (const env of envs) {
+		const envPlans = plans.filter((p) => envOf(p) === env);
+		const deletes = envPlans.flatMap((plan) => plan.unpaired.deletes.filter((d) => !takenFrom.has(rowKey(plan.stackName, plan.region, d.logicalId))).map((d) => ({
+			plan,
+			row: d
+		})));
+		const creates = envPlans.flatMap((plan) => plan.unpaired.creates.filter((c) => !takenTo.has(rowKey(plan.stackName, plan.region, c.logicalId))).map((c) => ({
+			plan,
+			row: c
+		})));
+		const types = [...new Set(creates.map((c) => c.row.resourceType))].sort();
+		for (const type of types) {
+			if (!isPairableType(type)) continue;
+			const ds = deletes.filter((d) => d.row.resourceType === type);
+			const cs = creates.filter((c) => c.row.resourceType === type);
+			if (ds.length === 0 || cs.length === 0) continue;
+			if (ds.length === 1 && cs.length === 1) {
+				if (ds[0].plan !== cs[0].plan) candidates.push(move(ds[0].plan, ds[0].row.logicalId, cs[0].plan, cs[0].row.logicalId, type, "detected"));
+				continue;
+			}
+			const matchesOf = /* @__PURE__ */ new Map();
+			const claims = /* @__PURE__ */ new Map();
+			for (const c of cs) {
+				const matches = ds.filter((d) => d.plan !== c.plan && looselyEqual(c.row.properties, d.row.properties));
+				matchesOf.set(c, matches);
+				for (const d of matches) claims.set(d, (claims.get(d) ?? 0) + 1);
+			}
+			const groupFrom = /* @__PURE__ */ new Set();
+			const groupTo = /* @__PURE__ */ new Set();
+			let groupPlan;
+			for (const c of cs) {
+				const matches = matchesOf.get(c) ?? [];
+				if (matches.length === 0) continue;
+				if (matches.length === 1 && claims.get(matches[0]) === 1) {
+					const d = matches[0];
+					candidates.push(move(d.plan, d.row.logicalId, c.plan, c.row.logicalId, type, "detected"));
+					continue;
+				}
+				groupTo.add(location(c.plan.stackName, c.row.logicalId));
+				for (const d of matches) {
+					groupFrom.add(location(d.plan.stackName, d.row.logicalId));
+					groupPlan ??= d.plan;
+				}
+			}
+			if (groupTo.size > 0 && groupPlan !== void 0) result.ambiguous.push({
+				resourceType: type,
+				from: [...groupFrom].sort(),
+				to: [...groupTo].sort(),
+				plan: groupPlan
+			});
+		}
+	}
+	let kept = candidates;
+	for (;;) {
+		const failed = [];
+		for (const dest of plans) {
+			const incoming = kept.filter((m) => m.toStack === dest.stackName && m.toRegion === dest.region);
+			if (incoming.length === 0) continue;
+			const renamed = applyLogicalIdRenames(dest.state, dest.renames.map(({ from, to }) => ({
+				from,
+				to
+			})), dest.template);
+			const withMoves = insertMovedRecords(renamed, incoming.map((m) => ({
+				from: m.from,
+				to: m.to,
+				record: planAt(m.fromStack, m.fromRegion).state.resources[m.from],
+				source: producerRecordKey(m.fromStack, m.fromRegion)
+			})), dest.template);
+			const { changes } = await dest.diff(withMoves);
+			for (const m of incoming) {
+				const change = changes.get(m.to);
+				if (change?.changeType === "NO_CHANGE") continue;
+				failed.push(m);
+				const paths = (change?.propertyChanges ?? []).map((p) => p.path);
+				for (const a of change?.attributeChanges ?? []) paths.push(a.attribute);
+				if (paths.length === 0) paths.push(`(${change?.changeType ?? "not in the diff"})`);
+				if (m.source === "override") result.refused.push({
+					fromStack: m.fromStack,
+					from: m.from,
+					toStack: m.toStack,
+					to: m.to,
+					reason: `its properties also changed (${paths.join(", ")}); cdkd refactor keeps only an unchanged resource. Revert the property change, run cdkd refactor, then deploy the change`
+				});
+				else result.differing.push({
+					move: m,
+					paths
+				});
+			}
+		}
+		if (failed.length === 0) break;
+		kept = kept.filter((m) => !failed.includes(m));
+	}
+	for (const m of kept) {
+		planAt(m.fromStack, m.fromRegion).movesOut.push(m);
+		planAt(m.toStack, m.toRegion).movesIn.push(m);
+	}
+	result.moves = kept;
+	const both = plans.filter((p) => p.movesOut.length > 0 && p.movesIn.length > 0);
+	if (both.length > 0) throw new CdkdError(safeMsg`cdkd refactor refused: ${both.map((p) => p.stackName).join(", ")} would both lose ` + "and gain a resource in one run, so nothing was written. Refactor one direction at a time: select only the stacks of one move direction, or name one direction in the mapping file.", "REFACTOR_REFUSED");
+	return result;
+}
+function renderMovePlan(plan) {
+	const lines = [];
+	if (plan.moves.length === 0 && plan.differing.length === 0 && plan.refused.length === 0 && plan.ambiguous.length === 0) return lines;
+	lines.push("Moves between stacks");
+	for (const m of plan.moves) lines.push(safeMsg`  ${m.fromStack}.${m.from} -> ${m.toStack}.${m.to}  (${m.resourceType}${m.source === "override" ? ", from the mapping file" : ""})`);
+	for (const { move: m, paths } of plan.differing) lines.push(safeMsg`  Not moved: ${m.fromStack}.${m.from} -> ${m.toStack}.${m.to} (${m.resourceType}) also ` + safeMsg`changes ${paths.join(", ")}. cdkd refactor keeps only an unchanged resource: revert ` + "the property change, run cdkd refactor, then deploy the change.");
+	for (const group of plan.ambiguous) lines.push(safeMsg`  Ambiguous (${group.resourceType}): ${group.from.join(", ")} could each be ` + safeMsg`${group.to.join(", ")}. Name the pairs with --override-file.`);
+	for (const r of plan.refused) lines.push(safeMsg`  Refused: ${r.fromStack}.${r.from} -> ${r.toStack}.${r.to}: ${r.reason}.`);
+	return lines;
+}
+const lockKey = (p) => producerRecordKey(p.stackName, p.region);
+function marksFor(plan, startedAt) {
+	return plan.movesOut.map((m) => ({
+		from: m.from,
+		toStack: m.toStack,
+		toRegion: m.toRegion,
+		to: m.to,
+		startedAt
+	}));
+}
+function withMarks(state, marks) {
+	if (marks.length === 0) return state;
+	const { moves } = pendingMovesOutOf(state);
+	return {
+		...state,
+		...stackInstanceIdCarriedFrom(state),
+		pendingMovesOut: [...moves, ...marks]
+	};
+}
+function withoutMarks(state, done) {
+	const { moves } = pendingMovesOutOf(state);
+	const left = moves.filter((m) => !done.has(m.from));
+	const { pendingMovesOut: _dropped, ...rest } = state;
+	const carried = {
+		...rest,
+		...stackInstanceIdCarriedFrom(rest)
+	};
+	return left.length > 0 ? {
+		...carried,
+		pendingMovesOut: left
+	} : carried;
+}
+async function applyMoveGroup(input) {
+	const { stateBackend, lockManager, recovery, contentionMessage } = input;
+	const plans = [...input.plans].sort((a, b) => lockKey(a) < lockKey(b) ? -1 : 1);
+	await withLocks(plans, lockManager, contentionMessage, async () => {
+		const loaded = /* @__PURE__ */ new Map();
+		for (const plan of plans) {
+			const stateData = await stateBackend.getState(plan.stackName, plan.region);
+			if (!stateData || stateData.etag !== plan.etag) throw new CdkdError(safeMsg`The state of stack ${plan.stackName} (${plan.region}) changed after cdkd ` + "refactor planned it, so nothing was written. Re-run cdkd refactor.", "REFACTOR_STATE_CHANGED");
+			refuseReadForWrite(stateData.state, plan.stackName, plan.region, recovery);
+			if (await stateBackend.loadRollbackJournal(plan.stackName, plan.region) !== null) throw new CdkdError(safeMsg`cdkd refactor refused stack ${plan.stackName} (${plan.region}): an earlier ` + safeMsg`deploy left a rollback journal, so nothing was written. Run 'cdkd rollback ` + safeMsg`${plan.stackName}' or a successful 'cdkd deploy' first.`, "REFACTOR_REFUSED");
+			loaded.set(plan, {
+				state: stateData.state,
+				...stateData.migrationPending && { migrationPending: true }
+			});
+		}
+		const recordOf = (stack, region, logicalId) => {
+			const plan = plans.find((p) => p.stackName === stack && p.region === region);
+			return loaded.get(plan).state.resources[logicalId];
+		};
+		const renamed = (plan) => applyLogicalIdRenames(loaded.get(plan).state, plan.renames.map(({ from, to }) => ({
+			from,
+			to
+		})), plan.template);
+		const startedAt = (input.now ?? Date.now)();
+		const written = [];
+		const fail = (plan, error) => {
+			const sources = plans.filter((p) => p.movesOut.length > 0).map((p) => p.stackName);
+			return new CdkdError(safeMsg`cdkd refactor could not save stack ${plan.stackName} (${plan.region}): ` + safeMsg`${error.message}.\n` + (written.length > 0 ? safeMsg`Written before the failure: ${written.join(", ")}.\n` : "") + safeMsg`Any move that started is recorded in its source stack (${sources.join(", ")}), ` + "whose 'cdkd deploy' and 'cdkd destroy' refuse until it is finished. Re-run " + safeMsg`'cdkd refactor ${sources.join(" ")}' to finish it.`, "REFACTOR_PARTIAL");
+		};
+		const save = async (plan, state, expectedEtag) => {
+			try {
+				const etag = await stateBackend.saveState(plan.stackName, plan.region, state, {
+					expectedEtag,
+					...loaded.get(plan).migrationPending && { migrateLegacy: true }
+				});
+				written.push(`${plan.stackName} (${plan.region})`);
+				return etag;
+			} catch (error) {
+				throw fail(plan, error);
+			}
+		};
+		const markerMoves = plans.flatMap((p) => p.movesOut.map((m) => ({
+			fromStack: m.fromStack,
+			fromRegion: m.fromRegion,
+			from: m.from,
+			toStack: m.toStack,
+			toRegion: m.toRegion,
+			to: m.to,
+			startedAt
+		})));
+		if (markerMoves.length > 0) await updateRefactorMarker(stateBackend, (moves) => [...moves.filter((m) => !markerMoves.some((n) => sameMove(m, n))), ...markerMoves]);
+		const sourceEtags = /* @__PURE__ */ new Map();
+		const marked = /* @__PURE__ */ new Map();
+		for (const plan of plans.filter((p) => p.movesIn.length === 0)) {
+			const leaving = [...plan.renames.map((r) => r.from), ...plan.movesOut.map((m) => m.from)];
+			if (leaving.length > 0) await stateBackend.rotateCreateTokenNonce(plan.stackName, plan.region, leaving);
+			const state = withMarks(renamed(plan), marksFor(plan, startedAt));
+			marked.set(plan, state);
+			sourceEtags.set(plan, await save(plan, state, plan.etag));
+		}
+		for (const plan of plans.filter((p) => p.movesIn.length > 0)) {
+			if (plan.renames.length > 0) await stateBackend.rotateCreateTokenNonce(plan.stackName, plan.region, plan.renames.map((r) => r.from));
+			await save(plan, insertMovedRecords(renamed(plan), plan.movesIn.map((m) => ({
+				from: m.from,
+				to: m.to,
+				record: recordOf(m.fromStack, m.fromRegion, m.from),
+				source: producerRecordKey(m.fromStack, m.fromRegion)
+			})), plan.template), plan.etag);
+		}
+		for (const plan of plans.filter((p) => p.movesOut.length > 0)) await save(plan, withoutMarks(removeMovedRecords(marked.get(plan), plan.movesOut.map(({ from, to }) => ({
+			from,
+			to
+		}))), new Set(plan.movesOut.map((m) => m.from))), sourceEtags.get(plan));
+		if (markerMoves.length > 0) try {
+			await updateRefactorMarker(stateBackend, (moves) => moves.filter((m) => !markerMoves.some((n) => sameMove(m, n))));
+		} catch (error) {
+			throw new CdkdError(safeMsg`Every record of the refactor was written, but the refactor marker could not ` + safeMsg`be cleared: ${error.message}. Until it is, deploy and destroy of ` + "the moved stacks refuse; re-run cdkd refactor to clear it.", "REFACTOR_PARTIAL");
+		}
+	});
+}
+function refuseReadForWrite(state, stackName, region, recovery) {
+	refuseMalformedState(state, stackName, region, recovery);
+	refuseMalformedOrphans(state, stackName, region, recovery);
+	refuseMalformedOrphanRecords(state, stackName, region, recovery);
+}
+async function withLocks(plans, lockManager, contentionMessage, fn) {
+	const logger = getLogger();
+	const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
+	const locked = [];
+	try {
+		for (const plan of plans) {
+			if (!await lockManager.acquireLock(plan.stackName, plan.region, owner, "refactor")) throw new Error(await contentionMessage(plan));
+			locked.push(plan);
+		}
+		return await fn();
+	} finally {
+		for (const plan of [...locked].reverse()) await lockManager.releaseLock(plan.stackName, plan.region).catch((err) => {
+			logger.warn(safeMsg`Failed to release lock: ${displayAwsMessage(describeAwsFailure(err).detail)}`);
+		});
+	}
+}
+async function finishPendingMoves(input) {
+	const { stackName, region, stateBackend, lockManager, recovery, contentionMessage } = input;
+	const finishedOf = (m) => ({
+		fromStack: stackName,
+		fromRegion: region,
+		from: m.from,
+		toStack: m.toStack,
+		toRegion: m.toRegion,
+		to: m.to
+	});
+	const first = await stateBackend.getState(stackName, region);
+	if (!first) {
+		const finished = [];
+		const stuck = [];
+		for (const m of input.markerMoves ?? []) {
+			const dest = await stateBackend.getState(m.toStack, m.toRegion);
+			if (dest !== null && Object.hasOwn(dest.state.resources, m.to)) finished.push(finishedOf(m));
+			else stuck.push(safeMsg`${stackName}.${m.from} -> ${m.toStack}.${m.to}`);
+		}
+		if (stuck.length > 0) throw new CdkdError(safeMsg`cdkd refactor cannot finish ${stuck.join(", ")}: ${stackName} (${region}) has ` + "no cdkd state any more and the destination does not record the resource. If the resource is still in AWS, adopt it into the destination with cdkd import; then remove the move from the refactor marker in the state bucket.", "REFACTOR_REFUSED");
+		return { finished };
+	}
+	const { moves: marked, malformed } = pendingMovesOutOf(first.state);
+	const moves = [...marked, ...(input.markerMoves ?? []).filter((m) => !marked.some((n) => n.from === m.from))];
+	if (malformed) throw new CdkdError(safeMsg`Stack ${stackName} (${region}) records an unfinished cdkd refactor move this ` + "binary cannot read (its pendingMovesOut field is malformed), so nothing was written. Inspect the record with cdkd state show and repair it by hand.", "REFACTOR_REFUSED");
+	if (moves.length === 0) return { finished: [] };
+	const keyOf = (s) => producerRecordKey(s.stackName, s.region);
+	const stacks = /* @__PURE__ */ new Map();
+	stacks.set(keyOf({
+		stackName,
+		region
+	}), {
+		stackName,
+		region
+	});
+	for (const m of moves) stacks.set(keyOf({
+		stackName: m.toStack,
+		region: m.toRegion
+	}), {
+		stackName: m.toStack,
+		region: m.toRegion
+	});
+	const ordered = [...stacks.values()].sort((a, b) => keyOf(a) < keyOf(b) ? -1 : 1);
+	return withLocks(ordered, lockManager, contentionMessage, async () => {
+		const read = /* @__PURE__ */ new Map();
+		for (const s of ordered) {
+			const data = await stateBackend.getState(s.stackName, s.region);
+			if (data) {
+				refuseReadForWrite(data.state, s.stackName, s.region, recovery);
+				read.set(keyOf(s), {
+					state: data.state,
+					etag: data.etag,
+					...data.migrationPending && { migrationPending: true }
+				});
+			}
+		}
+		const source = read.get(keyOf({
+			stackName,
+			region
+		}));
+		if (!source) return { finished: [] };
+		const currentMarked = pendingMovesOutOf(source.state).moves;
+		const current = [...currentMarked, ...(input.markerMoves ?? []).filter((m) => !currentMarked.some((n) => n.from === m.from))];
+		const refusals = [];
+		const finished = [];
+		const additions = /* @__PURE__ */ new Map();
+		for (const m of current) {
+			const destKey = keyOf({
+				stackName: m.toStack,
+				region: m.toRegion
+			});
+			const dest = read.get(destKey);
+			const record = Object.hasOwn(source.state.resources, m.from) ? source.state.resources[m.from] : void 0;
+			const held = dest !== void 0 && Object.hasOwn(dest.state.resources, m.to) ? dest.state.resources[m.to] : void 0;
+			const describe = safeMsg`${stackName}.${m.from} -> ${m.toStack}.${m.to}`;
+			if (dest === void 0) refusals.push(safeMsg`${describe}: ${m.toStack} (${m.toRegion}) has no cdkd state`);
+			else if (record === void 0) {
+				if (held === void 0) refusals.push(safeMsg`${describe}: neither stack records the resource; adopt it into ${m.toStack} with cdkd import`);
+				else finished.push(finishedOf(m));
+			} else if (held === void 0 && !input.declaresInDestination(m.toStack, m.toRegion, m.to, record.resourceType)) refusals.push(safeMsg`${describe}: ${m.toStack}'s template does not declare ${m.to} as a ` + safeMsg`${record.resourceType}, so the record is not moved there. Check the move, ` + "and the CDK app the run synthesized");
+			else if (held === void 0) {
+				const list = additions.get(destKey) ?? [];
+				list.push({
+					from: m.from,
+					to: m.to,
+					record,
+					source: keyOf({
+						stackName,
+						region
+					})
+				});
+				additions.set(destKey, list);
+				finished.push(finishedOf(m));
+			} else if (held.physicalId !== record.physicalId) refusals.push(safeMsg`${describe}: ${m.toStack} already holds a different resource under ${m.to} ` + "(created by a deploy before the move finished). Delete or orphan that resource in " + safeMsg`${m.toStack}, then re-run cdkd refactor`);
+			else finished.push(finishedOf(m));
+		}
+		for (const [destKey, list] of additions) {
+			const dest = read.get(destKey);
+			const s = stacks.get(destKey);
+			await stateBackend.saveState(s.stackName, s.region, insertMovedRecords(dest.state, list, { Resources: {} }), {
+				expectedEtag: dest.etag,
+				...dest.migrationPending && { migrateLegacy: true }
+			});
+		}
+		if (finished.length > 0) {
+			const done = new Set(finished.map((f) => f.from));
+			const leaving = finished.filter((f) => Object.hasOwn(source.state.resources, f.from)).map(({ from, to }) => ({
+				from,
+				to
+			}));
+			await stateBackend.saveState(stackName, region, withoutMarks(leaving.length > 0 ? removeMovedRecords(source.state, leaving) : source.state, done), {
+				expectedEtag: source.etag,
+				...source.migrationPending && { migrateLegacy: true }
+			});
+		}
+		if (refusals.length > 0) {
+			const error = new CdkdError(safeMsg`cdkd refactor could not finish ${refusals.length} interrupted move(s) out of ` + safeMsg`${stackName} (${region}); they stay recorded, so the deploy and destroy of ` + "both stacks keep refusing" + (finished.length > 0 ? safeMsg` (${finished.length} other move(s) were finished)` : "") + ":\n" + refusals.map((r) => `  ${r}.`).join("\n"), "REFACTOR_REFUSED");
+			Object.assign(error, { finishedMoves: finished });
+			throw error;
+		}
+		return { finished };
+	});
+}
+async function finishInterruptedMoves(input) {
+	const { stateBackend } = input;
+	const marker = await stateBackend.getRefactorMarker();
+	const parsed = marker === null ? {
+		moves: [],
+		malformed: false
+	} : refactorMarkerMovesOf(marker.body);
+	if (parsed.malformed) throw new CdkdError(safeMsg`The cdkd refactor marker ${stateBackend.refactorMarkerKey()} cannot be read, so ` + "cdkd refactor cannot tell which moves are unfinished; nothing was written. Inspect it in the state bucket, and delete it once no move is in progress.", "REFACTOR_REFUSED");
+	const keyOf = (stackName, region) => producerRecordKey(stackName, region);
+	const selected = new Set(input.selected.map((s) => keyOf(s.stackName, s.region)));
+	const sources = /* @__PURE__ */ new Map();
+	for (const s of input.selected) {
+		const current = await stateBackend.getState(s.stackName, s.region);
+		const marked = current ? pendingMovesOutOf(current.state).moves : [];
+		if (current && hasPendingMovesOut(current.state)) sources.set(keyOf(s.stackName, s.region), {
+			...s,
+			markerMoves: [],
+			marked
+		});
+	}
+	for (const m of parsed.moves) {
+		if (!selected.has(keyOf(m.fromStack, m.fromRegion)) && !selected.has(keyOf(m.toStack, m.toRegion))) continue;
+		const key = keyOf(m.fromStack, m.fromRegion);
+		const entry = sources.get(key) ?? {
+			stackName: m.fromStack,
+			region: m.fromRegion,
+			markerMoves: [],
+			marked: []
+		};
+		entry.markerMoves.push({
+			from: m.from,
+			toStack: m.toStack,
+			toRegion: m.toRegion,
+			to: m.to,
+			startedAt: m.startedAt
+		});
+		sources.set(key, entry);
+	}
+	const declaresInDestination = (stackName, region, logicalId, resourceType) => {
+		const resources = input.templateOf(stackName, region)?.Resources ?? {};
+		return Object.hasOwn(resources, logicalId) && resources[logicalId].Type === resourceType;
+	};
+	const finished = [];
+	const pending = [];
+	for (const source of sources.values()) {
+		if (input.dryRun) {
+			for (const m of [...source.marked, ...source.markerMoves.filter((x) => !source.marked.some((y) => y.from === x.from))]) pending.push({
+				fromStack: source.stackName,
+				fromRegion: source.region,
+				from: m.from,
+				toStack: m.toStack,
+				toRegion: m.toRegion,
+				to: m.to
+			});
+			continue;
+		}
+		let result;
+		try {
+			result = await finishPendingMoves({
+				stackName: source.stackName,
+				region: source.region,
+				markerMoves: source.markerMoves,
+				declaresInDestination,
+				stateBackend,
+				lockManager: input.lockManager,
+				recovery: input.recovery,
+				contentionMessage: input.contentionMessage
+			});
+		} catch (error) {
+			const done = error.finishedMoves ?? [];
+			if (done.length > 0) await updateRefactorMarker(stateBackend, (moves) => moves.filter((m) => !done.some((f) => sameMove(m, f))));
+			throw error;
+		}
+		if (result.finished.length > 0) await updateRefactorMarker(stateBackend, (moves) => moves.filter((m) => !result.finished.some((f) => sameMove(m, f))));
+		finished.push(...result.finished);
+	}
+	return {
+		finished,
+		pending
+	};
+}
+
+//#endregion
+//#region src/cli/commands/refactor.ts
+function changedPaths(change) {
+	if (change === void 0) return ["(not in the diff)"];
+	const paths = (change.propertyChanges ?? []).map((p) => p.path);
+	for (const a of change.attributeChanges ?? []) paths.push(a.attribute);
+	return paths.length > 0 ? paths : [`(${change.changeType})`];
+}
+async function planStackRefactor(input) {
+	const { stackName, region, state, etag, template, overrides, diff, recovery } = input;
+	refuseMalformedOrphans(state, stackName, region, recovery);
+	refuseMalformedOrphanRecords(state, stackName, region, recovery);
+	const base = await diff(state);
+	if (base.blocking.length > 0) throw new CdkdError(safeMsg`cdkd refactor refused stack ${stackName} (${region}): ` + `'cdkd diff' reports a condition 'cdkd deploy' refuses to start on. Resolve what 'cdkd diff ${stackName}' reports, then re-run cdkd refactor.`, "REFACTOR_REFUSED");
+	const orphanIds = new Set((Array.isArray(state.orphans) ? state.orphans : []).map((o) => o !== null && typeof o === "object" ? o.logicalId : void 0).filter((id) => typeof id === "string"));
+	const creates = [];
+	const deletes = [];
+	for (const change of base.changes.values()) if (change.changeType === "CREATE" && !orphanIds.has(change.logicalId)) creates.push({
+		logicalId: change.logicalId,
+		resourceType: change.resourceType,
+		properties: change.desiredProperties ?? {}
+	});
+	else if (change.changeType === "DELETE") {
+		const record = state.resources[change.logicalId];
+		deletes.push({
+			logicalId: change.logicalId,
+			resourceType: change.resourceType,
+			properties: record !== void 0 && record.properties !== null && typeof record.properties === "object" ? record.properties : {}
+		});
+	}
+	const proposal = proposeRenames(creates, deletes, overrides);
+	const refusedOverrides = [...proposal.refusedOverrides];
+	const differing = [];
+	const skipped = [];
+	const candidates = proposal.renames.filter((r) => {
+		if (!orphanIds.has(r.from)) return true;
+		const reason = `a rollback-orphan record also names ${r.from}; run 'cdkd deploy' first to settle it`;
+		if (r.source === "override") refusedOverrides.push({
+			from: r.from,
+			to: r.to,
+			reason
+		});
+		else skipped.push({
+			rename: r,
+			reason
+		});
+		return false;
+	});
+	const confirm = async (proposed) => {
+		let kept = [...proposed];
+		while (kept.length > 0) {
+			const renamed = applyLogicalIdRenames(state, toLogicalIdRenames(kept), template);
+			const { changes } = await diff(renamed);
+			const failed = kept.filter((r) => changes.get(r.to)?.changeType !== "NO_CHANGE");
+			if (failed.length === 0) return {
+				kept,
+				changes
+			};
+			for (const rename of failed) {
+				const paths = changedPaths(changes.get(rename.to));
+				if (rename.source === "override") refusedOverrides.push({
+					from: rename.from,
+					to: rename.to,
+					reason: `its properties also changed (${paths.join(", ")}); cdkd refactor keeps only an unchanged resource. Revert the property change, run cdkd refactor, then deploy the change`
+				});
+				else differing.push({
+					rename,
+					paths
+				});
+			}
+			kept = kept.filter((r) => !failed.includes(r));
+		}
+		return {
+			kept,
+			changes: void 0
+		};
+	};
+	let { kept: renames, changes: confirmed } = await confirm(candidates);
+	let ambiguous = proposal.ambiguous;
+	let budget = MAX_TRIAL_DIFFS;
+	for (;;) {
+		const takenFrom = new Set(renames.map((r) => r.from));
+		const takenTo = new Set(renames.map((r) => r.to));
+		const accepted = [];
+		const remaining = [];
+		for (const group of ambiguous) {
+			const froms = group.from.filter((id) => !takenFrom.has(id));
+			const tos = group.to.filter((id) => !takenTo.has(id));
+			if (froms.length === 0 || tos.length === 0) continue;
+			if (froms.length * tos.length > budget) {
+				remaining.push({
+					resourceType: group.resourceType,
+					from: froms,
+					to: tos
+				});
+				continue;
+			}
+			const passing = /* @__PURE__ */ new Map();
+			for (const to of tos) {
+				const matches = [];
+				for (const from of froms) {
+					budget -= 1;
+					const { changes } = await diff(applyLogicalIdRenames(state, [...toLogicalIdRenames(renames), {
+						from,
+						to
+					}], template));
+					if (changes.get(to)?.changeType === "NO_CHANGE") matches.push(from);
+				}
+				passing.set(to, matches);
+			}
+			const claims = /* @__PURE__ */ new Map();
+			for (const matches of passing.values()) for (const from of matches) claims.set(from, (claims.get(from) ?? 0) + 1);
+			const leftFrom = /* @__PURE__ */ new Set();
+			const leftTo = [];
+			for (const [to, matches] of passing) {
+				if (matches.length === 0) continue;
+				if (matches.length === 1 && claims.get(matches[0]) === 1) {
+					accepted.push({
+						from: matches[0],
+						to,
+						resourceType: group.resourceType,
+						source: "detected"
+					});
+					continue;
+				}
+				leftTo.push(to);
+				for (const from of matches) leftFrom.add(from);
+			}
+			if (leftTo.length > 0) remaining.push({
+				resourceType: group.resourceType,
+				from: [...leftFrom].sort(),
+				to: leftTo.sort()
+			});
+		}
+		ambiguous = remaining;
+		if (accepted.length === 0) break;
+		({kept: renames, changes: confirmed} = await confirm([...renames, ...accepted]));
+	}
+	const renamedTo = new Set(renames.map((r) => r.to));
+	const stillChanging = confirmed === void 0 ? [] : [...confirmed.values()].filter((change) => (change.changeType === "UPDATE" || change.changeType === "CREATE") && !renamedTo.has(change.logicalId) && [...referencedLogicalIds(template, change.logicalId)].some((id) => renamedTo.has(id))).map((change) => change.logicalId).sort();
+	const takenTo = /* @__PURE__ */ new Set([
+		...renames.map((r) => r.to),
+		...skipped.map((x) => x.rename.to),
+		...ambiguous.flatMap((g) => g.to),
+		...overrides.map((o) => o.to)
+	]);
+	const takenFrom = /* @__PURE__ */ new Set([
+		...renames.map((r) => r.from),
+		...skipped.map((x) => x.rename.from),
+		...ambiguous.flatMap((g) => g.from),
+		...overrides.map((o) => o.from),
+		...orphanIds
+	]);
+	return {
+		stackName,
+		region,
+		etag,
+		renames,
+		differing,
+		skipped,
+		ambiguous,
+		refusedOverrides,
+		stillChanging,
+		template,
+		unpaired: {
+			creates: creates.filter((c) => !takenTo.has(c.logicalId)),
+			deletes: deletes.filter((d) => !takenFrom.has(d.logicalId))
+		},
+		movesOut: [],
+		movesIn: [],
+		state,
+		diff
+	};
+}
+const MAX_TRIAL_DIFFS = 64;
+function referencedLogicalIds(template, logicalId) {
+	const out = /* @__PURE__ */ new Set();
+	const resources = template.Resources ?? {};
+	if (!Object.hasOwn(resources, logicalId)) return out;
+	const resource = resources[logicalId];
+	const dependsOn = resource.DependsOn;
+	for (const id of Array.isArray(dependsOn) ? dependsOn : [dependsOn]) if (typeof id === "string") out.add(id);
+	const walk = (value) => {
+		if (Array.isArray(value)) {
+			value.forEach(walk);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		for (const [key, arg] of Object.entries(value)) {
+			if (key === "Ref" && typeof arg === "string") out.add(arg);
+			else if (key === "Fn::GetAtt") {
+				if (Array.isArray(arg) && typeof arg[0] === "string") out.add(arg[0]);
+				else if (typeof arg === "string") out.add(arg.split(".")[0]);
+			} else if (key === "Fn::Sub") {
+				const text = typeof arg === "string" ? arg : Array.isArray(arg) ? arg[0] : void 0;
+				if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}.]*)/g)) out.add(match[1]);
+			}
+			walk(arg);
+		}
+	};
+	walk(resource.Properties);
+	return out;
+}
+function toLogicalIdRenames(renames) {
+	return renames.map(({ from, to }) => ({
+		from,
+		to
+	}));
+}
+async function applyStackRefactor(input) {
+	const { plan, stateBackend, lockManager, contentionMessage } = input;
+	const logger = getLogger();
+	const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
+	if (!await lockManager.acquireLock(plan.stackName, plan.region, owner, "refactor")) throw new Error(await contentionMessage());
+	try {
+		const stateData = await stateBackend.getState(plan.stackName, plan.region);
+		if (!stateData || stateData.etag !== plan.etag) throw new CdkdError(safeMsg`The state of stack ${plan.stackName} (${plan.region}) changed after cdkd ` + `refactor planned it, so nothing was written for this stack. Re-run cdkd refactor.`, "REFACTOR_STATE_CHANGED");
+		refuseMalformedState(stateData.state, plan.stackName, plan.region, input.recovery);
+		refuseMalformedOrphans(stateData.state, plan.stackName, plan.region, input.recovery);
+		refuseMalformedOrphanRecords(stateData.state, plan.stackName, plan.region, input.recovery);
+		if (await stateBackend.loadRollbackJournal(plan.stackName, plan.region) !== null) throw rollbackJournalRefusal(plan.stackName, plan.region);
+		const renamed = applyLogicalIdRenames(stateData.state, toLogicalIdRenames(plan.renames), plan.template);
+		await stateBackend.rotateCreateTokenNonce(plan.stackName, plan.region, plan.renames.map((r) => r.from));
+		await stateBackend.saveState(plan.stackName, plan.region, renamed, {
+			expectedEtag: plan.etag,
+			...stateData.migrationPending && { migrateLegacy: true }
+		});
+	} finally {
+		await lockManager.releaseLock(plan.stackName, plan.region).catch((err) => {
+			logger.warn(safeMsg`Failed to release lock: ${displayAwsMessage(describeAwsFailure(err).detail)}`);
+		});
+	}
+}
+function rollbackJournalRefusal(stackName, region) {
+	return new CdkdError(safeMsg`cdkd refactor refused stack ${stackName} (${region}): an earlier deploy left a ` + safeMsg`rollback journal, so nothing was written for this stack. Run 'cdkd rollback ${stackName}' ` + `or a successful 'cdkd deploy' first.`, "REFACTOR_REFUSED");
+}
+function renderRefactorPlan(plan) {
+	const lines = [safeMsg`Stack ${plan.stackName} (${plan.region})`];
+	if (plan.renames.length === 0) lines.push("  No resource to refactor.");
+	for (const r of plan.renames) lines.push(safeMsg`  ${r.from} -> ${r.to}  (${r.resourceType}${r.source === "override" ? ", from the mapping file" : ""})`);
+	for (const { rename, paths } of plan.differing) lines.push(safeMsg`  Not refactored: ${rename.from} -> ${rename.to} (${rename.resourceType}) also changes ` + safeMsg`${paths.join(", ")}. cdkd refactor keeps only an unchanged resource: revert the ` + "property change, run cdkd refactor, then deploy the change.");
+	for (const { rename, reason } of plan.skipped) lines.push(safeMsg`  Not refactored: ${rename.from} -> ${rename.to} (${rename.resourceType}): ${reason}.`);
+	for (const group of plan.ambiguous) lines.push(safeMsg`  Ambiguous (${group.resourceType}): ${group.from.join(", ")} could each be ` + safeMsg`${group.to.join(", ")}. Name the pairs with --override-file.`);
+	for (const refused of plan.refusedOverrides) lines.push(safeMsg`  Refused: ${refused.from} -> ${refused.to}: ${refused.reason}.`);
+	if (plan.stillChanging.length > 0) lines.push(safeMsg`  Warning: ${plan.stillChanging.join(", ")} reference a renamed resource and still ` + "change on the next deploy. Check that each pair above names the resource you meant; 'cdkd diff' after the refactor shows the change.");
+	return lines;
+}
+function sampleMappingFile(plans, moveGroups = []) {
+	const moveEnvironments = moveGroups.map(({ group, account }) => {
+		const resources = {};
+		group.from.forEach((from, i) => {
+			Object.defineProperty(resources, from, {
+				value: group.to[i] ?? group.to[0],
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+		});
+		return {
+			account,
+			region: group.plan.region,
+			resources
+		};
+	});
+	const stackEnvironments = plans.filter(({ plan }) => plan.ambiguous.length > 0).map(({ plan, account }) => {
+		const resources = {};
+		for (const group of plan.ambiguous) group.from.forEach((from, i) => {
+			const to = group.to[i] ?? group.to[0];
+			Object.defineProperty(resources, `${plan.stackName}.${from}`, {
+				value: `${plan.stackName}.${to}`,
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+		});
+		return {
+			account,
+			region: plan.region,
+			resources
+		};
+	});
+	return JSON.stringify({ environments: [...stackEnvironments, ...moveEnvironments] }, null, 2);
+}
+function overridesForStack(environments, stackName, account, region, revert) {
+	const out = [];
+	for (const env of environments) {
+		if (env.account !== account || env.region !== region) continue;
+		for (const pair of mappingPairs(env.resources, revert)) {
+			if (pair.fromStack !== stackName || pair.toStack !== stackName) continue;
+			out.push({
+				from: pair.from,
+				to: pair.to
+			});
+		}
+	}
+	return out;
+}
+function moveOverridesOf(environments, accounts, revert) {
+	const out = [];
+	for (const env of environments) {
+		if (!accounts.has(env.account)) continue;
+		for (const pair of mappingPairs(env.resources, revert)) {
+			if (pair.fromStack === pair.toStack) continue;
+			out.push({
+				region: env.region,
+				env: envKey(env.account, env.region),
+				...pair
+			});
+		}
+	}
+	return out;
+}
+function envKey(account, region) {
+	return JSON.stringify([account, region]);
+}
+async function refactorCommand(stacks, options) {
+	const providerClasses = await loadProviderClasses();
+	const logger = getLogger();
+	const holdNotice = (signal) => {
+		logger.warn(safeMsg`${signal} received: finishing the cdkd state writes already started (a few S3 ` + "writes), then stopping.");
+	};
+	if (options.verbose) logger.setLevel("debug");
+	if (options.revert === true && options.overrideFile === void 0) throw new CdkdError("--revert requires --override-file", "INCOMPATIBLE_OPTIONS");
+	warnIfDeprecatedRegion(options);
+	foldRegionOption(options);
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region
+	});
+	const app = resolveApp(options.app);
+	if (!app) throw new Error("No app command specified. Use --app, set CDKD_APP env var, or add \"app\" to cdk.json");
+	let environments = [];
+	if (options.overrideFile !== void 0) {
+		let text;
+		try {
+			text = readFileSync(options.overrideFile, "utf-8");
+		} catch {
+			throw new CdkdError(safeMsg`Cannot read the mapping file ${options.overrideFile}`, "REFACTOR_MAPPING_FILE");
+		}
+		try {
+			environments = parseMappingFile(text);
+		} catch (error) {
+			throw new CdkdError(safeMsg`Invalid mapping file ${options.overrideFile}: ${error.message}`, "REFACTOR_MAPPING_FILE");
+		}
+	}
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const region = effectiveRegion.region;
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region, legacyStateBucketFallbackRegion(effectiveRegion));
+	const awsClients = new AwsClients({
+		region: effectiveRegion.region,
+		...options.profile && { profile: options.profile }
+	});
+	setAwsClients(awsClients);
+	try {
+		logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
+		const synthesizer = new Synthesizer();
+		const context = parseContextOptions(options.context);
+		const synthOptions = {
+			app,
+			output: options.output,
+			...options.region && { region: options.region },
+			...options.profile && { profile: options.profile },
+			...Object.keys(context).length > 0 && { context },
+			stateBucket,
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
+			deferMacroExpansion: true
+		};
+		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
+		const targetStacks = selectStacks(allStacks, stacks, options);
+		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
+		const stateConfig = {
+			bucket: stateBucket,
+			prefix: options.statePrefix
+		};
+		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
+			region,
+			...options.profile && { profile: options.profile }
+		});
+		await stateBackend.verifyBucketExists();
+		const lockManager = new LockManager(awsClients.s3, stateConfig);
+		const recovery = {
+			profile: options.profile,
+			stateBucket,
+			statePrefix: options.statePrefix
+		};
+		const regionForStack = stackRegionResolver({
+			effective: effectiveRegion,
+			probe: stateBackend,
+			logger,
+			siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
+		});
+		const diffCalculator = new DiffCalculator();
+		const registry = new ProviderRegistry();
+		registerAllProviders(registry, providerClasses);
+		const canonicalizeProperties = makeCanonicalizePropertiesFn(registry);
+		const producerLookup = producerLookupOver(allStacks);
+		const resolveAssetRedirect = createAssetRedirectResolver({
+			stateBackend,
+			stsRegion: region,
+			...options.profile && { profile: options.profile },
+			useCdkBootstrapAssets: resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets),
+			suppressLegacyNotice: true
+		});
+		let callerAccount;
+		const accountOf = async (stackInfo) => {
+			if (stackInfo.account) return stackInfo.account;
+			callerAccount ??= (await getAccountInfo()).accountId;
+			return callerAccount;
+		};
+		const selectedStacks = [];
+		for (const stackInfo of targetStacks) selectedStacks.push({
+			stackName: stackInfo.stackName,
+			region: await regionForStack(stackInfo.stackName, stackInfo.region)
+		});
+		const templateOf = (stackName, region) => allStacks.find((s) => s.stackName === stackName && (s.region === void 0 || s.region === region))?.template;
+		const { finished: finishedMoves, pending: pendingMoves } = await withDeferredInterrupts(() => finishInterruptedMoves({
+			selected: selectedStacks,
+			templateOf,
+			dryRun: options.dryRun === true,
+			stateBackend,
+			lockManager,
+			recovery,
+			contentionMessage: (st) => buildLockContentionMessage({
+				lockManager,
+				stackName: st.stackName,
+				region: st.region,
+				recovery
+			})
+		}), holdNotice);
+		for (const f of finishedMoves) logger.info(safeMsg`Finished an interrupted move: ${f.fromStack}.${f.from} -> ${f.toStack}.${f.to}`);
+		if (pendingMoves.length > 0) {
+			for (const f of pendingMoves) logger.info(safeMsg`An interrupted move would be finished: ${f.fromStack}.${f.from} -> ${f.toStack}.${f.to}`);
+			logger.info("\n--dry-run: state was NOT written. Re-run without --dry-run to finish these moves; the refactor plan is computed after them.");
+			return;
+		}
+		const plans = [];
+		const planStacks = /* @__PURE__ */ new Map();
+		for (const stackInfo of targetStacks) {
+			const stackRegion = await regionForStack(stackInfo.stackName, stackInfo.region);
+			const stateData = await stateBackend.getState(stackInfo.stackName, stackRegion);
+			if (!stateData) {
+				logger.info(safeMsg`Stack ${stackInfo.stackName} (${stackRegion}) has no cdkd state: nothing to refactor.`);
+				continue;
+			}
+			refuseMalformedState(stateData.state, stackInfo.stackName, stackRegion, recovery);
+			if (await stateBackend.loadRollbackJournal(stackInfo.stackName, stackRegion) !== null) throw rollbackJournalRefusal(stackInfo.stackName, stackRegion);
+			const assetRedirect = await resolveAssetRedirect(stackInfo.assetManifestPath, stackRegion);
+			if (assetRedirect) rewriteTemplateAssetReferences(stackInfo.template, assetRedirect);
+			const overrides = environments.length === 0 ? [] : overridesForStack(environments, stackInfo.stackName, await accountOf(stackInfo), stackRegion, options.revert === true);
+			const diff = async (state) => {
+				const result = await computeStackDiff(state, stackInfo.template, stackRegion, stackInfo.stackName, stateBackend, diffCalculator, {
+					canonicalizeProperties,
+					...options.cfnFallback === false && { cfnFallback: false },
+					producerLookup,
+					...stackInfo.account && { consumerAccount: stackInfo.account },
+					refusalRecovery: recovery,
+					inheritSecretBearingTemplate: false,
+					previewMaskedInputs: true,
+					...stackInfo.nestedTemplates && { nestedTemplates: stackInfo.nestedTemplates }
+				});
+				return {
+					changes: result.changes,
+					blocking: result.blocking
+				};
+			};
+			const plan = await planStackRefactor({
+				stackName: stackInfo.stackName,
+				region: stackRegion,
+				state: stateData.state,
+				etag: stateData.etag,
+				template: stackInfo.template,
+				overrides,
+				diff,
+				recovery
+			});
+			plans.push(plan);
+			planStacks.set(plan, stackInfo);
+		}
+		const accountByPlan = /* @__PURE__ */ new Map();
+		if (plans.length > 1) for (const plan of plans) accountByPlan.set(plan, await accountOf(planStacks.get(plan)));
+		const movePlan = plans.length > 1 ? await planMoves(plans, (plan) => envKey(accountByPlan.get(plan), plan.region), moveOverridesOf(environments, new Set(accountByPlan.values()), options.revert === true)) : {
+			moves: [],
+			differing: [],
+			refused: [],
+			ambiguous: []
+		};
+		if (plans.length <= 1 && environments.length > 0) {
+			const lone = moveOverridesOf(environments, new Set(plans.length === 1 ? [await accountOf(planStacks.get(plans[0]))] : []), options.revert === true);
+			for (const o of lone) movePlan.refused.push({
+				fromStack: o.fromStack,
+				from: o.from,
+				toStack: o.toStack,
+				to: o.to,
+				reason: "a move needs both stacks selected; name both, or pass --all"
+			});
+		}
+		for (const plan of plans) for (const line of renderRefactorPlan(plan)) logger.info(line);
+		for (const line of renderMovePlan(movePlan)) logger.info(line);
+		if (plans.some((p) => p.ambiguous.length > 0) || movePlan.ambiguous.length > 0) {
+			const withAccounts = [];
+			for (const plan of plans) {
+				if (plan.ambiguous.length === 0) continue;
+				withAccounts.push({
+					plan,
+					account: await accountOf(planStacks.get(plan))
+				});
+			}
+			const moveGroups = [];
+			for (const group of movePlan.ambiguous) moveGroups.push({
+				group,
+				account: await accountOf(planStacks.get(group.plan))
+			});
+			logger.info("\nA mapping file naming each ambiguous pair (edit the pairs, then pass it with --override-file):");
+			for (const line of sampleMappingFile(withAccounts, moveGroups).split("\n")) logger.info(displaySafe(line));
+			throw new CdkdError("cdkd refactor found resources it cannot pair on its own; nothing was written. Name each ambiguous pair in a mapping file and re-run with --override-file.", "REFACTOR_AMBIGUOUS");
+		}
+		const refused = [...plans.flatMap((p) => p.refusedOverrides), ...movePlan.refused];
+		if (refused.length > 0) throw new CdkdError(`cdkd refactor refused ${refused.length} pair(s) the mapping file names; nothing was written. Fix or remove each refused pair in the mapping file (the reasons are above), then re-run cdkd refactor.`, "REFACTOR_REFUSED");
+		const toApply = plans.filter((p) => p.renames.length > 0 || p.movesOut.length > 0 || p.movesIn.length > 0);
+		if (toApply.length === 0) {
+			logger.info("\nNothing to refactor.");
+			return;
+		}
+		if (options.dryRun) {
+			logger.info("\n--dry-run: state was NOT written. Re-run without --dry-run to apply.");
+			return;
+		}
+		const count = toApply.reduce((n, p) => n + p.renames.length, 0) + movePlan.moves.length;
+		if (!options.yes && !options.force) {
+			if (!await confirmOrRefuse(`\nRename or move ${count} resource(s) in cdkd state as listed above? AWS resources are not touched.`, { refusal: "The cdkd refactor confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes (or -f / --force) to confirm, or run the command from a real terminal." })) {
+				logger.info("Refactor cancelled.");
+				return;
+			}
+		}
+		if (movePlan.moves.length > 0) {
+			await withDeferredInterrupts(() => applyMoveGroup({
+				plans: toApply,
+				stateBackend,
+				lockManager,
+				recovery,
+				contentionMessage: (plan) => buildLockContentionMessage({
+					lockManager,
+					stackName: plan.stackName,
+					region: plan.region,
+					recovery
+				})
+			}), holdNotice);
+			logger.info(safeMsg`Refactored ${count} resource(s) across ${toApply.length} stack(s): ` + safeMsg`${toApply.map((p) => `${p.stackName} (${p.region})`).join(", ")}.`);
+			logger.info("\nAWS resources were not touched. Run 'cdkd diff' to confirm the refactored resources show no change, and deploy the destination stacks before the stacks that import from them.");
+			return;
+		}
+		const done = [];
+		for (const plan of toApply) {
+			try {
+				await withDeferredInterrupts(() => applyStackRefactor({
+					plan,
+					stateBackend,
+					lockManager,
+					recovery,
+					contentionMessage: () => buildLockContentionMessage({
+						lockManager,
+						stackName: plan.stackName,
+						region: plan.region,
+						recovery
+					})
+				}), holdNotice);
+			} catch (error) {
+				if (done.length > 0) logger.error(safeMsg`Already refactored before this failure, and kept: ${done.join(", ")}.`);
+				throw error;
+			}
+			done.push(`${plan.stackName} (${plan.region})`);
+			logger.info(safeMsg`Refactored ${plan.renames.length} resource(s) in stack ${plan.stackName} (${plan.region}).`);
+		}
+		logger.info("\nAWS resources were not touched. Run 'cdkd diff' to confirm the renamed resources show no change.");
+	} finally {
+		awsClients.destroy();
+	}
+}
+function selectStacks(allStacks, stacks, options) {
+	const logger = getLogger();
+	const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
+	if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
+	let targetStacks;
+	if (options.all) {
+		const { topLevel, inStages } = partitionTopLevel(allStacks);
+		if (topLevel.length === 0) throw new Error(renderAllNoTopLevelStacks(inStages));
+		if (inStages.length > 0) logger.info(renderAllLeftOutStageStacks(inStages));
+		targetStacks = topLevel;
+	} else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns, { dedupe: "identity" });
+	else if (allStacks.length === 1) targetStacks = allStacks;
+	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all (top-level stacks; '**' for every stack)`);
+	if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
+	return targetStacks;
+}
+function createRefactorCommand() {
+	const cmd = new Command("refactor").description("Keep resources whose logical IDs a construct rename changed, instead of replacing them (mirrors 'cdk refactor'). Rewrites cdkd state only; AWS resources are not touched.").argument("[stacks...]", "Stack name(s) to refactor. Accepts CDK display paths (e.g. 'MyStage/Api') with wildcards, or exact physical CloudFormation names.").option("--all", "Refactor every top-level stack (Stage stacks: '**')", false).option("--dry-run", "Print the refactor plan without writing state", false).option("--override-file <path>", "A JSON mapping file naming pairs the detection finds ambiguous, in the cdk refactor format: {\"environments\":[{\"account\",\"region\",\"resources\":{\"Stack.OldId\":\"Stack.NewId\"}}]}").option("--revert", "Apply the mapping file in reverse (requires --override-file)", false).option("-f, --force", "Skip the confirmation prompt", false).addOption(useCdkBootstrapAssetsOption).addOption(noCfnFallbackOption).action(withErrorHandling(refactorCommand));
+	[
+		...commonOptions,
+		...appOptions,
+		...stateOptions,
+		...stackOptions,
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(deprecatedRegionOption);
+	return cmd;
+}
+
+//#endregion
+//#region src/cli/commands/publish-assets.ts
+async function publishAssetsCommand(stacks, options) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	warnIfDeprecatedRegion(options);
+	const rawNamedRegion = rawCliRegion(options.region);
+	foldRegionOption(options);
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region
+	});
+	const app = resolveApp(options.app);
+	if (!app) throw new Error("No app command specified. Use --app, set CDKD_APP env var, or add \"app\" to cdk.json");
+	logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
+	const synthesizer = new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOptions = {
+		app,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context }
+	};
+	const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
+	logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
+	const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
+	let targetStacks;
+	if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
+	if (options.all) targetStacks = allStacks;
+	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns, { dedupe: "identity" });
+	else if (allStacks.length === 1) targetStacks = allStacks;
+	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
+	if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks));
+	const effectiveRegion = await resolveEffectiveRegion(options);
+	exportInferredRegionForSdk(effectiveRegion);
+	const baseRegion = effectiveRegion.region;
+	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+	const stsClient = new STSClient({
+		...ambientClientDefaults(),
+		region: baseRegion
+	});
+	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
+	stsClient.destroy();
+	const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
+	let markerAccess;
+	const getModeResolver = async () => {
+		if (markerAccess !== void 0) return markerAccess?.resolver ?? null;
+		let bucket;
+		try {
+			bucket = await resolveStateBucketWithDefault(options.stateBucket, baseRegion, legacyStateBucketFallbackRegion(effectiveRegion));
+		} catch {
+			logger.info("No cdkd state bucket found — publishing to the asset-manifest destinations (CDK bootstrap storage) verbatim. Run 'cdkd bootstrap' to opt into cdkd-owned asset storage that 'cdk gc' never touches.");
+			markerAccess = null;
+			return null;
+		}
+		const markerClients = new AwsClients({
+			region: baseRegion,
+			...options.profile && { profile: options.profile }
+		});
+		const backend = new S3StateBackend(markerClients.s3, {
+			bucket,
+			prefix: options.statePrefix
+		}, {
+			region: baseRegion,
+			...options.profile && { profile: options.profile }
+		});
+		const resolver = new AssetModeResolver(backend, accountId, { ...options.profile && { profile: options.profile } });
+		markerAccess = {
+			resolver,
+			regionFor: stackRegionResolver({
+				effective: effectiveRegion,
+				probe: backend,
+				logger,
+				siblings: allStacks.filter((s) => !s.region).map((s) => s.stackName)
+			}),
+			dispose: () => markerClients.destroy()
+		};
+		return resolver;
+	};
+	const regionForStack = async (stack) => {
+		if (stack.region) return stack.region;
 		if (!regionNeedsReconciliation(effectiveRegion)) return baseRegion;
 		await getModeResolver();
 		return markerAccess ? markerAccess.regionFor(stack.stackName) : baseRegion;
@@ -21835,7 +23531,8 @@ function parseMappingJson(raw, source) {
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse ${source} as JSON: ` + describeAwsFailure(err).detail);
+		getLogger().debug(safeMsg`${source} failed to parse: ${parseFailureDebugDetail(err)}`);
+		throw new Error(`Failed to parse ${source} as JSON: ` + describeJsonParseFailure(err, utf8ByteLength(raw)));
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${source} must be a JSON object {logicalId: physicalId}`);
 	const out = {};
@@ -21983,7 +23680,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 			dependencies: deps,
 			deletionPolicy: tmplResource.DeletionPolicy,
 			updateReplacePolicy: tmplResource.UpdateReplacePolicy,
-			...constructPathField(constructPathOf(template, row.logicalId)),
+			...constructPathField(constructPathOf$1(template, row.logicalId)),
 			provisionedBy: row.provisionedBy ?? "sdk",
 			...prior && prior.physicalId === row.physicalId && (hasUnverifiableParameterRefusal(prior) || hasReasonlessBaselineRefusal(prior) && (namesParameter ??= resourcesNamingDeclaredParameter(template))(row.logicalId)) && {
 				observedBaselineRefused: true,
@@ -22508,7 +24205,8 @@ function readNestedChildTemplate(templatePath, childLogicalId) {
 	try {
 		return JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse nested-stack template for '${childLogicalId}' at ${templatePath}: ${describeAwsFailure(err).detail}`);
+		getLogger().debug(safeMsg`Nested-stack template for '${childLogicalId}' failed to parse: ${parseFailureDebugDetail(err)}`);
+		throw new Error(`Failed to parse nested-stack template for '${childLogicalId}' at ${templatePath}: ${describeJsonParseFailure(err, utf8ByteLength(raw))}`);
 	}
 }
 function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
@@ -24764,7 +26462,7 @@ function attachWebSocketServer(opts) {
 			});
 		});
 		ws.on("error", (err) => {
-			logger.debug(`WebSocket error for connection ${connectionId}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`WebSocket error for connection ${connectionId}: ${describeAwsFailure(err).detail}`);
 		});
 		for (const frame of preVerdictFrames) {
 			const { body, isBase64Encoded } = bufferToBody$1(frame.raw, frame.isBinary);
@@ -26282,7 +27980,8 @@ function readEnvOverridesFile$3(filePath) {
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${describeAwsFailure(err).detail}`);
+		getLogger().debug(safeMsg`--env-vars file failed to parse: ${parseFailureDebugDetail(err)}`);
+		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${describeJsonParseFailure(err, utf8ByteLength(raw))}`);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
 	return parsed;
@@ -27580,7 +29279,7 @@ async function localRunTaskCommand(target, options) {
 					await channels.profileCredsFile.dispose();
 					credsHostPath = void 0;
 				} catch (err) {
-					getLogger().debug(`Failed to remove profile credentials tmpdir ${channels.profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+					getLogger().debug(`Failed to remove profile credentials tmpdir ${channels.profileCredsFile.hostPath}: ${describeAwsFailure(err).detail}`);
 				}
 			};
 			try {
@@ -27589,7 +29288,7 @@ async function localRunTaskCommand(target, options) {
 					afterContainersStopped: disposeCreds
 				});
 			} catch (err) {
-				getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+				getLogger().debug(`cleanup failed: ${describeAwsFailure(err).detail}`);
 			}
 			await disposeCreds();
 			await flushStdio();
@@ -27873,13 +29572,14 @@ function readEnvOverridesFile$2(filePath) {
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read --env-vars file '${filePath}': ${describeAwsFailure(err).detail}`);
 	}
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(safeMsg`--env-vars file failed to parse: ${parseFailureDebugDetail(err)}`);
+		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${describeJsonParseFailure(err, utf8ByteLength(raw))}`);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
 	return parsed;
@@ -28249,7 +29949,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 			const stream = logStream;
 			logStream = void 0;
 			drainInFlight = killAndDrainContainerLogs(containerId, stream).catch((err) => {
-				getLogger().debug(safeMsg`container log drain failed: ${err instanceof Error ? err.message : String(err)}`);
+				getLogger().debug(safeMsg`container log drain failed: ${describeAwsFailure(err).detail}`);
 			}).finally(() => {
 				drainInFlight = void 0;
 			});
@@ -28269,7 +29969,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 		if (stateProvider) try {
 			stateProvider.dispose();
 		} catch (err) {
-			getLogger().debug(`state provider dispose failed: ${err instanceof Error ? err.message : String(err)}`);
+			getLogger().debug(`state provider dispose failed: ${describeAwsFailure(err).detail}`);
 		}
 		if (startPending) getLogger().info("Waiting for the in-flight docker run so its container can be removed...");
 		if (startInFlight && !await settlesWithin(startInFlight, containerStartWait.ms)) {
@@ -28283,16 +29983,16 @@ async function localInvokeAgentCoreCommand(target, options) {
 		if (containerId) try {
 			await removeContainer(containerId);
 		} catch (err) {
-			getLogger().debug(`removeContainer(${containerId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			getLogger().debug(`removeContainer(${containerId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		if (profileCredsFile) try {
 			await profileCredsFile.dispose();
 		} catch (err) {
-			getLogger().debug(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+			getLogger().debug(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${describeAwsFailure(err).detail}`);
 		}
 		await flushStdio();
 	}, (err) => {
-		getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(`cleanup failed: ${describeAwsFailure(err).detail}`);
 	});
 	try {
 		if (typeof options.assumeRole === "string") explicitRoleArnOrThrow("--assume-role", options.assumeRole, (message) => new CdkdError(message, "LOCAL_INVOKE_AGENTCORE_ASSUME_ROLE_INVALID"));
@@ -29102,7 +30802,7 @@ async function readEvent$1(options) {
 		try {
 			raw = readFileSync(options.event, "utf-8");
 		} catch (err) {
-			throw new CdkdError(`Failed to read --event file '${options.event}': ${err instanceof Error ? err.message : String(err)}`, "LOCAL_INVOKE_AGENTCORE_EVENT_READ_FAILED");
+			throw new CdkdError(`Failed to read --event file '${options.event}': ${describeAwsFailure(err).detail}`, "LOCAL_INVOKE_AGENTCORE_EVENT_READ_FAILED");
 		}
 		return parseEvent$1(raw, options.event);
 	}
@@ -29112,7 +30812,8 @@ function parseEvent$1(raw, source) {
 	try {
 		return JSON.parse(raw);
 	} catch (err) {
-		throw new CdkdError(`Failed to parse event payload from ${source} as JSON: ${err instanceof Error ? err.message : String(err)}`, "LOCAL_INVOKE_AGENTCORE_EVENT_PARSE_FAILED");
+		getLogger().debug(safeMsg`Event payload failed to parse: ${parseFailureDebugDetail(err)}`);
+		throw new CdkdError(`Failed to parse event payload from ${source} as JSON: ${describeJsonParseFailure(err, utf8ByteLength(raw))}`, "LOCAL_INVOKE_AGENTCORE_EVENT_PARSE_FAILED");
 	}
 }
 async function readStdin$1() {
@@ -29149,13 +30850,14 @@ function readEnvOverridesFile$1(filePath) {
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		throw new CdkdError(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`, "LOCAL_INVOKE_AGENTCORE_ENV_VARS_READ_FAILED");
+		throw new CdkdError(`Failed to read --env-vars file '${filePath}': ${describeAwsFailure(err).detail}`, "LOCAL_INVOKE_AGENTCORE_ENV_VARS_READ_FAILED");
 	}
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new CdkdError(`Failed to parse --env-vars file '${filePath}' as JSON: ${err instanceof Error ? err.message : String(err)}`, "LOCAL_INVOKE_AGENTCORE_ENV_VARS_PARSE_FAILED");
+		getLogger().debug(safeMsg`--env-vars file failed to parse: ${parseFailureDebugDetail(err)}`);
+		throw new CdkdError(`Failed to parse --env-vars file '${filePath}' as JSON: ${describeJsonParseFailure(err, utf8ByteLength(raw))}`, "LOCAL_INVOKE_AGENTCORE_ENV_VARS_PARSE_FAILED");
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CdkdError(`--env-vars file '${filePath}' must contain a JSON object at the top level.`, "LOCAL_INVOKE_AGENTCORE_ENV_VARS_NOT_OBJECT");
 	return parsed;
@@ -29267,14 +30969,14 @@ async function localInvokeCommand(target, options) {
 	const drainLogs = singleFlight(async () => {
 		await killAndDrainContainerLogs(containerId, logStream);
 	}, (err) => {
-		getLogger().debug(safeMsg`container log drain failed: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(safeMsg`container log drain failed: ${describeAwsFailure(err).detail}`);
 	});
 	const cleanup = singleFlight(async () => {
 		await drainLogs();
 		if (containerId) try {
 			await removeContainer(containerId);
 		} catch (err) {
-			getLogger().debug(`removeContainer(${containerId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			getLogger().debug(`removeContainer(${containerId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		if (imagePlan?.inlineTmpDir) try {
 			rmSync(imagePlan.inlineTmpDir, {
@@ -29282,7 +30984,7 @@ async function localInvokeCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			getLogger().debug(`Failed to remove inline-code tmpdir ${imagePlan.inlineTmpDir}: ${err instanceof Error ? err.message : String(err)}`);
+			getLogger().debug(`Failed to remove inline-code tmpdir ${imagePlan.inlineTmpDir}: ${describeAwsFailure(err).detail}`);
 		}
 		if (imagePlan?.layersTmpDir) try {
 			rmSync(imagePlan.layersTmpDir, {
@@ -29290,7 +30992,7 @@ async function localInvokeCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			getLogger().debug(`Failed to remove merged-layers tmpdir ${imagePlan.layersTmpDir}: ${err instanceof Error ? err.message : String(err)}`);
+			getLogger().debug(`Failed to remove merged-layers tmpdir ${imagePlan.layersTmpDir}: ${describeAwsFailure(err).detail}`);
 		}
 		if (imagePlan?.layerArnTmpDirs) for (const dir of imagePlan.layerArnTmpDirs) try {
 			rmSync(dir, {
@@ -29298,16 +31000,16 @@ async function localInvokeCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			getLogger().debug(`Failed to remove ARN-layer tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+			getLogger().debug(`Failed to remove ARN-layer tmpdir ${dir}: ${describeAwsFailure(err).detail}`);
 		}
 		if (profileCredsFile) try {
 			await profileCredsFile.dispose();
 		} catch (err) {
-			getLogger().debug(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+			getLogger().debug(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${describeAwsFailure(err).detail}`);
 		}
 		await flushStdio();
 	}, (err) => {
-		getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(`cleanup failed: ${describeAwsFailure(err).detail}`);
 	});
 	try {
 		if (typeof options.assumeRole === "string") explicitRoleArnOrThrow("--assume-role", options.assumeRole);
@@ -29695,13 +31397,14 @@ function readEnvOverridesFile(filePath) {
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read --env-vars file '${filePath}': ${describeAwsFailure(err).detail}`);
 	}
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(safeMsg`--env-vars file failed to parse: ${parseFailureDebugDetail(err)}`);
+		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${describeJsonParseFailure(err, utf8ByteLength(raw))}`);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
 	return parsed;
@@ -29716,7 +31419,8 @@ function parseEvent(raw, source) {
 	try {
 		return JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse event payload from ${source} as JSON: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(safeMsg`Event payload failed to parse: ${parseFailureDebugDetail(err)}`);
+		throw new Error(`Failed to parse event payload from ${source} as JSON: ${describeJsonParseFailure(err, utf8ByteLength(raw))}`);
 	}
 }
 async function readStdin() {
@@ -29935,6 +31639,7 @@ function buildProgram() {
 	program.addCommand(createEventsCommand());
 	program.addCommand(createGcCommand());
 	program.addCommand(createOrphanCommand());
+	program.addCommand(createRefactorCommand());
 	program.addCommand(createImportCommand());
 	program.addCommand(createPublishAssetsCommand());
 	program.addCommand(createForceUnlockCommand());
@@ -29960,4 +31665,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DSbJoNKe.js.map
+//# sourceMappingURL=program-TEYrbsKm.js.map