diff --git a/packages/@aws-cdk/toolkit-lib/lib/actions/bootstrap/private/helpers.ts b/packages/@aws-cdk/toolkit-lib/lib/actions/bootstrap/private/helpers.ts
index 3cd42d218..2c02e5325 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/actions/bootstrap/private/helpers.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/actions/bootstrap/private/helpers.ts
@@ -1,5 +1,5 @@
 import type * as cxapi from '@aws-cdk/cx-api';
-import { ToolkitError } from '../../../api/shared-public';
+import { ToolkitError } from '../../../toolkit/toolkit-error';
 
 /**
  * Given a set of "<account>/<region>" strings, construct environments for them
diff --git a/packages/@aws-cdk/toolkit-lib/lib/actions/diff/index.ts b/packages/@aws-cdk/toolkit-lib/lib/actions/diff/index.ts
index 9fda9f36d..491fe0594 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/actions/diff/index.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/actions/diff/index.ts
@@ -1,4 +1,4 @@
-import type { StackSelector } from '../../../lib/api/shared-public';
+import type { StackSelector } from '../../api/cloud-assembly';
 
 export interface CloudFormationDiffOptions {
   /**
diff --git a/packages/@aws-cdk/toolkit-lib/lib/actions/diff/private/helpers.ts b/packages/@aws-cdk/toolkit-lib/lib/actions/diff/private/helpers.ts
index 76049bd64..114c294f4 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/actions/diff/private/helpers.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/actions/diff/private/helpers.ts
@@ -10,8 +10,8 @@ import type { ResourcesToImport } from '../../../api/resource-import';
 import { removeNonImportResources, ResourceMigrator } from '../../../api/resource-import';
 import type { IoHelper, SdkProvider } from '../../../api/shared-private';
 import { IO, cfnApi } from '../../../api/shared-private';
-import { ToolkitError } from '../../../api/shared-public';
-import { deserializeStructure, formatErrorMessage } from '../../../private/util';
+import { ToolkitError } from '../../../toolkit/toolkit-error';
+import { deserializeStructure, formatErrorMessage } from '../../../util';
 
 export function prepareDiff(
   ioHelper: IoHelper,
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/awscli-compatible.ts b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/awscli-compatible.ts
index ae4f9d765..2962fdee1 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/awscli-compatible.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/awscli-compatible.ts
@@ -8,8 +8,8 @@ import * as promptly from 'promptly';
 import { makeCachingProvider } from './provider-caching';
 import { ProxyAgentProvider } from './proxy-agent';
 import type { SdkHttpOptions } from './types';
+import { AuthenticationError } from '../../toolkit/toolkit-error';
 import { IO, type IoHelper } from '../io/private';
-import { AuthenticationError } from '../toolkit-error';
 
 const DEFAULT_CONNECTION_TIMEOUT = 10000;
 const DEFAULT_TIMEOUT = 300000;
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/credential-plugins.ts b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/credential-plugins.ts
index 58ddbd95b..ae57f08d3 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/credential-plugins.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/credential-plugins.ts
@@ -2,11 +2,11 @@ import { inspect } from 'util';
 import type { CredentialProviderSource, ForReading, ForWriting, PluginProviderResult, SDKv2CompatibleCredentials, SDKv3CompatibleCredentialProvider, SDKv3CompatibleCredentials } from '@aws-cdk/cli-plugin-contract';
 import type { AwsCredentialIdentity, AwsCredentialIdentityProvider } from '@smithy/types';
 import { credentialsAboutToExpire, makeCachingProvider } from './provider-caching';
+import { AuthenticationError } from '../../toolkit/toolkit-error';
 import { formatErrorMessage } from '../../util';
 import { IO, type IoHelper } from '../io/private';
 import type { PluginHost } from '../plugin';
 import type { Mode } from '../plugin/mode';
-import { AuthenticationError } from '../toolkit-error';
 
 /**
  * Cache for credential providers.
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-provider.ts b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-provider.ts
index 3a7b223e3..f9b93a11a 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-provider.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-provider.ts
@@ -12,10 +12,10 @@ import { CredentialPlugins } from './credential-plugins';
 import { makeCachingProvider } from './provider-caching';
 import { SDK } from './sdk';
 import { callTrace, traceMemberMethods } from './tracing';
+import { AuthenticationError } from '../../toolkit/toolkit-error';
 import { formatErrorMessage } from '../../util';
 import { IO, type IoHelper } from '../io/private';
 import { PluginHost, Mode } from '../plugin';
-import { AuthenticationError } from '../toolkit-error';
 
 export type AssumeRoleAdditionalOptions = Partial<Omit<AssumeRoleCommandInput, 'ExternalId' | 'RoleArn'>>;
 
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk.ts b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk.ts
index 0c6fd1fb0..b1af463ca 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk.ts
@@ -348,9 +348,9 @@ import { cachedAsync } from './cached';
 import type { Account } from './sdk-provider';
 import { traceMemberMethods } from './tracing';
 import { defaultCliUserAgent } from './user-agent';
+import { AuthenticationError } from '../../toolkit/toolkit-error';
 import { formatErrorMessage } from '../../util';
 import { IO, type IoHelper } from '../io/private';
-import { AuthenticationError } from '../toolkit-error';
 
 export interface S3ClientOptions {
   /**
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/bootstrap/bootstrap-environment.ts b/packages/@aws-cdk/toolkit-lib/lib/api/bootstrap/bootstrap-environment.ts
index 031a84fba..a1712a728 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/bootstrap/bootstrap-environment.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/bootstrap/bootstrap-environment.ts
@@ -3,12 +3,12 @@ import type * as cxapi from '@aws-cdk/cx-api';
 import type { BootstrapEnvironmentOptions, BootstrappingParameters } from './bootstrap-props';
 import { BootstrapStack, bootstrapVersionFromTemplate } from './deploy-bootstrap';
 import { legacyBootstrapTemplate } from './legacy-template';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { bundledPackageRootDir, loadStructuredFile, serializeStructure } from '../../util';
 import type { SDK, SdkProvider } from '../aws-auth/private';
 import type { SuccessfulDeployStackResult } from '../deployments';
 import { IO, type IoHelper } from '../io/private';
 import { Mode } from '../plugin';
-import { ToolkitError } from '../toolkit-error';
 import { DEFAULT_TOOLKIT_STACK_NAME } from '../toolkit-info';
 
 export type BootstrapSource = { source: 'legacy' } | { source: 'default' } | { source: 'custom'; templateFile: string };
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/index.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/index.ts
index 807df7b3c..b824ddfea 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/index.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/index.ts
@@ -1,4 +1,4 @@
-export { StackSelectionStrategy, StackSelector } from './stack-selector';
+export { ExpandStackSelection, StackSelectionStrategy, StackSelector } from './stack-selector';
 export * from './cached-source';
 export * from './source-builder';
 export * from './types';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/context-aware-source.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/context-aware-source.ts
index 6324d4ab2..5452a7a44 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/context-aware-source.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/context-aware-source.ts
@@ -1,10 +1,10 @@
 import type { MissingContext } from '@aws-cdk/cloud-assembly-schema';
 import * as contextproviders from '../../../context-providers';
 import type { ToolkitServices } from '../../../toolkit/private';
+import { ToolkitError } from '../../../toolkit/toolkit-error';
 import { PROJECT_CONTEXT, type Context } from '../../context';
 import type { IoHelper } from '../../io/private';
 import { IO } from '../../io/private';
-import { ToolkitError } from '../../shared-public';
 import type { ICloudAssemblySource, IReadableCloudAssembly } from '../types';
 
 export interface ContextAwareCloudAssemblyProps {
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/exec.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/exec.ts
index 200ef5338..6e9564d5d 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/exec.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/exec.ts
@@ -1,7 +1,7 @@
 import * as child_process from 'node:child_process';
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 import split = require('split2');
-import { ToolkitError } from '../../shared-public';
+import { ToolkitError } from '../../../toolkit/toolkit-error';
 
 type EventPublisher = (event: 'open' | 'data_stdout' | 'data_stderr' | 'close', line: string) => void;
 
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/prepare-source.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/prepare-source.ts
index a7bad284a..fd6adfecd 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/prepare-source.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/prepare-source.ts
@@ -7,13 +7,13 @@ import * as cxapi from '@aws-cdk/cx-api';
 import * as fs from 'fs-extra';
 import { lte } from 'semver';
 import type { SdkProvider, IoHelper } from '../../../api/shared-private';
-import { splitBySize, versionNumber } from '../../../private/util';
 import type { ToolkitServices } from '../../../toolkit/private';
+import { ToolkitError } from '../../../toolkit/toolkit-error';
+import { splitBySize, versionNumber } from '../../../util';
 import { IO } from '../../io/private';
 import type { IReadLock, IWriteLock } from '../../rwlock';
 import { RWLock } from '../../rwlock';
 import { Settings } from '../../settings';
-import { ToolkitError } from '../../shared-public';
 import { loadTree, some } from '../../tree';
 import { prepareDefaultEnvironment as oldPrepare, prepareContext, spaceAvailableForContext, guessExecutable } from '../environment';
 import type { AppSynthOptions, LoadAssemblyOptions } from '../source-builder';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/source-builder.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/source-builder.ts
index 76d019c87..7788adf2e 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/source-builder.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/source-builder.ts
@@ -6,12 +6,12 @@ import type { ContextAwareCloudAssemblyProps } from './context-aware-source';
 import { ContextAwareCloudAssemblySource } from './context-aware-source';
 import { execInChildProcess } from './exec';
 import { ExecutionEnvironment, assemblyFromDirectory } from './prepare-source';
-import type { ToolkitServices } from '../../../toolkit/private';
-import { IO } from '../../io/private';
-import { ToolkitError, AssemblyError } from '../../shared-public';
+import { ToolkitError, AssemblyError } from '../../../toolkit/toolkit-error';
 import type { AssemblyBuilder, FromCdkAppOptions } from '../source-builder';
 import { ReadableCloudAssembly } from './readable-assembly';
+import type { ToolkitServices } from '../../../toolkit/private';
 import { Context } from '../../context';
+import { IO } from '../../io/private';
 import { RWLock } from '../../rwlock';
 import { Settings } from '../../settings';
 
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/stack-assembly.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/stack-assembly.ts
index c64baf7f0..4c6c01836 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/stack-assembly.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/stack-assembly.ts
@@ -1,7 +1,7 @@
 import '../../../private/dispose-polyfill';
 import { major } from 'semver';
+import { ToolkitError } from '../../../toolkit/toolkit-error';
 import type { IoHelper } from '../../shared-private';
-import { ToolkitError } from '../../shared-public';
 import { BaseStackAssembly, ExtendedStackSelection as CliExtendedStackSelection } from '../stack-assembly';
 import { StackCollection } from '../stack-collection';
 import type { StackSelector } from '../stack-selector';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/stack-collection.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/stack-collection.ts
index e0fd03e72..d3d3e58e2 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/stack-collection.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloud-assembly/stack-collection.ts
@@ -1,8 +1,8 @@
 import type * as cxapi from '@aws-cdk/cx-api';
 import { SynthesisMessageLevel } from '@aws-cdk/cx-api';
-import { AssemblyError, ToolkitError } from '../toolkit-error';
 import type { IStackAssembly } from './stack-assembly';
 import { type StackDetails } from '../../payloads/stack-details';
+import { AssemblyError, ToolkitError } from '../../toolkit/toolkit-error';
 
 /**
  * A collection of stacks and related artifacts
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/evaluate-cloudformation-template.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/evaluate-cloudformation-template.ts
index 20fe4f232..ecba39dbf 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/evaluate-cloudformation-template.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/evaluate-cloudformation-template.ts
@@ -1,9 +1,9 @@
 import type { CloudFormationStackArtifact } from '@aws-cdk/cx-api';
 import type { Export, ListExportsCommandOutput, StackResourceSummary } from '@aws-sdk/client-cloudformation';
-import type { SDK } from '../aws-auth/private';
-import { ToolkitError } from '../toolkit-error';
 import type { NestedStackTemplates } from './nested-stack-helpers';
 import type { Template } from './stack-helpers';
+import { ToolkitError } from '../../toolkit/toolkit-error';
+import type { SDK } from '../aws-auth/private';
 import type { ResourceMetadata } from '../resource-metadata';
 import { resourceMetadata } from '../resource-metadata';
 
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/stack-helpers.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/stack-helpers.ts
index 78a8ebcf5..fb93dc5d1 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/stack-helpers.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/stack-helpers.ts
@@ -1,8 +1,8 @@
 import type { Stack, Tag } from '@aws-sdk/client-cloudformation';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { formatErrorMessage, deserializeStructure } from '../../util';
 import type { ICloudFormationClient } from '../aws-auth/private';
 import { StackStatus } from '../stack-events';
-import { ToolkitError } from '../toolkit-error';
 
 export interface Template {
   Parameters?: Record<string, TemplateParameter>;
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/template-body-parameter.ts b/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/template-body-parameter.ts
index 82170c7ee..69c7f93d1 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/template-body-parameter.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/cloudformation/template-body-parameter.ts
@@ -5,11 +5,11 @@ import { type CloudFormationStackArtifact, type Environment, EnvironmentPlacehol
 import { HeadObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import { getEndpointFromInstructions } from '@smithy/middleware-endpoint';
 import * as chalk from 'chalk';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { contentHash, toYAML } from '../../util';
 import type { AssetManifestBuilder } from '../deployments';
 import type { EnvironmentResources } from '../environment';
 import { IO, type IoHelper } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
 
 export type TemplateBodyParameter = {
   TemplateBody?: string;
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/context.ts b/packages/@aws-cdk/toolkit-lib/lib/api/context.ts
index 895a5f129..9005a2df8 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/context.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/context.ts
@@ -1,5 +1,5 @@
 import { Settings } from './settings';
-import { ToolkitError } from './toolkit-error';
+import { ToolkitError } from '../toolkit/toolkit-error';
 
 export { TRANSIENT_CONTEXT_KEY } from './settings';
 export const PROJECT_CONTEXT = 'cdk.context.json';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/asset-publishing.ts b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/asset-publishing.ts
index 58d6ff8d1..8d9cf6c34 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/asset-publishing.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/asset-publishing.ts
@@ -14,11 +14,11 @@ import type {
 import {
   AssetPublishing,
 } from 'cdk-assets';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { SDK, SdkProvider } from '../aws-auth/private';
 import type { IoMessageMaker, IoHelper } from '../io/private';
 import { IO } from '../io/private';
 import { Mode } from '../plugin';
-import { ToolkitError } from '../toolkit-error';
 
 interface PublishAssetsOptions {
   /**
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/assets.ts b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/assets.ts
index 2f0412f6a..1ca46fb27 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/assets.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/assets.ts
@@ -4,9 +4,9 @@ import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
 import * as chalk from 'chalk';
 import type { AssetManifestBuilder } from './asset-manifest-builder';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { EnvironmentResources } from '../environment';
 import { IO, type IoHelper } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
 import type { ToolkitInfo } from '../toolkit-info';
 
 /**
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/cfn-api.ts b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/cfn-api.ts
index 972a7d11a..ae5a3efa9 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/cfn-api.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/cfn-api.ts
@@ -14,12 +14,12 @@ import type { FileManifestEntry } from 'cdk-assets';
 import { AssetManifest } from 'cdk-assets';
 import { AssetManifestBuilder } from './asset-manifest-builder';
 import type { Deployments } from './deployments';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { ICloudFormationClient, SdkProvider } from '../aws-auth/private';
 import type { Template, TemplateBodyParameter, TemplateParameter } from '../cloudformation';
 import { CloudFormationStack, makeBodyParameter } from '../cloudformation';
 import { IO, type IoHelper } from '../io/private';
 import type { ResourcesToImport } from '../resource-import';
-import { ToolkitError } from '../toolkit-error';
 
 /**
  * Describe a changeset in CloudFormation, regardless of its current state.
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/checks.ts b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/checks.ts
index 865e7061b..f9959e05f 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/checks.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/checks.ts
@@ -1,6 +1,6 @@
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { SDK } from '../aws-auth/private';
 import { IO, type IoHelper } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
 
 export async function determineAllowCrossAccountAssetPublishing(
   sdk: SDK,
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack.ts b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack.ts
index 923f771d2..9a4e3bd83 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack.ts
@@ -27,6 +27,7 @@ import {
 import { determineAllowCrossAccountAssetPublishing } from './checks';
 import type { ChangeSetDeploymentMethod, DeploymentMethod } from './deployment-method';
 import type { DeployStackResult, SuccessfulDeployStackResult } from './deployment-result';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { formatErrorMessage } from '../../util';
 import type { SDK, SdkProvider, ICloudFormationClient } from '../aws-auth/private';
 import type { TemplateBodyParameter } from '../cloudformation';
@@ -37,7 +38,6 @@ import { tryHotswapDeployment } from '../hotswap/hotswap-deployments';
 import { IO, type IoHelper } from '../io/private';
 import type { ResourcesToImport } from '../resource-import';
 import { StackActivityMonitor } from '../stack-events';
-import { ToolkitError } from '../toolkit-error';
 
 export interface DeployStackOptions {
   /**
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployment-result.ts b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployment-result.ts
index 586c5793c..c166570dc 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployment-result.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployment-result.ts
@@ -1,4 +1,4 @@
-import { ToolkitError } from '../toolkit-error';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 
 export type DeployStackResult =
   | SuccessfulDeployStackResult
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployments.ts b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployments.ts
index dd589750d..8700c06ef 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployments.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployments.ts
@@ -16,6 +16,7 @@ import { determineAllowCrossAccountAssetPublishing } from './checks';
 import { deployStack, destroyStack } from './deploy-stack';
 import type { DeploymentMethod } from './deployment-method';
 import type { DeployStackResult } from './deployment-result';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { formatErrorMessage } from '../../util';
 import type { SdkProvider } from '../aws-auth/private';
 import type {
@@ -34,7 +35,6 @@ import { IO, type IoHelper } from '../io/private';
 import type { ResourceIdentifierSummaries, ResourcesToImport } from '../resource-import';
 import { StackActivityMonitor, StackEventPoller, RollbackChoice } from '../stack-events';
 import type { Tag } from '../tags';
-import { ToolkitError } from '../toolkit-error';
 import { DEFAULT_TOOLKIT_STACK_NAME } from '../toolkit-info';
 
 const BOOTSTRAP_STACK_VERSION_FOR_ROLLBACK = 23;
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/environment/environment-access.ts b/packages/@aws-cdk/toolkit-lib/lib/api/environment/environment-access.ts
index 07bf4e4e0..034b915b5 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/environment/environment-access.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/environment/environment-access.ts
@@ -1,9 +1,9 @@
 import type * as cxapi from '@aws-cdk/cx-api';
-import { ToolkitError } from '../toolkit-error';
 import type { EnvironmentResources } from './environment-resources';
 import { EnvironmentResourcesRegistry } from './environment-resources';
 import type { StringWithoutPlaceholders } from './placeholders';
 import { replaceEnvPlaceholders } from './placeholders';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { formatErrorMessage } from '../../util';
 import type { SDK, CredentialsOptions, SdkForEnvironment, SdkProvider } from '../aws-auth/private';
 import { IO, type IoHelper } from '../io/private';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/environment/environment-resources.ts b/packages/@aws-cdk/toolkit-lib/lib/api/environment/environment-resources.ts
index e7db2bab0..8a095c771 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/environment/environment-resources.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/environment/environment-resources.ts
@@ -1,9 +1,9 @@
 import type { Environment } from '@aws-cdk/cx-api';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { formatErrorMessage } from '../../util';
 import type { SDK } from '../aws-auth/private';
 import { IO, type IoHelper } from '../io/private';
 import { Notices } from '../notices';
-import { ToolkitError } from '../toolkit-error';
 import { type EcrRepositoryInfo, ToolkitInfo } from '../toolkit-info';
 
 /**
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/garbage-collector.ts b/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/garbage-collector.ts
index 179f4a197..c7da36ce3 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/garbage-collector.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/garbage-collector.ts
@@ -7,9 +7,9 @@ import type { IECRClient, IS3Client, SDK, SdkProvider } from '../aws-auth/privat
 import { DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo } from '../toolkit-info';
 import { ProgressPrinter } from './progress-printer';
 import { ActiveAssetCache, BackgroundStackRefresh, refreshStacks } from './stack-refresh';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { IO, type IoHelper } from '../io/private';
 import { Mode } from '../plugin';
-import { ToolkitError } from '../toolkit-error';
 
 // Must use a require() otherwise esbuild complains
 // eslint-disable-next-line @typescript-eslint/no-require-imports,@typescript-eslint/consistent-type-imports
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/progress-printer.ts b/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/progress-printer.ts
index 0d45016c9..f998ec2f3 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/progress-printer.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/progress-printer.ts
@@ -1,7 +1,7 @@
 import * as chalk from 'chalk';
 import type { GcAsset as GCAsset } from './garbage-collector';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { IO, type IoHelper } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
 
 export class ProgressPrinter {
   private ioHelper: IoHelper;
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/stack-refresh.ts b/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/stack-refresh.ts
index 6b4472419..8b6cd1398 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/stack-refresh.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/garbage-collection/stack-refresh.ts
@@ -1,7 +1,7 @@
 import type { ParameterDeclaration } from '@aws-sdk/client-cloudformation';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { ICloudFormationClient } from '../aws-auth/private';
 import { IO, type IoHelper } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
 
 export class ActiveAssetCache {
   private readonly stacks: Set<string> = new Set();
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/appsync-mapping-templates.ts b/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/appsync-mapping-templates.ts
index 1953abc64..86061f6c5 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/appsync-mapping-templates.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/appsync-mapping-templates.ts
@@ -7,11 +7,11 @@ import {
   classifyChanges,
 } from './common';
 import type { ResourceChange } from '../../payloads/hotswap';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { lowerCaseFirstCharacter, transformObjectKeys } from '../../util';
 import type { SDK } from '../aws-auth/private';
 
 import type { EvaluateCloudFormationTemplate } from '../cloudformation';
-import { ToolkitError } from '../toolkit-error';
 
 export async function isHotswappableAppSyncChange(
   logicalId: string,
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/common.ts b/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/common.ts
index 82e995aff..c8e677ee4 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/common.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/common.ts
@@ -1,8 +1,8 @@
 import type { PropertyDifference } from '@aws-cdk/cloudformation-diff';
 import type { HotswappableChange, NonHotswappableChange, ResourceChange } from '../../payloads/hotswap';
 import { NonHotswappableReason } from '../../payloads/hotswap';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { SDK } from '../aws-auth/private';
-import { ToolkitError } from '../toolkit-error';
 
 export const ICON = '✨';
 
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/hotswap-deployments.ts b/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/hotswap-deployments.ts
index 00cb8d36c..9af590ce5 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/hotswap-deployments.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/hotswap-deployments.ts
@@ -28,11 +28,11 @@ import {
   isHotswappableS3BucketDeploymentChange,
 } from './s3-bucket-deployments';
 import { isHotswappableStateMachineChange } from './stepfunctions-state-machines';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { SuccessfulDeployStackResult } from '../deployments';
 import { IO, SPAN } from '../io/private';
 import type { IMessageSpan, IoHelper } from '../io/private';
 import { Mode } from '../plugin';
-import { ToolkitError } from '../toolkit-error';
 
 // Must use a require() otherwise esbuild complains about calling a namespace
 // eslint-disable-next-line @typescript-eslint/no-require-imports,@typescript-eslint/consistent-type-imports
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/lambda-functions.ts b/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/lambda-functions.ts
index 473e2fcfb..26f613d7b 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/lambda-functions.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/hotswap/lambda-functions.ts
@@ -4,10 +4,10 @@ import type { FunctionConfiguration, UpdateFunctionConfigurationCommandInput } f
 import type { HotswapChange } from './common';
 import { classifyChanges } from './common';
 import type { AffectedResource, ResourceChange } from '../../payloads/hotswap';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { flatMap } from '../../util';
 import type { ILambdaClient, SDK } from '../aws-auth/private';
 import { CfnEvaluationException, type EvaluateCloudFormationTemplate } from '../cloudformation';
-import { ToolkitError } from '../toolkit-error';
 
 // namespace object imports won't work in the bundle for function exports
 // eslint-disable-next-line @typescript-eslint/no-require-imports
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/index.ts b/packages/@aws-cdk/toolkit-lib/lib/api/index.ts
index 1c772cb1a..af9c363d7 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/index.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/index.ts
@@ -18,7 +18,6 @@ export * from './resource-import';
 export * from './rwlock';
 export * from './settings';
 export * from './stack-events';
-export * from './toolkit-error';
 export * from './toolkit-info';
 export * from './work-graph';
 export * from './tree';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/notices/cached-data-source.ts b/packages/@aws-cdk/toolkit-lib/lib/api/notices/cached-data-source.ts
index 8c0dbe487..08ce30748 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/notices/cached-data-source.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/notices/cached-data-source.ts
@@ -1,7 +1,7 @@
 import * as fs from 'fs-extra';
 import type { Notice, NoticeDataSource } from './types';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { IoDefaultMessages } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
 
 interface CachedNotices {
   expiration: number;
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/notices/web-data-source.ts b/packages/@aws-cdk/toolkit-lib/lib/api/notices/web-data-source.ts
index 040359725..a936a43c3 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/notices/web-data-source.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/notices/web-data-source.ts
@@ -2,12 +2,12 @@ import type { ClientRequest } from 'http';
 import type { RequestOptions } from 'https';
 import * as https from 'node:https';
 import type { SdkHttpOptions } from '../aws-auth';
+import type { Notice, NoticeDataSource } from './types';
+import { ToolkitError } from '../../toolkit/toolkit-error';
+import { formatErrorMessage, humanHttpStatusError, humanNetworkError } from '../../util';
 import { ProxyAgentProvider } from '../aws-auth/private';
 import type { IoHelper } from '../io/private';
 import { IO } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
-import type { Notice, NoticeDataSource } from './types';
-import { formatErrorMessage, humanHttpStatusError, humanNetworkError } from '../../util';
 
 export class WebsiteNoticeDataSource implements NoticeDataSource {
   private readonly options: SdkHttpOptions;
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/plugin/plugin.ts b/packages/@aws-cdk/toolkit-lib/lib/api/plugin/plugin.ts
index 0e8b5051a..7c0c8fa96 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/plugin/plugin.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/plugin/plugin.ts
@@ -1,15 +1,9 @@
 import { inspect } from 'util';
 import type { CredentialProviderSource, IPluginHost, Plugin } from '@aws-cdk/cli-plugin-contract';
 import { type ContextProviderPlugin, isContextProviderPlugin } from './context-provider-plugin';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { IIoHost } from '../io';
 import { IoDefaultMessages, IoHelper } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
-
-export let TESTING = false;
-
-export function markTesting() {
-  TESTING = true;
-}
 
 /**
  * Class to manage a plugin collection
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts b/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts
index 7fc4ca7ac..97e37e857 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts
@@ -6,11 +6,11 @@ import type { ResourceIdentifierSummary, ResourceToImport } from '@aws-sdk/clien
 import * as chalk from 'chalk';
 import * as fs from 'fs-extra';
 import * as promptly from 'promptly';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import type { DeploymentMethod, Deployments } from '../deployments';
 import { assertIsSuccessfulDeployStackResult } from '../deployments';
 import { IO, type IoHelper } from '../io/private';
 import type { Tag } from '../tags';
-import { ToolkitError } from '../toolkit-error';
 
 export type ResourcesToImport = ResourceToImport[];
 export type ResourceIdentifierSummaries = ResourceIdentifierSummary[];
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/rwlock.ts b/packages/@aws-cdk/toolkit-lib/lib/api/rwlock.ts
index 1e3d15aa8..abdae1e65 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/rwlock.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/rwlock.ts
@@ -1,6 +1,6 @@
 import { promises as fs } from 'fs';
 import * as path from 'path';
-import { ToolkitError } from './toolkit-error';
+import { ToolkitError } from '../toolkit/toolkit-error';
 
 /**
  * A single-writer/multi-reader lock on a directory
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/settings.ts b/packages/@aws-cdk/toolkit-lib/lib/api/settings.ts
index 46bde4a68..b7e6db3a7 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/settings.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/settings.ts
@@ -1,7 +1,7 @@
 import * as os from 'os';
 import * as fs_path from 'path';
 import * as fs from 'fs-extra';
-import { ToolkitError } from './toolkit-error';
+import { ToolkitError } from '../toolkit/toolkit-error';
 import * as util from '../util';
 
 export type SettingsMap = { [key: string]: any };
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/shared-public.ts b/packages/@aws-cdk/toolkit-lib/lib/api/shared-public.ts
deleted file mode 100644
index 76707bc63..000000000
--- a/packages/@aws-cdk/toolkit-lib/lib/api/shared-public.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/* eslint-disable import/no-restricted-paths */
-
-export {
-  ToolkitError,
-  AuthenticationError,
-  AssemblyError,
-  ContextProviderError,
-} from './toolkit-error';
-
-export {
-  ExpandStackSelection,
-  StackSelectionStrategy,
-  StackSelector,
-} from './cloud-assembly/stack-selector';
-
-export { ResourceMetadata } from './resource-metadata';
-
-export type {
-  IoMessageLevel,
-  IoMessageCode,
-  IoMessage,
-  IoRequest,
-} from './io/io-message';
-export type { IIoHost } from './io/io-host';
-export type { ToolkitAction } from './io/toolkit-action';
-export { PluginHost, ContextProviderPlugin } from './plugin';
-
-export * from '../payloads';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts b/packages/@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts
index fed2f5e40..8842a7c4f 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/toolkit-info.ts
@@ -11,9 +11,9 @@ import {
   REPOSITORY_NAME_OUTPUT,
 } from './bootstrap/bootstrap-props';
 import type { CloudFormationStack } from './cloudformation';
+import { ToolkitError } from '../toolkit/toolkit-error';
 import { stabilizeStack } from './deployments/cfn-api';
 import { IO, type IoHelper } from './io/private';
-import { ToolkitError } from './toolkit-error';
 
 export const DEFAULT_TOOLKIT_STACK_NAME = 'CDKToolkit';
 
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/work-graph/work-graph-builder.ts b/packages/@aws-cdk/toolkit-lib/lib/api/work-graph/work-graph-builder.ts
index 3101fb036..1b6fc7b20 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/work-graph/work-graph-builder.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/work-graph/work-graph-builder.ts
@@ -3,9 +3,9 @@ import { AssetManifest, type IManifestEntry } from 'cdk-assets';
 import { WorkGraph } from './work-graph';
 import type { AssetBuildNode, WorkNode } from './work-graph-types';
 import { DeploymentState } from './work-graph-types';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { contentHashAny } from '../../util';
 import type { IoHelper } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
 
 export class WorkGraphBuilder {
   /**
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/work-graph/work-graph.ts b/packages/@aws-cdk/toolkit-lib/lib/api/work-graph/work-graph.ts
index 38bc6dbda..7d5917742 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/api/work-graph/work-graph.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/api/work-graph/work-graph.ts
@@ -1,8 +1,8 @@
 import type { WorkNode, StackNode, AssetBuildNode, AssetPublishNode } from './work-graph-types';
 import { DeploymentState } from './work-graph-types';
+import { ToolkitError } from '../../toolkit/toolkit-error';
 import { parallelPromises } from '../../util';
 import { IO, type IoHelper } from '../io/private';
-import { ToolkitError } from '../toolkit-error';
 export type Concurrency = number | Record<WorkNode['type'], number>;
 
 export class WorkGraph {
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/ami.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/ami.ts
index 2d667e951..300a6eafb 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/ami.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/ami.ts
@@ -2,7 +2,7 @@ import type { AmiContextQuery } from '@aws-cdk/cloud-assembly-schema';
 import type { IContextProviderMessages } from '.';
 import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/private';
 import type { ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 
 /**
  * Plugin to search AMIs for the current account
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/cc-api-provider.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/cc-api-provider.ts
index c8cf6fd02..670a62bcb 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/cc-api-provider.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/cc-api-provider.ts
@@ -4,7 +4,7 @@ import { ResourceNotFoundException } from '@aws-sdk/client-cloudcontrol';
 import type { ICloudControlClient, SdkProvider } from '../api/aws-auth/private';
 import { initContextProviderSdk } from '../api/aws-auth/private';
 import type { ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 import { findJsonValue, getResultObj } from '../util';
 
 export class CcApiContextProviderPlugin implements ContextProviderPlugin {
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/hosted-zones.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/hosted-zones.ts
index 6f424c5b4..3916f4f8d 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/hosted-zones.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/hosted-zones.ts
@@ -4,7 +4,7 @@ import type { IContextProviderMessages } from '.';
 import type { IRoute53Client, SdkProvider } from '../api/aws-auth/private';
 import { initContextProviderSdk } from '../api/aws-auth/private';
 import type { ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 
 export class HostedZoneContextProviderPlugin implements ContextProviderPlugin {
   constructor(private readonly aws: SdkProvider, private readonly io: IContextProviderMessages) {
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/index.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/index.ts
index e98c631ee..8c5a741cf 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/index.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/index.ts
@@ -17,7 +17,7 @@ import { replaceEnvPlaceholders } from '../api/environment';
 import { IO } from '../api/io/private';
 import type { IoHelper } from '../api/io/private';
 import type { PluginHost, ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 import { formatErrorMessage } from '../util';
 
 type ContextProviderFactory = ((sdk: SdkProvider, io: IContextProviderMessages) => ContextProviderPlugin);
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/keys.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/keys.ts
index 2e76c3aef..c2b30a74d 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/keys.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/keys.ts
@@ -5,7 +5,7 @@ import type { IContextProviderMessages } from '.';
 import type { IKMSClient, SdkProvider } from '../api/aws-auth/private';
 import { initContextProviderSdk } from '../api/aws-auth/private';
 import type { ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 
 export class KeyContextProviderPlugin implements ContextProviderPlugin {
   constructor(private readonly aws: SdkProvider, private readonly io: IContextProviderMessages) {
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/load-balancers.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/load-balancers.ts
index b94aae3ad..543d9a644 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/load-balancers.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/load-balancers.ts
@@ -10,7 +10,7 @@ import type { LoadBalancer, Listener, TagDescription } from '@aws-sdk/client-ela
 import type { IElasticLoadBalancingV2Client, SdkProvider } from '../api/aws-auth/private';
 import { initContextProviderSdk } from '../api/aws-auth/private';
 import type { ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 
 /**
  * Provides load balancer context information.
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/security-groups.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/security-groups.ts
index 13fe81856..ab7abd090 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/security-groups.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/security-groups.ts
@@ -3,7 +3,7 @@ import type { SecurityGroupContextResponse } from '@aws-cdk/cx-api';
 import type { Filter, SecurityGroup } from '@aws-sdk/client-ec2';
 import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/private';
 import type { ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 
 export class SecurityGroupContextProviderPlugin implements ContextProviderPlugin {
   constructor(private readonly aws: SdkProvider) {
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/ssm-parameters.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/ssm-parameters.ts
index 10fb27735..c1765d5a6 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/ssm-parameters.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/ssm-parameters.ts
@@ -3,7 +3,7 @@ import type { GetParameterCommandOutput } from '@aws-sdk/client-ssm';
 import type { IContextProviderMessages } from '.';
 import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/private';
 import type { ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 
 /**
  * Plugin to read arbitrary SSM parameter names
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/vpcs.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/vpcs.ts
index 4c97e15d4..c19a695ea 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/vpcs.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/vpcs.ts
@@ -5,7 +5,7 @@ import type { IContextProviderMessages } from '.';
 import { initContextProviderSdk } from '../api/aws-auth/private';
 import type { IEC2Client, SdkProvider } from '../api/aws-auth/private';
 import type { ContextProviderPlugin } from '../api/plugin';
-import { ContextProviderError } from '../api/toolkit-error';
+import { ContextProviderError } from '../toolkit/toolkit-error';
 
 export class VpcNetworkContextProviderPlugin implements ContextProviderPlugin {
   constructor(private readonly aws: SdkProvider, private readonly io: IContextProviderMessages) {
diff --git a/packages/@aws-cdk/toolkit-lib/lib/index.ts b/packages/@aws-cdk/toolkit-lib/lib/index.ts
index 877957d14..6de451e35 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/index.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/index.ts
@@ -7,11 +7,13 @@ import './private/dispose-polyfill';
 
 // The main show
 export * from './toolkit';
+export * from './toolkit/toolkit-error';
 export * from './actions';
+export * from './payloads';
 
 // Supporting acts
 export * from './api/aws-auth';
 export * from './api/cloud-assembly';
 export * from './api/io';
 export * from './api/tags';
-export * from './api/shared-public';
+export * from './api/plugin';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/payloads/hotswap.ts b/packages/@aws-cdk/toolkit-lib/lib/payloads/hotswap.ts
index a25e02220..4bb3e5679 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/payloads/hotswap.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/payloads/hotswap.ts
@@ -2,6 +2,7 @@ import type { PropertyDifference, Resource } from '@aws-cdk/cloudformation-diff'
 import type * as cxapi from '@aws-cdk/cx-api';
 import type { Duration } from './types';
 import type { ResourceMetadata } from '../api/resource-metadata/resource-metadata';
+export type { ResourceMetadata } from '../api/resource-metadata/resource-metadata';
 
 /**
  * A resource affected by a change
diff --git a/packages/@aws-cdk/toolkit-lib/lib/private/util.ts b/packages/@aws-cdk/toolkit-lib/lib/private/util.ts
deleted file mode 100644
index c4f213e45..000000000
--- a/packages/@aws-cdk/toolkit-lib/lib/private/util.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-/* eslint-disable import/no-restricted-paths */
-
-export * from '../util';
diff --git a/packages/@aws-cdk/toolkit-lib/lib/toolkit/non-interactive-io-host.ts b/packages/@aws-cdk/toolkit-lib/lib/toolkit/non-interactive-io-host.ts
index 925bf67ce..56a15d6ba 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/toolkit/non-interactive-io-host.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/toolkit/non-interactive-io-host.ts
@@ -1,7 +1,7 @@
 import * as chalk from 'chalk';
 import type { IIoHost, IoMessage, IoMessageLevel, IoRequest } from '../api/io';
-import type { IActivityPrinter } from '../api/shared-private';
-import { HistoryActivityPrinter, isMessageRelevantForLevel } from '../api/shared-private';
+import { isMessageRelevantForLevel } from '../api/io/private';
+import { HistoryActivityPrinter, type IActivityPrinter } from '../private/activity-printer';
 import { isCI, isTTY } from '../util/shell-env';
 
 export interface NonInteractiveIoHostProps {
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/toolkit-error.ts b/packages/@aws-cdk/toolkit-lib/lib/toolkit/toolkit-error.ts
similarity index 100%
rename from packages/@aws-cdk/toolkit-lib/lib/api/toolkit-error.ts
rename to packages/@aws-cdk/toolkit-lib/lib/toolkit/toolkit-error.ts
diff --git a/packages/@aws-cdk/toolkit-lib/lib/toolkit/toolkit.ts b/packages/@aws-cdk/toolkit-lib/lib/toolkit/toolkit.ts
index b656b6136..8362770fd 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/toolkit/toolkit.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/toolkit/toolkit.ts
@@ -8,6 +8,7 @@ import * as fs from 'fs-extra';
 import { NonInteractiveIoHost } from './non-interactive-io-host';
 import type { ToolkitServices } from './private';
 import { assemblyFromSource } from './private';
+import { ToolkitError } from './toolkit-error';
 import type { DeployResult, DestroyResult, RollbackResult } from './types';
 import type {
   BootstrapEnvironments,
@@ -44,25 +45,26 @@ import { ALL_STACKS, CloudAssemblySourceBuilder } from '../api/cloud-assembly/pr
 import type { StackCollection } from '../api/cloud-assembly/stack-collection';
 import { Deployments } from '../api/deployments';
 import { DiffFormatter } from '../api/diff';
-import type { IIoHost, IoMessageLevel } from '../api/io';
+import type { IIoHost, IoMessageLevel, ToolkitAction } from '../api/io';
 import type { IoHelper } from '../api/io/private';
 import { asIoHelper, asSdkLogger, IO, SPAN, withoutColor, withoutEmojis, withTrimmedWhitespace } from '../api/io/private';
 import { CloudWatchLogEventMonitor, findCloudWatchLogGroups } from '../api/logs-monitor';
+import { PluginHost } from '../api/plugin';
 import { AmbiguityError, ambiguousMovements, findResourceMovements, formatAmbiguousMappings, formatTypedMappings, fromManifestAndExclusionList, resourceMappings } from '../api/refactoring';
 import { ResourceMigrator } from '../api/resource-import';
-import type { AssemblyData, StackDetails, SuccessfulDeployStackResult, ToolkitAction } from '../api/shared-public';
-import { PermissionChangeType, PluginHost, ToolkitError } from '../api/shared-public';
 import { tagsForStack } from '../api/tags';
 import { DEFAULT_TOOLKIT_STACK_NAME } from '../api/toolkit-info';
 import type { Concurrency, AssetBuildNode, AssetPublishNode, StackNode } from '../api/work-graph';
 import { WorkGraphBuilder } from '../api/work-graph';
+import type { AssemblyData, StackDetails, SuccessfulDeployStackResult } from '../payloads';
+import { PermissionChangeType } from '../payloads';
 import {
   formatErrorMessage,
   formatTime,
   obscureTemplate,
   serializeStructure,
   validateSnsTopicArn,
-} from '../private/util';
+} from '../util';
 import { pLimit } from '../util/concurrency';
 import { promiseWithResolvers } from '../util/promises';
 
diff --git a/packages/@aws-cdk/toolkit-lib/lib/util/directories.ts b/packages/@aws-cdk/toolkit-lib/lib/util/directories.ts
index beb93e8a9..4b69432bf 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/util/directories.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/util/directories.ts
@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { ToolkitError } from '../api/toolkit-error';
+import { ToolkitError } from '../toolkit/toolkit-error';
 
 /**
  * Return a location that will be used as the CDK home directory.
diff --git a/packages/@aws-cdk/toolkit-lib/lib/util/objects.ts b/packages/@aws-cdk/toolkit-lib/lib/util/objects.ts
index 2ff69c990..a9d234a1d 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/util/objects.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/util/objects.ts
@@ -1,6 +1,6 @@
 import type { Obj } from './types';
 import { isArray, isObject } from './types';
-import { ToolkitError } from '../api/toolkit-error';
+import { ToolkitError } from '../toolkit/toolkit-error';
 
 /**
  * Return a new object by adding missing keys into another object
diff --git a/packages/@aws-cdk/toolkit-lib/lib/util/version-range.ts b/packages/@aws-cdk/toolkit-lib/lib/util/version-range.ts
index 69fd5d980..0eb701d18 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/util/version-range.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/util/version-range.ts
@@ -1,5 +1,5 @@
 import * as semver from 'semver';
-import { ToolkitError } from '../api/toolkit-error';
+import { ToolkitError } from '../toolkit/toolkit-error';
 
 // bracket - https://docs.oracle.com/middleware/1212/core/MAVEN/maven_version.htm#MAVEN401
 // pep - https://www.python.org/dev/peps/pep-0440/#version-specifiers
diff --git a/packages/@aws-cdk/toolkit-lib/test/_helpers/index.ts b/packages/@aws-cdk/toolkit-lib/test/_helpers/index.ts
index 48a21c732..bbfd9f9d8 100644
--- a/packages/@aws-cdk/toolkit-lib/test/_helpers/index.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/_helpers/index.ts
@@ -2,8 +2,8 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import type { AssemblyBuilder, AssemblyDirectoryProps, FromCdkAppOptions, ICloudAssemblySource } from '../../lib';
-import { ToolkitError } from '../../lib';
 import type { CloudAssemblySourceBuilder } from '../../lib/api/cloud-assembly/private';
+import { ToolkitError } from '../../lib/toolkit/toolkit-error';
 
 export * from './test-cloud-assembly-source';
 export * from './test-io-host';
diff --git a/packages/@aws-cdk/toolkit-lib/test/actions/bootstrap.test.ts b/packages/@aws-cdk/toolkit-lib/test/actions/bootstrap.test.ts
index 45bcbcfa9..268319f2c 100644
--- a/packages/@aws-cdk/toolkit-lib/test/actions/bootstrap.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/actions/bootstrap.test.ts
@@ -13,7 +13,7 @@ import { bold } from 'chalk';
 import type { BootstrapOptions } from '../../lib/actions/bootstrap';
 import { BootstrapEnvironments, BootstrapSource, BootstrapStackParameters } from '../../lib/actions/bootstrap';
 import { SdkProvider } from '../../lib/api/shared-private';
-import { Toolkit } from '../../lib/toolkit';
+import { Toolkit } from '../../lib/toolkit/toolkit';
 import { TestIoHost, builderFixture, disposableCloudAssemblySource } from '../_helpers';
 import {
   MockSdk,
diff --git a/packages/@aws-cdk/toolkit-lib/test/actions/deploy-hotswap.test.ts b/packages/@aws-cdk/toolkit-lib/test/actions/deploy-hotswap.test.ts
index 44f4d739a..00c4019d6 100644
--- a/packages/@aws-cdk/toolkit-lib/test/actions/deploy-hotswap.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/actions/deploy-hotswap.test.ts
@@ -2,6 +2,8 @@ import { HotswapMode } from '../../lib/api/hotswap';
 import { Toolkit } from '../../lib/toolkit';
 import { builderFixture, TestIoHost } from '../_helpers';
 
+jest.setTimeout(10_000);
+
 const ioHost = new TestIoHost();
 const toolkit = new Toolkit({ ioHost });
 
diff --git a/packages/@aws-cdk/toolkit-lib/test/actions/deploy-trace-logs.test.ts b/packages/@aws-cdk/toolkit-lib/test/actions/deploy-trace-logs.test.ts
index 8039bbd57..9483ea4fc 100644
--- a/packages/@aws-cdk/toolkit-lib/test/actions/deploy-trace-logs.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/actions/deploy-trace-logs.test.ts
@@ -5,6 +5,8 @@ import { Toolkit } from '../../lib/toolkit';
 import { TestIoHost, builderFixture } from '../_helpers';
 import { MockSdk } from '../_helpers/mock-sdk';
 
+jest.setTimeout(10_000);
+
 let ioHost: TestIoHost;
 let toolkit: Toolkit;
 
diff --git a/packages/@aws-cdk/toolkit-lib/test/actions/deploy.test.ts b/packages/@aws-cdk/toolkit-lib/test/actions/deploy.test.ts
index 9ebc5d490..8ddde14c6 100644
--- a/packages/@aws-cdk/toolkit-lib/test/actions/deploy.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/actions/deploy.test.ts
@@ -5,6 +5,8 @@ import { RequireApproval } from '../../lib/api/require-approval';
 import { Toolkit } from '../../lib/toolkit';
 import { builderFixture, cdkOutFixture, disposableCloudAssemblySource, TestIoHost } from '../_helpers';
 
+jest.setTimeout(10_000);
+
 let ioHost: TestIoHost;
 let toolkit: Toolkit;
 let mockDeployStack: jest.SpyInstance<Promise<DeployStackResult>, [DeployStackOptions]>;
diff --git a/packages/@aws-cdk/toolkit-lib/test/actions/destroy.test.ts b/packages/@aws-cdk/toolkit-lib/test/actions/destroy.test.ts
index ed6938d6c..b63fa432e 100644
--- a/packages/@aws-cdk/toolkit-lib/test/actions/destroy.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/actions/destroy.test.ts
@@ -1,7 +1,7 @@
 import * as chalk from 'chalk';
+import { StackSelectionStrategy } from '../../lib/api/cloud-assembly';
 import * as deployments from '../../lib/api/deployments';
 import type { DestroyStackOptions } from '../../lib/api/deployments';
-import { StackSelectionStrategy } from '../../lib/api/shared-public';
 import type { RollbackResult } from '../../lib/toolkit';
 import { Toolkit } from '../../lib/toolkit';
 import { builderFixture, disposableCloudAssemblySource, TestIoHost } from '../_helpers';
diff --git a/packages/@aws-cdk/toolkit-lib/test/actions/diff.test.ts b/packages/@aws-cdk/toolkit-lib/test/actions/diff.test.ts
index 09e6d917f..1f110525d 100644
--- a/packages/@aws-cdk/toolkit-lib/test/actions/diff.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/actions/diff.test.ts
@@ -2,9 +2,9 @@ import * as path from 'path';
 import * as chalk from 'chalk';
 import { DiffMethod } from '../../lib/actions/diff';
 import * as awsauth from '../../lib/api/aws-auth/private';
+import { StackSelectionStrategy } from '../../lib/api/cloud-assembly';
 import * as deployments from '../../lib/api/deployments';
 import { RequireApproval } from '../../lib/api/require-approval';
-import { StackSelectionStrategy } from '../../lib/api/shared-public';
 import { Toolkit } from '../../lib/toolkit';
 import { builderFixture, disposableCloudAssemblySource, TestIoHost } from '../_helpers';
 import { MockSdk, restoreSdkMocksToDefault, setDefaultSTSMocks } from '../_helpers/mock-sdk';
diff --git a/packages/@aws-cdk/toolkit-lib/test/api/bootstrap/bootstrap2.test.ts b/packages/@aws-cdk/toolkit-lib/test/api/bootstrap/bootstrap2.test.ts
index f995c547c..972a12ca8 100644
--- a/packages/@aws-cdk/toolkit-lib/test/api/bootstrap/bootstrap2.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/api/bootstrap/bootstrap2.test.ts
@@ -3,7 +3,6 @@
 import * as deployStack from '../../../lib/api/deployments/deploy-stack';
 import type { Stack } from '@aws-sdk/client-cloudformation';
 import { CreatePolicyCommand, GetPolicyCommand } from '@aws-sdk/client-iam';
-import { Bootstrapper, ToolkitInfo } from '../../../lib/api';
 import {
   mockBootstrapStack,
   mockIAMClient,
@@ -12,6 +11,8 @@ import {
 } from '../../_helpers/mock-sdk';
 import { asIoHelper } from '../../../lib/api/io/private';
 import type { IIoHost } from '../../../lib/api/io';
+import { Bootstrapper } from '../../../lib/api/bootstrap';
+import { ToolkitInfo } from '../../../lib/api/toolkit-info';
 
 const mockDeployStack = jest.spyOn(deployStack, 'deployStack');
 
diff --git a/packages/@aws-cdk/toolkit-lib/test/api/cloud-assembly/source-builder.test.ts b/packages/@aws-cdk/toolkit-lib/test/api/cloud-assembly/source-builder.test.ts
index 658ed353c..3ed21772f 100644
--- a/packages/@aws-cdk/toolkit-lib/test/api/cloud-assembly/source-builder.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/api/cloud-assembly/source-builder.test.ts
@@ -1,8 +1,8 @@
 import * as fs from 'fs-extra';
 import { RWLock } from '../../../lib/api/rwlock';
 import { contextproviders } from '../../../lib/api/shared-private';
-import { ToolkitError } from '../../../lib/api/shared-public';
 import { Toolkit } from '../../../lib/toolkit/toolkit';
+import { ToolkitError } from '../../../lib/toolkit/toolkit-error';
 import { appFixture, appFixtureConfig, autoCleanOutDir, builderFixture, builderFunctionFromFixture, cdkOutFixture, TestIoHost } from '../../_helpers';
 
 // these tests often run a bit longer than the default
diff --git a/packages/@aws-cdk/toolkit-lib/test/api/plugin/credential-plugin.test.ts b/packages/@aws-cdk/toolkit-lib/test/api/plugin/credential-plugin.test.ts
index f7d4679ae..b9ea7e958 100644
--- a/packages/@aws-cdk/toolkit-lib/test/api/plugin/credential-plugin.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/api/plugin/credential-plugin.test.ts
@@ -1,9 +1,7 @@
 import type { CredentialProviderSource, SDKv3CompatibleCredentials } from '@aws-cdk/cli-plugin-contract';
 import { CredentialPlugins, credentialsAboutToExpire } from '../../../lib/api/aws-auth/private';
 import { TestIoHost } from '../../../lib/api/io/private/testing';
-import { Mode, PluginHost, markTesting } from '../../../lib/api/plugin';
-
-markTesting();
+import { Mode, PluginHost } from '../../../lib/api/plugin';
 
 let host: PluginHost;
 let credentialPlugins: CredentialPlugins;
diff --git a/packages/@aws-cdk/toolkit-lib/test/api/plugin/plugin-host.test.ts b/packages/@aws-cdk/toolkit-lib/test/api/plugin/plugin-host.test.ts
index fe44f190e..790684cf0 100644
--- a/packages/@aws-cdk/toolkit-lib/test/api/plugin/plugin-host.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/api/plugin/plugin-host.test.ts
@@ -1,8 +1,6 @@
 import type { CredentialProviderSource } from '@aws-cdk/cli-plugin-contract';
 import type { ContextProviderPlugin } from '../../../lib/api/plugin';
-import { PluginHost, markTesting } from '../../../lib/api/plugin';
-
-markTesting();
+import { PluginHost } from '../../../lib/api/plugin';
 
 beforeEach(() => {
   jest.resetModules();
diff --git a/packages/@aws-cdk/toolkit-lib/test/api/toolkit-error.test.ts b/packages/@aws-cdk/toolkit-lib/test/toolkit/toolkit-error.test.ts
similarity index 98%
rename from packages/@aws-cdk/toolkit-lib/test/api/toolkit-error.test.ts
rename to packages/@aws-cdk/toolkit-lib/test/toolkit/toolkit-error.test.ts
index 0f74a5e25..265c5a4bc 100644
--- a/packages/@aws-cdk/toolkit-lib/test/api/toolkit-error.test.ts
+++ b/packages/@aws-cdk/toolkit-lib/test/toolkit/toolkit-error.test.ts
@@ -1,4 +1,4 @@
-import { AssemblyError, AuthenticationError, ContextProviderError, ToolkitError } from '../../lib/api/toolkit-error';
+import { AssemblyError, AuthenticationError, ContextProviderError, ToolkitError } from '../../lib/toolkit/toolkit-error';
 
 describe('toolkit error', () => {
   let toolkitError = new ToolkitError('Test toolkit error');
diff --git a/packages/aws-cdk/lib/api/index.ts b/packages/aws-cdk/lib/api/index.ts
index 1b459f71c..2eadf84cd 100644
--- a/packages/aws-cdk/lib/api/index.ts
+++ b/packages/aws-cdk/lib/api/index.ts
@@ -6,6 +6,6 @@ export * from './aws-auth';
 export * from './rwlock';
 export * from './tree';
 
-export * from '../../../@aws-cdk/toolkit-lib/lib/api/toolkit-error';
+export * from '../../../@aws-cdk/toolkit-lib/lib/toolkit/toolkit-error';
 export * from './cloud-assembly';
 export * from './plugin';
diff --git a/packages/aws-cdk/lib/cli/cdk-toolkit.ts b/packages/aws-cdk/lib/cli/cdk-toolkit.ts
index ee2f9ffce..1483ea12e 100644
--- a/packages/aws-cdk/lib/cli/cdk-toolkit.ts
+++ b/packages/aws-cdk/lib/cli/cdk-toolkit.ts
@@ -9,8 +9,8 @@ import * as uuid from 'uuid';
 import { CliIoHost } from './io-host';
 import type { Configuration } from './user-configuration';
 import { PROJECT_CONFIG } from './user-configuration';
+import { StackSelectionStrategy, ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import type { ToolkitAction } from '../../../@aws-cdk/toolkit-lib/lib/api';
-import { StackSelectionStrategy, ToolkitError } from '../../../@aws-cdk/toolkit-lib/lib/api';
 import { asIoHelper } from '../../../@aws-cdk/toolkit-lib/lib/api/io/private';
 import { PermissionChangeType } from '../../../@aws-cdk/toolkit-lib/lib/payloads';
 import type { ToolkitOptions } from '../../../@aws-cdk/toolkit-lib/lib/toolkit';
diff --git a/packages/aws-cdk/lib/cli/cli.ts b/packages/aws-cdk/lib/cli/cli.ts
index b72382891..0472219e7 100644
--- a/packages/aws-cdk/lib/cli/cli.ts
+++ b/packages/aws-cdk/lib/cli/cli.ts
@@ -9,7 +9,7 @@ import { prettyPrintError } from './pretty-print-error';
 import type { Command } from './user-configuration';
 import { Configuration } from './user-configuration';
 import * as version from './version';
-import { ToolkitError } from '../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import { asIoHelper, IO } from '../../../@aws-cdk/toolkit-lib/lib/api/io/private';
 import { SdkProvider, SdkToCliLogger, setSdkTracing } from '../api/aws-auth';
 import type { BootstrapSource } from '../api/bootstrap';
diff --git a/packages/aws-cdk/lib/cli/io-host/cli-io-host.ts b/packages/aws-cdk/lib/cli/io-host/cli-io-host.ts
index 3626dc371..dc0acc0c3 100644
--- a/packages/aws-cdk/lib/cli/io-host/cli-io-host.ts
+++ b/packages/aws-cdk/lib/cli/io-host/cli-io-host.ts
@@ -2,8 +2,8 @@ import * as util from 'node:util';
 import { RequireApproval } from '@aws-cdk/cloud-assembly-schema';
 import * as chalk from 'chalk';
 import * as promptly from 'promptly';
-import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib/lib/api';
-import type { IIoHost, IoMessage, IoMessageCode, IoMessageLevel, IoRequest, ToolkitAction } from '../../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib';
+import type { IIoHost, IoMessage, IoMessageCode, IoMessageLevel, IoRequest, ToolkitAction } from '../../../../@aws-cdk/toolkit-lib';
 import type { IoHelper } from '../../../../@aws-cdk/toolkit-lib/lib/api/io/private';
 import { asIoHelper, IO, IoDefaultMessages, isMessageRelevantForLevel } from '../../../../@aws-cdk/toolkit-lib/lib/api/io/private';
 import { CurrentActivityPrinter, HistoryActivityPrinter } from '../../../../@aws-cdk/toolkit-lib/lib/private/activity-printer';
diff --git a/packages/aws-cdk/lib/cli/root-dir.ts b/packages/aws-cdk/lib/cli/root-dir.ts
index 6769a3c06..ba1e1b0f6 100644
--- a/packages/aws-cdk/lib/cli/root-dir.ts
+++ b/packages/aws-cdk/lib/cli/root-dir.ts
@@ -1,6 +1,6 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { ToolkitError } from '../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 
 /**
  * From the current file, find the directory that contains the CLI's package.json
diff --git a/packages/aws-cdk/lib/cli/user-configuration.ts b/packages/aws-cdk/lib/cli/user-configuration.ts
index 8db188ea2..9f6660c0b 100644
--- a/packages/aws-cdk/lib/cli/user-configuration.ts
+++ b/packages/aws-cdk/lib/cli/user-configuration.ts
@@ -1,7 +1,7 @@
 import * as os from 'os';
 import * as fs_path from 'path';
 import * as fs from 'fs-extra';
-import { ToolkitError } from '../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import { Context, PROJECT_CONTEXT } from '../api/context';
 import { Settings } from '../api/settings';
 import type { Tag } from '../api/tags';
diff --git a/packages/aws-cdk/lib/cli/util/npm.ts b/packages/aws-cdk/lib/cli/util/npm.ts
index 20d27015c..307fc118e 100644
--- a/packages/aws-cdk/lib/cli/util/npm.ts
+++ b/packages/aws-cdk/lib/cli/util/npm.ts
@@ -1,6 +1,6 @@
 import { exec as _exec } from 'child_process';
 import { promisify } from 'util';
-import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib';
 
 const exec = promisify(_exec);
 
diff --git a/packages/aws-cdk/lib/cli/version.ts b/packages/aws-cdk/lib/cli/version.ts
index 0e30bf6c0..8f48c68f2 100644
--- a/packages/aws-cdk/lib/cli/version.ts
+++ b/packages/aws-cdk/lib/cli/version.ts
@@ -3,7 +3,7 @@ import * as path from 'path';
 import * as chalk from 'chalk';
 import * as fs from 'fs-extra';
 import * as semver from 'semver';
-import { ToolkitError } from '../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import { debug, info } from '../logging';
 import { cdkCacheDir } from '../util';
 import { cliRootDir } from './root-dir';
diff --git a/packages/aws-cdk/lib/commands/context.ts b/packages/aws-cdk/lib/commands/context.ts
index 2ab6f39b9..ea52809cc 100644
--- a/packages/aws-cdk/lib/commands/context.ts
+++ b/packages/aws-cdk/lib/commands/context.ts
@@ -1,6 +1,6 @@
 import * as chalk from 'chalk';
 import { minimatch } from 'minimatch';
-import { ToolkitError } from '../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import type { Context } from '../api/context';
 import { renderTable } from '../cli/tables';
 import { PROJECT_CONFIG, PROJECT_CONTEXT, USER_DEFAULTS } from '../cli/user-configuration';
diff --git a/packages/aws-cdk/lib/commands/init/init-hooks.ts b/packages/aws-cdk/lib/commands/init/init-hooks.ts
index d6b2ad79b..9ec507812 100644
--- a/packages/aws-cdk/lib/commands/init/init-hooks.ts
+++ b/packages/aws-cdk/lib/commands/init/init-hooks.ts
@@ -1,6 +1,6 @@
 import * as path from 'path';
 import { shell } from './os';
-import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib';
 import { formatErrorMessage } from '../../util';
 
 export type SubstitutePlaceholders = (...fileNames: string[]) => Promise<void>;
diff --git a/packages/aws-cdk/lib/commands/init/init.ts b/packages/aws-cdk/lib/commands/init/init.ts
index d53d6832e..41eae9b87 100644
--- a/packages/aws-cdk/lib/commands/init/init.ts
+++ b/packages/aws-cdk/lib/commands/init/init.ts
@@ -3,7 +3,7 @@ import * as path from 'path';
 import * as chalk from 'chalk';
 import * as fs from 'fs-extra';
 import { invokeBuiltinHooks } from './init-hooks';
-import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib';
 import { cliRootDir } from '../../cli/root-dir';
 import { versionNumber } from '../../cli/version';
 import { error, info, warning } from '../../logging';
diff --git a/packages/aws-cdk/lib/commands/init/os.ts b/packages/aws-cdk/lib/commands/init/os.ts
index fa8edeaae..2660ce25c 100644
--- a/packages/aws-cdk/lib/commands/init/os.ts
+++ b/packages/aws-cdk/lib/commands/init/os.ts
@@ -1,6 +1,6 @@
 import * as child_process from 'child_process';
 import * as chalk from 'chalk';
-import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../../@aws-cdk/toolkit-lib';
 import { debug } from '../../logging';
 
 /**
diff --git a/packages/aws-cdk/lib/commands/migrate.ts b/packages/aws-cdk/lib/commands/migrate.ts
index bc27fc8ce..ce06da88e 100644
--- a/packages/aws-cdk/lib/commands/migrate.ts
+++ b/packages/aws-cdk/lib/commands/migrate.ts
@@ -20,7 +20,7 @@ import type {
 import * as cdk_from_cfn from 'cdk-from-cfn';
 import * as chalk from 'chalk';
 import { cliInit } from './init';
-import { ToolkitError } from '../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import { info } from '../../lib/logging';
 import type { ICloudFormationClient, SdkProvider } from '../api/aws-auth';
 import { CloudFormationStack } from '../api/cloudformation';
diff --git a/packages/aws-cdk/lib/cxapp/cloud-assembly.ts b/packages/aws-cdk/lib/cxapp/cloud-assembly.ts
index 89cbffd4d..7f819847e 100644
--- a/packages/aws-cdk/lib/cxapp/cloud-assembly.ts
+++ b/packages/aws-cdk/lib/cxapp/cloud-assembly.ts
@@ -1,7 +1,8 @@
 import type * as cxapi from '@aws-cdk/cx-api';
 import { minimatch } from 'minimatch';
 import * as semver from 'semver';
-import { BaseStackAssembly, StackCollection, ToolkitError } from '../api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
+import { BaseStackAssembly, StackCollection } from '../api/cloud-assembly';
 import { flatten } from '../util';
 
 export enum DefaultSelection {
diff --git a/packages/aws-cdk/lib/cxapp/cloud-executable.ts b/packages/aws-cdk/lib/cxapp/cloud-executable.ts
index 3fe354361..d8c94a9c2 100644
--- a/packages/aws-cdk/lib/cxapp/cloud-executable.ts
+++ b/packages/aws-cdk/lib/cxapp/cloud-executable.ts
@@ -1,10 +1,10 @@
 import type * as cxapi from '@aws-cdk/cx-api';
 import { CloudAssembly } from './cloud-assembly';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import type { ICloudAssemblySource, IReadableCloudAssembly } from '../../../@aws-cdk/toolkit-lib/lib/api/cloud-assembly';
 import { BorrowedAssembly } from '../../../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/borrowed-assembly';
 import type { IoHelper } from '../../../@aws-cdk/toolkit-lib/lib/api/io/private';
 import { IO } from '../../../@aws-cdk/toolkit-lib/lib/api/io/private';
-import { ToolkitError } from '../api';
 import type { SdkProvider } from '../api/aws-auth';
 import { GLOBAL_PLUGIN_HOST } from '../cli/singleton-plugin-host';
 import type { Configuration } from '../cli/user-configuration';
diff --git a/packages/aws-cdk/lib/cxapp/environments.ts b/packages/aws-cdk/lib/cxapp/environments.ts
index a7ce17cfe..ce6e29257 100644
--- a/packages/aws-cdk/lib/cxapp/environments.ts
+++ b/packages/aws-cdk/lib/cxapp/environments.ts
@@ -1,6 +1,6 @@
 import type * as cxapi from '@aws-cdk/cx-api';
 import { minimatch } from 'minimatch';
-import { ToolkitError } from '../api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import type { SdkProvider, StackCollection } from '../api';
 
 export function looksLikeGlob(environment: string) {
diff --git a/packages/aws-cdk/lib/cxapp/exec.ts b/packages/aws-cdk/lib/cxapp/exec.ts
index c4e7d98d5..9ce593cac 100644
--- a/packages/aws-cdk/lib/cxapp/exec.ts
+++ b/packages/aws-cdk/lib/cxapp/exec.ts
@@ -6,9 +6,10 @@ import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
 import * as fs from 'fs-extra';
 import * as semver from 'semver';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import { IO, type IoHelper } from '../../../@aws-cdk/toolkit-lib/lib/api/io/private';
 import type { SdkProvider, IReadLock } from '../api';
-import { RWLock, ToolkitError, guessExecutable, loadTree, prepareContext, prepareDefaultEnvironment, some, spaceAvailableForContext } from '../api';
+import { RWLock, guessExecutable, loadTree, prepareContext, prepareDefaultEnvironment, some, spaceAvailableForContext } from '../api';
 import type { Configuration } from '../cli/user-configuration';
 import { PROJECT_CONFIG, USER_DEFAULTS } from '../cli/user-configuration';
 import { versionNumber } from '../cli/version';
diff --git a/packages/aws-cdk/test/cxapp/exec.test.ts b/packages/aws-cdk/test/cxapp/exec.test.ts
index 218da47eb..5131d1632 100644
--- a/packages/aws-cdk/test/cxapp/exec.test.ts
+++ b/packages/aws-cdk/test/cxapp/exec.test.ts
@@ -4,7 +4,7 @@ import * as cdk from 'aws-cdk-lib';
 import * as semver from 'semver';
 import * as sinon from 'sinon';
 import { ImportMock } from 'ts-mock-imports';
-import { ToolkitError } from '../../../@aws-cdk/toolkit-lib/lib/api';
+import { ToolkitError } from '../../../@aws-cdk/toolkit-lib';
 import { RWLock } from '../../lib/api/rwlock';
 import { Configuration } from '../../lib/cli/user-configuration';
 import { execProgram } from '../../lib/cxapp/exec';