@go-to-k/cdkd 0.289.3 → 0.289.5

package/dist/{program-DLd8dIyf.js → program-CgSZ7WgF.js}

@@ -1,8 +1,8 @@
-import { $ as collectInlinePolicyNamesManagedBySiblings, $n as buildDockerImage, $r as IntrinsicResolutionRefusalError, $t as DagBuilder, A as isStatefulRecreateTargetForReplace, An as importableOutputs, Ar as findLargeInlineResources, At as coerceCfnBoolean, B as gray, Bn as rewriteTemplateAssetReferences, Bt as withSharedDrainBudget, C as refusesFinalSnapshot, Cn as buildLockContentionMessage, Cr as resolveStateBucketWithDefaultAndSource, Ct as isUnboundTemplateParameter, D as makeSiblingClaimReader, Dn as DEFAULT_STATE_PREFIX, Dr as CFN_TEMPLATE_BODY_LIMIT, Dt as normalizeAwsTagsToCfn, E as extractDeploymentEventError, En as CUSTOM_RESOURCE_RESPONSE_PREFIX, Er as warnDeprecatedNoPrefixCliFlag, Et as WAFv2WebACLProvider, F as isWarmThroughputDecrease, Fn as stringifyValue, Fr as PARTITION_TABLE, Ft as requireConfigArray, G as collectPublishedOutputNames, Gn as getBootstrapMarkerKey, Gr as setAwsClients, Gt as s3BucketWebsiteUrl, H as red, Hn as BOOTSTRAP_MARKER_PREFIX, Hr as AwsClients, Ht as s3BucketDomainName, I as toFiniteNumber, In as WorkGraph, Ir as canonicalizeRegion, It as requireConfigObject, J as secretBearing, Jn as readBootstrapMarkerBody, Jt as INTRINSIC_KEYS, K as exportAliasCollisionScrubWarning, Kn as isCrossRegionRedirect, Kt as applyRoleArnIfSet, L as formatResourceLine, Ln as buildAssetRedirectMap, Lr as derivePartitionAndUrlSuffix, Lt as requireConfigString, M as renderStatefulReason, Mn as orphansCarriedFrom, Mr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Mt as configStringRefusal, N as WARM_THROUGHPUT_MEMBERS, Nn as shouldRetainResource, Nr as displaySafe, Nt as readConfigString, O as planOrphanAdoption, On as exportNamesCarriedFrom, Or as CFN_TEMPLATE_URL_LIMIT, Ot as resolveExplicitPhysicalId, P as coerceWarmThroughput$1, Pn as AssetPublisher, Pr as expectedOwnerParam, Pt as replayWarn, Q as IAMRoleProvider, Qn as describeAwsFailure, Qr as DynamicReferenceRegionAmbiguousError, Qt as withRetry, R as bold, Rn as createAssetRedirectResolver, Rr as AssemblyReader, Rt as classifyReplaySecretRegion, S as isFinalSnapshotError, Si as retryClassificationText, Sn as buildForceUnlockCommand, Sr as resolveStateBucketWithDefault, St as getAccountInfo, T as makeCanonicalizePropertiesFn, Tn as shellQuote, Tr as stateBucketExistenceConfirmed, Tt as refStateLookupFromResource, U as yellow, Un as assertAssetBucketRegion, Ur as getAwsClients, Ut as s3BucketDualStackDomainName, V as green, Vn as AssetModeResolver, Vr as resolveBucketRegion, Vt as s3BucketArn, W as collectDeclaredOutputNames, Wn as ensureAssetStorage, Wr as resetAwsClients, Wt as s3BucketRegionalDomainName, X as secretSafeKeyDisplay, Xn as validateContainerRepoName, Xt as findSilentDropProperties, Y as secretBearingStateKeyWarning, Yn as validateAssetBucketName, Yr as CrossAccountSecretRefusalError, Yt as findActionableSilentDrops, Z as getCurrentResourceSecrets, Zn as buildDenyExternalAccessPolicy, Zr as DeployCancelledError, Zt as describeTypeWithThrottleRetry, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as isRetryableTransientError, _n as scrubResourceRecord, _r as getLegacyStateBucketName, _t as isTerminationProtectionPropagationError, a as DeploymentEventsStore, ai as ProvisioningError, an as carriesSecretMask, ar as getDockerCmd, at as maskerOrIdentity, b as ccRoutedFinalSnapshotError, bi as markNonRetryable, bn as rebuildClientForBucketRegion, br as resolveCaptureObservedState, bt as cfnRefValueFromPhysicalId, c as replayFailedOperations, ci as StackHasActiveImportsError, cn as errorCauseChain, cr as runDockerForeground, ct as interruptWatchListenerCount, d as updatePartialReason, dn as markSameGenerationBag, dr as stripControlChars, dt as CloudControlProvider, ei as LocalInvokeBuildError$1, en as TemplateParser, er as describeDockerCapturedOutput, et as clearOnUpdateRemoval, f as withResourceDeadline, fn as maskSecretsInError, fr as AssetManifestLoader, ft as slowCcOperationTimeoutMs, g as bindingSkippedOutputs, gi as isMarkedNonRetryable, gn as redactSecretsForState, gr as getDefaultStateBucketName, gt as disableInstanceApiTermination, h as computeImplicitDeleteEdges, hi as withErrorHandling, hn as recoverMaskedOutput, hr as synthesisStatusMessage, ht as deleteSkipReason, i as DeploymentEventsReader, ii as PartialFailureError, in as TEMPLATE_SOURCED_RULES, ir as formatDockerLoginError, it as maskDeep, j as isStatefulRecreateTargetSync, jn as orphansAfterRollback, jr as uploadCfnTemplate, jt as configBooleanRefusal, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as importableOutputKeys, kr as MIGRATE_TMP_PREFIX, kt as assertRegionMatch, l as replayRollback, li as StackTerminationProtectionError, ln as identityKeyFor, lr as runDockerStreaming, lt as isInterruptedWaitError, m as IMPLICIT_DELETE_DEPENDENCIES, mi as normalizeAwsError, mn as recordMaskOnlyValue, mr as Synthesizer, mt as deleteIndeterminateGuards, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as STATE_SOURCED_CROSS_GENERATION_RULES, nr as describeDockerFailure, nt as wouldReturnToSdkProvider, o as planFailedOps, oi as ResourceTimeoutError, on as createSecretMasker, or as partitionSensitiveEnv, ot as beginCommandInterruptScope, p as maskingRetryLogger, pn as maskSecretsInText, pr as getDockerImageBySourceHash, pt as UNSPECIFIED_SKIP_REASON, q as isExportAliasCollision, qn as parseBootstrapMarker, qr as CdkdError, qt as DiffCalculator, r as DeployEngine, ri as NestedStackChildDirectDestroyError, rn as STATE_SOURCED_READBACK_RULES, rr as dockerSpawnEnvWithSensitive, rt as createMaskedRetryLogger, s as planRollback, si as ResourceUpdateNotSupportedError, sn as dynamicReferenceTokens, sr as redactDockerArgvValues, st as endCommandInterruptScope, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as LocalStartServiceError, tn as STATE_SOURCED_BASELINE_RULES, tr as describeDockerExecFailure, tt as ProviderRegistry, u as updatePartialMessage, un as isSingleDynamicReferenceToken, ur as escapeRegExp, ut as startInterruptWatch, v as PRE_DELETE_SNAPSHOT_TYPES, vi as isThrottlingError, vn as LockManager, vr as resolveApp, vt as IntrinsicFunctionResolver, w as unsupportedFinalSnapshotError, wn as forceQuitRecoveryClause, wr as resolveUseCdkBootstrapAssets, wt as parameterTypeMayLoseSecretIdentity, x as createPreDeleteFinalSnapshot, xi as markRedactedCause, xn as UNRENDERABLE, xr as resolveSkipPrefix, xt as coerceParameterTypedValue, y as buildFinalSnapshotIdentifier, yi as isTransientServerError, yn as S3StateBackend, yr as resolveAutoAssetStorage, yt as carriesDynamicReference, z as cyan, zn as loadPublishableAssetManifest, zr as processStackMessages, zt as producerRegionsFromState } from "./deploy-engine-DAykhfpV.js";
-import { _ as withSkipPrefix, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName } from "./logger-D2Md1kTq.js";
+import { $ as collectInlinePolicyNamesManagedBySiblings, $n as buildDenyExternalAccessPolicy, $r as DynamicReferenceRegionAmbiguousError, $t as describeTypeWithThrottleRetry, A as isStatefulRecreateTargetForReplace, An as exportNamesCarriedFrom, Ar as CFN_TEMPLATE_URL_LIMIT, At as coerceCfnBoolean, B as gray, Bn as createAssetRedirectResolver, Br as processStackMessages, Bt as classifyReplaySecretRegion, C as refusesFinalSnapshot, Ci as retryClassificationText, Cn as UNRENDERABLE, Cr as resolveSkipPrefix, Ct as isUnboundTemplateParameter, D as makeSiblingClaimReader, Dn as shellQuote, Dr as stateBucketExistenceConfirmed, Dt as normalizeAwsTagsToCfn, E as extractDeploymentEventError, En as forceQuitRecoveryClause, Er as resolveUseCdkBootstrapAssets, Et as WAFv2WebACLProvider, F as isWarmThroughputDecrease, Fn as shouldRetainResource, Fr as expectedOwnerParam, Ft as readConfigString, G as collectPublishedOutputNames, Gn as assertAssetBucketRegion, Gr as resetAwsClients, Gt as s3BucketDualStackDomainName, H as red, Hn as rewriteTemplateAssetReferences, Hr as resolveBucketRegion, Ht as withSharedDrainBudget, I as toFiniteNumber, In as AssetPublisher, Ir as PARTITION_TABLE, It as replayWarn, J as secretBearing, Jn as isCrossRegionRedirect, Jr as CdkdError, Jt as applyRoleArnIfSet, K as exportAliasCollisionScrubWarning, Kn as ensureAssetStorage, Kr as setAwsClients, Kt as s3BucketRegionalDomainName, L as formatResourceLine, Ln as stringifyValue, Lr as canonicalizeRegion, Lt as requireConfigArray, M as renderStatefulReason, Mn as importableOutputs, Mr as findLargeInlineResources, Mt as configBooleanRefusal, N as WARM_THROUGHPUT_MEMBERS, Nn as orphansAfterRollback, Nr as uploadCfnTemplate, Nt as configIntegerRefusal, O as planOrphanAdoption, On as CUSTOM_RESOURCE_RESPONSE_PREFIX, Or as warnDeprecatedNoPrefixCliFlag, Ot as resolveExplicitPhysicalId, P as coerceWarmThroughput$1, Pn as orphansCarriedFrom, Pr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Pt as configStringRefusal, Q as IAMRoleProvider, Qn as validateContainerRepoName, Qr as DeployCancelledError, Qt as findSilentDropProperties, R as bold, Rn as WorkGraph, Rr as derivePartitionAndUrlSuffix, Rt as requireConfigObject, S as isFinalSnapshotError, Si as markRedactedCause, Sn as rebuildClientForBucketRegion, Sr as resolveCaptureObservedState, St as getAccountInfo, T as makeCanonicalizePropertiesFn, Tn as buildLockContentionMessage, Tr as resolveStateBucketWithDefaultAndSource, Tt as refStateLookupFromResource, U as yellow, Un as AssetModeResolver, Ur as AwsClients, Ut as s3BucketArn, V as green, Vn as loadPublishableAssetManifest, Vt as producerRegionsFromState, W as collectDeclaredOutputNames, Wn as BOOTSTRAP_MARKER_PREFIX, Wr as getAwsClients, Wt as s3BucketDomainName, X as secretSafeKeyDisplay, Xn as readBootstrapMarkerBody, Xr as CrossAccountSecretRefusalError, Xt as INTRINSIC_KEYS, Y as secretBearingStateKeyWarning, Yn as parseBootstrapMarker, Yt as DiffCalculator, Z as getCurrentResourceSecrets, Zn as validateAssetBucketName, Zt as findActionableSilentDrops, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as isMarkedNonRetryable, _n as recoverMaskedOutput, _r as synthesisStatusMessage, _t as isTerminationProtectionPropagationError, a as DeploymentEventsStore, ai as PartialFailureError, an as STATE_SOURCED_READBACK_RULES, ar as dockerSpawnEnvWithSensitive, at as maskerOrIdentity, b as ccRoutedFinalSnapshotError, bi as isTransientServerError, bn as LockManager, br as resolveApp, bt as cfnRefValueFromPhysicalId, c as replayFailedOperations, ci as ResourceUpdateNotSupportedError, cn as createSecretMasker, cr as partitionSensitiveEnv, ct as interruptWatchListenerCount, d as updatePartialReason, dn as identityKeyFor, dr as runDockerStreaming, dt as CloudControlProvider, ei as IntrinsicResolutionRefusalError, en as withRetry, er as describeAwsFailure, et as clearOnUpdateRemoval, f as withResourceDeadline, fn as isSingleDynamicReferenceToken, fr as escapeRegExp, ft as slowCcOperationTimeoutMs, g as bindingSkippedOutputs, gi as withErrorHandling, gn as recordMaskOnlyValue, gr as Synthesizer, gt as disableInstanceApiTermination, h as computeImplicitDeleteEdges, hi as normalizeAwsError, hn as maskSecretsInText, hr as getDockerImageBySourceHash, ht as deleteSkipReason, i as DeploymentEventsReader, ii as NestedStackChildDirectDestroyError, in as STATE_SOURCED_CROSS_GENERATION_RULES, ir as describeDockerFailure, it as maskDeep, j as isStatefulRecreateTargetSync, jn as importableOutputKeys, jr as MIGRATE_TMP_PREFIX, jt as coerceCfnInteger, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as DEFAULT_STATE_PREFIX, kr as CFN_TEMPLATE_BODY_LIMIT, kt as assertRegionMatch, l as replayRollback, li as StackHasActiveImportsError, ln as dynamicReferenceTokens, lr as redactDockerArgvValues, lt as isInterruptedWaitError, m as IMPLICIT_DELETE_DEPENDENCIES, mn as maskSecretsInError, mr as AssetManifestLoader, mt as deleteIndeterminateGuards, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as LocalStartServiceError, nn as TemplateParser, nr as describeDockerCapturedOutput, nt as wouldReturnToSdkProvider, o as planFailedOps, oi as ProvisioningError, on as TEMPLATE_SOURCED_RULES, or as formatDockerLoginError, ot as beginCommandInterruptScope, p as maskingRetryLogger, pn as markSameGenerationBag, pr as stripControlChars, pt as UNSPECIFIED_SKIP_REASON, q as isExportAliasCollision, qn as getBootstrapMarkerKey, qt as s3BucketWebsiteUrl, r as DeployEngine, rn as STATE_SOURCED_BASELINE_RULES, rr as describeDockerExecFailure, rt as createMaskedRetryLogger, s as planRollback, si as ResourceTimeoutError, sn as carriesSecretMask, sr as getDockerCmd, st as endCommandInterruptScope, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as LocalInvokeBuildError$1, tn as DagBuilder, tr as buildDockerImage, tt as ProviderRegistry, u as updatePartialMessage, ui as StackTerminationProtectionError, un as errorCauseChain, ur as runDockerForeground, ut as startInterruptWatch, v as PRE_DELETE_SNAPSHOT_TYPES, vi as isRetryableTransientError, vn as redactSecretsForState, vr as getDefaultStateBucketName, vt as IntrinsicFunctionResolver, w as unsupportedFinalSnapshotError, wn as buildForceUnlockCommand, wr as resolveStateBucketWithDefault, wt as parameterTypeMayLoseSecretIdentity, x as createPreDeleteFinalSnapshot, xi as markNonRetryable, xn as S3StateBackend, xr as resolveAutoAssetStorage, xt as coerceParameterTypedValue, y as buildFinalSnapshotIdentifier, yi as isThrottlingError, yn as scrubResourceRecord, yr as getLegacyStateBucketName, yt as carriesDynamicReference, z as cyan, zn as buildAssetRedirectMap, zr as AssemblyReader, zt as requireConfigString } from "./deploy-engine-Dhgm0r8o.js";
+import { _ as withSkipPrefix, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, y as displaySafe } from "./logger-CecsQ1UT.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DPykgdNN.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-rQ1BW281.js";
+import { t as getCdkdVersion } from "./version-DMsY_Ble.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-DD_xuWE3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -24300,6 +24300,50 @@ function requireSecretStringShape(literal) {
 	throw new Error(`SecretString must be a string, got ${literal === null ? "null" : Array.isArray(literal) ? "array" : typeof literal}`);
 }
 /**
+* The refusal for the MEMBERS of a `GenerateSecretString` block whose container
+* has already passed `requireConfigObject` (issue #3056), or `undefined` when
+* every member is usable. ONE predicate for two readers — the generator, which
+* mints from the block, and `retainPreviousGenerateBlock`, which decides
+* whether the PREVIOUS block is worth recording — per the #1653 rule that the
+* retention runs the same predicate the wire does. A module-level function
+* rather than a method so the recording helper can call it without reaching
+* `this`, which the #2212 fence confines to one logger call.
+*
+* Per member, the shared `config-shape.ts` predicate for its type: CFn is
+* stringly typed, so `PasswordLength: "32"` and `ExcludePunctuation: "true"`
+* coerce, while `null`, a blank, a non-numeric string, an object or an
+* unresolved intrinsic refuse. `PasswordLength` is capped at 4096, the
+* service's documented maximum, so a runaway length is refused before
+* `new Uint8Array` allocates it. `GenerateStringKey` / `SecretStringTemplate`
+* must be declared TOGETHER — the docs pin only key -> template; measured on
+* CloudFormation (us-east-1, 2026-09-13), a template with
+* `SecretStringTemplate` alone fails with `SecretStringTemplate and
+* GenerateStringKey must both be set or removed`, the service's own message
+* naming both directions (only that one was exercised) — the template must
+* parse to a JSON OBJECT (an array or a scalar parses and cannot take a key),
+* and the key may not be `__proto__`, which `template[key] = password` would
+* hand to the prototype setter, silently dropping the password from the
+* document. The messages name shapes only, never a value: the template can
+* carry a secret.
+*/
+function generateMemberRefusal(config) {
+	const P = "AWS::SecretsManager::Secret GenerateSecretString";
+	const shape = configIntegerRefusal(config, "PasswordLength", P, 1, 4096) ?? configBooleanRefusal(config, "ExcludeUppercase", P) ?? configBooleanRefusal(config, "ExcludeLowercase", P) ?? configBooleanRefusal(config, "ExcludeNumbers", P) ?? configBooleanRefusal(config, "ExcludePunctuation", P) ?? configStringRefusal(config, "ExcludeCharacters", "", P) ?? configStringRefusal(config, "GenerateStringKey", "required", P) ?? configStringRefusal(config, "SecretStringTemplate", "required", P);
+	if (shape !== void 0) return shape;
+	const key = config["GenerateStringKey"];
+	const template = config["SecretStringTemplate"];
+	if (key === void 0 && template === void 0) return void 0;
+	if (key === void 0 || template === void 0) return `${P}.GenerateStringKey and ${P}.SecretStringTemplate must be declared together (got only ${key === void 0 ? "SecretStringTemplate" : "GenerateStringKey"})`;
+	if (key === "__proto__") return `${P}.GenerateStringKey must not be __proto__ (the password would be written to the prototype, not the document)`;
+	let parsed;
+	try {
+		parsed = JSON.parse(template);
+	} catch {
+		return `${P}.SecretStringTemplate must be a JSON object (got a string that does not parse as JSON)`;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return `${P}.SecretStringTemplate must be a JSON object (got JSON that is not an object)`;
+}
+/**
 * AWS Secrets Manager Secret Provider
 *
 * Implements resource provisioning for AWS::SecretsManager::Secret using the Secrets Manager SDK.
@@ -24334,9 +24378,12 @@ var SecretsManagerSecretProvider = class {
 		});
 		try {
 			let secretString;
-			const generateConfig = properties["GenerateSecretString"];
-			if (generateConfig) secretString = this.generateSecretString(generateConfig);
-			else if (properties["SecretString"] !== void 0 && properties["SecretString"] !== "") secretString = requireSecretStringShape(properties["SecretString"]);
+			const rawGenerate = properties["GenerateSecretString"];
+			if (rawGenerate != null) {
+				const generateConfig = requireConfigObject(rawGenerate, "AWS::SecretsManager::Secret GenerateSecretString");
+				secretString = this.generateSecretString(generateConfig);
+			} else if (properties["SecretString"] !== void 0 && properties["SecretString"] !== "") secretString = requireSecretStringShape(properties["SecretString"]);
+			if (secretString === void 0) this.logger.warn(`AWS::SecretsManager::Secret ${logicalId} declares no secret value (neither GenerateSecretString nor a non-empty SecretString); the secret is created with NO version. Consumers reading it will fail until a value is set.`);
 			const createParams = { Name: name };
 			if (secretString) createParams.SecretString = secretString;
 			if (properties["Description"]) createParams.Description = properties["Description"];
@@ -24365,7 +24412,7 @@ var SecretsManagerSecretProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating secret ${logicalId}: ${physicalId}`);
 		try {
-			const secretString = this.changedSecretValue(properties, previousProperties);
+			const { value: secretString, skippedGenerate } = this.changedSecretValue(properties, previousProperties);
 			const updateParams = { SecretId: physicalId };
 			if (secretString !== void 0) updateParams.SecretString = secretString;
 			const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
@@ -24420,7 +24467,8 @@ var SecretsManagerSecretProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Id: physicalId }
+				attributes: { Id: physicalId },
+				effectiveProperties: skippedGenerate ? this.retainPreviousGenerateBlock(logicalId, properties, previousProperties) : void 0
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -24450,8 +24498,51 @@ var SecretsManagerSecretProvider = class {
 		}
 	}
 	/**
-	* The `SecretString` an in-place update must send, or `undefined` when the
-	* value's SOURCE is unchanged (issue #2472).
+	* The bag to RECORD when the generate block was skipped: the desired
+	* properties with `GenerateSecretString` restored to the previously-applied
+	* value, or with the key dropped when the previous side cannot be vouched
+	* for either.
+	*
+	* Validated through `requireConfigObject` AND `generateMemberRefusal` — the
+	* same two predicates the wire read runs, container then members — rather
+	* than a hand-written twin, so the two cannot disagree about a blank string,
+	* an explicit null, an intrinsic, or (since issue #3056) a malformed member
+	* inside a well-formed block: a pre-#3056 record holding
+	* `PasswordLength: 'abc'` is dropped, not retained. The retained block is
+	* COPIED, not aliased: both engine consumers spread the answer one level
+	* deep only (the #1653 review rule).
+	*
+	* The DROP is announced rather than silent (the #1654 rule: dropping a key
+	* moves a hazard unless something still says so). A record carrying
+	* neither value source later reaches the reverse-replacement replay-create,
+	* where `create()` — which cannot see the record's history — would create
+	* the secret with NO version; the warning here is what makes that record
+	* diagnosable, and `create()` warns again when it meets one.
+	*
+	* One shape is announced rather than reconciled: a secret created from a
+	* LITERAL whose template then switches to a malformed generate block. The
+	* previous side has no block, so the key is dropped, and the record then
+	* carries neither source while AWS still holds the literal. Restoring the
+	* previous `SecretString` would be the #1612 answer, but it re-records a
+	* literal the template has REMOVED; the drop keeps the next deploy of the
+	* same template an announced UPDATE (desired block vs absent), which is the
+	* loud outcome this arm exists for.
+	*/
+	retainPreviousGenerateBlock(logicalId, properties, previousProperties) {
+		const usableContainer = requireConfigObject(previousProperties["GenerateSecretString"], "AWS::SecretsManager::Secret GenerateSecretString", { onUnusable: () => {} });
+		const usablePrevious = usableContainer !== void 0 && generateMemberRefusal(usableContainer) === void 0 ? usableContainer : void 0;
+		const effective = { ...properties };
+		if (usablePrevious === void 0) {
+			delete effective["GenerateSecretString"];
+			this.logger.warn(`AWS::SecretsManager::Secret ${logicalId}: GenerateSecretString is dropped from the recorded properties. The desired block is unusable and the previously recorded one is absent or unusable, so the record now carries no GenerateSecretString; fix the template so the next deploy records one.`);
+		} else effective["GenerateSecretString"] = { ...usablePrevious };
+		return effective;
+	}
+	/**
+	* The `SecretString` an in-place update must send (as `value`), or
+	* `undefined` when the value's SOURCE is unchanged (issue #2472) or when a
+	* malformed `GenerateSecretString` block was SKIPPED (issue #3048,
+	* `skippedGenerate: true` — the caller records the previous block instead).
 	*
 	* The source is `GenerateSecretString` when present (CloudFormation gives it
 	* precedence over a literal) and `SecretString` otherwise. A generated value
@@ -24524,15 +24615,38 @@ var SecretsManagerSecretProvider = class {
 	* template.
 	*/
 	changedSecretValue(properties, previousProperties) {
-		const generateConfig = properties["GenerateSecretString"];
-		if (generateConfig) {
+		const rawGenerate = properties["GenerateSecretString"];
+		if (rawGenerate != null) {
+			const generateConfig = rawGenerate;
 			const previous = previousProperties["GenerateSecretString"];
-			return isDeepStrictEqual(asJson(generateConfig), asJson(previous)) || isDeepStrictEqual(asJson(this.asPersisted(generateConfig)), asJson(previous)) ? void 0 : this.generateSecretString(generateConfig);
+			if (isDeepStrictEqual(asJson(generateConfig), asJson(previous)) || isDeepStrictEqual(asJson(this.asPersisted(generateConfig)), asJson(previous))) return {
+				value: void 0,
+				skippedGenerate: false
+			};
+			const skip = (m) => this.logger.warn(`${m} No new secret value is generated; the secret keeps the value AWS currently holds.`);
+			const usable = requireConfigObject(generateConfig, "AWS::SecretsManager::Secret GenerateSecretString", { onUnusable: skip });
+			const generated = usable === void 0 ? void 0 : this.generateSecretString(usable, { onUnusable: skip });
+			return generated === void 0 ? {
+				value: void 0,
+				skippedGenerate: true
+			} : {
+				value: generated,
+				skippedGenerate: false
+			};
 		}
 		const literal = properties["SecretString"];
-		if (literal === void 0) return void 0;
-		if (isDeepStrictEqual(asJson(literal), asJson(previousProperties["SecretString"]))) return;
-		return requireSecretStringShape(literal);
+		if (literal === void 0) return {
+			value: void 0,
+			skippedGenerate: false
+		};
+		if (isDeepStrictEqual(asJson(literal), asJson(previousProperties["SecretString"]))) return {
+			value: void 0,
+			skippedGenerate: false
+		};
+		return {
+			value: requireSecretStringShape(literal),
+			skippedGenerate: false
+		};
 	}
 	/**
 	* `bag` as the state writer would persist it: every plaintext this
@@ -24548,17 +24662,49 @@ var SecretsManagerSecretProvider = class {
 		return secrets !== void 0 && secrets.size > 0 ? redactSecretsForState(bag, secrets) : bag;
 	}
 	/**
-	* Generate a secret string from GenerateSecretString configuration
-	*
-	* Simple implementation that generates a random string based on the config.
-	*/
-	generateSecretString(config) {
-		const length = config["PasswordLength"] || 32;
-		const excludeUppercase = config["ExcludeUppercase"];
-		const excludeLowercase = config["ExcludeLowercase"];
-		const excludeNumbers = config["ExcludeNumbers"];
-		const excludePunctuation = config["ExcludePunctuation"];
-		const excludeCharacters = readConfigString(config, "ExcludeCharacters", "", "AWS::SecretsManager::Secret GenerateSecretString");
+	* Generate a secret string from a USABLE `GenerateSecretString` block (the
+	* caller has already run `requireConfigObject` on the container).
+	*
+	* Every MEMBER is read through the shared `config-shape.ts` predicate for
+	* its type (issue #3056) rather than a cast: CFn is stringly typed, so
+	* `PasswordLength: "32"` and `ExcludePunctuation: "true"` are legitimate
+	* and coerce, while a malformed member — `null`, a blank, a non-numeric
+	* string, an object, an unresolved intrinsic — REFUSES instead of taking a
+	* default. The defaults it used to take were not inert: `(x as number) || 32`
+	* read `PasswordLength: 'abc'` as a truthy string and `new Uint8Array('abc')`
+	* minted an EMPTY password; a truthy `'false'` EXCLUDED punctuation; and a
+	* malformed `SecretStringTemplate` fell into the `catch` and returned the
+	* bare password RAW where the template declared a JSON document — as the
+	* new `AWSCURRENT`.
+	*
+	* The member rules themselves live in `generateMemberRefusal` (shared with
+	* the recording helper); both present means the key is written into the
+	* parsed template, both absent means a bare password, which is what the
+	* service does.
+	*
+	* With no `onUnusable` a refusal THROWS (the create path, where the block
+	* is template-borne). With one, the message is handed over and `undefined`
+	* is returned — the update path's SKIP, decided by the caller, so that this
+	* function never mints from a block it could not read. The two members the
+	* schema declares that this recipe does not implement, `IncludeSpace` and
+	* `RequireEachIncludedType`, are a separate fidelity gap (issue #3068), not
+	* a shape question.
+	*/
+	generateSecretString(config, options) {
+		const refusal = generateMemberRefusal(config);
+		if (refusal !== void 0) {
+			if (options?.onUnusable) {
+				options.onUnusable(`${refusal}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
+				return;
+			}
+			throw new Error(refusal);
+		}
+		const length = coerceCfnInteger(config["PasswordLength"]) ?? 32;
+		const excludeUppercase = coerceCfnBoolean(config["ExcludeUppercase"]) ?? false;
+		const excludeLowercase = coerceCfnBoolean(config["ExcludeLowercase"]) ?? false;
+		const excludeNumbers = coerceCfnBoolean(config["ExcludeNumbers"]) ?? false;
+		const excludePunctuation = coerceCfnBoolean(config["ExcludePunctuation"]) ?? false;
+		const excludeCharacters = config["ExcludeCharacters"] ?? "";
 		let chars = "";
 		if (!excludeUppercase) chars += "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 		if (!excludeLowercase) chars += "abcdefghijklmnopqrstuvwxyz";
@@ -24572,14 +24718,10 @@ var SecretsManagerSecretProvider = class {
 		for (let i = 0; i < length; i++) password += chars[bytes[i] % chars.length];
 		const generateStringKey = config["GenerateStringKey"];
 		const secretStringTemplate = config["SecretStringTemplate"];
-		if (generateStringKey && secretStringTemplate) try {
-			const template = JSON.parse(secretStringTemplate);
-			template[generateStringKey] = password;
-			return JSON.stringify(template);
-		} catch {
-			return password;
-		}
-		return password;
+		if (generateStringKey === void 0 || secretStringTemplate === void 0) return password;
+		const template = JSON.parse(secretStringTemplate);
+		template[generateStringKey] = password;
+		return JSON.stringify(template);
 	}
 	/**
 	* Read the AWS-current secret configuration in CFn-property shape.
@@ -74401,6 +74543,22 @@ function isPhase2CreatableType(resourceType) {
 	return isCustomResourceType(resourceType);
 }
 /**
+* One spelling of "this value came from an S3 key or a state record, and is
+* about to be interpolated into a message a terminal will render" (issue
+* #3003). `cdkd state show --show-nested` reaches the walker's refusals below,
+* and cdkd's output is line-oriented, so an unsanitized value invents a line
+* that reads like a row. A `logicalId` is a KEY of the record body -- CloudFormation
+* constrains a logical id, but nothing enforces that on a record read back
+* from S3, and it is half of the child stack name derived from it.
+*
+* Module-scoped rather than local to the walker: the first cut of this change
+* guarded the walker's two refusals and left the root one, which is the shape
+* the issue is about.
+*/
+function safeSegment(value) {
+	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+}
+/**
 * Recursively load the cdkd-state tree rooted at `(rootStackName, region)`.
 * For every `AWS::CloudFormation::Stack` row in each level's
 * `state.resources`, derives the child's v6 state key
@@ -74436,7 +74594,7 @@ async function buildCdkdStateStackTree(rootStackName, region, stateBackend, pref
 	if (prefetchedRootState !== void 0) rootState = prefetchedRootState;
 	else {
 		const rootResult = await stateBackend.getState(rootStackName, region);
-		if (!rootResult) throw new Error(`No cdkd state found for stack '${rootStackName}' (${region}). Cannot build nested-stack tree.`);
+		if (!rootResult) throw new Error(`No cdkd state found for stack '${safeSegment(rootStackName)}' (${safeSegment(region)}). Cannot build nested-stack tree.`);
 		rootState = rootResult.state;
 	}
 	return walkCdkdStateStackTree(rootStackName, region, rootState, stateBackend);
@@ -74447,8 +74605,8 @@ async function walkCdkdStateStackTree(stackName, region, state, stateBackend) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		const childStackName = `${stackName}~${logicalId}`;
 		const childResult = await stateBackend.getState(childStackName, region);
-		if (!childResult) throw new Error(`cdkd state is missing nested-child '${childStackName}' (${region}). Parent stack '${stackName}' lists '${logicalId}' as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at 'cdkd/${childStackName}/${region}/state.json'. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or run 'cdkd state orphan ${stackName}' and re-import.`);
-		if (childResult.state.region !== void 0 && childResult.state.region !== region) throw new Error(`cdkd state region mismatch: nested-child '${childStackName}' has state.region='${childResult.state.region}' but its parent '${stackName}' is being walked against region='${region}'. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
+		if (!childResult) throw new Error(`cdkd state is missing nested-child '${safeSegment(childStackName)}' (${safeSegment(region)}). Parent stack '${safeSegment(stackName)}' lists '${safeSegment(logicalId)}' as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at 'cdkd/${safeSegment(childStackName)}/${safeSegment(region)}/state.json'. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or run 'cdkd state orphan ${safeSegment(stackName)}' and re-import.`);
+		if (childResult.state.region !== void 0 && childResult.state.region !== region) throw new Error(`cdkd state region mismatch: nested-child '${safeSegment(childStackName)}' has state.region='${safeSegment(childResult.state.region)}' but its parent '${safeSegment(stackName)}' is being walked against region='${safeSegment(region)}'. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
 		nestedChildren.set(logicalId, await walkCdkdStateStackTree(childStackName, region, childResult.state, stateBackend));
 	}
 	return {
@@ -76501,8 +76659,34 @@ function formatStackRef(ref) {
 * `()` would read as "no region" rather than "a region cdkd will not print".
 */
 function formatStackRefSafe(ref) {
-	const stack = displaySafe(ref.stackName, { asciiOnly: true }) || "<unrenderable>";
-	return ref.region ? `${stack} (${displaySafe(ref.region, { asciiOnly: true }) || "<unrenderable>"})` : stack;
+	return ref.region ? `${safe(ref.stackName)} (${safe(ref.region)})` : safe(ref.stackName);
+}
+/**
+* One spelling of "this value came from an S3 key or a state record, and is
+* about to be interpolated into a message a terminal will render".
+*
+* Call it for a stack name or a region. NOT every refusal in this file goes
+* through it, and this comment does not say which do -- `grep safe(` answers
+* it exactly. The sentence that used to sit here claimed all of them, and
+* three sites in `state destroy` / `state refresh-observed` disprove it by
+* interpolating a `listStacks()` region raw (go-to-k/cdkd#3027). That is the
+* same over-claiming shape `lock-manager.ts`'s twin helper records having got
+* wrong three times.
+*
+* It exists as one function rather than the expression repeated per site
+* because the failure this closes WAS the repeated form: issue #2772 guarded
+* the rendered rows and left the refusals, and the first cut of #3003 guarded
+* three refusals and left four more in these same two commands. A value
+* reaching a message is the population, not a list of call sites.
+*
+* `asciiOnly` because the population has a known charset — CloudFormation
+* constrains a stack name and AWS constrains a region, so the allowlist is a
+* no-op on every legitimate input while an S3 key admits any UTF-8. Free-form
+* text (a parser's own message, an AWS error) takes the denylist class
+* instead; `display-safe.ts`'s header draws that line.
+*/
+function safe(value) {
+	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
 }
 /**
 * Resolve a stack name + optional region flag against the `listStacks` index
@@ -76512,18 +76696,18 @@ function formatStackRefSafe(ref) {
 */
 function resolveSingleRegion(stackName, refs, requestedRegion) {
 	const matches = refs.filter((r) => r.stackName === stackName);
-	if (matches.length === 0) throw new Error(`No state found for stack '${stackName}'. Run 'cdkd state list' to see available stacks.`);
+	if (matches.length === 0) throw new Error(`No state found for stack '${safe(stackName)}'. Run 'cdkd state list' to see available stacks.`);
 	if (requestedRegion) {
 		const ref = matches.find((r) => r.region === requestedRegion);
 		if (!ref) {
-			const seen = matches.map((r) => r.region ?? "(legacy)").join(", ");
-			throw new Error(`No state found for stack '${stackName}' in region '${requestedRegion}'. Available regions: ${seen}.`);
+			const seen = matches.map((r) => r.region === void 0 ? "(legacy)" : safe(r.region));
+			throw new Error(`No state found for stack '${safe(stackName)}' in region '${safe(requestedRegion)}'. Available regions: ${seen.join(", ")}.`);
 		}
 		return ref;
 	}
 	if (matches.length === 1) return matches[0];
-	const regions = matches.map((r) => r.region ?? "(legacy)").join(", ");
-	throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
+	const regions = matches.map((r) => r.region === void 0 ? "(legacy)" : safe(r.region));
+	throw new Error(`Stack '${safe(stackName)}' has state in multiple regions: ${regions.join(", ")}. Re-run with --stack-region <region> to disambiguate.`);
 }
 /**
 * Shared bootstrap for every `state` subcommand: build the AWS clients,
@@ -76744,9 +76928,9 @@ async function stateResourcesCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${stackName}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
-		if (!stateResult) throw new Error(`No state found for stack '${stackName}' (${ref.region}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
+		if (!stateResult) throw new Error(`No state found for stack '${safe(stackName)}' (${safe(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		const resources = stateResult.state.resources ?? {};
 		const details = Object.entries(resources).map(([logicalId, resource]) => ({
 			logicalId,
@@ -76951,9 +77135,9 @@ async function stateShowCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${stackName}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
 		const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
-		if (!stateResult) throw new Error(`No state found for stack '${stackName}' (${ref.region}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
+		if (!stateResult) throw new Error(`No state found for stack '${safe(stackName)}' (${safe(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (options.showNested) {
 			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state), setup.lockManager, lockInfo);
 			if (options.json) {
@@ -91753,4 +91937,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DLd8dIyf.js.map
+//# sourceMappingURL=program-CgSZ7WgF.js.map