@go-to-k/cdkd 0.290.19 → 0.290.21

package/dist/{deploy-engine-D7mwWwGs.js → deploy-engine-KnCjibgq.js}

@@ -1,6 +1,6 @@
-import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
+import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BOnyvRN8.js";
+import { t as getCdkdVersion } from "./version-CGcB3KHZ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4139,6 +4139,77 @@ async function expectedOwnerParam(client) {
 	return owner ? { ExpectedBucketOwner: owner } : {};
 }
 
+//#endregion
+//#region src/utils/s3-listing-keys.ts
+/**
+* URL-safe reading of an S3 listing's key-bearing fields (issue
+* [#3313](https://github.com/go-to-k/cdkd/issues/3313)).
+*
+* **Why this exists at all.** `ListObjectsV2` and `ListObjectVersions` answer in
+* XML, and an XML parser normalises a CARRIAGE RETURN to a LINE FEED per the
+* specification (XML 1.0 section 2.11). So a key containing a CR comes back
+* with an LF in its place, and anything the caller then does with that
+* value — a `DeleteObject`, a `GetObject`, a membership test against a key
+* cdkd constructed — addresses a key that does not exist.
+*
+* MEASURED against real S3 (us-east-1, 2026-09-17), not read off the spec:
+*
+* ```
+* PutObject  key `a b`            -> listed as `a+b`   (FORM-style, not %20)
+* PutObject  key `a+b`            -> listed as `a%2Bb`
+* PutObject  key containing CR    -> stored
+* ListObjectsV2, no EncodingType -> the CR comes back as \n
+* ListObjectsV2, EncodingType=url -> ...%0D..., which decodes to the real CR
+* ```
+*
+* The delete that follows such a listing is the dangerous half: it SUCCEEDS
+* and removes nothing, so a sweep counts it and moves on. That is how
+* `s3-noncurrent-version-purge.ts` — the sweep that removes state versions
+* carrying a secret plaintext — can report a clean run over a surviving one.
+*
+* **What is and is NOT encoded**, measured in the same run, because getting
+* this backwards breaks pagination rather than fixing anything:
+*
+* | field | under `EncodingType: 'url'` | so |
+* | --- | --- | --- |
+* | `Contents[].Key`, `Versions[].Key`, `DeleteMarkers[].Key` | encoded | DECODE |
+* | `CommonPrefixes[].Prefix` | encoded | DECODE |
+* | `NextKeyMarker` | encoded | DECODE — the next request sends the RAW value |
+* | `NextVersionIdMarker` | NOT encoded | pass back verbatim (a version id is opaque) |
+* | `NextContinuationToken` | opaque, NOT encoded | send back VERBATIM; decoding corrupts it |
+* | `Prefix`, `Delimiter` | ENCODED (AWS lists them) | decode IF read; no cdkd site reads them |
+*
+* A helper that decoded `NextContinuationToken` along with the rest would
+* produce a token S3 rejects, which is why the two are named separately here
+* rather than "decode every string on the response".
+*
+* **NUL is out of scope and that is a measurement, not an omission**: S3
+* refuses to store a key containing one (`PutObject` fails), so no listing can
+* deliver it. An ESC survives verbatim — the transformation is specific to the
+* line-ending class, so a guard looking for "control characters" would miss
+* the one character that actually moves.
+*/
+/**
+* Decode one key-bearing field of a listing taken with `EncodingType: 'url'`.
+*
+* Returns `undefined` unchanged so a caller can pass an optional field
+* straight through.
+*
+* `decodeURIComponent` throws on a malformed sequence (`%` not followed by two
+* hex digits). That cannot arise from S3's own encoding, but this function is
+* the ONE place a raw response value is trusted, so it refuses rather than
+* guesses: a key it cannot decode is one a later delete would address wrongly,
+* which is the defect this module exists to close.
+*/
+function decodeListingKey(value) {
+	if (value === void 0) return void 0;
+	try {
+		return decodeURIComponent(value.replace(/\+/g, "%20"));
+	} catch (error) {
+		throw new Error(`S3 returned a listing key that is not valid URL encoding: ${JSON.stringify(value)}. cdkd takes every listing with EncodingType='url' so a key containing a carriage return survives the XML round-trip; a value that will not decode cannot be addressed safely, so this listing is refused rather than acted on.`, { cause: error });
+	}
+}
+
 //#endregion
 //#region src/state/s3-replication-purge-gap.ts
 /**
@@ -4653,6 +4724,7 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 			Bucket: bucket,
 			...requestFields,
 			Prefix: prefix,
+			EncodingType: "url",
 			...keyMarker !== void 0 && { KeyMarker: keyMarker },
 			...versionIdMarker !== void 0 && { VersionIdMarker: versionIdMarker }
 		}));
@@ -4665,22 +4737,29 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 			hasBody: false
 		}))];
 		for (const { entry, hasBody } of entries) {
-			if (entry.Key === void 0 || !wanted.has(entry.Key)) continue;
+			let decodedKey;
+			try {
+				decodedKey = decodeListingKey(entry.Key);
+			} catch {
+				if (hasBody && entry.Key !== void 0) unsettledBodies.add(`${entry.Key} [key not decodable; shown as S3 returned it]`);
+				continue;
+			}
+			if (decodedKey === void 0 || !wanted.has(decodedKey)) continue;
 			if (entry.IsLatest === void 0) {
-				recordFailure(failed, entry.Key, `version ${entry.VersionId ?? "<unknown>"}: listing omitted IsLatest, so the entry was left alone rather than risk deleting a current version`);
-				if (hasBody) unsettledBodies.add(entry.Key);
+				recordFailure(failed, decodedKey, `version ${entry.VersionId ?? "<unknown>"}: listing omitted IsLatest, so the entry was left alone rather than risk deleting a current version`);
+				if (hasBody) unsettledBodies.add(decodedKey);
 			}
 			if (entry.IsLatest !== false) continue;
 			if (!entry.VersionId) {
-				recordFailure(failed, entry.Key, `listing returned a noncurrent entry with no VersionId, so it could not be deleted`);
-				if (hasBody) unsettledBodies.add(entry.Key);
+				recordFailure(failed, decodedKey, `listing returned a noncurrent entry with no VersionId, so it could not be deleted`);
+				if (hasBody) unsettledBodies.add(decodedKey);
 				continue;
 			}
 			stale.push({
-				Key: entry.Key,
+				Key: decodedKey,
 				VersionId: entry.VersionId
 			});
-			if (hasBody) purged.add(entry.Key);
+			if (hasBody) purged.add(decodedKey);
 		}
 		for (let i = 0; i < stale.length; i += DELETE_BATCH_SIZE) {
 			const batch = stale.slice(i, i + DELETE_BATCH_SIZE);
@@ -4712,7 +4791,7 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 				unsettledBodies.add(key);
 			}
 		}
-		keyMarker = resp.IsTruncated === true ? resp.NextKeyMarker : void 0;
+		keyMarker = resp.IsTruncated === true ? decodeListingKey(resp.NextKeyMarker) : void 0;
 		versionIdMarker = keyMarker !== void 0 ? resp.NextVersionIdMarker : void 0;
 	} while (keyMarker !== void 0);
 }
@@ -10387,10 +10466,11 @@ var S3StateBackend = class {
 					Bucket: this.config.bucket,
 					...await this.ownerParam(),
 					Prefix: prefix,
+					EncodingType: "url",
 					...continuationToken && { ContinuationToken: continuationToken }
 				}));
 				for (const obj of response.Contents ?? []) {
-					const key = obj.Key;
+					const key = decodeListingKey(obj.Key);
 					if (!key) continue;
 					if (!key.endsWith("/state.json")) continue;
 					const segments = key.slice(prefix.length).split("/");
@@ -10483,9 +10563,13 @@ var S3StateBackend = class {
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
 				Prefix: keyPrefix,
+				EncodingType: "url",
 				...continuationToken && { ContinuationToken: continuationToken }
 			}));
-			for (const obj of response.Contents ?? []) if (obj.Key) keys.push(obj.Key);
+			for (const obj of response.Contents ?? []) {
+				const decoded = decodeListingKey(obj.Key);
+				if (decoded) keys.push(decoded);
+			}
 			continuationToken = response.IsTruncated ? response.NextContinuationToken : void 0;
 		} while (continuationToken);
 		return keys;
@@ -10515,6 +10599,7 @@ var S3StateBackend = class {
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
 				Prefix: keyPrefix,
+				EncodingType: "url",
 				...continuationToken && { ContinuationToken: continuationToken }
 			}));
 			for (const obj of response.Contents ?? []) {
@@ -10528,7 +10613,7 @@ var S3StateBackend = class {
 					continue;
 				}
 				objects.push({
-					key: obj.Key,
+					key: decodeListingKey(obj.Key) ?? obj.Key,
 					lastModified: obj.LastModified,
 					size: obj.Size
 				});
@@ -20529,6 +20614,11 @@ function findUnrecognizedProperties(resourceType, templateProperties) {
 
 //#endregion
 //#region src/state/malformed-resources-bag.ts
+/**
+* The identifier cap every message here uses unless a caller says otherwise.
+* See {@link safeIdentifier} for why it is a parameter at all.
+*/
+const IDENT_CAP_DEFAULT = 128;
 /** The error code every malformed-record refusal carries, whatever its class. */
 const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
 /**
@@ -20600,16 +20690,27 @@ function hasReadableOutputs(state) {
 * `shellQuote` composition every message in THIS module needs and that one
 * must not have.
 */
-function safeIdentifier(value) {
+function safeIdentifier(value, maxCodePoints = IDENT_CAP_DEFAULT) {
 	const safe = displaySafe(value, { asciiOnly: true });
 	if (!safe) return UNRENDERABLE;
-	const { text, truncated } = truncateCodePoints(safe, 128);
+	const { text, truncated } = truncateCodePoints(safe, maxCodePoints);
 	return truncated ? `${text}...` : text;
 }
-function malformedStateDetail(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+/**
+* The DIAGNOSIS sentence itself, with no identity and no remedy in it.
+*
+* ONE spelling, for the reason {@link malformedStateDetail} gives for existing
+* at all: two copies of a diagnosis are what drift. It is extracted because
+* {@link malformedDestroyResourcesRefusalMessage} needs the same sentence
+* under an identity it does NOT trust, where the detail's substituted
+* `cdkd state show` command must not appear — a difference in the COMMAND, not
+* in the diagnosis.
+*/
+const MALFORMED_RESOURCES_DIAGNOSIS = "has no readable 'resources' map — the record is malformed or truncated. Both 'cdkd deploy' and 'cdkd destroy' REFUSE such a record rather than acting on it: they read the same map, an unreadable one is indistinguishable from an empty stack, and acting on that reading would make a deploy re-CREATE every resource and a destroy delete none of them.";
+function malformedStateDetail(stackName, region, maxCodePoints = IDENT_CAP_DEFAULT) {
+	const stack = safeIdentifier(stackName, maxCodePoints);
+	const reg = safeIdentifier(region, maxCodePoints);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) ${MALFORMED_RESOURCES_DIAGNOSIS} Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /**
 * For a READ-ONLY command: give the record an empty resource bag so the
@@ -20667,6 +20768,192 @@ function malformedStateRefusalMessage(stackName, region) {
 	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
 }
 /**
+* The DESTROY refusal text for the `resources` bag (issue
+* [#3161](https://github.com/go-to-k/cdkd/issues/3161)).
+*
+* A SECOND `resources` refusal beside {@link malformedStateRefusalMessage},
+* for the reason every split in this module is its own: that text says saving
+* over the record "would replace the evidence with a well-formed empty one",
+* which is not what a destroy does. A destroy DELETES the record, and it does
+* so down a path the other four refusing commands never take.
+*
+* What the runner does with the bag is COUNT it —
+* `Object.keys(state.resources).length` — and route on the count. The count is
+* the list of what to delete, so an unreadable bag counts ZERO and the run
+* takes the EMPTY-STACK FAST PATH, which deletes `state.json` outright. Every
+* resource the record named stays live in AWS, now unreferenced, and the
+* destroy reports success.
+*
+* **Reading the bag as EMPTY — the read-only repair — IS that outcome rather
+* than an alternative to it**, which is why no repair is available here.
+* Measured rather than reasoned: `[]`, `5` and `true` all enumerate no keys,
+* so they already ARE the repaired-to-`{}` shape, and each one reaches the
+* fast path today. The same measurement
+* {@link refuseMalformedResourceProperties} records one container down.
+*
+* It NAMES `cdkd state orphan`, which the sibling refusals do not, and
+* that answers the objection go-to-k/cdkd#3161 raises against refusing at all
+* — that a cleanup command refusing leaves the user with no supported way to
+* tear the stack down. Proceeding would not tear anything down either, and
+* that is per-shape rather than a slogan: `[]` / a number / a boolean name no
+* resource at all, while a STRING names one fabricated logical id per
+* character whose ENTRY is a single character — so `resourceType` and
+* `physicalId` are both `undefined` and `ProviderRegistry.getProviderFor`
+* throws before any provider is selected, which means no AWS delete is issued
+* and no live resource can be addressed. (Measured 2026-09-17 against the real
+* registry: `Cannot read properties of undefined (reading 'startsWith')`, out
+* of the `isCustomResource` test — a routing failure, NOT a `provider.delete`
+* rejection, which an earlier revision of this note claimed.) What a forced
+* run would do is therefore bounded by the record: on the first three shapes
+* it deletes `state.json` and nothing else, and on a string every fabricated
+* id fails and `errorCount > 0` keeps a record — but keeps it LAUNDERED, since
+* the preserve-write spreads the bag (`{ ...state.resources }`) and `'ab'`
+* comes back as a well-formed `{"0":"a","1":"b"}`. So "it preserves the
+* evidence" would be the wrong defence of proceeding; the string shape reaches
+* the same laundering by another route, which strengthens the refusal rather
+* than weakening it (review round 2 of go-to-k/cdkd#3332). The only outcome
+* worth offering is the record's removal, and `cdkd state orphan` is the
+* supported command for it, leaving the live resources in place. It reads
+* `state.resources` nowhere, which is what makes the pointer true and is
+* fenced in `tests/unit/state/malformed-resources-bag.test.ts`.
+*
+* **That remedy is a TEMPLATE, not a substituted command, and the asymmetry
+* with the `cdkd state show` line above it is the point.** `state orphan`
+* DELETES a record; `state show` reads one. The `region` this function is
+* handed comes from `destroy-runner.ts`'s
+* `state.region ?? ctx.baseRegion`, and `state.region` is RECORD-BODY content
+* that `getState` does not check against the key it loaded from — measured
+* 2026-09-17: a record planted at `.../us-east-1/state.json` carrying
+* `"region": "eu-west-1"` rendered a pasteable
+* `cdkd state orphan <stack> --stack-region eu-west-1`, aiming a destructive
+* command at a DIFFERENT region's record for the same stack. That is the
+* misdirection class {@link stackClause} records for stack names, one field
+* over. Substituting into the read-only `state show` line is the pre-existing
+* behaviour of {@link malformedStateDetail} and is left alone; what this lane
+* must not add is a destructive one. The divergence itself — the runner also
+* LOCKS and DELETES against the body region — is go-to-k/cdkd#3328.
+*
+* **A template is not enough on its own, because the name the reader would
+* type into it comes from the clause ABOVE.** `safeIdentifier` composes
+* `displaySafe` with a cap, and `displaySafe` TRIMS — so a planted
+* `resources["..."]` record keyed `"prod-api "` opens this message as
+* `State for 'prod-api' (...)`, byte-identical to a HEALTHY sibling spelled
+* `prod-api`. An operator who then orphans "the record the line above names"
+* deletes the intact one. That is exactly the identity failure `displayIdent`
+* exists for and {@link namedPropertyBagsClause} applies to logical ids. So
+* the remedy sentence is GATED on the identity rendering EXACTLY: when it does
+* not, the text names no removal target at all and opens on
+* {@link stackClause}'s no-identity form, ending on
+* {@link inspectCommand}'s TEMPLATE rather than on a command built from the
+* very identity it just called untrustworthy. The same call
+* `buildForceUnlockCommand` makes when a value would render misleadingly.
+*
+* **Rendering exactly is not the same as being TRUE, and the EXACT arm must
+* not claim it is.** `exact` answers a question about this message's own text;
+* it says nothing about PROVENANCE. A planted `"region": "eu-west-1"` on a
+* `.../us-east-1/` key is an ordinary region string, so it renders exactly and
+* the arm fires — and an earlier revision then said to run `cdkd state orphan`
+* "with the stack and region this message NAMES", which is the attacker's
+* region (review round 2 of go-to-k/cdkd#3332: templating had removed the
+* paste, not the aim). The arm therefore points at the record's S3 KEY, which
+* `getState` resolved and a record body cannot forge, and says outright that
+* the region printed above is body-derived and need not match it. The
+* divergence is go-to-k/cdkd#3328.
+*
+* **The cap this arm measures against is `STACK_REF_MAX_CODE_POINTS`, not the
+* 128 every other text in this module uses**, and it is threaded rather than
+* hard-coded because the VERDICT turns on it. At 128 an ordinary multi-level
+* CDK nested child (`<root>~<...NestedStackResource><hash>~<...>`, measured
+* past 150 code points) truncates, fails `exact`, and takes the withhold arm
+* on a HEALTHY record — which is fail-safe but makes the fallback the common
+* path for exactly the nested destroys this lane added a guard to (review
+* round 2 of go-to-k/cdkd#3332). The bound is still a bound: a planted
+* multi-kilobyte name is truncated at 1152 and lands in the withhold arm.
+*
+* Identifiers are sanitized and THEN shell-quoted, for the reasons
+* {@link safeIdentifier}'s note gives.
+*/
+function malformedDestroyResourcesRefusalMessage(stackName, region) {
+	const cap = STACK_REF_MAX_CODE_POINTS;
+	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(region, cap) === region;
+	return `${exact ? malformedStateDetail(stackName, region, cap) : `${stackClause(void 0, void 0)} ${MALFORMED_RESOURCES_DIAGNOSIS}`} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out rather than pasteable, because that command DELETES a record and the region printed above is read from the record's own BODY, which need not match its key. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing — then: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+}
+/**
+* For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `resources`
+* bag cannot be read (issue
+* [#3161](https://github.com/go-to-k/cdkd/issues/3161)).
+*
+* The `resources` twin of {@link refuseMalformedOutputsForDestroy}, and a
+* SEPARATE call from it for the reason that one is separate from
+* {@link refuseMalformedOutputs}: a record can be malformed in either
+* container alone and the refusal must name the one that is broken.
+*
+* CALL IT AT THE TOP OF THE DESTROY, **above the `resourceCount` read**. The
+* placement rule is {@link repairMalformedResourcesForReadOnly}'s and it is
+* not decoration here: the empty-stack fast path sits immediately below that
+* read and DELETES the record, so a guard written anywhere below it refuses a
+* record that is already gone.
+*/
+function refuseMalformedResourcesForDestroy(state, stackName, region) {
+	if (hasReadableResources(state)) return;
+	throw markNonRetryable(new CdkdError(malformedDestroyResourcesRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The DEPLOY refusal text for the `resources` bag (issue
+* [#3161](https://github.com/go-to-k/cdkd/issues/3161)).
+*
+* A THIRD `resources` text, and not {@link malformedStateRefusalMessage}'s for
+* the same reason the destroy one is not: that text describes the SAVE as the
+* harm, and here the save is the last thing that happens rather than the
+* first. An unreadable map reads as zero RECORDED resources, so the change
+* calculation plans every resource the template declares as a CREATE and the
+* deploy re-provisions the whole stack against live AWS — colliding on every
+* deterministic name and duplicating the rest — before saving a well-formed
+* record over the only evidence anything was wrong. An operator told their
+* record would be "replaced with a well-formed empty one" would not know that
+* running anyway duplicates their stack.
+*
+* **It must be true under `cdkd deploy --dry-run` as well**, which it is: the
+* guard sits at the state LOAD, above the diff and above the `if
+* (this.options.dryRun)` return, so a dry run reaches it. Refusing there is
+* the decision {@link malformedResourcePropertiesRefusalMessage} records for
+* the sibling container, for the same reason — the repaired PREVIEW is
+* available one command over from `cdkd diff`, which repairs this bag and
+* warns, so refusing here costs nothing that is not already offered, while a
+* plausible `--dry-run` plan followed by a refusal the moment the flag comes
+* off would be the worst arm of all.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedDeployResourcesRefusalMessage(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did.`;
+}
+/**
+* For `cdkd deploy`: refuse a record whose `resources` bag cannot be read
+* (issue [#3161](https://github.com/go-to-k/cdkd/issues/3161)).
+*
+* The gap go-to-k/cdkd#3317's review named and left: that lane closed the
+* per-entry `properties` container at `DiffCalculator.calculateDiff`, and
+* {@link unreadableResourcePropertyBags} deliberately returns `[]` for a
+* record whose ROOT bag is unreadable — so `"resources": "abcdef"` reached the
+* deploy diff, enumerated two fabricated logical ids, and re-created the
+* stack. {@link refuseMalformedState}'s callers are `import.ts`, `orphan.ts`
+* and `rollback.ts`, none of which is on this path.
+*
+* CALL IT AT THE LOAD, beside {@link refuseMalformedOutputs} — the placement
+* rule {@link repairMalformedResourcesForReadOnly}'s note records. Not at
+* `calculateDiff`: the engine's own load dominates that call AND the twelve
+* reads between them — five, measured 2026-09-17 over comment-stripped source;
+* re-derive rather than trusting the figure — the first of which
+* (`Object.keys(currentState.resources)` in a debug line) is where a `null`
+* bag raised the bare `TypeError` #3018 exists to remove.
+*/
+function refuseMalformedResourcesForDeploy(state, stackName, region) {
+	if (hasReadableResources(state)) return;
+	throw markNonRetryable(new CdkdError(malformedDeployResourcesRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
 * The warning a view emits when it emptied one or more {@link
 * RenderedStateContainer}s it could not walk (go-to-k/cdkd#3187).
 *
@@ -20942,7 +21229,7 @@ function malformedExportNamesWarning(stackName, region) {
 */
 function refuseMalformedOutputs(state, stackName, region) {
 	if (hasReadableOutputs(state)) return;
-	throw new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+	throw markNonRetryable(new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
 }
 /**
 * The DESTROY refusal text (issue
@@ -31442,7 +31729,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ac412LEP.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B8GAVns4.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -41338,9 +41625,11 @@ function deepEqualValue(a, b) {
 * escaping silently, so the authority on "where is this applied" is a grep the
 * test performs, not a number anybody has to maintain.
 */
-function crossStackReadsForPartialSave(previous, recordedImports, recordedOutputReads) {
-	const imports = unionCrossStackReads(previous.imports, recordedImports, (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${e.exportName}`);
-	const outputReads = unionCrossStackReads(previous.outputReads, recordedOutputReads, (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${e.outputName}`);
+function crossStackReadsForPartialSave(previous, recordedImports, recordedOutputReads, normalizeName) {
+	const importKey = (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${normalizeName(e.exportName)}`;
+	const outputReadKey = (e) => `${normalizeName(e.sourceStack)}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${normalizeName(e.outputName)}`;
+	const imports = unionCrossStackReads(previous.imports, recordedImports, importKey);
+	const outputReads = unionCrossStackReads(previous.outputReads, recordedOutputReads, outputReadKey);
 	return {
 		...imports.length > 0 && { imports },
 		...outputReads.length > 0 && { outputReads }
@@ -41754,7 +42043,13 @@ var DeployEngine = class DeployEngine {
 	* only outputs-substituted references: a literal output equal to a secret
 	* nothing resolved is not recorded, and is not touched.
 	*
-	* Run by every {@link redactOutputs} (issue
+	* Run by every {@link redactOutputs}, AND by
+	* {@link crossStackReadKeyNormalizer} (issue
+	* [#3289](https://github.com/go-to-k/cdkd/issues/3289)), which needs the
+	* same bag and runs BEFORE the persist walk. Calling it twice in one save
+	* is safe and MEASURED rather than assumed: the entry fold re-sets equal
+	* values, and `recordResolvedPair` leaves a pair alone when the plaintext
+	* is unchanged, so no CONFLICTING marker is invented. (issue
 	* [#2814](https://github.com/go-to-k/cdkd/issues/2814)), because a part the
 	* drain cap stopped waiting for records into its pass map LATE: a secret
 	* that arrives between the pass and the final save is then still a needle
@@ -42080,14 +42375,108 @@ var DeployEngine = class DeployEngine {
 				state: scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0)
 			};
 		});
+		const outputs = this.redactOutputs(state.outputs);
+		const crossStackReads = this.redactCrossStackReads(state);
 		return {
 			...state,
 			resources,
-			outputs: this.redactOutputs(state.outputs),
-			...orphans === void 0 ? {} : { orphans }
+			outputs,
+			...orphans === void 0 ? {} : { orphans },
+			...crossStackReads
 		};
 	}
 	/**
+	* Redact the TEMPLATE-DERIVED names in `state.imports` / `state.outputReads`
+	* (issue [#3289](https://github.com/go-to-k/cdkd/issues/3289)).
+	*
+	* Both lists rode the `...state` spread unredacted, so a reference whose name
+	* an `Fn::Sub` assembled around a resolved secret persisted that secret in
+	* plaintext, durably. The fields are NOT symmetric and the issue as filed
+	* named the wrong ones, so the provenance of each is stated here rather than
+	* left to be re-derived:
+	*
+	* - `imports[].exportName` IS template-derived (`resolveValue` on the
+	*   `Fn::ImportValue` argument), so it leaks. Its `sourceStack` /
+	*   `sourceRegion` are NOT: `recordImport` takes them from the exports index
+	*   entry or the state scan, i.e. from the producer's own record.
+	* - `outputReads[]` has TWO leaking fields: `outputName` AND `sourceStack`,
+	*   both `resolveValue` on `Fn::GetStackOutput` arguments. `sourceRegion` is
+	*   template-derived too but passes `isClientSafeRegion` before it can be
+	*   recorded, and it is read STRUCTURALLY (`producerRegionsFromState` keys a
+	*   secret-region decision on it), so it is deliberately left alone.
+	*
+	* REDACTION HAPPENS HERE, at the persist choke point, and must not move to
+	* record time: `crossStackReadsForPartialSave` / `unionCrossStackReads` dedup
+	* on `${sourceStack}\0${region}\0${name}`, so changing a value mid-run makes
+	* the union write BOTH spellings, and its first-seen-wins merge would keep
+	* whichever arrived first.
+	*
+	* `outputReads[].sourceStack` is both a leak and the literal match key
+	* `findDownstreamConsumers` compares against, so redacting it necessarily
+	* stops that match. That reader reports rather than drops — see
+	* `recreate-downstream-consumers.ts`; a consumer vanishing from a DATA-LOSS
+	* prompt is a worse failure than one it cannot name precisely.
+	*
+	* The union bag is every secret THIS deploy resolved, because a
+	* cross-stack reference can sit in a resource property (recorded per logical
+	* id) or in an Output (recorded in the outputs pass), and the entry carries
+	* no logical id to narrow it by.
+	*/
+	redactCrossStackReads(state) {
+		if (state.imports === void 0 && state.outputReads === void 0) return {};
+		const secrets = this.allRecordedSecrets();
+		const redact = (value) => redactSecretsForState(value, secrets);
+		return {
+			...state.imports === void 0 ? {} : { imports: state.imports.map((entry) => ({
+				...entry,
+				exportName: redact(entry.exportName)
+			})) },
+			...state.outputReads === void 0 ? {} : { outputReads: state.outputReads.map((entry) => ({
+				...entry,
+				sourceStack: redact(entry.sourceStack),
+				outputName: redact(entry.outputName)
+			})) }
+		};
+	}
+	/**
+	* The name normalizer `crossStackReadsForPartialSave` keys its union on
+	* (issue [#3289](https://github.com/go-to-k/cdkd/issues/3289)).
+	*
+	* It applies the SAME redaction the persist path applies, so a name this run
+	* holds in plaintext and the name the previous record holds redacted produce
+	* ONE key. Without it the union keeps both and the persist redaction makes
+	* them identical duplicates. The parameter's own doc carries the measurement.
+	*
+	* Returns identity when this deploy resolved no secret, which keeps the key
+	* byte-identical to the pre-#3289 one for every stack that has none.
+	*/
+	crossStackReadKeyNormalizer() {
+		this.absorbOutputsPassSecrets();
+		const secrets = this.allRecordedSecrets();
+		if (secrets.size === 0) return (name) => name;
+		return (name) => redactSecretsForState(name, secrets);
+	}
+	/**
+	* Every secret this deploy resolved, in one bag.
+	*
+	* `perResourceSecrets` is keyed by logical id and `outputSecrets` holds the
+	* outputs pass, which is the right scoping for a RECORD (a resource's own
+	* secrets redact that resource). A cross-stack read entry carries no logical
+	* id, so it has nothing to be scoped BY — the reference may have sat in any
+	* resource's property or in an Output.
+	*
+	* Over-redaction here is the safe direction and is bounded the same way the
+	* value scan always is: `MIN_NEEDLE_LENGTH` keeps a short plaintext from
+	* matching a substring, and an export name that genuinely equals another
+	* resource's secret is a name that should not be persisted either.
+	*/
+	allRecordedSecrets() {
+		const all = /* @__PURE__ */ new Map();
+		for (const bag of this.perResourceSecrets.values()) for (const [plaintext, expression] of bag) all.set(plaintext, expression);
+		for (const [plaintext, expression] of this.outputSecrets) all.set(plaintext, expression);
+		return all;
+	}
+	/**
 	* Stamp `parentStack` / `parentLogicalId` / `parentRegion` (schema v6+)
 	* onto a state object that's about to be saved, when this engine was
 	* constructed with `options.parentStackInfo` (= it's deploying a
@@ -42330,6 +42719,7 @@ var DeployEngine = class DeployEngine {
 			};
 			const currentEtag = currentStateData?.etag;
 			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
+			refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -42430,7 +42820,7 @@ var DeployEngine = class DeployEngine {
 							outputs: outputsChanged ? outputsToPersist : persistedOutputs,
 							...exportNamesToPersist === void 0 ? exportNamesCarriedFrom(currentState) : { exportNames: [...exportNamesToPersist] },
 							...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
-							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 							lastModified: Date.now()
 						};
 						const saveOptions = {};
@@ -42561,7 +42951,7 @@ var DeployEngine = class DeployEngine {
 						...exportNamesCarriedFrom(currentState),
 						...skippedOutputsCarriedFrom(currentState),
 						...orphansCarriedFrom(currentState),
-						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 						lastModified: Date.now()
 					};
 					const migrate = pendingMigration;
@@ -42695,7 +43085,7 @@ var DeployEngine = class DeployEngine {
 					...exportNamesCarriedFrom(currentState),
 					...skippedOutputsCarriedFrom(currentState),
 					...orphansCarriedFrom(currentState),
-					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 					lastModified: Date.now()
 				};
 				const migrate = pendingMigration;
@@ -42736,7 +43126,7 @@ var DeployEngine = class DeployEngine {
 					...exportNamesCarriedFrom(currentState),
 					...skippedOutputsCarriedFrom(currentState),
 					...orphansAfterRollback(currentState, rollbackOrphans),
-					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 					lastModified: Date.now()
 				};
 				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
@@ -42755,7 +43145,7 @@ var DeployEngine = class DeployEngine {
 						...exportNamesCarriedFrom(currentState),
 						...skippedOutputsCarriedFrom(currentState),
 						...orphansAfterRollback(currentState, rollbackOrphans),
-						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 						lastModified: Date.now()
 					};
 					await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
@@ -42828,7 +43218,7 @@ var DeployEngine = class DeployEngine {
 			...exportNamesCarriedFrom(currentState),
 			...skippedOutputsCarriedFrom(currentState),
 			...orphansCarriedFrom(currentState),
-			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 			lastModified: Date.now()
 		});
 		try {
@@ -42972,7 +43362,7 @@ var DeployEngine = class DeployEngine {
 			recordEvent: (event) => this.recordEvent(event),
 			finalSnapshotClients: this.options.finalSnapshotClients,
 			skipFinalSnapshot: this.options.skipFinalSnapshot,
-			importedProducerRegions: producerRegionsFromState(crossStackReadsForPartialSave(previousState, this.recordedImports, this.recordedOutputReads))
+			importedProducerRegions: producerRegionsFromState(crossStackReadsForPartialSave(previousState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()))
 		};
 	}
 	/**
@@ -44333,5 +44723,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, isRetryableTransientError as $i, S3StateBackend as $n, getLegacyStateBucketName as $r, s3BucketArn as $t, extractDeploymentEventError as A, CrossAccountSecretRefusalError as Ai, findSilentDropProperties as An, readBootstrapMarkerBody as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, PartialFailureError as Bi, createSecretMasker as Bn, formatDockerLoginError as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, AwsClients as Ci, refuseMalformedOutputs as Cn, AssetModeResolver as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, AssetError as Di, repairMalformedResourcePropertiesForReadOnly as Dn, getBootstrapMarkerKey as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, setAwsClients as Ei, repairMalformedOutputsForReadOnly as En, ensureAssetStorage as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, LocalInvokeBuildError as Fi, STATE_SOURCED_BASELINE_RULES as Fn, buildDockerImage as Fr, isSettledInstanceState as Ft, gray as G, StackTerminationProtectionError as Gi, markSameGenerationBag as Gn, runDockerStreaming as Gr, readConfigString as Gt, formatResourceLine as H, ResourceTimeoutError as Hi, errorCauseChain as Hn, partitionSensitiveEnv as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, LocalStartServiceError as Ii, STATE_SOURCED_CROSS_GENERATION_RULES as In, describeDockerCapturedOutput as Ir, WAFv2WebACLProvider as It, yellow as J, formatError as Ji, recordMaskOnlyValue as Jn, AssetManifestLoader as Jr, requireConfigObject as Jt, green as K, StateError as Ki, maskSecretsInError as Kn, escapeRegExp$1 as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, LockError as Li, STATE_SOURCED_READBACK_RULES as Ln, describeDockerExecFailure as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, DeployCancelledError as Mi, withRetry as Mn, validateContainerRepoName as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, DynamicReferenceRegionAmbiguousError as Ni, DagBuilder as Nn, buildDenyExternalAccessPolicy as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, CdkdError as Oi, repairMalformedResourcesForReadOnly as On, isCrossRegionRedirect as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, IntrinsicResolutionRefusalError as Pi, TemplateParser as Pn, describeAwsFailure as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, isMarkedNonRetryable as Qi, LockManager as Qn, getDefaultStateBucketName as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, MalformedProducerRecordRefusalError as Ri, TEMPLATE_SOURCED_RULES as Rn, describeDockerFailure as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, resolveBucketRegion as Si, refuseMalformedNestedChildOutputs as Sn, rewriteTemplateAssetReferences as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, resetAwsClients as Ti, refuseMalformedState as Tn, assertAssetBucketRegion as Tr, carriesDynamicReference as Tt, bold as U, ResourceUpdateNotSupportedError as Ui, identityKeyFor as Un, redactDockerArgvValues as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, ProvisioningError as Vi, dynamicReferenceTokens as Vn, getDockerCmd as Vr, coerceCfnInteger as Vt, cyan as W, StackHasActiveImportsError as Wi, isSingleDynamicReferenceToken as Wn, runDockerForeground as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, normalizeAwsError as Xi, redactSecretsForState as Xn, Synthesizer as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, isCdkdError as Yi, recoverMaskedOutput as Yn, getDockerImageBySourceHash as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, withErrorHandling as Zi, scrubResourceRecord as Zn, synthesisStatusMessage as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, canonicalizeRegion as _i, malformedRenderedContainersWarning as _n, stringifyValue as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, __exportAll as aa, resolveStateBucketWithDefaultAndSource as ai, applyCallerIdentityCredentials as an, shellQuote as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, processStackMessages as bi, malformedStateRefusalMessage as bn, createAssetRedirectResolver as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, warnDeprecatedNoPrefixCliFlag as ci, INTRINSIC_KEYS as cn, exportNamesCarriedFrom as cr, createMaskedRetryLogger as ct, updatePartialReason as d, MIGRATE_TMP_PREFIX as di, hasReadableResources as dn, importableOutputs as dr, beginCommandInterruptScope as dt, isThrottlingError as ea, resolveApp as ei, s3BucketDomainName as en, rebuildClientForBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, findLargeInlineResources as fi, malformedExportNamesWarning as fn, isReadableBag as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, PARTITION_TABLE as gi, malformedOutputsWarning as gn, AssetPublisher as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, expectedOwnerParam as hi, malformedOutputsRefusalMessage as hn, shouldRetainResource as hr, startInterruptWatch as ht, DeploymentEventsReader as i, retryClassificationText as ia, resolveStateBucketWithDefault as ii, applyRoleArnIfSet as in, formatLockExpiry as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, DependencyError as ji, describeTypeWithThrottleRetry as jn, validateAssetBucketName as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, ConfigError as ki, findActionableSilentDrops as kn, parseBootstrapMarker as kr, getAccountInfo as kt, replayRollback as l, CFN_TEMPLATE_BODY_LIMIT as li, STATE_RESOURCES_MALFORMED as ln, hasReadableExportSet as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mi, malformedLocalOutputsWarning as mn, orphansCarriedFrom as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, markNonRetryable as na, resolveCaptureObservedState as ni, s3BucketRegionalDomainName as nn, buildLockContentionMessage as nr, getCurrentResourceSecrets as nt, planFailedOps as o, resolveUseCdkBootstrapAssets as oi, callerEnvCredentials as on, CUSTOM_RESOURCE_RESPONSE_PREFIX as or, ProviderRegistry as ot, maskingRetryLogger as p, uploadCfnTemplate as pi, malformedExportSourceWarning as pn, orphansAfterRollback as pr, interruptWatchListenerCount as pt, red as q, SynthesisError as qi, maskSecretsInText as qn, stripControlChars as qr, requireConfigArray as qt, DeployEngine as r, markRedactedCause as ra, resolveSkipPrefix as ri, s3BucketWebsiteUrl as rn, forceQuitRecoveryClause as rr, IAMRoleProvider as rt, planRollback as s, stateBucketExistenceConfirmed as si, DiffCalculator as sn, DEFAULT_STATE_PREFIX as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isTransientServerError as ta, resolveAutoAssetStorage as ti, s3BucketDualStackDomainName as tn, buildForceUnlockCommand as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, CFN_TEMPLATE_URL_LIMIT as ui, hasReadableOutputs as un, importableOutputKeys as ur, maskerOrIdentity as ut, keptWholeReasonText as v, derivePartitionAndUrlSuffix as vi, malformedResourcePropertiesWarning as vn, WorkGraph as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, getAwsClients as wi, refuseMalformedOutputsForDestroy as wn, BOOTSTRAP_MARKER_PREFIX as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, clearBucketRegionCache as xi, producerRecordKey as xn, loadPublishableAssetManifest as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, AssemblyReader as yi, malformedResourcesWarning as yn, buildAssetRedirectMap as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, NestedStackChildDirectDestroyError as zi, carriesSecretMask as zn, dockerSpawnEnvWithSensitive as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-D7mwWwGs.js.map
+export { secretBearing as $, withErrorHandling as $i, LockManager as $n, getDefaultStateBucketName as $r, s3BucketArn as $t, extractDeploymentEventError as A, CdkdError as Ai, findActionableSilentDrops as An, parseBootstrapMarker as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, MalformedProducerRecordRefusalError as Bi, carriesSecretMask as Bn, dockerSpawnEnvWithSensitive as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, clearBucketRegionCache as Ci, refuseMalformedOutputs as Cn, rewriteTemplateAssetReferences as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, resetAwsClients as Di, repairMalformedOutputsForReadOnly as Dn, ensureAssetStorage as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, getAwsClients as Ei, refuseMalformedState as En, assertAssetBucketRegion as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DynamicReferenceRegionAmbiguousError as Fi, TemplateParser as Fn, describeAwsFailure as Fr, isSettledInstanceState as Ft, gray as G, ResourceUpdateNotSupportedError as Gi, isSingleDynamicReferenceToken as Gn, runDockerForeground as Gr, readConfigString as Gt, formatResourceLine as H, PartialFailureError as Hi, dynamicReferenceTokens as Hn, getDockerCmd as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, IntrinsicResolutionRefusalError as Ii, STATE_SOURCED_BASELINE_RULES as In, buildDockerImage as Ir, WAFv2WebACLProvider as It, yellow as J, StateError as Ji, maskSecretsInText as Jn, stripControlChars as Jr, requireConfigObject as Jt, green as K, StackHasActiveImportsError as Ki, markSameGenerationBag as Kn, runDockerStreaming as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, LocalInvokeBuildError as Li, STATE_SOURCED_CROSS_GENERATION_RULES as Ln, describeDockerCapturedOutput as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, CrossAccountSecretRefusalError as Mi, describeTypeWithThrottleRetry as Mn, validateAssetBucketName as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, DependencyError as Ni, withRetry as Nn, validateContainerRepoName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, setAwsClients as Oi, repairMalformedResourcePropertiesForReadOnly as On, getBootstrapMarkerKey as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, DeployCancelledError as Pi, DagBuilder as Pn, buildDenyExternalAccessPolicy as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, normalizeAwsError as Qi, scrubResourceRecord as Qn, synthesisStatusMessage as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, LocalStartServiceError as Ri, STATE_SOURCED_READBACK_RULES as Rn, describeDockerExecFailure as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, processStackMessages as Si, refuseMalformedNestedChildOutputs as Sn, loadPublishableAssetManifest as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AwsClients as Ti, refuseMalformedResourcesForDestroy as Tn, BOOTSTRAP_MARKER_PREFIX as Tr, carriesDynamicReference as Tt, bold as U, ProvisioningError as Ui, errorCauseChain as Un, partitionSensitiveEnv as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, NestedStackChildDirectDestroyError as Vi, createSecretMasker as Vn, formatDockerLoginError as Vr, coerceCfnInteger as Vt, cyan as W, ResourceTimeoutError as Wi, identityKeyFor as Wn, redactDockerArgvValues as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, formatError as Xi, recoverMaskedOutput as Xn, getDockerImageBySourceHash as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, SynthesisError as Yi, recordMaskOnlyValue as Yn, AssetManifestLoader as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, isCdkdError as Zi, redactSecretsForState as Zn, Synthesizer as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, expectedOwnerParam as _i, malformedRenderedContainersWarning as _n, AssetPublisher as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, markRedactedCause as aa, resolveStateBucketWithDefault as ai, applyCallerIdentityCredentials as an, formatLockExpiry as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, derivePartitionAndUrlSuffix as bi, malformedStateRefusalMessage as bn, buildAssetRedirectMap as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, stateBucketExistenceConfirmed as ci, INTRINSIC_KEYS as cn, DEFAULT_STATE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, CFN_TEMPLATE_URL_LIMIT as di, hasReadableResources as dn, importableOutputKeys as dr, beginCommandInterruptScope as dt, isMarkedNonRetryable as ea, getLegacyStateBucketName as ei, s3BucketDomainName as en, S3StateBackend as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, MIGRATE_TMP_PREFIX as fi, malformedExportNamesWarning as fn, importableOutputs as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, decodeListingKey as gi, malformedOutputsWarning as gn, shouldRetainResource as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as hi, malformedOutputsRefusalMessage as hn, orphansCarriedFrom as hr, startInterruptWatch as ht, DeploymentEventsReader as i, markNonRetryable as ia, resolveSkipPrefix as ii, applyRoleArnIfSet as in, forceQuitRecoveryClause as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, ConfigError as ji, findSilentDropProperties as jn, readBootstrapMarkerBody as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AssetError as ki, repairMalformedResourcesForReadOnly as kn, isCrossRegionRedirect as kr, getAccountInfo as kt, replayRollback as l, warnDeprecatedNoPrefixCliFlag as li, STATE_RESOURCES_MALFORMED as ln, exportNamesCarriedFrom as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, uploadCfnTemplate as mi, malformedLocalOutputsWarning as mn, orphansAfterRollback as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isThrottlingError as na, resolveAutoAssetStorage as ni, s3BucketRegionalDomainName as nn, buildForceUnlockCommand as nr, getCurrentResourceSecrets as nt, planFailedOps as o, retryClassificationText as oa, resolveStateBucketWithDefaultAndSource as oi, callerEnvCredentials as on, shellQuote as or, ProviderRegistry as ot, maskingRetryLogger as p, findLargeInlineResources as pi, malformedExportSourceWarning as pn, isReadableBag as pr, interruptWatchListenerCount as pt, red as q, StackTerminationProtectionError as qi, maskSecretsInError as qn, escapeRegExp$1 as qr, requireConfigArray as qt, DeployEngine as r, isTransientServerError as ra, resolveCaptureObservedState as ri, s3BucketWebsiteUrl as rn, buildLockContentionMessage as rr, IAMRoleProvider as rt, planRollback as s, __exportAll as sa, resolveUseCdkBootstrapAssets as si, DiffCalculator as sn, CUSTOM_RESOURCE_RESPONSE_PREFIX as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isRetryableTransientError as ta, resolveApp as ti, s3BucketDualStackDomainName as tn, rebuildClientForBucketRegion as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, CFN_TEMPLATE_BODY_LIMIT as ui, hasReadableOutputs as un, hasReadableExportSet as ur, maskerOrIdentity as ut, keptWholeReasonText as v, PARTITION_TABLE as vi, malformedResourcePropertiesWarning as vn, stringifyValue as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, resolveBucketRegion as wi, refuseMalformedOutputsForDestroy as wn, AssetModeResolver as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, AssemblyReader as xi, producerRecordKey as xn, createAssetRedirectResolver as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, canonicalizeRegion as yi, malformedResourcesWarning as yn, WorkGraph as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LockError as zi, TEMPLATE_SOURCED_RULES as zn, describeDockerFailure as zr, assertRegionMatch as zt };
+//# sourceMappingURL=deploy-engine-KnCjibgq.js.map