@go-to-k/cdkd 0.290.31 → 0.290.32

package/dist/{program-CnSaRdY9.js → program-DdmCUgOP.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-21iNqwR3.js";
-import { C as displayAwsMessage, E as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BjWM-UVj.js";
+import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-CfOsVRQB.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BX4pJk0T.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-IwTfNQ-K.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DNzgk-BS.js";
+import { t as getCdkdVersion } from "./version-F41ektvu.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BuEvX2d9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -270,35 +270,6 @@ function describeStateKey(key, suffix = STATE_FILE_SUFFIX, knownPrefix) {
 	return region === void 0 ? name : `${name} (${displayIdent(region)})`;
 }
 /**
-* The shape a state-key segment must have before it may be interpolated into a
-* command cdkd invites an operator to PASTE.
-*
-* An ALLOW-LIST, and deliberately so: the first cut of this predicate was a
-* deny-list that refused a leading `-`, and review defeated it with a leading
-* `~`. A deny-list has to enumerate every character a shell treats specially
-* BEFORE cdkd sees the word, and the set of things nobody thought of is
-* unbounded. The repo already settled this once — `rollback-executor.ts`'s
-* `PASTEABLE_LOGICAL_ID` is `/^[A-Za-z0-9]{1,255}$/`, with a comment naming
-* `~user` and `=x` by name.
-*
-* This one is wider than that because the values here are not logical ids: a
-* cdkd state record's stack name carries `~` (a nested-stack child is minted
-* `${parent}~${logicalId}`) and a region carries `-`. What it keeps from the
-* precedent is the LEADING character, which is where the danger is. MEASURED
-* in bash on a real host rather than reasoned:
-*
-*     ~root        -> /var/root        ~/x  -> $HOME/x       ~-  -> $OLDPWD
-*     a=~/x        -> a=$HOME/x
-*     Parent~Child -> inert            a:~/x -> inert
-*
-* So `~` is dangerous only in the leading position or straight after `=`,
-* which is why a medial `~` stays in the set and `=` stays out of it entirely.
-* A leading digit or letter also closes the option case: `--state-bucket=x`
-* cannot match, and that one is NOT about shell quoting — it is still an
-* OPTION after quoting, which is why the answer is refusal rather than quoting.
-*/
-const PASTEABLE_STATE_IDENT = /^[A-Za-z0-9][A-Za-z0-9~_.-]*$/;
-/**
 * The cap for rendering a whole state or lock KEY, as opposed to one segment.
 *
 * A key CONTAINS a stack name, so capping it at `STACK_REF_MAX_CODE_POINTS`
@@ -314,28 +285,6 @@ const PASTEABLE_STATE_IDENT = /^[A-Za-z0-9][A-Za-z0-9~_.-]*$/;
 * BUDGET, not an enforced bound. Nothing in `src/` validates key length.
 */
 const STATE_KEY_MAX_CODE_POINTS = STACK_REF_MAX_CODE_POINTS + 64;
-/**
-* Is this value safe to interpolate into a command we tell an operator to RUN?
-*
-* Two independent tests, and BOTH are load-bearing:
-*
-* 1. {@link PASTEABLE_STATE_IDENT}, which decides the shell question — see its
-*    own note for why it is an allow-list and what was measured.
-* 2. It renders byte-identically through `displayIdent`, which adds the LENGTH
-*    cap and the ASCII rule the regex does not carry, asked through the public
-*    API rather than by re-spelling `PLAIN_IDENT` (a second spelling of a
-*    security predicate is how the two drift).
-*
-* Deliberately NOT shell-quoting instead. Quoting answers test 2's population
-* and none of the option case — `'--state-bucket=attacker'` is still parsed as
-* a flag — and a command that LOOKS runnable is the thing being handed over, so
-* the honest answer for a value failing either test is to print the S3 key and
-* let the operator decide.
-*/
-function isPasteableIdent(value) {
-	if (!PASTEABLE_STATE_IDENT.test(value)) return false;
-	return displayIdent(value, { maxCodePoints: STACK_REF_MAX_CODE_POINTS }) === value;
-}
 
 //#endregion
 //#region src/cli/options.ts
@@ -69751,17 +69700,31 @@ function isTemplateShapeResolutionFailure(err) {
 * Per-pattern throw sites, and the fence that keeps them true, are in
 * `tests/unit/cli/scrub-abandoned-scan-origin.test.ts`.
 *
-* ONE CLASSIFICATION CHANGE, recorded because it is a GATE and this file does
-* not otherwise mention it. go-to-k/cdkd#3426 routed the `Ref <id> not found`
-* throw through the resolver's display builder, which strips control
+* TWO CLASSIFICATION CHANGES, recorded because they are a GATE and this file
+* does not otherwise mention them. go-to-k/cdkd#3426 routed the `Ref <id> not
+* found` throw through the resolver's display builder, which strips control
 * characters and trims — so an id carrying a CR or padding, which `\S+` could
 * not match before, matches now, and such a unit moves from `count` (gateable
-* by `cdkd scrub --dry-run --fail`) to `warn` (not). The SAFE direction would
-* have been the other one, and it is accepted for a reason: a plain dangling
-* `Ref` already warned, so this adds no NEW bypass — it extends an existing
-* classification to ids that differ from an ordinary one only by characters
-* nobody can see. The alternative is a gate whose verdict depends on invisible
-* bytes in a logical id, which is worse to reason about. Pinned by
+* by `cdkd scrub --dry-run --fail`) to `warn` (not). go-to-k/cdkd#3432 did the
+* same to `Resource <id> not found for Fn::GetAtt`, the SECOND pattern below,
+* for the same reason and with the same effect. Both are listed here rather
+* than one, because a note naming a single pattern reads as a property of that
+* pattern instead of a property of every id-bearing shape in the list. THE
+* THIRD moved too, in go-to-k/cdkd#3432's own review round: `Parameter <name>
+* is required ...` carried the same premise one expression name over — a
+* `Parameters` KEY is arbitrary JSON just as a `Resources` key is — and a
+* reviewer measured it putting a live terminal-rewriting sequence on that
+* throw. So all THREE patterns now see a sanitized id, and this note names no
+* exception; an earlier revision of it described the third as the one still
+* rendered raw, which would have shipped as a standing description of a live
+* exposure.
+*
+* The SAFE direction would have been the other one, and it is accepted for a
+* reason: a plain dangling `Ref`, `Fn::GetAtt` or unbound parameter already
+* warned, so this adds no NEW bypass — it extends an existing classification to
+* ids that differ from an ordinary one only by characters nobody can see. The
+* alternative is a gate whose verdict depends on invisible bytes in a logical
+* id, which is worse to reason about. All three are pinned by
 * `tests/unit/cli/scrub-abandoned-scan-origin.test.ts`.
 */
 const TEMPLATE_SHAPE_FAILURE_PATTERNS = [
@@ -84098,19 +84061,20 @@ async function orphanCommand(pathArgs, options) {
 		})).stacks);
 		const stackInfo = resolved.stack;
 		const orphanLogicalIds = resolved.logicalIds;
-		const targetRegion = await pickStackRegion(stateBackend, stackInfo.stackName, stackInfo.region, options.stackRegion);
+		const { region: targetRegion, recordRegion } = await pickStackRegion(stateBackend, stackInfo.stackName, stackInfo.region, options.stackRegion);
 		logger.info(`Target: ${stackInfo.stackName} (${targetRegion}); orphaning ${orphanLogicalIds.length} resource(s): ${orphanLogicalIds.join(", ")}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
+		const recovery = {
+			profile: options.profile,
+			stateBucket,
+			statePrefix: options.statePrefix
+		};
 		if (!options.dryRun) {
 			if (!await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "orphan")) throw new Error(await buildLockContentionMessage({
 				lockManager,
 				stackName: stackInfo.stackName,
 				region: targetRegion,
-				recovery: {
-					profile: options.profile,
-					stateBucket,
-					statePrefix: options.statePrefix
-				}
+				recovery
 			}));
 		}
 		try {
@@ -84119,7 +84083,7 @@ async function orphanCommand(pathArgs, options) {
 			const { state, etag, migrationPending } = stateData;
 			refuseMalformedState(state, stackInfo.stackName, targetRegion);
 			refuseMalformedOutputs(state, stackInfo.stackName, targetRegion);
-			refuseMalformedResourcePropertiesForOrphan(state, orphanLogicalIds, stackInfo.stackName, targetRegion);
+			refuseMalformedResourcePropertiesForOrphan(state, orphanLogicalIds, stackInfo.stackName, recordRegion, recovery);
 			const missing = orphanLogicalIds.filter((id) => !(id in state.resources));
 			if (missing.length > 0) {
 				const have = Object.keys(state.resources ?? {}).join(", ");
@@ -84214,8 +84178,14 @@ function resolveConstructPaths(paths, stacks) {
 async function pickStackRegion(stateBackend, stackName, synthRegion, flag) {
 	const refs = (await stateBackend.listStacks()).filter((r) => r.stackName === stackName);
 	if (refs.length === 0) {
-		if (flag) return flag;
-		if (synthRegion) return synthRegion;
+		if (flag) return {
+			region: flag,
+			recordRegion: flag
+		};
+		if (synthRegion) return {
+			region: synthRegion,
+			recordRegion: synthRegion
+		};
 		throw new Error(`No state found for stack '${stackName}'. Run 'cdkd state list' to see available stacks.`);
 	}
 	if (flag) {
@@ -84223,12 +84193,24 @@ async function pickStackRegion(stateBackend, stackName, synthRegion, flag) {
 			const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
 			throw new Error(`No state found for stack '${stackName}' in region '${flag}'. Available regions: ${seen}.`);
 		}
-		return flag;
+		return {
+			region: flag,
+			recordRegion: flag
+		};
 	}
 	if (synthRegion) {
-		if (refs.find((r) => r.region === synthRegion)) return synthRegion;
+		if (refs.find((r) => r.region === synthRegion)) return {
+			region: synthRegion,
+			recordRegion: synthRegion
+		};
+	}
+	if (refs.length === 1) {
+		const recordRegion = refs[0].region;
+		return {
+			region: recordRegion ?? synthRegion ?? "",
+			recordRegion
+		};
 	}
-	if (refs.length === 1) return refs[0].region ?? synthRegion ?? "";
 	const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
 	throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
 }
@@ -88998,11 +88980,12 @@ const CONTAINER_AWS_CREDENTIALS_PATH = "/cdkd-aws/credentials";
 * file behind in `/tmp` is a security smell (temp credentials live on
 * disk).
 */
-async function writeProfileCredentialsFile(profileName, creds) {
+async function writeProfileCredentialsFile(profileName, creds, opts) {
 	if (profileName === "") throw new Error("writeProfileCredentialsFile: profile name must not be empty.");
 	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name ${displayIdent(profileName)} contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
 	const dir = await mkdtemp(path.join(tmpdir(), "cdkd-profile-creds-"));
 	const hostPath = path.join(dir, "credentials");
+	opts?.onDirCreated?.(hostPath);
 	const lines = [
 		`[${profileName}]`,
 		`aws_access_key_id = ${creds.accessKeyId}`,
@@ -89012,10 +88995,16 @@ async function writeProfileCredentialsFile(profileName, creds) {
 	try {
 		await writeFile(hostPath, lines.join("\n") + "\n", { mode: 384 });
 	} catch (err) {
+		let removed = true;
 		await rm(dir, {
 			recursive: true,
 			force: true
-		}).catch(() => {});
+		}).catch(() => {
+			removed = false;
+		});
+		if (removed) try {
+			opts?.onDirRemoved?.(hostPath);
+		} catch {}
 		throw err;
 	}
 	return {
@@ -89030,6 +89019,46 @@ async function writeProfileCredentialsFile(profileName, creds) {
 		}
 	};
 }
+/**
+* The sentence an exit path owes when it leaves this file on disk
+* (issue [#3410](https://github.com/go-to-k/cdkd/issues/3410)).
+*
+* Takes the PATH rather than the `ProfileCredentialsFile` (go-to-k/cdkd#3435
+* review): a caller on a signal path may hold the path from
+* `writeProfileCredentialsFile`'s `onDirCreated` hook while the file object
+* itself is still an unresolved promise, and the sentence is the same either
+* way. `undefined` renders nothing, so a run that passed no `--profile` is not
+* told about a path that does not exist.
+*
+* ## Why the remedy is to NAME the path rather than to remove it
+*
+* Every exit path that can reach this notice leaves the CONTAINERS running with
+* this file bind-mounted, and that is the premise `local-run-task.ts`'s detach
+* arm already records: the file cannot be disposed there precisely because the
+* containers outlive the process. A force-exit is the same situation reached a
+* different way -- "container cleanup skipped" is what it announces -- so the
+* synchronous `rmSync` that suggests itself would be removing a mount the
+* surviving containers are still reading, on the strength of a premise this
+* repo has not measured either way. What the file is instead is INVISIBLE: it
+* is mode-0600 in `$TMPDIR`, nothing reports it, and one accumulates per
+* force-quit. Naming it is what the operator can act on, and it is what the
+* detach arm already does.
+*
+* ONE BUILDER FOR ALL THREE SITES, not three sentences that agree today. They
+* say the same thing for the same reason -- the two force-exit arms
+* (`local-run-task.ts`, `local-start-api.ts`) and the detach notice -- and a
+* wording that drifts between them is how an operator learns to read one shape
+* and miss another. Each CALLER supplies its own cause clause; this supplies
+* the remedy.
+*
+* `displayIdent` for the same reason the detach arm gives: the path is cdkd's
+* own `mkdtemp` output, so sanitization is the identity on it, but the rule
+* belongs to the SURFACE rather than to the value.
+*/
+function strandedProfileCredentialsNotice(hostPath) {
+	if (hostPath === void 0) return void 0;
+	return `The AWS credentials file mounted into the containers is NOT removed: delete ${displayIdent(hostPath)} once you tear them down.`;
+}
 
 //#endregion
 //#region src/local/websocket-body.ts
@@ -89907,6 +89936,7 @@ async function localStartApiCommand(target, options) {
 	const inlineTmpDirs = /* @__PURE__ */ new Set();
 	const layerTmpDirs = /* @__PURE__ */ new Set();
 	let profileCredsFile;
+	let credsHostPath;
 	const authorizerCache = createAuthorizerCache();
 	const jwksCache = createJwksCache();
 	const jwksWarnedAt = /* @__PURE__ */ new Map();
@@ -89984,7 +90014,14 @@ async function localStartApiCommand(target, options) {
 		}
 		const stateByStack = options.fromState || isCfnFlagPresent(options) ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options) : /* @__PURE__ */ new Map();
 		const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
-		if (options.profile && profileCredentials && !profileCredsFile) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials);
+		if (options.profile && profileCredentials && !profileCredsFile) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials, {
+			onDirCreated: (hostPath) => {
+				credsHostPath = hostPath;
+			},
+			onDirRemoved: () => {
+				credsHostPath = void 0;
+			}
+		});
 		const lambdaIds = uniqueLambdaIds(routes, routesWithAuth, webSocketApis);
 		const specs = /* @__PURE__ */ new Map();
 		for (let i = 0; i < lambdaIds.length; i++) {
@@ -90270,7 +90307,7 @@ async function localStartApiCommand(target, options) {
 		if (shutdownStarted) {
 			if (!forceExitArmed) {
 				forceExitArmed = true;
-				logger.warn(`Received second ${signal}; force-exiting. Orphan containers may remain — run 'docker ps --filter name=cdkd-local-' and 'docker rm -f' to clean up.`);
+				logger.warn(forceExitShutdownWarning(signal, credsHostPath));
 				process.exit(130);
 			}
 			return;
@@ -91045,6 +91082,28 @@ async function resolveProfileCredentials(profile) {
 	}
 }
 /**
+* The line the force-exit arm of {@link localStartApiCommand}'s shutdown
+* prints (go-to-k/cdkd#3435 review).
+*
+* PURE and EXPORTED for one reason: nothing stands this long-running server
+* command up in a unit test, so the force-exit arm's only fence was a
+* source-shape rule over the file — "does it CALL the notice builder". A
+* reviewer measured that predicate: mutating the rendered line to drop
+* `stranded` while keeping the call left the entire suite green, with the
+* operator never told the mode-0600 credentials tmpdir exists. That is exactly
+* go-to-k/cdkd#3410's defect, re-openable inside its own fix. The
+* CONCATENATION is what has to be asserted, so it lives here rather than
+* inline.
+*
+* `hostPath` is the credentials tmpdir's path or `undefined`; a run that passed
+* no `--profile` gets the container sentence alone, with no trailing space and
+* no mention of a file that does not exist.
+*/
+function forceExitShutdownWarning(signal, hostPath) {
+	const stranded = strandedProfileCredentialsNotice(hostPath);
+	return `Received second ${signal}; force-exiting. Orphan containers may remain — run 'docker ps --filter name=cdkd-local-' and 'docker rm -f' to clean up.` + (stranded === void 0 ? "" : ` ${stranded}`);
+}
+/**
 * Issue an STS AssumeRole and return temporary credentials. Mirrors
 * `cdkd local invoke`'s helper byte-for-byte; lifted here so the
 * start-api command stays self-contained.
@@ -92306,6 +92365,7 @@ async function localRunTaskCommand(target, options) {
 	let detachedSuccessfully = false;
 	let stateProvider;
 	let channels;
+	let credsHostPath;
 	let cleanupPromise;
 	const cleanup = async () => {
 		if (!cleanupPromise) cleanupPromise = (async () => {
@@ -92366,7 +92426,8 @@ async function localRunTaskCommand(target, options) {
 		sigintHandler = () => {
 			sigintCount += 1;
 			if (sigintCount >= 2) {
-				process.stderr.write("Force-exit on second ^C; container cleanup skipped.\n");
+				const stranded = strandedProfileCredentialsNotice(credsHostPath);
+				process.stderr.write(`Force-exit on second ^C; container cleanup skipped.${stranded ? ` ${stranded}` : ""}\n`);
 				process.exit(130);
 			}
 			logger.info("Stopping task...");
@@ -92383,7 +92444,14 @@ async function localRunTaskCommand(target, options) {
 			resolvedRoleArn = options.assumeTaskRole;
 			assumedCredentials = await assumeTaskRole(resolvedRoleArn, options.region);
 		}
-		channels = await resolveTaskCredentialChannels(options, assumedCredentials);
+		channels = await resolveTaskCredentialChannels(options, assumedCredentials, {
+			onDirCreated: (hostPath) => {
+				credsHostPath = hostPath;
+			},
+			onDirRemoved: () => {
+				credsHostPath = void 0;
+			}
+		});
 		const envOverrides = readEnvOverridesFile$2(options.envVars);
 		const runOpts = buildRunEcsTaskOptions(options, channels, {
 			...envOverrides !== void 0 && { envOverrides },
@@ -92395,7 +92463,8 @@ async function localRunTaskCommand(target, options) {
 		if (options.detach) {
 			logger.info("Task containers started in detached mode; cdkd is exiting.");
 			logger.info(`Use 'docker ps -a --filter network=${result.state.network?.networkName ?? "<network>"}' to inspect; tear down with 'docker rm -f' and 'docker network rm'.`);
-			if (channels.profileCredsFile) logger.info(`The AWS credentials file mounted into the containers is NOT removed in detached mode: delete ${displayIdent(channels.profileCredsFile.hostPath)} once you tear them down.`);
+			const detachedNotice = strandedProfileCredentialsNotice(channels.profileCredsFile?.hostPath);
+			if (detachedNotice) logger.info(`Detached mode leaves the mounted credentials file behind. ${detachedNotice}`);
 			detachedSuccessfully = true;
 			sigintCount = 99;
 			return;
@@ -92677,11 +92746,11 @@ async function resolveSidecarCredentials(options, assumedCredentials) {
 * never the `--role-arn` role — and never an `--assume-task-role` STS result,
 * which wins earlier and is served by the metadata sidecar instead.
 */
-async function resolveTaskCredentialChannels(options, assumedCredentials) {
+async function resolveTaskCredentialChannels(options, assumedCredentials, opts) {
 	const sidecarCredentials = await resolveSidecarCredentials(options, assumedCredentials);
 	if (options.profile && sidecarCredentials && !assumedCredentials) return {
 		sidecarCredentials,
-		profileCredsFile: await writeProfileCredentialsFile(options.profile, sidecarCredentials)
+		profileCredsFile: await writeProfileCredentialsFile(options.profile, sidecarCredentials, opts)
 	};
 	return {
 		sidecarCredentials,
@@ -95546,4 +95615,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CnSaRdY9.js.map
+//# sourceMappingURL=program-DdmCUgOP.js.map