@go-to-k/cdkd 0.290.38 → 0.290.40

package/dist/{program-Br4uc31m.js → program-BmtaBtO_.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as NestedStackChildDirectDestroyError, $n as identityKeyFor, $r as getDockerCmd, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as PARTITION_TABLE, An as refuseMalformedNestedChildOutputs, Ar as stringifyValue, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as setAwsClients, Bn as findSilentDropProperties, Br as getBootstrapMarkerKey, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as CFN_TEMPLATE_URL_LIMIT, Cn as malformedOutputsWarning, Cr as importableOutputKeys, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dn as malformedStateRefusalMessage, Dr as orphansCarriedFrom, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as uploadCfnTemplate, En as malformedResourcesWarning, Er as orphansAfterRollback, Et as deleteSkipReason, F as extractDeploymentEventError, Fn as refuseMalformedState, Fr as rewriteTemplateAssetReferences, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gn as STATE_SOURCED_BASELINE_RULES, Gr as validateContainerRepoName, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as CdkdError, Hn as withRetry, Hr as parseBootstrapMarker, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as resolveBucketRegion, In as repairMalformedOutputsForReadOnly, Ir as AssetModeResolver, It as isNamelessDynamicReferenceError, J as bold, Ji as IntrinsicResolutionRefusalError, Jn as TEMPLATE_SOURCED_RULES, Jr as describeDockerCapturedOutput, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as DeployCancelledError, Kn as STATE_SOURCED_CROSS_GENERATION_RULES, Kr as buildDenyExternalAccessPolicy, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as AwsClients, Ln as repairMalformedResourcePropertiesForReadOnly, Lr as BOOTSTRAP_MARKER_PREFIX, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as derivePartitionAndUrlSuffix, Mn as refuseMalformedOutputsForDestroy, Mr as buildAssetRedirectMap, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Ni as AssemblyReader, Nn as refuseMalformedResourcePropertiesForOrphan, Nr as createAssetRedirectResolver, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oi as decodeListingKey, On as producerRecordKey, Or as shouldRetainResource, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as processStackMessages, Pn as refuseMalformedResourcesForDestroy, Pr as loadPublishableAssetManifest, Pt as getAccountInfo, Q as red, Qi as MalformedProducerRecordRefusalError, Qn as errorCauseChain, Qr as formatDockerLoginError, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as getAwsClients, Rn as repairMalformedResourcesForReadOnly, Rr as assertAssetBucketRegion, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as CFN_TEMPLATE_BODY_LIMIT, Sn as malformedOutputsRefusalMessage, Sr as hasUnverifiableParameterRefusal, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as findLargeInlineResources, Tn as malformedResourcePropertiesWarning, Tr as isReadableBag, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Un as DagBuilder, Ur as readBootstrapMarkerBody, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vn as describeTypeWithThrottleRetry, Vr as isCrossRegionRedirect, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as CrossAccountSecretRefusalError, Wn as TemplateParser, Wr as validateAssetBucketName, Wt as assertRegionMatch, X as gray, Xi as LocalStartServiceError, Xn as createSecretMasker, Xr as describeDockerFailure, Xt as readConfigString, Y as cyan, Yi as LocalInvokeBuildError$1, Yn as carriesSecretMask, Yr as describeDockerExecFailure, Yt as configStringRefusal, Z as green, Zn as dynamicReferenceTokens, Zr as dockerSpawnEnvWithSensitive, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as markRedactedCause, _i as resolveStateBucketWithDefaultAndSource, _n as hasReadableOutputs, _r as CUSTOM_RESOURCE_RESPONSE_PREFIX, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as StackTerminationProtectionError, ai as stripControlChars, an as s3BucketDomainName, ar as recoverMaskedOutput, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as safeStringify, bi as warnDeprecatedNoPrefixCliFlag, bn as malformedExportSourceWarning, br as hasReadableExportSet, bt as startInterruptWatch, c as replayFailedOperations, ci as Synthesizer, cn as s3BucketWebsiteUrl, cr as LockManager, ct as IAMRoleProvider, d as updatePartialMessage, da as withErrorHandling, di as getLegacyStateBucketName, dn as applyCallerIdentityCredentials, dr as UNREPRODUCIBLE_LOCK_CLAUSE, dt as ProviderRegistry, ea as PartialFailureError, ei as partitionSensitiveEnv, en as requireConfigString, er as isSingleDynamicReferenceToken, et as collectDeclaredOutputNames, f as updatePartialReason, fa as isMarkedNonRetryable, fi as resolveApp, fn as callerEnvCredentials, fr as buildForceUnlockCommand, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as markNonRetryable, gi as resolveStateBucketWithDefault, gn as STATE_RESOURCES_MALFORMED, gr as shellQuote, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as isTransientServerError, hi as resolveSkipPrefix, hn as INTRINSIC_KEYS, hr as formatLockExpiry, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as StackHasActiveImportsError, ii as escapeRegExp, in as s3BucketArn, ir as recordMaskOnlyValue, it as secretBearing, j as isFinalSnapshotError, ji as canonicalizeRegion, jn as refuseMalformedOutputs, jr as WorkGraph, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ki as expectedOwnerParam, kn as refuseDivergentRecordRegionForDestroy, kr as AssetPublisher, kt as IntrinsicFunctionResolver, l as replayRollback, li as synthesisStatusMessage, ln as applyRoleArnIfSet, lr as S3StateBackend, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as isThrottlingError, mi as resolveCaptureObservedState, mn as DiffCalculator, mr as forceQuitRecoveryClause, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as ResourceTimeoutError, ni as runDockerForeground, nn as producerRegionsFromState, nr as maskSecretsInError, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oi as AssetManifestLoader, on as s3BucketDualStackDomainName, or as redactSecretsForState, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as isRetryableTransientError, pi as resolveAutoAssetStorage, pn as envCredentialsAreAssumedRole, pr as buildLockContentionMessage, pt as createMaskedRetryLogger, q as formatResourceLine, qi as DynamicReferenceRegionAmbiguousError, qn as STATE_SOURCED_READBACK_RULES, qr as buildDockerImage, qt as configBooleanRefusal, r as DeployEngine, ra as ResourceUpdateNotSupportedError, ri as runDockerStreaming, rn as withSharedDrainBudget, rr as maskSecretsInText, rt as isExportAliasCollision, s as planRollback, sa as SynthesisError, si as getDockerImageBySourceHash, sn as s3BucketRegionalDomainName, sr as scrubResourceRecord, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as ProvisioningError, ti as redactDockerArgvValues, tn as classifyReplaySecretRegion, tr as markSameGenerationBag, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as normalizeAwsError, ui as getDefaultStateBucketName, un as AWS_CREDENTIAL_ENV_KEYS, ur as rebuildClientForBucketRegion, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as retryClassificationText, vi as resolveUseCdkBootstrapAssets, vn as hasReadableResources, vr as DEFAULT_STATE_PREFIX, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as MIGRATE_TMP_PREFIX, wn as malformedRenderedContainersWarning, wr as importableOutputs, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as ssmResolvedValueType, xn as malformedLocalOutputsWarning, xr as hasReasonlessBaselineRefusal, xt as CloudControlProvider, y as keptWholeReasonText, ya as describeAwsFailure, yi as stateBucketExistenceConfirmed, yn as malformedExportNamesWarning, yr as exportNamesCarriedFrom, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as resetAwsClients, zn as findActionableSilentDrops, zr as ensureAssetStorage, zt as refStateLookupFromResource } from "./deploy-engine-BdYBI1uT.js";
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BX4pJk0T.js";
+import { $ as yellow, $i as CrossAccountSecretRefusalError, $n as TemplateParser, $r as validateAssetBucketName, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as ssmResolvedValueType, An as malformedResourcePropertiesWarning, Ar as hasReasonlessBaselineRefusal, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as canonicalizeRegion, Bn as refuseMalformedResourcesForDestroy, Br as WorkGraph, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as isThrottlingError, Ci as resolveCaptureObservedState, Cn as malformedExportSourceWarning, Cr as forceQuitRecoveryClause, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as retryClassificationText, Di as resolveUseCdkBootstrapAssets, Dn as malformedOutputsWarning, Dr as DEFAULT_STATE_PREFIX, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as markRedactedCause, Ei as resolveStateBucketWithDefaultAndSource, En as malformedOutputsRefusalMessage, Er as CUSTOM_RESOURCE_RESPONSE_PREFIX, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as uploadCfnTemplate, Fn as refuseMalformedNestedChildOutputs, Fr as orphansAfterRollback, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as resolveBucketRegion, Gn as repairMalformedResourcesForReadOnly, Gr as AssetModeResolver, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as AssemblyReader, Hn as repairMalformedOutputsForReadOnly, Hr as createAssetRedirectResolver, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, In as refuseMalformedOutputs, Ir as orphansCarriedFrom, It as isNamelessDynamicReferenceError, J as bold, Ji as resetAwsClients, Jn as findActionableSilentDrops, Jr as ensureAssetStorage, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as AwsClients, Kn as safeRegion, Kr as BOOTSTRAP_MARKER_PREFIX, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as decodeListingKey, Ln as refuseMalformedOutputsForDestroy, Lr as shouldRetainResource, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as CFN_TEMPLATE_URL_LIMIT, Mn as malformedStateRefusalMessage, Mr as importableOutputKeys, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Ni as MIGRATE_TMP_PREFIX, Nn as producerRecordKey, Nr as importableOutputs, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as describeAwsFailure, Oi as stateBucketExistenceConfirmed, On as malformedRenderedContainersWarning, Or as exportNamesCarriedFrom, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as findLargeInlineResources, Pn as refuseDivergentRecordRegionForDestroy, Pr as isReadableBag, Pt as getAccountInfo, Q as red, Qn as DagBuilder, Qr as readBootstrapMarkerBody, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as expectedOwnerParam, Rn as refuseMalformedResourceEntries, Rr as AssetPublisher, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as isRetryableTransientError, Si as resolveAutoAssetStorage, Sn as malformedExportNamesWarning, Sr as buildLockContentionMessage, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as markNonRetryable, Ti as resolveStateBucketWithDefault, Tn as malformedOrphanRecordsWarning, Tr as shellQuote, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as processStackMessages, Un as repairMalformedResourceEntriesForReadOnly, Ur as loadPublishableAssetManifest, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as derivePartitionAndUrlSuffix, Vn as refuseMalformedState, Vr as buildAssetRedirectMap, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wn as repairMalformedResourcePropertiesForReadOnly, Wr as rewriteTemplateAssetReferences, Wt as assertRegionMatch, X as gray, Xn as describeTypeWithThrottleRetry, Xr as isCrossRegionRedirect, Xt as readConfigString, Y as cyan, Yi as setAwsClients, Yn as findSilentDropProperties, Yr as getBootstrapMarkerKey, Yt as configStringRefusal, Z as green, Zi as CdkdError, Zn as withRetry, Zr as parseBootstrapMarker, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as Synthesizer, _n as UNREADABLE_RESOURCES_MAP_ROW, _r as LockManager, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as LocalStartServiceError, ai as describeDockerFailure, an as s3BucketDomainName, ar as createSecretMasker, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as withErrorHandling, bi as getLegacyStateBucketName, bn as hasReadableResources, br as UNREPRODUCIBLE_LOCK_CLAUSE, bt as startInterruptWatch, c as replayFailedOperations, ca as NestedStackChildDirectDestroyError, ci as getDockerCmd, cn as s3BucketWebsiteUrl, cr as identityKeyFor, ct as IAMRoleProvider, d as updatePartialMessage, da as ResourceTimeoutError, di as runDockerForeground, dn as applyCallerIdentityCredentials, dr as maskSecretsInError, dt as ProviderRegistry, ei as validateContainerRepoName, en as requireConfigString, er as STATE_SOURCED_BASELINE_RULES, et as collectDeclaredOutputNames, f as updatePartialReason, fa as ResourceUpdateNotSupportedError, fi as runDockerStreaming, fn as callerEnvCredentials, fr as maskSecretsInText, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as SynthesisError, gi as getDockerImageBySourceHash, gn as STATE_RESOURCES_MALFORMED, gr as scrubResourceRecord, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as AssetManifestLoader, hn as INTRINSIC_KEYS, hr as redactSecretsForState, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as LocalInvokeBuildError$1, ii as describeDockerExecFailure, in as s3BucketArn, ir as carriesSecretMask, it as secretBearing, j as isFinalSnapshotError, ji as CFN_TEMPLATE_BODY_LIMIT, jn as malformedResourcesWarning, jr as hasUnverifiableParameterRefusal, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as safeStringify, ki as warnDeprecatedNoPrefixCliFlag, kn as malformedResourceEntriesWarning, kr as hasReadableExportSet, kt as IntrinsicFunctionResolver, l as replayRollback, la as PartialFailureError, li as partitionSensitiveEnv, ln as applyRoleArnIfSet, lr as isSingleDynamicReferenceToken, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as StackTerminationProtectionError, mi as stripControlChars, mn as DiffCalculator, mr as recoverMaskedOutput, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as DynamicReferenceRegionAmbiguousError, ni as buildDockerImage, nn as producerRegionsFromState, nr as STATE_SOURCED_READBACK_RULES, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oi as dockerSpawnEnvWithSensitive, on as s3BucketDualStackDomainName, or as dynamicReferenceTokens, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as StackHasActiveImportsError, pi as escapeRegExp, pn as envCredentialsAreAssumedRole, pr as recordMaskOnlyValue, pt as createMaskedRetryLogger, q as formatResourceLine, qi as getAwsClients, qn as safeStackName, qr as assertAssetBucketRegion, qt as configBooleanRefusal, r as DeployEngine, ra as IntrinsicResolutionRefusalError, ri as describeDockerCapturedOutput, rn as withSharedDrainBudget, rr as TEMPLATE_SOURCED_RULES, rt as isExportAliasCollision, s as planRollback, sa as MalformedProducerRecordRefusalError, si as formatDockerLoginError, sn as s3BucketRegionalDomainName, sr as errorCauseChain, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as DeployCancelledError, ti as buildDenyExternalAccessPolicy, tn as classifyReplaySecretRegion, tr as STATE_SOURCED_CROSS_GENERATION_RULES, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as ProvisioningError, ui as redactDockerArgvValues, un as AWS_CREDENTIAL_ENV_KEYS, ur as markSameGenerationBag, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, vi as synthesisStatusMessage, vn as displayLogicalId, vr as S3StateBackend, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as isTransientServerError, wi as resolveSkipPrefix, wn as malformedLocalOutputsWarning, wr as formatLockExpiry, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as isMarkedNonRetryable, xi as resolveApp, xn as isReadableResourceEntry, xr as buildForceUnlockCommand, xt as CloudControlProvider, y as keptWholeReasonText, ya as normalizeAwsError, yi as getDefaultStateBucketName, yn as hasReadableOutputs, yr as rebuildClientForBucketRegion, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as PARTITION_TABLE, zn as refuseMalformedResourcePropertiesForOrphan, zr as stringifyValue, zt as refStateLookupFromResource } from "./deploy-engine-DJxLBuTb.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BkcLg0jL.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BeHfM5ow.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B70ujDSS.js";
+import { t as getCdkdVersion } from "./version-CEKVu0mE.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DPTeR_IT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -67807,6 +67807,8 @@ function conditionsDependOnTokenParameters(template, tokenParameterNames) {
 	}
 	return false;
 }
+/** How many unreadable row names the human preview lists before summarizing. */
+const UNREADABLE_PREVIEW_NAMES = 10;
 /** Empty template used to diff a removed nested child's state → all DELETE. */
 const EMPTY_TEMPLATE = { Resources: {} };
 /**
@@ -67869,20 +67871,35 @@ function indexNestedChildTemplates(template, templatePath) {
 async function loadStateOrEmpty(stackName, region, stateBackend) {
 	const result = await stateBackend.getState(stackName, region);
 	if (result) {
-		if (repairMalformedResourcesForReadOnly(result.state)) logger.warn(malformedResourcesWarning(stackName, region));
+		const unreadable = [];
+		if (repairMalformedResourcesForReadOnly(result.state)) {
+			logger.warn(malformedResourcesWarning(stackName, region));
+			unreadable.push(UNREADABLE_RESOURCES_MAP_ROW);
+		}
+		const dropped = repairMalformedResourceEntriesForReadOnly(result.state);
+		if (dropped.length > 0) {
+			logger.warn(malformedResourceEntriesWarning(stackName, region, dropped));
+			unreadable.push(...dropped);
+		}
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
 		if (unreadableProps.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
 		if (repairMalformedOutputsForReadOnly(result.state)) logger.warn(malformedOutputsWarning(stackName, region));
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
-		return result.state;
+		return {
+			state: result.state,
+			unreadable
+		};
 	}
 	return {
-		stackName,
-		region,
-		resources: {},
-		outputs: {},
-		version: 10,
-		lastModified: Date.now()
+		state: {
+			stackName,
+			region,
+			resources: {},
+			outputs: {},
+			version: 10,
+			lastModified: Date.now()
+		},
+		unreadable: []
 	};
 }
 /**
@@ -68032,8 +68049,19 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	let adoptedRecords = {};
 	let blocking = [];
 	let stateForDiff = currentState;
+	const unreadableOrphans = [];
 	if (currentState.orphans?.length && options.previewOrphanAdoption) {
-		const plan = await options.previewOrphanAdoption(currentState, effectiveTemplate, stackName, region);
+		const readableOrphans = currentState.orphans.filter((record) => {
+			if (isReadableResourceEntry(record?.state)) return true;
+			const id = record?.logicalId;
+			unreadableOrphans.push(typeof id === "string" ? id : "");
+			return false;
+		});
+		if (unreadableOrphans.length > 0) logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans));
+		const plan = await options.previewOrphanAdoption({
+			...currentState,
+			orphans: readableOrphans
+		}, effectiveTemplate, stackName, region);
 		adoptedOrphans = Object.keys(plan.adopted);
 		adoptedRecords = plan.adopted;
 		blocking = plan.refusals;
@@ -68088,7 +68116,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		outputChanges,
 		adoptedOrphans,
 		adoptedRecords,
-		blocking
+		blocking,
+		unreadableOrphans
 	};
 }
 /**
@@ -68167,9 +68196,9 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 */
 async function buildDiffTree(args) {
 	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, ancestorTemplatePaths } = args;
-	const state = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { state, unreadable } = await loadStateOrEmpty(stackName, region, stateBackend);
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
-	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
+	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
 		...parameters && { parameters },
 		...canonicalizeProperties && { canonicalizeProperties },
 		...cfnFallback !== void 0 && { cfnFallback },
@@ -68192,6 +68221,7 @@ async function buildDiffTree(args) {
 		outputChanges,
 		adoptedOrphans,
 		blocking,
+		unreadable: [...unreadable, ...unreadableOrphans],
 		children: []
 	};
 	if (!recursive) return node;
@@ -68241,7 +68271,7 @@ async function buildDiffTree(args) {
 * (also all DELETE).
 */
 async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference) {
-	const state = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { state, unreadable } = await loadStateOrEmpty(stackName, region, stateBackend);
 	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator, { inheritSecretBearingTemplate: parentHasSecretReference });
 	const node = {
 		stackName,
@@ -68251,6 +68281,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 		ccApiRoutes: /* @__PURE__ */ new Map(),
 		adoptedOrphans: [],
 		blocking: [],
+		unreadable,
 		outputChanges,
 		children: []
 	};
@@ -68317,7 +68348,7 @@ function collectCcApiRoutes(template, state) {
 /** True when this node has at least one real (non-`NO_CHANGE`) change. */
 function nodeHasChanges(node) {
 	for (const change of node.changes.values()) if (change.changeType !== "NO_CHANGE") return true;
-	return node.outputChanges.length > 0 || node.adoptedOrphans.length > 0;
+	return node.outputChanges.length > 0 || node.adoptedOrphans.length > 0 || node.unreadable.length > 0;
 }
 /** True when this node OR any descendant has a real change (tree-wide drift detector for `--fail`). */
 /**
@@ -68390,6 +68421,7 @@ function diffTreeToJson(node) {
 		})),
 		adoptedOrphans: node.adoptedOrphans,
 		blocking: node.blocking,
+		unreadable: node.unreadable,
 		children: node.children.map(diffTreeToJson)
 	};
 }
@@ -68627,6 +68659,12 @@ function renderDiffTree(node, isRoot, logFn) {
 		logFn(`\n${create} to create, ${update} to update, ${del} to delete`);
 		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
 		if (node.adoptedOrphans.length > 0) logFn(`${node.adoptedOrphans.length} resource(s) to adopt from a previous rollback: ${node.adoptedOrphans.map(stripControlChars).join(", ")}`);
+		if (node.unreadable.length > 0) {
+			const named = node.unreadable.slice(0, UNREADABLE_PREVIEW_NAMES).map((id) => id === "(resources map)" ? id : displayLogicalId(id));
+			const rest = node.unreadable.length - named.length;
+			const onlyTheMap = node.unreadable.length === 1 && node.unreadable[0] === "(resources map)";
+			logFn(`${node.unreadable.length} state record row(s) could not be read: ${named.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}.` + (onlyTheMap ? "" : " One the template still declares is shown above as a create; one it no longer declares is not shown above."));
+		}
 	}
 	if (node.blocking.length > 0) {
 		logFn("\n  Blocking (cdkd deploy will refuse):");
@@ -73056,6 +73094,10 @@ const UNCOMPARED_REASONS = {
 		kind: "unknown",
 		phrase: "not compared AT ALL: the read or comparison failed"
 	},
+	unreadableRecord: {
+		kind: "unknown",
+		phrase: "not compared AT ALL: their state record is not readable as a resource"
+	},
 	baselineRefused: {
 		kind: "unknown",
 		phrase: "not compared AT ALL: a `cdkd import` run refused to capture their observed baseline"
@@ -73078,9 +73120,36 @@ const UNCOMPARED_REASONS = {
 	}
 };
 /**
+* Was ANY of the resource's properties compared?
+*
+* A THIRD exhaustive record beside {@link notComparedReason}'s and
+* {@link UNCOMPARED_REASONS}, and it exists because this question was answered
+* THREE times by a hand-written `readFailed` / `baselineRefused` cause list —
+* the summary parenthetical and the block heading, and `--json`'s
+* `referencesUnresolved`. Hand lists of one growing union are how a new cause
+* comes to be described as something it is not, which is exactly what those
+* sites' own comments say happened when `baselineRefused` was added.
+* go-to-k/cdkd#3018 added a further cause and every list was silently wrong
+* again, reporting an unreadable record as "only PARTIALLY compared" and as
+* `referencesUnresolved: true` — understating it in the reassuring direction,
+* the one failure mode the comments name. All three readers take this record.
+*
+* `false` means none of it was compared. It is a SEPARATE axis from
+* {@link UncomparedKind}, which asks whether cdkd is uncertain or simply does
+* not cover the type; a `skipped` resource is `byDesign` and also had nothing
+* compared, and collapsing the two would make one of the answers wrong.
+*/
+const ANY_OF_IT_COMPARED = {
+	refused: true,
+	unresolvedToken: true,
+	readFailed: false,
+	baselineRefused: false,
+	unreadableRecord: false
+};
+/**
 * The sentence lead each {@link UncomparedKind} group is reported under.
 *
-* Exhaustive for the same reason the record above is, and SEPARATE from it
+* Exhaustive for the same reason `UNCOMPARED_REASONS` is, and SEPARATE from it
 * because the lead is per GROUP while the phrase is per reason: writing the
 * claim into each phrase would put five copies of two sentences in the file,
 * and five copies is how two of them come to disagree.
@@ -73254,7 +73323,7 @@ async function driftCommand(stacks, options) {
 		const reports = [];
 		for (const ref of targetRefs) {
 			if (!ref.region) throw new Error(`Stack '${ref.stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${ref.stackName}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run drift detection.`);
-			const report = await runDriftForStack(ref.stackName, ref.region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId);
+			const report = await runDriftForStack(ref.stackName, ref.region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair");
 			reports.push(report);
 		}
 		if (options.json) writeJsonReport(reports);
@@ -73606,6 +73675,7 @@ function notComparedReason(cause) {
 		refused: "cdkd refused to resolve a dynamic reference its state records (spell the reference as a full ARN, which names its region)",
 		unresolvedToken: "its state records a `{{resolve:...}}` spelling cdkd resolves for nobody (permanent; a re-run cannot clear it)",
 		readFailed: "the read or comparison threw, so NONE of its properties were compared",
+		unreadableRecord: "its state record is not readable as a resource — not an object, or carrying no resource type — so there was nothing to compare (repair or re-import the record)",
 		baselineRefused: "a `cdkd import` run refused to capture its observed baseline, so the only baseline available is the recorded properties that refusal already found untrustworthy (deploy a change to this resource to restore one)"
 	}[cause];
 }
@@ -73959,13 +74029,37 @@ function redactDriftChanges(changes, secrets, secretPaths, maskPaths) {
 * `--revert` can pass the captured AWS-current snapshot to
 * `provider.update` as the `previousProperties` argument.
 */
-async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId) {
+async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode) {
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
 	return await withStackName(stackName, async () => {
 		const outcomes = [];
 		const state = result.state;
 		const logger = getLogger();
+		if (malformedRecordMode === "refuse") {
+			refuseMalformedState(state, stackName, region);
+			refuseMalformedResourceEntries(state, stackName, region);
+		} else {
+			if (repairMalformedResourcesForReadOnly(state)) {
+				logger.warn(malformedResourcesWarning(stackName, region));
+				outcomes.push({
+					kind: "notCompared",
+					logicalId: UNREADABLE_RESOURCES_MAP_ROW,
+					resourceType: "unreadable record",
+					notComparedCause: "unreadableRecord"
+				});
+			}
+			const dropped = repairMalformedResourceEntriesForReadOnly(state);
+			if (dropped.length > 0) {
+				logger.warn(malformedResourceEntriesWarning(stackName, region, dropped));
+				for (const logicalId of dropped) outcomes.push({
+					kind: "notCompared",
+					logicalId,
+					resourceType: "unreadable record",
+					notComparedCause: "unreadableRecord"
+				});
+			}
+		}
 		const secretResolvers = new DriftSecretResolvers(region);
 		const producerRegions = producerRegionsFromState(state);
 		const entries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
@@ -74198,6 +74292,7 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 	const siblings = {};
 	for (const [lid, res] of Object.entries(state.resources ?? {})) {
 		if (lid === excludedLogicalId) continue;
+		if (!isReadableResourceEntry(res)) continue;
 		siblings[lid] = {
 			resourceType: res.resourceType,
 			physicalId: res.physicalId,
@@ -75819,7 +75914,7 @@ function writeJsonReport(reports) {
 		const notCompared = notComparedOutcomes(r).map(({ outcome, cause }) => ({
 			logicalId: outcome.logicalId,
 			type: outcome.resourceType,
-			referencesUnresolved: cause !== "readFailed" && cause !== "baselineRefused",
+			referencesUnresolved: ANY_OF_IT_COMPARED[cause],
 			cause
 		}));
 		return {
@@ -75864,7 +75959,7 @@ function writeHumanReport(reports) {
 		const checked = inspected - notCompared.length;
 		if (drifted.length === 0) {
 			if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
-			else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => n.cause === "readFailed" || n.cause === "baselineRefused") ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
+			else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => !ANY_OF_IT_COMPARED[n.cause]) ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
 			else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
 		} else {
 			const word = drifted.length === 1 ? "resource" : "resources";
@@ -75879,11 +75974,9 @@ function writeHumanReport(reports) {
 			}
 		}
 		if (notCompared.length > 0) {
-			const notComparedAtAll = notCompared.filter((n) => n.cause === "readFailed" || n.cause === "baselineRefused").length;
-			const readFailedCount = notCompared.filter((n) => n.cause === "readFailed").length;
-			const baselineRefusedCount = notCompared.filter((n) => n.cause === "baselineRefused").length;
+			const notComparedAtAll = notCompared.filter((n) => !ANY_OF_IT_COMPARED[n.cause]).length;
 			const referenceCaused = notCompared.length - notComparedAtAll;
-			const atAllCause = [...readFailedCount > 0 ? ["the read or comparison failed"] : [], ...baselineRefusedCount > 0 ? ["an import refused their observed baseline"] : []].join("; ");
+			const atAllCause = Object.keys(UNCOMPARED_REASONS).filter((cause) => cause in ANY_OF_IT_COMPARED).filter((cause) => !ANY_OF_IT_COMPARED[cause] && notCompared.some((n) => n.cause === cause)).map((cause) => UNCOMPARED_REASONS[cause].phrase.replace(/^not compared AT ALL: /, "")).join("; ");
 			process.stdout.write(notComparedAtAll === 0 ? `\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n` : `\n  ${notCompared.length} resource(s) NOT fully compared — ${notComparedAtAll} not compared AT ALL (${atAllCause})` + (referenceCaused > 0 ? `, ${referenceCaused} only PARTIALLY compared (a dynamic reference cdkd could not, or refused to, resolve)` : "") + `:\n`);
 			for (const { outcome, cause } of notCompared) process.stdout.write(`    ! ${outcome.logicalId} (${outcome.resourceType}) — ${notComparedReason(cause)}\n`);
 		}
@@ -78073,7 +78166,10 @@ async function exportCommand(stackArg, options) {
 		try {
 			if (nestedStackRows.length > 0) {
 				const nestedStackTree = await buildCdkdStateStackTree(resolvedStackName, targetRegion, stateBackend, state);
-				reportDriftBaselineGaps(state, logger);
+				reportDriftBaselineGaps(state, logger, {
+					stackName: resolvedStackName,
+					region: migrationPending ? void 0 : targetRegion
+				});
 				if (allSynthStacks.length > 0) {
 					const crossRefs = scanCrossStackReferences(allSynthStacks, resolvedStackName);
 					if (crossRefs.length > 0) {
@@ -78161,7 +78257,10 @@ async function exportCommand(stackArg, options) {
 					return;
 				}
 			}
-			reportDriftBaselineGaps(state, logger);
+			reportDriftBaselineGaps(state, logger, {
+				stackName: resolvedStackName,
+				region: migrationPending ? void 0 : targetRegion
+			});
 			if (allSynthStacks.length > 0) {
 				const crossRefs = scanCrossStackReferences(allSynthStacks, resolvedStackName);
 				if (crossRefs.length > 0) {
@@ -79360,17 +79459,49 @@ function classifyOverlayCurrentValue(current) {
 	return "literal";
 }
 /**
+* How much of an overlay value's JSON this function is willing to quote back.
+*
+* CODE POINTS, not UTF-16 code units — see {@link boundedOverlayPreview}. The
+* number is the pre-go-to-k/cdkd#3018 one, kept so no in-range message moves.
+*/
+const OVERLAY_PREVIEW_MAX_CODE_POINTS = 120;
+/**
+* `JSON.stringify(value)`, cut to {@link OVERLAY_PREVIEW_MAX_CODE_POINTS} code
+* points through the shared helper rather than by `slice` (go-to-k/cdkd#3018).
+*
+* `String.prototype.slice` counts UTF-16 code units, so a cut landing between
+* the halves of an astral character leaves a LONE HIGH SURROGATE at the end of
+* the preview — `JSON.stringify` emits an astral character as the raw pair
+* rather than as two `\u` escapes, so the pair really is what gets cut.
+* `truncateCodePoints` in `src/utils/display-safe.ts` owns that rule, and this
+* is the site go-to-k/cdkd#3018 was opened over. Other `slice`-based display
+* truncations remain elsewhere (`src/local/websocket-server.ts`,
+* `src/local/rest-v1-integrations.ts` among them); closing this one is not a
+* claim about them.
+*
+* Deliberately NOT applied to the SCALAR branch below, which is the arm that
+* cannot exceed the cap: tracing the two call sites, it is reachable only with
+* a NUMBER or a BOOLEAN. A string `current` never reaches the rewrite warning
+* (`typeof current !== 'string'` gates it) and never reaches the refusal (only
+* a list classifies `unrepresentable`), and a number arriving from a parsed
+* template is a double, so its JSON is a couple of dozen characters. Capping it
+* anyway would be behaviour no test can distinguish from not capping it, which
+* is worse than the asymmetry: it reads as a guard while pinning nothing.
+*/
+function boundedOverlayPreview(value) {
+	const { text, truncated } = truncateCodePoints(displaySafe(JSON.stringify(value)), OVERLAY_PREVIEW_MAX_CODE_POINTS);
+	return truncated ? `${text}…` : text;
+}
+/**
 * Human-readable shape of an overlay value, for the refusal error and the
 * rewrite warning. Bounded: the value is user-supplied and lands in an error
-* message that a failed export persists, so a large list is summarized rather
+* message that a failed export persists, so a large value is summarized rather
 * than serialized whole.
 */
 function describeOverlayValueShape(current) {
 	if (Array.isArray(current)) {
 		if (current.length === 0) return "an empty list";
-		const preview = JSON.stringify(current);
-		const shown = preview.length > 120 ? `${preview.slice(0, 120)}…` : preview;
-		return `a ${current.length}-element list (${shown})`;
+		return `a ${current.length}-element list (${boundedOverlayPreview(current)})`;
 	}
 	if (current === null) return "an explicit null";
 	return `a ${typeof current} (${JSON.stringify(current)})`;
@@ -79415,10 +79546,18 @@ function applyImportOverlayForPhase2(template, phase1Imports) {
 	return result;
 }
 /**
-* Returns true if every `Ref` / `Fn::GetAtt` inside `node` points at a
-* logical ID in `allow`. Used to keep Outputs entries that only reference
-* imported resources and drop the ones that referenced excluded ones.
+* How many logical ids each of this advice's three lists names before it stops
+* and counts the rest.
+*
+* ONE constant for all three because they are one decision — how long a warning
+* block may get before it stops being read — and three hand-spelled `10`s are
+* how two of them end up disagreeing after a later edit. Its siblings are
+* `UNREADABLE_PREVIEW_NAMES` in `diff-recursive.ts` (the `cdkd diff` preview)
+* and `NAMED_UNREADABLE_ENTRIES` in the shared module (the refusal texts);
+* deliberately not shared with either, since a list inside one warning line and
+* a block of indented rows do not have the same budget.
 */
+const NAMED_BASELINE_IDS = 10;
 /**
 * Pre-flight check for missing drift baselines (`observedProperties`)
 * in the exporting stack's state. cdkd state schema v3 captures
@@ -79437,26 +79576,46 @@ function applyImportOverlayForPhase2(template, phase1Imports) {
 *
 * Exported for unit testing.
 */
-function reportDriftBaselineGaps(state, logger) {
-	const entries = Object.entries(state.resources ?? {});
+function reportDriftBaselineGaps(state, logger, loaded) {
+	const stackName = loaded?.stackName ?? state.stackName;
+	const rawRegion = loaded ? loaded.region : state.region;
+	const region = typeof rawRegion === "string" && rawRegion !== "" ? rawRegion : void 0;
+	if (!hasReadableResources(state)) {
+		logger.warn(malformedResourcesWarning(stackName, region));
+		return;
+	}
+	const entries = Object.entries(state.resources);
 	if (entries.length === 0) return;
-	const missing = entries.filter(([, r]) => r.observedProperties === void 0);
+	const stackRef = shellQuote(safeStackName(stackName)) + (region !== void 0 ? ` --stack-region ${shellQuote(safeRegion(region))}` : "");
+	const rendersExactly = region !== void 0 && safeStackName(stackName) === stackName && safeRegion(region) === region;
+	const readsAsAnOption = /^-/.test(stackName);
+	const refreshCommand = rendersExactly && !readsAsAnOption ? `cdkd state refresh-observed ${stackRef}` : void 0;
+	const refreshWithheld = region === void 0 ? "'cdkd state refresh-observed' for this stack once it is migrated: this record has no region, the legacy layout that command refuses, so migrate it first with any cdkd write, such as a deploy." : rendersExactly ? "'cdkd state refresh-observed' for this stack. The command is not printed: this stack's name starts with '-', which the CLI reads as an option however it is quoted, and '--all' would rewrite every record in the region rather than this one." : "'cdkd state refresh-observed' for this stack. The command is not printed: the stack name or region cdkd loaded cannot be rendered exactly, and a near-match could rewrite a different stack's baseline.";
+	const readable = entries.filter((entry) => isReadableResourceEntry(entry[1]));
+	const unreadableCount = entries.length - readable.length;
+	if (unreadableCount > 0) {
+		const unreadable = entries.filter(([, r]) => !isReadableResourceEntry(r)).map(([logicalId]) => logicalId);
+		logger.warn(`${unreadable.length} of ${entries.length} resource(s) in cdkd state have a record that is not readable as a resource — not an object, or carrying no resource type — so their drift baseline cannot be reported on. The state record is malformed or truncated. Inspect it with: cdkd state show ${stackRef} --json`);
+		for (const logicalId of unreadable.slice(0, NAMED_BASELINE_IDS)) logger.warn(`  ${displayLogicalId(logicalId)}`);
+		if (unreadable.length > NAMED_BASELINE_IDS) logger.warn(`  ... and ${unreadable.length - NAMED_BASELINE_IDS} more`);
+	}
+	const missing = readable.filter(([, r]) => r.observedProperties === void 0);
 	if (missing.length === 0) return;
 	if (state.version !== void 0 && state.version < 3) {
-		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next \`cdk deploy\` after migration may surface spurious changes if AWS has drifted from the template. Run \`cdkd state refresh-observed ${safeSegment(state.stackName)}\` (or any redeploy) before export to capture an AWS-current baseline.`);
+		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next 'cdk deploy' after migration may surface spurious changes if AWS has drifted from the ` + (unreadableCount > 0 ? `template. Repair the ${unreadableCount} unreadable record(s) named above first — 'cdkd state refresh-observed' refuses a record that holds one — then capture an AWS-current baseline before export.` : `template. Capture an AWS-current baseline before export — any redeploy does ` + (refreshCommand !== void 0 ? `it, or run: ${refreshCommand}` : `it, or run ${refreshWithheld}`)));
 		return;
 	}
 	const refused = missing.filter(([, r]) => r.observedBaselineRefused === true);
 	const refreshable = missing.filter(([, r]) => r.observedBaselineRefused !== true);
 	if (refreshable.length > 0) {
-		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next \`cdk deploy\` after migration may surface unexpected changes. Run \`cdkd state refresh-observed ${safeSegment(state.stackName)}\` to capture a baseline before export, then \`cdkd drift\` to verify the stack matches AWS.`);
-		for (const [logicalId] of refreshable.slice(0, 10)) logger.warn(`  ${logicalId}`);
-		if (refreshable.length > 10) logger.warn(`  ... and ${refreshable.length - 10} more`);
+		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next 'cdk deploy' after migration may surface unexpected changes. ` + (unreadableCount > 0 ? `Repair the ${unreadableCount} unreadable record(s) named above first — 'cdkd state refresh-observed' refuses a record that holds one. Then capture a baseline and run 'cdkd drift' to verify the stack matches AWS.` : refreshCommand !== void 0 ? `Capture a baseline before export, then run 'cdkd drift' to verify the stack matches AWS, with: ${refreshCommand}` : `Capture a baseline before export with ${refreshWithheld} Then run 'cdkd drift' to verify the stack matches AWS.`));
+		for (const [logicalId] of refreshable.slice(0, NAMED_BASELINE_IDS)) logger.warn(`  ${displayLogicalId(logicalId)}`);
+		if (refreshable.length > NAMED_BASELINE_IDS) logger.warn(`  ... and ${refreshable.length - NAMED_BASELINE_IDS} more`);
 	}
 	if (refused.length > 0) {
 		logger.warn(`${refused.length} of ${entries.length} resource(s) had their baseline REFUSED by a \`cdkd import\` run, because their recorded properties can no longer position the secret redaction. \`cdkd state refresh-observed\` will decline them too — capturing a readback against those properties could persist a resolved secret into state.json in plaintext. Deploy a change to each one to restore its baseline.`);
-		for (const [logicalId] of refused.slice(0, 10)) logger.warn(`  ${logicalId}`);
-		if (refused.length > 10) logger.warn(`  ... and ${refused.length - 10} more`);
+		for (const [logicalId] of refused.slice(0, NAMED_BASELINE_IDS)) logger.warn(`  ${displayLogicalId(logicalId)}`);
+		if (refused.length > NAMED_BASELINE_IDS) logger.warn(`  ... and ${refused.length - NAMED_BASELINE_IDS} more`);
 	}
 }
 /**
@@ -82010,10 +82169,11 @@ async function listStateFileKeys(s3, bucket, prefix) {
 		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
 			Prefix: searchPrefix,
+			EncodingType: "url",
 			...continuationToken && { ContinuationToken: continuationToken }
 		}));
 		for (const obj of resp.Contents ?? []) {
-			const key = obj.Key;
+			const key = decodeListingKey(obj.Key);
 			if (typeof key === "string" && key.endsWith("/state.json")) keys.push(key);
 		}
 		continuationToken = resp.NextContinuationToken;
@@ -82043,9 +82203,18 @@ async function readSchemaVersion(s3, bucket, keys) {
 }
 /**
 * List every region's bootstrap marker under `cdkd-bootstrap/` in the state
-* bucket. Malformed markers are skipped with a warning — `state info` is a
-* cosmetic command and should not crash on an unexpected payload (deploy
+* bucket. A malformed marker PAYLOAD is skipped with a warning — `state info`
+* is a cosmetic command and should not crash on an unexpected body (deploy
 * hard-errors on the same marker instead).
+*
+* A malformed KEY is the one exception, and the distinction is deliberate
+* (go-to-k/cdkd#3313): `decodeListingKey` throws on a value that is not valid
+* URL encoding, and that call sits outside the per-marker `try`, so it aborts
+* the command rather than skipping the entry. A key cdkd cannot decode is one
+* it cannot address, and continuing would mean reporting on a marker while
+* unable to say which object it came from. Unreachable against S3, whose own
+* encoding is well-formed by construction; it is a refusal for the case where
+* that assumption stops holding.
 */
 async function listAssetStorageMarkers(s3, bucket) {
 	const logger = getLogger();
@@ -82056,9 +82225,13 @@ async function listAssetStorageMarkers(s3, bucket) {
 		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
 			Prefix: BOOTSTRAP_MARKER_PREFIX,
+			EncodingType: "url",
 			...continuationToken && { ContinuationToken: continuationToken }
 		}));
-		for (const obj of resp.Contents ?? []) if (typeof obj.Key === "string" && obj.Key.startsWith("cdkd-bootstrap/") && obj.Key.endsWith(".json")) keys.push(obj.Key);
+		for (const obj of resp.Contents ?? []) {
+			const markerKey = decodeListingKey(obj.Key);
+			if (typeof markerKey === "string" && markerKey.startsWith("cdkd-bootstrap/") && markerKey.endsWith(".json")) keys.push(markerKey);
+		}
 		continuationToken = resp.NextContinuationToken;
 	} while (continuationToken);
 	for (const key of keys) {
@@ -82247,6 +82420,16 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 				}
 			}
 		}
+		const regionScoped = targets.flatMap((target) => target.region ? [{
+			stackName: target.stackName,
+			region: target.region
+		}] : []);
+		if (regionScoped.length > 1) for (const target of regionScoped) {
+			const loaded = await setup.stateBackend.getState(target.stackName, target.region);
+			if (!loaded) continue;
+			refuseMalformedState(loaded.state, target.stackName, target.region);
+			refuseMalformedResourceEntries(loaded.state, target.stackName, target.region);
+		}
 		if (!options.yes && !options.dryRun) {
 			const targetList = targets.map(formatStackRefSafe).join(", ");
 			if (!await confirmRefresh(`Refresh observedProperties for ${targets.length} stack(s) (${targetList})?`)) {
@@ -82254,12 +82437,16 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 				return;
 			}
 		}
+		for (const target of targets) if (!target.region) {
+			const stack = shellQuote(safeStackName(target.stackName));
+			const example = safeStackName(target.stackName) === target.stackName && !/^-|[*/]/.test(target.stackName) ? ` For example: cdkd deploy ${stack}` : "";
+			throw new Error(`Stack ${stack} has only a legacy state record without a region. Migrate it to the region-scoped layout with any cdkd write, then re-run refresh-observed.` + example);
+		}
 		let totalRefreshed = 0;
 		let totalUnsupported = 0;
 		let totalFailed = 0;
 		let totalRefusedBaseline = 0;
-		for (const target of targets) {
-			if (!target.region) throw new Error(`Stack '${target.stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${target.stackName}' (or any cdkd write) first to migrate it to the region-scoped layout, then re-run refresh-observed.`);
+		for (const target of regionScoped) {
 			const counts = await refreshObservedForStack(target.stackName, target.region, setup.stateBackend, setup.lockManager, providerRegistry, {
 				dryRun: options.dryRun ?? false,
 				logger,
@@ -82337,7 +82524,9 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
 	const { state, etag, migrationPending } = result;
-	const entries = Object.entries(state.resources ?? {});
+	refuseMalformedState(state, stackName, region);
+	refuseMalformedResourceEntries(state, stackName, region);
+	const entries = Object.entries(state.resources);
 	if (entries.length === 0) {
 		logger.info(`✓ ${stackName} (${region}): no resources in state, skipping`);
 		return {
@@ -97023,4 +97212,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Br4uc31m.js.map
+//# sourceMappingURL=program-BmtaBtO_.js.map