@go-to-k/cdkd 0.290.40 → 0.290.42

package/dist/{program-BmtaBtO_.js → program-HtHlEaZm.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as CrossAccountSecretRefusalError, $n as TemplateParser, $r as validateAssetBucketName, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as ssmResolvedValueType, An as malformedResourcePropertiesWarning, Ar as hasReasonlessBaselineRefusal, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as canonicalizeRegion, Bn as refuseMalformedResourcesForDestroy, Br as WorkGraph, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as isThrottlingError, Ci as resolveCaptureObservedState, Cn as malformedExportSourceWarning, Cr as forceQuitRecoveryClause, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as retryClassificationText, Di as resolveUseCdkBootstrapAssets, Dn as malformedOutputsWarning, Dr as DEFAULT_STATE_PREFIX, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as markRedactedCause, Ei as resolveStateBucketWithDefaultAndSource, En as malformedOutputsRefusalMessage, Er as CUSTOM_RESOURCE_RESPONSE_PREFIX, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as uploadCfnTemplate, Fn as refuseMalformedNestedChildOutputs, Fr as orphansAfterRollback, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as resolveBucketRegion, Gn as repairMalformedResourcesForReadOnly, Gr as AssetModeResolver, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as AssemblyReader, Hn as repairMalformedOutputsForReadOnly, Hr as createAssetRedirectResolver, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, In as refuseMalformedOutputs, Ir as orphansCarriedFrom, It as isNamelessDynamicReferenceError, J as bold, Ji as resetAwsClients, Jn as findActionableSilentDrops, Jr as ensureAssetStorage, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as AwsClients, Kn as safeRegion, Kr as BOOTSTRAP_MARKER_PREFIX, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as decodeListingKey, Ln as refuseMalformedOutputsForDestroy, Lr as shouldRetainResource, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as CFN_TEMPLATE_URL_LIMIT, Mn as malformedStateRefusalMessage, Mr as importableOutputKeys, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Ni as MIGRATE_TMP_PREFIX, Nn as producerRecordKey, Nr as importableOutputs, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as describeAwsFailure, Oi as stateBucketExistenceConfirmed, On as malformedRenderedContainersWarning, Or as exportNamesCarriedFrom, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as findLargeInlineResources, Pn as refuseDivergentRecordRegionForDestroy, Pr as isReadableBag, Pt as getAccountInfo, Q as red, Qn as DagBuilder, Qr as readBootstrapMarkerBody, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as expectedOwnerParam, Rn as refuseMalformedResourceEntries, Rr as AssetPublisher, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as isRetryableTransientError, Si as resolveAutoAssetStorage, Sn as malformedExportNamesWarning, Sr as buildLockContentionMessage, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as markNonRetryable, Ti as resolveStateBucketWithDefault, Tn as malformedOrphanRecordsWarning, Tr as shellQuote, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as processStackMessages, Un as repairMalformedResourceEntriesForReadOnly, Ur as loadPublishableAssetManifest, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as derivePartitionAndUrlSuffix, Vn as refuseMalformedState, Vr as buildAssetRedirectMap, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wn as repairMalformedResourcePropertiesForReadOnly, Wr as rewriteTemplateAssetReferences, Wt as assertRegionMatch, X as gray, Xn as describeTypeWithThrottleRetry, Xr as isCrossRegionRedirect, Xt as readConfigString, Y as cyan, Yi as setAwsClients, Yn as findSilentDropProperties, Yr as getBootstrapMarkerKey, Yt as configStringRefusal, Z as green, Zi as CdkdError, Zn as withRetry, Zr as parseBootstrapMarker, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as Synthesizer, _n as UNREADABLE_RESOURCES_MAP_ROW, _r as LockManager, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as LocalStartServiceError, ai as describeDockerFailure, an as s3BucketDomainName, ar as createSecretMasker, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as withErrorHandling, bi as getLegacyStateBucketName, bn as hasReadableResources, br as UNREPRODUCIBLE_LOCK_CLAUSE, bt as startInterruptWatch, c as replayFailedOperations, ca as NestedStackChildDirectDestroyError, ci as getDockerCmd, cn as s3BucketWebsiteUrl, cr as identityKeyFor, ct as IAMRoleProvider, d as updatePartialMessage, da as ResourceTimeoutError, di as runDockerForeground, dn as applyCallerIdentityCredentials, dr as maskSecretsInError, dt as ProviderRegistry, ei as validateContainerRepoName, en as requireConfigString, er as STATE_SOURCED_BASELINE_RULES, et as collectDeclaredOutputNames, f as updatePartialReason, fa as ResourceUpdateNotSupportedError, fi as runDockerStreaming, fn as callerEnvCredentials, fr as maskSecretsInText, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as SynthesisError, gi as getDockerImageBySourceHash, gn as STATE_RESOURCES_MALFORMED, gr as scrubResourceRecord, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as AssetManifestLoader, hn as INTRINSIC_KEYS, hr as redactSecretsForState, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as LocalInvokeBuildError$1, ii as describeDockerExecFailure, in as s3BucketArn, ir as carriesSecretMask, it as secretBearing, j as isFinalSnapshotError, ji as CFN_TEMPLATE_BODY_LIMIT, jn as malformedResourcesWarning, jr as hasUnverifiableParameterRefusal, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as safeStringify, ki as warnDeprecatedNoPrefixCliFlag, kn as malformedResourceEntriesWarning, kr as hasReadableExportSet, kt as IntrinsicFunctionResolver, l as replayRollback, la as PartialFailureError, li as partitionSensitiveEnv, ln as applyRoleArnIfSet, lr as isSingleDynamicReferenceToken, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as StackTerminationProtectionError, mi as stripControlChars, mn as DiffCalculator, mr as recoverMaskedOutput, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as DynamicReferenceRegionAmbiguousError, ni as buildDockerImage, nn as producerRegionsFromState, nr as STATE_SOURCED_READBACK_RULES, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oi as dockerSpawnEnvWithSensitive, on as s3BucketDualStackDomainName, or as dynamicReferenceTokens, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as StackHasActiveImportsError, pi as escapeRegExp, pn as envCredentialsAreAssumedRole, pr as recordMaskOnlyValue, pt as createMaskedRetryLogger, q as formatResourceLine, qi as getAwsClients, qn as safeStackName, qr as assertAssetBucketRegion, qt as configBooleanRefusal, r as DeployEngine, ra as IntrinsicResolutionRefusalError, ri as describeDockerCapturedOutput, rn as withSharedDrainBudget, rr as TEMPLATE_SOURCED_RULES, rt as isExportAliasCollision, s as planRollback, sa as MalformedProducerRecordRefusalError, si as formatDockerLoginError, sn as s3BucketRegionalDomainName, sr as errorCauseChain, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as DeployCancelledError, ti as buildDenyExternalAccessPolicy, tn as classifyReplaySecretRegion, tr as STATE_SOURCED_CROSS_GENERATION_RULES, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as ProvisioningError, ui as redactDockerArgvValues, un as AWS_CREDENTIAL_ENV_KEYS, ur as markSameGenerationBag, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, vi as synthesisStatusMessage, vn as displayLogicalId, vr as S3StateBackend, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as isTransientServerError, wi as resolveSkipPrefix, wn as malformedLocalOutputsWarning, wr as formatLockExpiry, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as isMarkedNonRetryable, xi as resolveApp, xn as isReadableResourceEntry, xr as buildForceUnlockCommand, xt as CloudControlProvider, y as keptWholeReasonText, ya as normalizeAwsError, yi as getDefaultStateBucketName, yn as hasReadableOutputs, yr as rebuildClientForBucketRegion, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as PARTITION_TABLE, zn as refuseMalformedResourcePropertiesForOrphan, zr as stringifyValue, zt as refStateLookupFromResource } from "./deploy-engine-DJxLBuTb.js";
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BkcLg0jL.js";
+import { $ as yellow, $n as STATE_SOURCED_BASELINE_RULES, $r as validateContainerRepoName, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as retryClassificationText, Ai as CFN_TEMPLATE_BODY_LIMIT, An as malformedResourcePropertiesWarning, Ar as hasUnverifiableParameterRefusal, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as decodeListingKey, Bn as refuseMalformedState, Br as buildAssetRedirectMap, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as withErrorHandling, Ci as resolveSkipPrefix, Cn as malformedExportSourceWarning, Cr as formatLockExpiry, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as isTransientServerError, Di as stateBucketExistenceConfirmed, Dn as malformedOutputsWarning, Dr as exportNamesCarriedFrom, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as isThrottlingError, Ei as resolveUseCdkBootstrapAssets, En as malformedOutputsRefusalMessage, Er as DEFAULT_STATE_PREFIX, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Fn as refuseMalformedOutputs, Fr as orphansCarriedFrom, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as AssemblyReader, Gn as safeRegion, Gr as BOOTSTRAP_MARKER_PREFIX, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as PARTITION_TABLE, Hn as repairMalformedResourceEntriesForReadOnly, Hr as loadPublishableAssetManifest, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as injectiveKey, In as refuseMalformedOutputsForDestroy, Ir as shouldRetainResource, It as isNamelessDynamicReferenceError, J as bold, Ji as resolveBucketRegion, Jn as findSilentDropProperties, Jr as getBootstrapMarkerKey, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as processStackMessages, Kn as safeStackName, Kr as assertAssetBucketRegion, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as injectiveKeyPrefix, Ln as refuseMalformedResourceEntries, Lr as AssetPublisher, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as safeStringify, Mi as MIGRATE_TMP_PREFIX, Mn as malformedStateRefusalMessage, Mr as importableOutputs, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Ni as findLargeInlineResources, Nn as refuseDivergentRecordRegionForDestroy, Nr as isReadableBag, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as markNonRetryable, Oi as warnDeprecatedNoPrefixCliFlag, On as malformedRenderedContainersWarning, Or as hasReadableExportSet, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as uploadCfnTemplate, Pn as refuseMalformedNestedChildOutputs, Pr as orphansAfterRollback, Pt as getAccountInfo, Q as red, Qi as setAwsClients, Qn as TemplateParser, Qr as validateAssetBucketName, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as producerCoordinateKey, Rn as refuseMalformedResourcePropertiesForOrphan, Rr as stringifyValue, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as normalizeAwsError, Si as resolveCaptureObservedState, Sn as malformedExportNamesWarning, Sr as forceQuitRecoveryClause, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as isRetryableTransientError, Ti as resolveStateBucketWithDefaultAndSource, Tn as malformedOrphanRecordsWarning, Tr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as canonicalizeRegion, Un as repairMalformedResourcePropertiesForReadOnly, Ur as rewriteTemplateAssetReferences, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as expectedOwnerParam, Vn as repairMalformedOutputsForReadOnly, Vr as createAssetRedirectResolver, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as derivePartitionAndUrlSuffix, Wn as repairMalformedResourcesForReadOnly, Wr as AssetModeResolver, Wt as assertRegionMatch, X as gray, Xi as getAwsClients, Xn as withRetry, Xr as parseBootstrapMarker, Xt as readConfigString, Y as cyan, Yi as AwsClients, Yn as describeTypeWithThrottleRetry, Yr as isCrossRegionRedirect, Yt as configStringRefusal, Z as green, Zi as resetAwsClients, Zn as DagBuilder, Zr as readBootstrapMarkerBody, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as StackTerminationProtectionError, _i as synthesisStatusMessage, _n as UNREADABLE_RESOURCES_MAP_ROW, _r as S3StateBackend, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as DynamicReferenceRegionAmbiguousError, ai as dockerSpawnEnvWithSensitive, an as s3BucketDomainName, ar as dynamicReferenceTokens, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, bi as resolveApp, bn as hasReadableResources, br as buildForceUnlockCommand, bt as startInterruptWatch, c as replayFailedOperations, ca as LocalStartServiceError, ci as partitionSensitiveEnv, cn as s3BucketWebsiteUrl, cr as isSingleDynamicReferenceToken, ct as IAMRoleProvider, d as updatePartialMessage, da as NestedStackChildDirectDestroyError, di as runDockerStreaming, dn as applyCallerIdentityCredentials, dr as maskSecretsInText, dt as ProviderRegistry, ea as CdkdError, ei as buildDenyExternalAccessPolicy, en as requireConfigString, er as STATE_SOURCED_CROSS_GENERATION_RULES, et as collectDeclaredOutputNames, f as updatePartialReason, fa as PartialFailureError, fi as escapeRegExp, fn as callerEnvCredentials, fr as recordMaskOnlyValue, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as StackHasActiveImportsError, gi as Synthesizer, gn as STATE_RESOURCES_MALFORMED, gr as LockManager, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as ResourceUpdateNotSupportedError, hi as getDockerImageBySourceHash, hn as INTRINSIC_KEYS, hr as scrubResourceRecord, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as DeployCancelledError, ii as describeDockerFailure, in as s3BucketArn, ir as createSecretMasker, it as secretBearing, j as isFinalSnapshotError, ja as describeAwsFailure, ji as CFN_TEMPLATE_URL_LIMIT, jn as malformedResourcesWarning, jr as importableOutputKeys, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as markRedactedCause, ki as ssmResolvedValueType, kn as malformedResourceEntriesWarning, kr as hasReasonlessBaselineRefusal, kt as IntrinsicFunctionResolver, l as replayRollback, li as redactDockerArgvValues, ln as applyRoleArnIfSet, lr as markSameGenerationBag, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as ResourceTimeoutError, mi as AssetManifestLoader, mn as DiffCalculator, mr as redactSecretsForState, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as CrossAccountSecretRefusalError, ni as describeDockerCapturedOutput, nn as producerRegionsFromState, nr as TEMPLATE_SOURCED_RULES, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as IntrinsicResolutionRefusalError, oi as formatDockerLoginError, on as s3BucketDualStackDomainName, or as errorCauseChain, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as ProvisioningError, pi as stripControlChars, pn as envCredentialsAreAssumedRole, pr as recoverMaskedOutput, pt as createMaskedRetryLogger, q as formatResourceLine, qn as findActionableSilentDrops, qr as ensureAssetStorage, qt as configBooleanRefusal, r as DeployEngine, ri as describeDockerExecFailure, rn as withSharedDrainBudget, rr as carriesSecretMask, rt as isExportAliasCollision, s as planRollback, sa as LocalInvokeBuildError$1, si as getDockerCmd, sn as s3BucketRegionalDomainName, sr as identityKeyFor, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as buildDockerImage, tn as classifyReplaySecretRegion, tr as STATE_SOURCED_READBACK_RULES, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as MalformedProducerRecordRefusalError, ui as runDockerForeground, un as AWS_CREDENTIAL_ENV_KEYS, ur as maskSecretsInError, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, vi as getDefaultStateBucketName, vn as displayLogicalId, vr as rebuildClientForBucketRegion, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as isMarkedNonRetryable, wi as resolveStateBucketWithDefault, wn as malformedLocalOutputsWarning, wr as shellQuote, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as resolveAutoAssetStorage, xn as isReadableResourceEntry, xr as buildLockContentionMessage, xt as CloudControlProvider, y as keptWholeReasonText, ya as SynthesisError, yi as getLegacyStateBucketName, yn as hasReadableOutputs, yr as UNREPRODUCIBLE_LOCK_CLAUSE, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as producerRecordKey, zn as refuseMalformedResourcesForDestroy, zr as WorkGraph, zt as refStateLookupFromResource } from "./deploy-engine-C1dgx124.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-D-2HeLmd.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CEKVu0mE.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DPTeR_IT.js";
+import { t as getCdkdVersion } from "./version-Divizw1k.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Cms9Daqn.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -18131,7 +18131,11 @@ function resolveDynamoDbDeleteBudgetClock() {
 * the first's spent allowance. In practice `destroy-runner.ts` builds a fresh
 * provider (and therefore a fresh registry) per region, so the collision is not
 * reachable today — but that is an invariant of the CALLER, enforced nowhere,
-* and the fix costs one string concat. `\0` cannot appear in either component.
+* and the fix costs one string concat. The key is ENCODED rather than
+* separated, so it does not rest on what can appear in either component --
+* both come from a state record, which `parseStateBody` reads as an unchecked
+* cast, so the claim this sentence used to make was about AWS rather than
+* about what arrives here (go-to-k/cdkd#3496).
 *
 * `region` is the STATE's region (`DeleteContext.expectedRegion`), which is
 * available synchronously at the top of `delete()` — unlike the client's own
@@ -18140,7 +18144,7 @@ function resolveDynamoDbDeleteBudgetClock() {
 * which degrades to the old bare-name key rather than failing.
 */
 function deleteBudgetKey(physicalId, region) {
-	return `${region ?? ""}\u0000${physicalId}`;
+	return injectiveKey(region ?? "", physicalId);
 }
 /**
 * The poll cap a wait may actually use: its own constant, or what the shared
@@ -23397,7 +23401,7 @@ var DynamoDBGlobalTableProvider = class {
 	* repeated `DescribeTable` calls.
 	*/
 	async getAttribute(physicalId, _resourceType, attributeName) {
-		const cacheKey = `${physicalId}::${attributeName}`;
+		const cacheKey = injectiveKey(physicalId, attributeName);
 		if (this.attributeCache.has(cacheKey)) return this.attributeCache.get(cacheKey);
 		try {
 			const resp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
@@ -28575,7 +28579,7 @@ const generations = /* @__PURE__ */ new Map();
 * long-lived process cannot grow the map without bound.
 */
 const MAX_TRACKED_GENERATIONS = 1e5;
-const tokenKey = (scope, logicalId, maxLength, charset) => `${scope}\u0000${process.env["AWS_REGION"] ?? ""}\u0000${getCurrentStackName() ?? ""}\u0000${logicalId}\u0000${maxLength}\u0000${charset}`;
+const tokenKey = (scope, logicalId, maxLength, charset) => injectiveKey(scope, process.env["AWS_REGION"] ?? "", getCurrentStackName() ?? "", logicalId, maxLength, charset);
 const derive = (key, generation, maxLength, charset) => {
 	const digest = createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex");
 	return `cdkd${charset === "alphanumeric" ? "" : "-"}${digest}`.slice(0, maxLength);
@@ -42392,7 +42396,7 @@ var RDSDBProxyProvider = class {
 		throw new ProvisioningError(`Timed out waiting for DBProxy ${physicalId} to fully delete`, resourceType, logicalId, physicalId);
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
-		const cacheKey = `${physicalId}:${attributeName}`;
+		const cacheKey = injectiveKey(physicalId, attributeName);
 		const cached = this.attributeCache.get(cacheKey);
 		if (cached !== void 0) return cached;
 		if (attributeName !== "Endpoint" && attributeName !== "DBProxyArn" && attributeName !== "VpcId") {
@@ -42467,7 +42471,7 @@ var RDSDBProxyProvider = class {
 		const newMap = this.toTagMap(newTags);
 		if (oldMap.size === newMap.size && [...oldMap.keys()].every((k) => newMap.has(k)) && [...oldMap.entries()].every(([k, v]) => newMap.get(k) === v)) return;
 		const client = this.getClient();
-		const arnCacheKey = `${physicalId}:DBProxyArn`;
+		const arnCacheKey = injectiveKey(physicalId, "DBProxyArn");
 		let arn = this.attributeCache.get(arnCacheKey);
 		if (!arn) try {
 			arn = (await client.send(new DescribeDBProxiesCommand({ DBProxyName: physicalId }))).DBProxies?.[0]?.DBProxyArn;
@@ -42534,7 +42538,8 @@ var RDSDBProxyProvider = class {
 		}
 	}
 	invalidateAttributeCache(physicalId) {
-		for (const key of this.attributeCache.keys()) if (key.startsWith(`${physicalId}:`)) this.attributeCache.delete(key);
+		const encodedPrefix = injectiveKeyPrefix(physicalId);
+		for (const key of this.attributeCache.keys()) if (key.startsWith(encodedPrefix)) this.attributeCache.delete(key);
 	}
 	wrapError(error, op, resourceType, logicalId, physicalId) {
 		const message = error instanceof Error ? error.message : String(error);
@@ -42717,7 +42722,7 @@ var RDSDBProxyEndpointProvider = class {
 		throw new ProvisioningError(`Timed out waiting for DBProxyEndpoint ${physicalId} to fully delete`, resourceType, logicalId, physicalId);
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
-		const cacheKey = `${physicalId}:${attributeName}`;
+		const cacheKey = injectiveKey(physicalId, attributeName);
 		const cached = this.attributeCache.get(cacheKey);
 		if (cached !== void 0) return cached;
 		if (attributeName !== "Endpoint" && attributeName !== "DBProxyEndpointArn" && attributeName !== "IsDefault" && attributeName !== "VpcId") {
@@ -42778,7 +42783,7 @@ var RDSDBProxyEndpointProvider = class {
 		const newMap = this.toTagMap(newTags);
 		if (oldMap.size === newMap.size && [...oldMap.keys()].every((k) => newMap.has(k)) && [...oldMap.entries()].every(([k, v]) => newMap.get(k) === v)) return;
 		const client = this.getClient();
-		const arnCacheKey = `${physicalId}:DBProxyEndpointArn`;
+		const arnCacheKey = injectiveKey(physicalId, "DBProxyEndpointArn");
 		let arn = this.attributeCache.get(arnCacheKey);
 		if (!arn) try {
 			arn = (await client.send(new DescribeDBProxyEndpointsCommand({ DBProxyEndpointName: physicalId }))).DBProxyEndpoints?.[0]?.DBProxyEndpointArn;
@@ -42846,7 +42851,8 @@ var RDSDBProxyEndpointProvider = class {
 		}
 	}
 	invalidateAttributeCache(physicalId) {
-		for (const key of this.attributeCache.keys()) if (key.startsWith(`${physicalId}:`)) this.attributeCache.delete(key);
+		const encodedPrefix = injectiveKeyPrefix(physicalId);
+		for (const key of this.attributeCache.keys()) if (key.startsWith(encodedPrefix)) this.attributeCache.delete(key);
 	}
 	wrapError(error, op, resourceType, logicalId, physicalId) {
 		const message = error instanceof Error ? error.message : String(error);
@@ -70023,6 +70029,12 @@ function malformedRecordsAuditedError(stackNames, outputStackNames) {
 	if (outputStackNames.length > 0) parts.push(`${outputStackNames.length} stack(s) were audited with an EMPTY outputs bag because their state record has no readable 'outputs' map: ${safeNames(outputStackNames)}. The report above describes their resources only — nothing is known about the values their outputs hold, and those values are what the exports index republishes to consumer stacks, so this run cannot certify them clean.`);
 	return new ScrubRefusalError(`${parts.join(" ")} See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
 }
+/**
+* Exported for its unit fence alone — no second production caller. The
+* collision it must not have (go-to-k/cdkd#3323) is only observable from
+* whether two queries SHARE a promise, which driving a whole `scrubStack`
+* fixture cannot show without asserting on a much larger outcome.
+*/
 function memoizeCrossStackStateReads(backend) {
 	const view = Object.create(backend);
 	let listed;
@@ -70032,7 +70044,7 @@ function memoizeCrossStackStateReads(backend) {
 		return listed;
 	};
 	view.getState = (stackName, stateRegion) => {
-		const key = `${stackName}\u0000${stateRegion}`;
+		const key = producerRecordKey(stackName, stateRegion);
 		let pending = states.get(key);
 		if (!pending) {
 			pending = backend.getState(stackName, stateRegion);
@@ -70383,7 +70395,7 @@ function storedValueCarriesNoPlaintext(stored) {
 *   selection.
 */
 function producerPublishesSecretExpression(templates, exportOwners, producerStack, key) {
-	const seen = /* @__PURE__ */ new Set([`${producerStack}\u0000${key}`]);
+	const seen = /* @__PURE__ */ new Set([producerCoordinateKey(producerStack, key)]);
 	const queue = [{
 		stack: producerStack,
 		key,
@@ -70424,7 +70436,7 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 				};
 			}
 			for (const hop of collectReExportHops(subject, templates, exportOwners)) {
-				const id = `${hop.stack}\u0000${hop.key}`;
+				const id = producerCoordinateKey(hop.stack, hop.key);
 				if (seen.has(id)) continue;
 				seen.add(id);
 				queue.push({
@@ -71128,7 +71140,7 @@ function makeCrossStackPrePass(deps) {
 	*/
 	const warnedDamagedProducers = /* @__PURE__ */ new Set();
 	const secretExpressionVerdict = (stack, key) => {
-		const id = `${stack}\u0000${key}`;
+		const id = producerCoordinateKey(stack, key);
 		let verdict = verdicts.get(id);
 		if (!verdict) {
 			verdict = producerPublishesSecretExpression(producerTemplates, exportOwners, stack, key);
@@ -76678,6 +76690,14 @@ function createStateMigrateCommand() {
 //#endregion
 //#region src/cli/commands/state-list-tree.ts
 /**
+* Helpers for `cdkd state list --tree`: reconstruct the parent → child stack
+* tree from a flat list of state records and render it.
+*
+* The actual S3 reads happen in {@link import('./state.js')} — this module
+* stays pure / synchronous so the tree-building logic can be unit-tested
+* without mocking the state backend.
+*/
+/**
 * How deep a node may sit below its root, counting the root as 0.
 *
 * A node that would sit deeper is made a root instead (see
@@ -76742,7 +76762,7 @@ const MAX_STACK_TREE_DEPTH = 100;
 * runs.
 */
 function buildStackTree(entries) {
-	const refKey = (stackName, region) => `${stackName}\0${region ?? ""}`;
+	const refKey = (stackName, region) => producerRecordKey(stackName, region ?? "");
 	const byKey = /* @__PURE__ */ new Map();
 	for (const entry of entries) byKey.set(refKey(entry.stackName, entry.region), {
 		...entry,
@@ -81686,7 +81706,7 @@ function renderStateBlock(state, lockInfo, withLegend) {
 * `--show-nested` render.
 */
 async function loadLocksForTree(tree, lockManager, rootLock) {
-	const nodeKey = (node) => `${node.stackName}\0${node.region}`;
+	const nodeKey = (node) => producerRecordKey(node.stackName, node.region);
 	const rootKey = nodeKey(tree);
 	const flat = [];
 	const collect = (node) => {
@@ -82728,7 +82748,7 @@ async function findJournalCandidates(backend, prefix) {
 		if (segments.length !== 2) continue;
 		const [stackName, region] = segments;
 		if (!stackName || !region) continue;
-		const dedupe = `${stackName}\0${region}`;
+		const dedupe = producerRecordKey(stackName, region);
 		if (seen.has(dedupe)) continue;
 		seen.add(dedupe);
 		refs.push({
@@ -84989,7 +85009,7 @@ var AttributeFetcher = class {
 	* success path returns `{ ok: true, value, fromCache: true }`.
 	*/
 	async getAtt(orphanLogicalId, attribute) {
-		const cacheKey = `${orphanLogicalId}\0${attribute}`;
+		const cacheKey = injectiveKey(orphanLogicalId, attribute);
 		if (this.cache.has(cacheKey)) return {
 			ok: true,
 			value: this.cache.get(cacheKey)
@@ -85047,7 +85067,7 @@ var AttributeFetcher = class {
 		this.logger.warn(`--force: live fetch failed for '${orphanLogicalId}.${attribute}' (${reason}); falling back to cached value from state.attributes.`);
 		if (carriesDynamicReference(cached)) this.logger.warn(`--force: the cached value for '${orphanLogicalId}.${attribute}' is an UNRESOLVED dynamic reference (a nested stack's redacted output, issue #2055). It is being written into the referring resource's state VERBATIM — cdkd cannot re-resolve it from here. Re-run without --force once the live attribute is readable, or fix the referring property by hand.`);
 		if (carriesSecretMask(cached)) this.logger.warn(`--force: the cached value for '${orphanLogicalId}.${attribute}' is the REDACTION MASK ('${"***"}'), not the attribute's value — cdkd redacted it into state and cannot recover it. It is being written into the referring resource's state VERBATIM, so that row now records a value the live resource does not have: the next 'cdkd diff' / 'cdkd deploy' reports a spurious change there (a REPLACEMENT if the property is create-only), 'cdkd rollback' refuses the record as a replay baseline, and 'cdkd export' blocks it. Re-run without --force once the live attribute is readable, re-import the record that holds the mask, or fix the referring property by hand.`);
-		const cacheKey = `${orphanLogicalId}\0${attribute}`;
+		const cacheKey = injectiveKey(orphanLogicalId, attribute);
 		this.cache.set(cacheKey, cached);
 		return {
 			ok: true,
@@ -87649,12 +87669,14 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 		/**
 		* Issue #1836: EXACT match first, case-insensitive second.
 		*
-		* `S3StateBackend.listStacks` dedupes on the EXACT `{stack}\0{region}` pair,
-		* so `cdkd/MyStack/US-EAST-1/state.json` and
-		* `cdkd/MyStack/us-east-1/state.json` are two DISTINCT refs — and
-		* ListObjectsV2 returns them in ASCII order, i.e. the upper-cased one FIRST.
-		* A fold-only `find` therefore hands `--stack-region us-east-1` the OTHER
-		* record, silently reading state the user did not name; the pre-fold `===`
+		* `S3StateBackend.listStacks` dedupes on the EXACT `(stack, region)` PAIR
+		* — through `producerRecordKey` since go-to-k/cdkd#3323, by a separator
+		* before that; what this note needs is only that the match is exact — so
+		* `cdkd/MyStack/US-EAST-1/state.json` and
+		* `cdkd/MyStack/us-east-1/state.json` are two DISTINCT refs, and
+		* ListObjectsV2 returns them in ASCII order, i.e. the upper-cased one
+		* FIRST. A fold-only `find` therefore hands `--stack-region us-east-1` the
+		* OTHER record, silently reading state the user did not name; the pre-fold `===`
 		* got that case right. So the fold is the RECOVERY for a case mismatch, never
 		* an override of a spelling that exists verbatim.
 		*
@@ -97212,4 +97234,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BmtaBtO_.js.map
+//# sourceMappingURL=program-HtHlEaZm.js.map