@go-to-k/cdkd 0.290.41 → 0.290.43

package/dist/{deploy-engine-RoGuHEgf.js → deploy-engine-Bw8VoyEi.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-D-2HeLmd.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-Cxppiepi.js";
+import { t as getCdkdVersion } from "./version-ChfV4K6h.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -25,7 +25,9 @@ import { CreateClusterSnapshotCommand, DescribeClusterSnapshotsCommand, Describe
 import { CreateSnapshotCommand as CreateSnapshotCommand$1, DescribeReplicationGroupsCommand, DescribeSnapshotsCommand as DescribeSnapshotsCommand$1, ElastiCacheClient } from "@aws-sdk/client-elasticache";
 import { ACMClient } from "@aws-sdk/client-acm";
 import { LambdaMicrovmsClient } from "@aws-sdk/client-lambda-microvms";
+import * as fs from "node:fs";
 import { createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
 import { basename, isAbsolute, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { homedir, tmpdir } from "node:os";
@@ -33,7 +35,6 @@ import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } fro
 import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBalancingV2Client } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
-import { join as join$1 } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
 import { inspect } from "node:util";
 import { hostname } from "os";
@@ -2803,6 +2804,231 @@ function parseEnvironment(env) {
 	};
 }
 
+//#endregion
+//#region src/utils/assembly-path.ts
+/**
+* `true` when `candidate` names something strictly beneath `base`, both given
+* as already-resolved absolute paths.
+*
+* The `..` test is SEPARATOR-AWARE rather than a bare `startsWith('..')`,
+* which would also reject a legitimate sibling named `..foo`. The empty-string
+* case is `base` itself: a directory is never a template, a manifest or a
+* metadata side file, so `.` and `./` are refused rather than read.
+*/
+function isInside(base, candidate) {
+	const rel = path.relative(base, candidate);
+	if (rel === "" || rel === "..") return false;
+	if (rel.startsWith(`..${path.sep}`)) return false;
+	return !path.isAbsolute(rel);
+}
+/**
+* `realpath(3)`, or `undefined` for a path that does not fully resolve.
+*
+* `.native` IS load-bearing and must not be simplified to `fs.realpathSync`.
+* The plain form is a JavaScript walker that folds `..` LEXICALLY — the same
+* mistake this module's own model branch is careful not to make — so it
+* disagrees with the kernel on a target carrying a `..` after a symlinked
+* component, in both directions:
+*
+* - It answers `ENOENT` for a path the kernel resolves and `readFileSync`
+*   then reads. With `cdk.out/a -> <outside>/sub` and
+*   `cdk.out/LINK.json -> a/../c.json` (both live), the JS walker folds to
+*   `cdk.out/c.json`, finds nothing, and the verdict falls through to the
+*   model — which folds the same way and calls it CONTAINED while the read
+*   returns `<outside>/c.json`. That is go-to-k/cdkd#3489's original defect,
+*   reopened by the guard meant to close it.
+* - On a case-insensitive filesystem (APFS by default) the same shape can make
+*   it SPIN. A `try`/`catch` cannot catch a spin, so a hand-modified assembly
+*   hung the very commands this check protects.
+*
+* `.native` is libuv's `realpath(3)` (`GetFinalPathNameByHandle` on Windows),
+* available since Node 8 against a floor of 22, and throws the same
+* `ENOENT` / `ELOOP` / `EACCES`. Using it is what makes the "exact whenever
+* the path resolves" claim above TRUE rather than aspirational.
+*/
+function tryRealpath(p) {
+	try {
+		return fs.realpathSync.native(p);
+	} catch {
+		return;
+	}
+}
+/** `fs.readlinkSync`, or `undefined` when `p` is not a symbolic link. */
+function tryReadlink(p) {
+	try {
+		return fs.readlinkSync(p);
+	} catch {
+		return;
+	}
+}
+/**
+* Link follows before the walk gives up and reports the path as unresolvable.
+* It does NOT refuse: an exhausted budget answers `undefined`, which leaves
+* the symlink arm silent and the lexical verdict standing. That is safe
+* because the OS gives up first — macOS caps at 32 (`ELOOP`) — so a chain that
+* reaches this cap is one nothing can read or create through anyway.
+*/
+const MAX_LINK_HOPS = 40;
+/**
+* Unresolvable path COMPONENTS the climb walks before giving up. Bounds the
+* recursion below, which is one frame per component: 20 000 components raised
+* an uncaught `RangeError` and 5 000 cost ~200 ms per call. Like the hop cap
+* this gives up rather than refusing, which is safe for the same reason —
+* nothing can read or create through a path that deep.
+*/
+const MAX_PATH_COMPONENTS = 1e3;
+/**
+* Where `target` REALLY points, for a path that may not exist yet.
+*
+* `fs.realpathSync` answers only for a path that fully resolves, and it throws
+* `ENOENT` for a DANGLING symbolic link exactly as it does for an absent file
+* — the two are indistinguishable from its result. That difference is the
+* whole point here: a write FOLLOWS a dangling link and creates the file at
+* its target, so `cdk.out/Foo.template.json -> ~/.ssh/authorized_keys` (target
+* absent) is an out-of-directory write that a realpath-only check reports as
+* contained. Measured: `cdkd synth --verbose` created the victim file.
+*
+* So each unresolvable component is handled by hand: climb to the deepest
+* ancestor that DOES resolve, then re-apply the remaining components,
+* following any symbolic link with `readlink` and re-resolving its target.
+* `undefined` means the walk could not resolve the path at all, which for
+* every caller means their own open fails too.
+*
+* KNOW WHAT THIS IS EXACT ABOUT, because the distinction is what bounds it:
+*
+* - For a path that FULLY RESOLVES, the answer is `fs.realpathSync`'s and is
+*   therefore exact. Every READ site is in this case by construction — a file
+*   that does not resolve cannot be read — so the containment verdict there is
+*   the kernel's, not this function's. The BASE side is exact there too: every
+*   one is either user-supplied (`-a`, `--output`, `cdkOutDir`) or the
+*   `dirname` of a file cdkd has just read successfully, so neither operand of
+*   a read is in the model's territory.
+* - For a path that does NOT exist yet, this is a best-effort MODEL of kernel
+*   resolution, and a model can be wrong at an edge. The known one: `..` INSIDE
+*   an unresolvable link's target is folded lexically here, while the kernel
+*   folds it only after following each preceding component, so a target of
+*   `a/../c.json` under a symlinked `a` diverges.
+*
+* That edge decides which of the TWO sites that WRITE needs a second check,
+* and the difference is the BASE rather than the act of writing:
+*
+* - `resolveVerboseTemplatePath` (`src/cli/commands/synth.ts`) writes into
+*   `--output`, which may be a pre-existing directory the assembly's author
+*   supplied, so the leaf CAN already be a symbolic link. It therefore asks
+*   the kernel directly with `lstat` and refuses one whatever it points at. A
+*   path-string model can be argued around; `lstat` cannot.
+* - `resolveInlineCodeFilePath` (`src/cli/commands/local-invoke.ts`) writes
+*   into a `mkdtemp` cdkd has just created, mode 0700 and empty, so no
+*   component of the candidate can be a symbolic link at all and the edge is
+*   unreachable. It needs no `lstat`.
+*
+* **A third write site over a base cdkd did not create needs the `lstat`**,
+* and inherits nothing from this function that would give it one.
+*
+* That second site is also the repo's first caller to `mkdirSync(...,
+* { recursive: true })` through a resolved path, which an earlier revision of
+* this comment leaned on not existing. It is still safe: the climb charges no
+* hop for a component, and exhausting `MAX_PATH_COMPONENTS` gives up into the
+* lexical verdict, which a freshly created directory has no link to defeat.
+*/
+function resolveThroughLinks(target, hops = 0, climbs = 0) {
+	const direct = tryRealpath(target);
+	if (direct !== void 0) return direct;
+	if (hops >= MAX_LINK_HOPS) return void 0;
+	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
+	const parent = path.dirname(target);
+	if (parent === target) return void 0;
+	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
+	if (realParent === void 0) return void 0;
+	const link = tryReadlink(target);
+	if (link === void 0) return path.join(realParent, path.basename(target));
+	return resolveThroughLinks(path.resolve(realParent, link), hops + 1, climbs);
+}
+/**
+* Resolve an assembly-supplied `candidate` against `dir` and report whether
+* the result stays inside it.
+*
+* The lexical arm joins exactly the way the call sites used to
+* (`path.join`, NOT `path.resolve`), so the verdict is about the path the
+* caller will actually open. `join`'s handling of an absolute candidate makes
+* this arm strictly more permissive than a `resolve`-based one would be; an
+* absolute value therefore stays a matter for each site's own tripwire.
+*
+* The SYMLINK arm exists because the lexical arm alone leaves an equivalent
+* hole: `cdk.out/link -> /etc` plus a candidate of `link/passwd` is lexically
+* contained and still reads `/etc/passwd`. Both sides go through
+* {@link resolveThroughLinks}, so an assembly directory REACHED through a link
+* (macOS spells `/tmp` as `/private/tmp`; a user may symlink `cdk.out` itself)
+* is unaffected, while a candidate that does not exist YET — the shape
+* `cdkd synth --verbose` writes, and the shape a DANGLING link presents — is
+* still resolved to where it would actually land. A real `cdk synth` writes no symbolic link
+* along any of these paths (measured against a CDK 2.268 assembly carrying a
+* Stage, two nesting levels and an asset manifest), so the arm costs a
+* legitimate assembly nothing.
+*
+* Windows shapes need no special case HERE: `path.relative` is the platform's
+* own, so a drive-relative or UNC candidate is judged by `path.win32` on
+* Windows, while on POSIX `C:\evil` and `..\..\evil` are single filename
+* components that no `readFileSync` can follow out of the directory.
+*
+* The verdict is about the assembly AS IT SITS ON DISK, which is the whole
+* threat model: a hand-modified or third-party `cdk.out` the user then points
+* cdkd at. It is NOT a defence against a process rewriting that directory
+* concurrently — the caller opens by path after this returns, so a link
+* swapped in between is outside what any check here can see.
+*/
+function resolveAssemblyPath(dir, candidate, options) {
+	const base = path.resolve(dir);
+	const bound = options?.containWithin === void 0 ? base : path.resolve(options.containWithin);
+	const joined = path.resolve(path.join(base, candidate));
+	if (!isInside(bound, joined)) return {
+		contained: false,
+		escape: "lexical",
+		path: joined
+	};
+	const realBase = resolveThroughLinks(bound);
+	if (realBase !== void 0) {
+		const realTarget = resolveThroughLinks(joined);
+		if (realTarget !== void 0 && !isInside(realBase, realTarget)) return {
+			contained: false,
+			escape: "symlink",
+			path: joined,
+			realPath: realTarget
+		};
+	}
+	return {
+		contained: true,
+		path: joined
+	};
+}
+/**
+* The shared tail of every containment refusal: what the value resolved to,
+* what it escaped, and why that means the assembly is not CDK-generated. Each
+* call site supplies its own subject ("Stack 'X' has templateFile='...' which
+* ") and its own error class, because the sites throw four different types.
+* `action` completes "Refusing to ..." for a caller that declines something
+* other than loading the file — `renderNestedTemplateTreeDefect` says "deploy"
+* or "diff", matching its own sibling refusals.
+*
+* Every interpolation goes through `displaySafe` for the reason
+* `AssemblyReader`'s own refusals give (go-to-k/cdkd#3277): this text exists
+* FOR a hand-modified assembly, so the candidate, the resolved path and even
+* `dir` (below a Stage it derives from the manifest's `directoryName`) are all
+* attacker-chosen, and `formatError` sanitizes only an error's `cause`, never
+* its own `message`.
+*/
+function renderAssemblyPathEscape(escape, dir, action = "load", provenanceOverride) {
+	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const base = path.resolve(dir);
+	const realBase = resolveThroughLinks(base) ?? base;
+	if (escape.escape === "symlink") {
+		if (escape.realPath === realBase) return `resolves to '${displaySafe(escape.path)}', a symbolic link to the directory '${displaySafe(base)}' itself rather than to a file inside it. ${provenance}`;
+		return `resolves to '${displaySafe(escape.path)}', which leads through a symbolic link to '${displaySafe(escape.realPath)}', outside '${displaySafe(base)}'. ${provenance}`;
+	}
+	if (escape.path === base) return `names the directory '${displaySafe(base)}' itself rather than a file inside it. ${provenance}`;
+	return `resolves to '${displaySafe(escape.path)}', outside '${displaySafe(base)}'. ${provenance}`;
+}
+
 //#endregion
 //#region src/synthesis/stack-messages.ts
 /**
@@ -2833,7 +3059,9 @@ const MESSAGE_ENTRY_TYPES = {
 function collectStackMessages(assemblyDir, artifact) {
 	const merged = { ...artifact.metadata ?? {} };
 	if (artifact.additionalMetadataFile) {
-		const metadataPath = join(assemblyDir, artifact.additionalMetadataFile);
+		const resolved = resolveAssemblyPath(assemblyDir, artifact.additionalMetadataFile);
+		if (!resolved.contained) throw new SynthesisError(`Stack metadata file '${displaySafe(artifact.additionalMetadataFile)}' ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+		const metadataPath = resolved.path;
 		let sideFile;
 		try {
 			sideFile = JSON.parse(readFileSync(metadataPath, "utf-8"));
@@ -2935,7 +3163,7 @@ var AssemblyReader = class {
 	/**
 	* Get all stacks from assembly (recursively traverses nested assemblies / Stages)
 	*/
-	getAllStacks(assemblyDir, manifest) {
+	getAllStacks(assemblyDir, manifest, assetOutdir = assemblyDir) {
 		if (!manifest.artifacts) {
 			this.logger.warn("No artifacts found in manifest");
 			return [];
@@ -2943,15 +3171,17 @@ var AssemblyReader = class {
 		const assetManifestMap = this.buildAssetManifestMap(assemblyDir, manifest);
 		const stacks = [];
 		for (const [artifactId, artifact] of Object.entries(manifest.artifacts)) if (artifact.type === "aws:cloudformation:stack") {
-			const stackInfo = this.extractStackInfo(assemblyDir, artifactId, artifact, manifest, assetManifestMap);
+			const stackInfo = this.extractStackInfo(assemblyDir, artifactId, artifact, manifest, assetManifestMap, assetOutdir);
 			stacks.push(stackInfo);
 		} else if (artifact.type === "cdk:cloud-assembly") {
 			const props = artifact.properties;
 			if (props?.directoryName) {
-				const nestedDir = join(assemblyDir, props.directoryName);
+				const resolved = resolveAssemblyPath(assemblyDir, props.directoryName);
+				if (!resolved.contained) throw new SynthesisError(`Nested assembly '${displaySafe(props.directoryName)}' ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				const nestedDir = resolved.path;
 				try {
 					const nestedManifest = this.readManifest(nestedDir);
-					const nestedStacks = this.getAllStacks(nestedDir, nestedManifest);
+					const nestedStacks = this.getAllStacks(nestedDir, nestedManifest, assetOutdir);
 					stacks.push(...nestedStacks);
 				} catch (error) {
 					this.logger.warn(`Failed to read nested assembly '${displaySafe(props.directoryName)}': ${displaySafe(error instanceof Error ? error.message : String(error))}`);
@@ -2985,19 +3215,25 @@ var AssemblyReader = class {
 		for (const [artifactId, artifact] of Object.entries(manifest.artifacts)) {
 			if (artifact.type !== "cdk:asset-manifest") continue;
 			const props = artifact.properties;
-			if (props?.file) map.set(artifactId, join(assemblyDir, props.file));
+			if (props?.file) {
+				const resolved = resolveAssemblyPath(assemblyDir, props.file);
+				if (!resolved.contained) throw new SynthesisError(`Asset manifest artifact '${displaySafe(artifactId)}' has file='${displaySafe(props.file)}' which ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				map.set(artifactId, resolved.path);
+			}
 		}
 		return map;
 	}
 	/**
 	* Extract stack info from artifact
 	*/
-	extractStackInfo(assemblyDir, artifactId, artifact, manifest, assetManifestMap) {
+	extractStackInfo(assemblyDir, artifactId, artifact, manifest, assetManifestMap, assetOutdir) {
 		const props = artifact.properties;
 		const stackName = props?.stackName || artifactId;
 		const templateFile = props?.templateFile;
 		if (!templateFile) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has no templateFile property`);
-		const templatePath = join(assemblyDir, templateFile);
+		const resolvedTemplate = resolveAssemblyPath(assemblyDir, templateFile);
+		if (!resolvedTemplate.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has templateFile='${displaySafe(templateFile)}' which ${renderAssemblyPathEscape(resolvedTemplate, assemblyDir)}`);
+		const templatePath = resolvedTemplate.path;
 		let template;
 		try {
 			const content = readFileSync(templatePath, "utf-8");
@@ -3031,7 +3267,9 @@ var AssemblyReader = class {
 			const assetPath = resource.Metadata?.["aws:asset:path"];
 			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
 			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
-			nestedTemplates[logicalId] = join(assemblyDir, assetPath);
+			const resolvedNested = resolveAssemblyPath(assemblyDir, assetPath);
+			if (!resolvedNested.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
+			nestedTemplates[logicalId] = resolvedNested.path;
 		}
 		return {
 			stackName,
@@ -3039,6 +3277,7 @@ var AssemblyReader = class {
 			artifactId,
 			template,
 			assetManifestPath,
+			assetOutdir,
 			dependencyNames,
 			region: env?.region !== "unknown-region" ? env?.region : void 0,
 			account: env?.account !== "unknown-account" ? env?.account : void 0,
@@ -4411,6 +4650,141 @@ function decodeListingKey(value) {
 	}
 }
 
+//#endregion
+//#region src/state/record-keys.ts
+/**
+* The ONE encoding anything that identifies a producer-side thing by a pair of
+* runtime strings goes through — a warned-once `Set`, a dedupe `Set`, a
+* memoization `Map`, a tree's node index.
+*
+* An import-free LEAF, the same shape as `src/utils/display-safe.ts` and
+* `src/utils/parameter-types.ts`, and that is load-bearing rather than tidy:
+* the consumers span the `cli`, `state` and `deployment` layers, and one of
+* them — `src/cli/commands/state-list-tree.ts` — is deliberately kept with NO
+* imports at all so the tree-building logic is unit-testable without mocking
+* anything. These functions previously lived in `malformed-resources-bag.ts`,
+* which reaches `error-handler` / `display-safe` / `lock-contention-message`,
+* and that module still RE-EXPORTS them so no existing importer moved.
+*
+* ENCODED, not separated. Issue
+* [#3308](https://github.com/go-to-k/cdkd/issues/3308) is the measurement
+* behind that and issue [#3323](https://github.com/go-to-k/cdkd/issues/3323)
+* is the one that found how far the class ran. Both halves of every key here
+* are attacker-influenced, and a separator only NARROWS a collision: with a
+* NUL separator, stack `Evil<NUL>us-east-1` in `ap-northeast-1` and stack
+* `Evil` in region `us-east-1<NUL>ap-northeast-1` produce the SAME key.
+*
+* `JSON.stringify` of a two-element array is injective over string pairs: the
+* quoting escapes anything that could imitate the separator, so no planted
+* value can produce another pair's key.
+*
+* **What a collision COSTS is per SITE, not a property of the key, and a note
+* here once claimed otherwise** — "one dropped warning LINE, never a wrong
+* resolution". That held for the two warned-once sets it was written for and
+* is false at three `cdkd scrub` sites, where a collision is a wrong ANSWER
+* feeding the pre-pass that decides whether a producer still holds plaintext.
+* Do not restore the narrower sentence: it reads as a licence to leave a
+* separator at a site nobody has re-checked.
+*
+* **Whether a separator was EVER injective is also per site**, because it
+* depends on each half's PROVENANCE. A half read out of an S3 key segment
+* cannot carry a NUL — measured on go-to-k/cdkd#3323, S3 refuses to store such
+* a key — so a key whose LEFT half is a segment splits uniquely at the FIRST
+* NUL. **The rule is two-sided and the dual is easy to miss**: a NUL-free
+* RIGHT half splits uniquely at the LAST one, which is what actually held at
+* one of the sites here. A half read out of a TEMPLATE or a state body is
+* gated by neither.
+*
+* Do not settle a site by asking whether the SEPARATOR is storable. That
+* question was asked twice on go-to-k/cdkd#3323 and gave the wrong answer both
+* times, in opposite directions. Encoding removes the need to ask at all,
+* which is why it is the fix rather than a wider separator.
+*/
+/** The ONE spelling of the encoding, private so no caller can re-derive it. */
+function injectivePairKey(first, second) {
+	return JSON.stringify([first, second]);
+}
+/**
+* The same rule for a key of MORE than two parts.
+*
+* The named wrappers above stay, because a `(stack, region)` record and a
+* `(stack, export)` coordinate are things worth naming. This one is for the
+* keys that are just a tuple — an idempotency-token memo key, a resource-pair
+* edge — where a name would add nothing and a positional list is the honest
+* shape. It is exported rather than private for the same reason the two are:
+* so a call site can adopt the rule without re-spelling the encoding
+* (go-to-k/cdkd#3496).
+*
+* `number` is accepted because several of these tuples carry one, and
+* stringifying at the call site would put the coercion back where a caller can
+* get it wrong. `JSON.stringify` distinguishes `1` from `"1"`, so a mixed
+* tuple stays injective across the two.
+*
+* KNOWN HOLE in that, recorded rather than guarded: `NaN`, `Infinity` and
+* `-Infinity` all stringify to `null`, so those three collapse onto one key
+* and onto a literal `null`. No call site passes one — every numeric argument
+* today is a literal bound (`64`, `32`) — and a runtime refusal would turn a
+* key builder into a throwing path for a value that cannot arrive. Check this
+* note before passing a COMPUTED number.
+*
+* Note what this does to a DIGEST that hashes the result: the encoded string
+* carries no raw control character at all — `JSON.stringify` escapes a NUL to
+* the six-character text `\u0000` — so a hash input that separates this key
+* from its neighbours with a NUL is injective too, without the separator
+* having to be chosen carefully.
+*/
+function injectiveKey(...parts) {
+	return JSON.stringify(parts);
+}
+/**
+* The prefix every {@link injectiveKey} OF TWO OR MORE PARTS whose first part
+* is `first` begins with. The arity matters and an earlier revision of this
+* line omitted it: a ONE-part key ends with a bracket where this prefix ends
+* with a comma, so it does not match one. Both call sites build two parts.
+*
+* It exists for the one reader shape an encoded key otherwise breaks: a cache that
+* evicts by scanning its keys for a leading component.
+*
+* DERIVED from the same encoder rather than spelled again, and that is the
+* whole point. go-to-k/cdkd#3496's first cut encoded three provider caches and
+* left `invalidateAttributeCache` testing the OLD `<physicalId>:` prefix, so
+* the scan matched nothing and every post-update `Fn::GetAtt` read the
+* pre-update value — silently, with every gate green. A prefix computed here
+* cannot drift from the key computed two functions up.
+*
+* Exact, not a heuristic: `JSON.stringify([first])` quotes and escapes `first`,
+* so replacing its closing `]` with `,` yields a string no OTHER first part can
+* begin with. Deriving it by searching the encoded key for a comma would NOT
+* be exact — a comma inside the value is not escaped by JSON.
+*/
+function injectiveKeyPrefix(first) {
+	return JSON.stringify([first]).slice(0, -1) + ",";
+}
+/**
+* The key for a state RECORD: the `(stackName, region)` pair that names one
+* `state.json`.
+*/
+function producerRecordKey(stackName, region) {
+	return injectivePairKey(stackName, region);
+}
+/**
+* The key for a producer COORDINATE: a `(stack, export-or-output name)` pair,
+* used by `cdkd scrub`'s re-export chain walk and its per-coordinate verdict
+* cache.
+*
+* A separate NAME because the subject is a different thing — a coordinate is
+* not a record, and a call site reading `producerRecordKey(stack, exportName)`
+* would say something false. ONE implementation, though, which is the property
+* the "one spelling" rule is actually about: two names over one implementation
+* cannot drift, two implementations can.
+*
+* An `exportName` is REDACTED on the way into state
+* (`StateImportEntry`'s JSDoc), so this half may hold any string at all.
+*/
+function producerCoordinateKey(stackName, exportOrOutputName) {
+	return injectivePairKey(stackName, exportOrOutputName);
+}
+
 //#endregion
 //#region src/state/s3-replication-purge-gap.ts
 /**
@@ -4730,7 +5104,7 @@ async function runProbe(s3Client, bucket, requestFields) {
 	}
 }
 function probe(s3Client, bucket, requestFields) {
-	const key = `${bucket}\u0000${requestFields.ExpectedBucketOwner ?? ""}`;
+	const key = injectiveKey(bucket, requestFields.ExpectedBucketOwner ?? "");
 	const cached = replicationProbeCache.get(key);
 	if (cached) return cached;
 	const pending = runProbe(s3Client, bucket, requestFields).then((result) => {
@@ -4790,11 +5164,7 @@ async function warnIfPurgeIsReplicated(s3Client, bucket, keys, options = {}) {
 		const covered = result.rules.filter((rule) => keys.some((key) => key.startsWith(rule.prefix)));
 		if (covered.length === 0) return;
 		const destinations = [...new Set(covered.map((rule) => rule.enabled ? rule.destination : `${rule.destination} (rule currently Disabled -- it stops FUTURE replication, not what it already copied)`))].sort();
-		const warnKey = [
-			bucket,
-			options.objectDescription ?? "",
-			...destinations
-		].join("\0");
+		const warnKey = injectiveKey(bucket, options.objectDescription ?? "", ...destinations);
 		if (warnedWarnings.has(warnKey)) {
 			emitDebug(`S3 replication on s3://${safeBucket} still covers purged keys (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}); already reported once this run for ${destinations.map((d) => displaySafe(d, { asciiOnly: true })).join(", ")}.`);
 			return;
@@ -6235,6 +6605,24 @@ function setsEqual(a, b) {
 //#endregion
 //#region src/assets/asset-manifest-loader.ts
 /**
+* THE one spelling of "where does this file asset's source live", shared by
+* {@link AssetManifestLoader.getAssetSourcePath} and `FileAssetPublisher`
+* (issue [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
+* Both used to `join(cdkOutputDir, asset.source.path)` independently. The
+* manifest is chosen by whoever wrote the assembly, `path.join` folds `..`,
+* and the publisher ZIPs whatever it finds and `PutObject`s it to a bucket the
+* same manifest names — so an unchecked `source.path` is an exfiltration
+* primitive with the caller's own credentials, which is the harm the manifest
+* FILE's own containment check cites. One function so the loader and the
+* publisher cannot disagree about which file is published.
+*/
+function resolveFileAssetSourcePath(manifestDir, asset, assetOutdir = manifestDir) {
+	const resolved = resolveAssemblyPath(manifestDir, asset.source.path, { containWithin: assetOutdir });
+	if (!resolved.contained) throw new Error(`File asset '${displaySafe(asset.displayName)}' has source.path='${displaySafe(asset.source.path)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
+	return resolved.path;
+}
+/**
 * Whether a file asset's `source.path` is a CloudFormation template asset
 * (the stack template `<Stack>.template.json` or a nested-stack template
 * `<Stack>.<Nested>.nested.template.json`). cdkd deploys templates itself and
@@ -6266,7 +6654,9 @@ var AssetManifestLoader = class {
 	* @returns Asset manifest or null if not found
 	*/
 	async loadManifest(cdkOutputDir, stackName) {
-		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
+		const resolved = resolveAssemblyPath(cdkOutputDir, `${stackName}.assets.json`);
+		if (!resolved.contained) throw new Error(`Asset manifest for stack '${displaySafe(stackName)}' ${renderAssemblyPathEscape(resolved, cdkOutputDir)}`);
+		const manifestPath = resolved.path;
 		try {
 			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
 			const content = await readFile(manifestPath, "utf-8");
@@ -6302,12 +6692,18 @@ var AssetManifestLoader = class {
 	/**
 	* Get asset source path (absolute path)
 	*
+	* Refuses a `source.path` resolving outside `cdkOutputDir` (issue
+	* [#3489](https://github.com/go-to-k/cdkd/issues/3489)). The manifest is
+	* assembly-supplied and `cdkd deploy -a <dir>` consumes a pre-synthesized
+	* one, so a `source.path` of `../../../home/<user>/.aws` would otherwise be
+	* packaged and uploaded to a bucket the SAME manifest names.
+	*
 	* @param cdkOutputDir CDK output directory
 	* @param asset File asset
 	* @returns Absolute path to asset source
 	*/
-	getAssetSourcePath(cdkOutputDir, asset) {
-		return join$1(cdkOutputDir, asset.source.path);
+	getAssetSourcePath(cdkOutputDir, asset, assetOutdir) {
+		return resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir ?? cdkOutputDir);
 	}
 	/**
 	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
@@ -6399,7 +6795,8 @@ var FileAssetPublisher = class {
 	* @param region AWS region
 	* @param profile AWS profile (optional)
 	*/
-	async publish(assetHash, asset, cdkOutputDir, accountId, region, _profile) {
+	async publish(assetHash, asset, cdkOutputDir, accountId, region, _profile, assetOutdir) {
+		const sourcePath = resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir ?? cdkOutputDir);
 		for (const [, dest] of Object.entries(asset.destinations)) {
 			const bucketName = this.resolvePlaceholders(dest.bucketName, accountId, region);
 			const objectKey = this.resolvePlaceholders(dest.objectKey, accountId, region);
@@ -6414,7 +6811,6 @@ var FileAssetPublisher = class {
 					this.logger.debug(`Asset already exists, skipping: s3://${bucketName}/${objectKey}`);
 					continue;
 				}
-				const sourcePath = join(cdkOutputDir, asset.source.path);
 				if (asset.source.packaging === "zip") await this.uploadZip(client, sourcePath, bucketName, objectKey);
 				else await this.uploadFile(client, sourcePath, bucketName, objectKey);
 				this.logger.debug(`✅ Published: s3://${bucketName}/${objectKey}`);
@@ -7734,6 +8130,28 @@ function describeDockerCapturedOutput(error, args, fallback) {
 //#endregion
 //#region src/assets/docker-build.ts
 /**
+* Where a Docker asset's build context lives, refusing a `source.directory`
+* that resolves outside `cdkOutDir` (issue
+* [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
+* The field is assembly-supplied and used BOTH as the executable's cwd and as
+* the `docker build` cwd, so an escaping value sends a directory from outside
+* `cdk.out` to BuildKit and bakes it into the image pushed to a repository the
+* same manifest names. Both sites used raw `${a}/${b}` concatenation, which
+* honours `..` exactly as `join` does; this is the one spelling they share.
+*
+* It throws through the CALLER's `wrapError` so each consumer keeps its own
+* typed error class, exactly as this module's other pre-docker refusals do.
+*
+* Twin of `resolveFileAssetSourcePath` and `resolveVerboseTemplatePath`.
+* Exported for unit testing.
+*/
+function resolveDockerContextDirectory(manifestDir, directory, wrapError, assetOutdir = manifestDir) {
+	const resolved = resolveAssemblyPath(manifestDir, directory, { containWithin: assetOutdir });
+	if (!resolved.contained) throw wrapError(`asset source.directory='${displaySafe(directory)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "build it")}`);
+	return resolved.path;
+}
+/**
 * Build a Docker image from a CDK asset source. Returns the local image
 * tag the caller should use for `docker tag` / `docker push` (publisher)
 * or `docker run` (local-invoke).
@@ -7751,10 +8169,11 @@ function describeDockerCapturedOutput(error, args, fallback) {
 async function buildDockerImage(asset, cdkOutDir, options) {
 	const source = asset.source;
 	const logger = getLogger().child("docker-build");
+	const contextDirectory = (directory) => resolveDockerContextDirectory(cdkOutDir, directory, options.wrapError, options.assetOutdir);
 	if (source.executable && source.executable.length > 0) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
-		const cwd = source.directory ? `${cdkOutDir}/${source.directory}` : cdkOutDir;
+		const cwd = source.directory ? contextDirectory(source.directory) : cdkOutDir;
 		const shownExecutable = redactDockerArgvValues(source.executable).join(" ");
 		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
 		let result;
@@ -7778,9 +8197,9 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	}
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
-	const contextDir = `${cdkOutDir}/${source.directory}`;
+	const contextDir = contextDirectory(source.directory);
 	buildArgs.push(".");
-	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${contextDir})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displaySafe(contextDir)})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
@@ -7910,8 +8329,8 @@ var DockerAssetPublisher = class {
 	* via `docker tag` so the downstream `push()` step (which is wired to
 	* `localTag` at graph-construction time) keeps working unchanged.
 	*/
-	async build(asset, cdkOutputDir, localTag) {
-		await this.buildImage(asset, cdkOutputDir, localTag);
+	async build(asset, cdkOutputDir, localTag, assetOutdir) {
+		await this.buildImage(asset, cdkOutputDir, localTag, assetOutdir);
 	}
 	/**
 	* Push a pre-built Docker image to ECR (public, used by WorkGraph asset-publish nodes)
@@ -7967,9 +8386,10 @@ var DockerAssetPublisher = class {
 	* downstream push step finds the image under the deterministic
 	* `cdkd-asset-<hash>` name it expects.
 	*/
-	async buildImage(asset, cdkOutputDir, tag) {
+	async buildImage(asset, cdkOutputDir, tag, assetOutdir) {
 		const actualTag = await buildDockerImage(asset, cdkOutputDir, {
 			tag,
+			...assetOutdir !== void 0 && { assetOutdir },
 			wrapError: (stderr) => new AssetError(`Docker build failed: ${stderr}`)
 		});
 		if (actualTag !== tag) {
@@ -9342,6 +9762,7 @@ var AssetPublisher = class {
 		const content = readFileSync(manifestPath, "utf-8");
 		const manifest = JSON.parse(content);
 		const cdkOutputDir = manifestPath.replace(/\/[^/]+$/, "");
+		const assetOutdir = options.assetOutdir ?? cdkOutputDir;
 		const prefix = options.nodePrefix || "";
 		const redirect = options.redirect;
 		const nodeIds = [];
@@ -9358,6 +9779,7 @@ var AssetPublisher = class {
 					hash,
 					asset,
 					cdkOutputDir,
+					assetOutdir,
 					accountId: options.accountId,
 					region: options.region,
 					...options.profile && { profile: options.profile }
@@ -9380,6 +9802,7 @@ var AssetPublisher = class {
 					hash,
 					asset,
 					cdkOutputDir,
+					assetOutdir,
 					localTag
 				}
 			});
@@ -9406,8 +9829,8 @@ var AssetPublisher = class {
 	*/
 	async executeNode(node) {
 		const data = node.data;
-		if (data.kind === "file") await this.filePublisher.publish(data.hash, data.asset, data.cdkOutputDir, data.accountId, data.region, data.profile);
-		else if (data.kind === "docker-build") await this.dockerPublisher.build(data.asset, data.cdkOutputDir, data.localTag);
+		if (data.kind === "file") await this.filePublisher.publish(data.hash, data.asset, data.cdkOutputDir, data.accountId, data.region, data.profile, data.assetOutdir);
+		else if (data.kind === "docker-build") await this.dockerPublisher.build(data.asset, data.cdkOutputDir, data.localTag, data.assetOutdir);
 		else if (data.kind === "docker-publish") await this.dockerPublisher.push(data.asset, data.accountId, data.region, data.localTag);
 		this.logger.debug(`✅ ${node.id}`);
 	}
@@ -10162,85 +10585,6 @@ async function buildLockContentionMessage(args) {
 	return `${head} ${advice}, run: ${recoveryCommand}`;
 }
 
-//#endregion
-//#region src/state/record-keys.ts
-/**
-* The ONE encoding anything that identifies a producer-side thing by a pair of
-* runtime strings goes through — a warned-once `Set`, a dedupe `Set`, a
-* memoization `Map`, a tree's node index.
-*
-* An import-free LEAF, the same shape as `src/utils/display-safe.ts` and
-* `src/utils/parameter-types.ts`, and that is load-bearing rather than tidy:
-* the consumers span the `cli`, `state` and `deployment` layers, and one of
-* them — `src/cli/commands/state-list-tree.ts` — is deliberately kept with NO
-* imports at all so the tree-building logic is unit-testable without mocking
-* anything. These functions previously lived in `malformed-resources-bag.ts`,
-* which reaches `error-handler` / `display-safe` / `lock-contention-message`,
-* and that module still RE-EXPORTS them so no existing importer moved.
-*
-* ENCODED, not separated. Issue
-* [#3308](https://github.com/go-to-k/cdkd/issues/3308) is the measurement
-* behind that and issue [#3323](https://github.com/go-to-k/cdkd/issues/3323)
-* is the one that found how far the class ran. Both halves of every key here
-* are attacker-influenced, and a separator only NARROWS a collision: with a
-* NUL separator, stack `Evil<NUL>us-east-1` in `ap-northeast-1` and stack
-* `Evil` in region `us-east-1<NUL>ap-northeast-1` produce the SAME key.
-*
-* `JSON.stringify` of a two-element array is injective over string pairs: the
-* quoting escapes anything that could imitate the separator, so no planted
-* value can produce another pair's key.
-*
-* **What a collision COSTS is per SITE, not a property of the key, and a note
-* here once claimed otherwise** — "one dropped warning LINE, never a wrong
-* resolution". That held for the two warned-once sets it was written for and
-* is false at three `cdkd scrub` sites, where a collision is a wrong ANSWER
-* feeding the pre-pass that decides whether a producer still holds plaintext.
-* Do not restore the narrower sentence: it reads as a licence to leave a
-* separator at a site nobody has re-checked.
-*
-* **Whether a separator was EVER injective is also per site**, because it
-* depends on each half's PROVENANCE. A half read out of an S3 key segment
-* cannot carry a NUL — measured on go-to-k/cdkd#3323, S3 refuses to store such
-* a key — so a key whose LEFT half is a segment splits uniquely at the FIRST
-* NUL. **The rule is two-sided and the dual is easy to miss**: a NUL-free
-* RIGHT half splits uniquely at the LAST one, which is what actually held at
-* one of the sites here. A half read out of a TEMPLATE or a state body is
-* gated by neither.
-*
-* Do not settle a site by asking whether the SEPARATOR is storable. That
-* question was asked twice on go-to-k/cdkd#3323 and gave the wrong answer both
-* times, in opposite directions. Encoding removes the need to ask at all,
-* which is why it is the fix rather than a wider separator.
-*/
-/** The ONE spelling of the encoding, private so no caller can re-derive it. */
-function injectivePairKey(first, second) {
-	return JSON.stringify([first, second]);
-}
-/**
-* The key for a state RECORD: the `(stackName, region)` pair that names one
-* `state.json`.
-*/
-function producerRecordKey(stackName, region) {
-	return injectivePairKey(stackName, region);
-}
-/**
-* The key for a producer COORDINATE: a `(stack, export-or-output name)` pair,
-* used by `cdkd scrub`'s re-export chain walk and its per-coordinate verdict
-* cache.
-*
-* A separate NAME because the subject is a different thing — a coordinate is
-* not a record, and a call site reading `producerRecordKey(stack, exportName)`
-* would say something false. ONE implementation, though, which is the property
-* the "one spelling" rule is actually about: two names over one implementation
-* cannot drift, two implementations can.
-*
-* An `exportName` is REDACTED on the way into state
-* (`StateImportEntry`'s JSDoc), so this half may hold any string at all.
-*/
-function producerCoordinateKey(stackName, exportOrOutputName) {
-	return injectivePairKey(stackName, exportOrOutputName);
-}
-
 //#endregion
 //#region src/utils/bucket-region-client.ts
 /**
@@ -12875,10 +13219,17 @@ function recordedExpressionsOf(secrets) {
 * the shape PR #2415 was forced to WITHDRAW (`provenPublicExpressions`,
 * residual #2425): keyed on a value alone, one stack's answer is served to
 * another stack's identically-spelled read. Here the key names the producer
-* stack, its region and the output — so a hit is served only to a resolution
-* that asked for that exact output of that exact stack, i.e. to precisely the
-* reader that would have received the plaintext before this feature existed.
-* Nothing is widened.
+* stack, its region and the output — so a hit is served to a resolution that
+* asked for that output of that stack, i.e. to the reader that would have
+* received the plaintext before this feature existed.
+*
+* `precisely`, in an earlier revision, overstated it. The key is
+* NUL-SEPARATED rather than encoded, and the halves are not all
+* charset-constrained, so a forged coordinate CAN collide with another's
+* key — see {@link maskedOutputKey} for why that is left standing and what
+* would change the answer (go-to-k/cdkd#3496). The bound that does hold is
+* the one above it: whoever can forge such a coordinate can already aim at
+* the real one, so nothing is widened by the collision either.
 *
 * A RECOVERED VALUE IS STILL SECRET, and every reader re-registers it as a
 * mask-only needle in its OWN bag before using it — the recovery hands back the
@@ -12911,11 +13262,23 @@ const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
 /**
 * Separator for the composite keys {@link crossStackSourceKey} builds.
 *
-* A NUL rather than a printable character because no AWS export name, stack
-* name, output name, region or role ARN can contain one, so no two distinct
-* source leaves can spell a single key. A printable separator (`:` / `|`) does
-* occur inside a real export name — CDK's own convention is
+* A NUL rather than a printable character: a printable separator (`:` / `|`)
+* does occur inside a real export name — CDK's own convention is
 * `Stack:ExportName` — which would let one leaf's key be read as another's.
+*
+* **It does NOT follow that no two distinct source leaves can spell a single
+* key, and this note asserted that for a while** (go-to-k/cdkd#3496). The
+* reason given was that no AWS export name, stack name, output name, region or
+* role ARN can contain a NUL — a claim about what AWS ACCEPTS, while these
+* halves are TEMPLATE literals read straight out of the intrinsic. A hand-written
+* template can put a NUL in any of them.
+*
+* What makes the key safe is not injectivity but what happens on a collision:
+* the association store POISONS a slot recorded against a differing
+* (expression, plaintext) pair rather than overwriting it, and the scope is a
+* `WeakMap` on the pass's own bag. So a forged key degrades to a REFUSAL, never
+* to one leaf's expression being served for another's. Keep that property if
+* this separator is ever revisited; it, not the charset, is the guarantee.
 */
 const CROSS_STACK_KEY_SEPARATOR = "\0";
 /** A non-empty literal string, or `undefined` for anything else. */
@@ -17149,7 +17512,7 @@ function extractLambdaVpcDeleteDeps(resources) {
 		for (const targetId of targets) {
 			if (targetId === lambdaId) continue;
 			if (!(targetId in resources)) continue;
-			const key = `${lambdaId}\u0000${targetId}`;
+			const key = injectiveKey(lambdaId, targetId);
 			if (seen.has(key)) continue;
 			seen.add(key);
 			edges.push({
@@ -27809,7 +28172,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	cachedDynamicReferences = /* @__PURE__ */ new Map();
 	/**
-	* `<parameter name>\u0000<reported Type>` pairs this resolver has already
+	* `(parameter name, reported Type)` pairs this resolver has already
 	* warned about (issue #1933 review).
 	*
 	* Keyed on the PAIR rather than the name alone: two different anomalous types
@@ -30427,7 +30790,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* contract as {@link lookupCfnExport}.
 	*/
 	async lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
-		const cacheKey = `${region}\0${stackName}`;
+		const cacheKey = injectiveKey(region, stackName);
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
 			fetch = this.fetchCfnStackOutputs(stackName, region);
@@ -31926,8 +32289,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${loggedParameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
-		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
-			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
+		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(parameterName, String(paramType)))) {
+			this.warnedUnrecognizedSsmTypes.add(injectiveKey(parameterName, String(paramType)));
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
 			this.logger.warn(`SSM parameter '${loggedParameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
@@ -33612,7 +33975,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CPWB3m4b.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C9R-ND4b.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -47320,5 +47683,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, ConfigError as $i, STATE_SOURCED_BASELINE_RULES as $n, readBootstrapMarkerBody as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, safeStringify$1 as Aa, warnDeprecatedNoPrefixCliFlag as Ai, malformedResourcePropertiesWarning as An, hasReadableExportSet as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, PARTITION_TABLE as Bi, refuseMalformedState as Bn, stringifyValue as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, isRetryableTransientError as Ca, resolveAutoAssetStorage as Ci, malformedExportSourceWarning as Cn, buildLockContentionMessage as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, markRedactedCause as Da, resolveStateBucketWithDefaultAndSource as Di, malformedOutputsWarning as Dn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, markNonRetryable as Ea, resolveStateBucketWithDefault as Ei, malformedOutputsRefusalMessage as En, shellQuote as Er, deleteSkipReason as Et, extractDeploymentEventError as F, findLargeInlineResources as Fi, refuseMalformedOutputs as Fn, isReadableBag as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, clearBucketRegionCache as Gi, safeRegion as Gn, rewriteTemplateAssetReferences as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, derivePartitionAndUrlSuffix as Hi, repairMalformedResourceEntriesForReadOnly as Hn, buildAssetRedirectMap as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, uploadCfnTemplate as Ii, refuseMalformedOutputsForDestroy as In, orphansAfterRollback as Ir, isNamelessDynamicReferenceError as It, bold as J, getAwsClients as Ji, findSilentDropProperties as Jn, assertAssetBucketRegion as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, resolveBucketRegion as Ki, safeStackName as Kn, AssetModeResolver as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Li, refuseMalformedResourceEntries as Ln, orphansCarriedFrom as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, CFN_TEMPLATE_BODY_LIMIT as Mi, malformedStateRefusalMessage as Mn, hasUnverifiableParameterRefusal as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, CFN_TEMPLATE_URL_LIMIT as Ni, refuseDivergentRecordRegionForDestroy as Nn, importableOutputKeys as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, retryClassificationText as Oa, resolveUseCdkBootstrapAssets as Oi, malformedRenderedContainersWarning as On, DEFAULT_STATE_PREFIX as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, MIGRATE_TMP_PREFIX as Pi, refuseMalformedNestedChildOutputs as Pn, importableOutputs as Pr, getAccountInfo as Pt, red as Q, CdkdError as Qi, TemplateParser as Qn, parseBootstrapMarker as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, decodeListingKey as Ri, refuseMalformedResourcePropertiesForOrphan as Rn, shouldRetainResource as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, isMarkedNonRetryable as Sa, resolveApp as Si, malformedExportNamesWarning as Sn, buildForceUnlockCommand as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, isTransientServerError as Ta, resolveSkipPrefix as Ti, malformedOrphanRecordsWarning as Tn, formatLockExpiry as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, AssemblyReader as Ui, repairMalformedResourcePropertiesForReadOnly as Un, createAssetRedirectResolver as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, canonicalizeRegion as Vi, repairMalformedOutputsForReadOnly as Vn, WorkGraph as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, processStackMessages as Wi, repairMalformedResourcesForReadOnly as Wn, loadPublishableAssetManifest as Wr, assertRegionMatch as Wt, gray as X, setAwsClients as Xi, withRetry as Xn, getBootstrapMarkerKey as Xr, readConfigString as Xt, cyan as Y, resetAwsClients as Yi, describeTypeWithThrottleRetry as Yn, ensureAssetStorage as Yr, configStringRefusal as Yt, green as Z, AssetError as Zi, DagBuilder as Zn, isCrossRegionRedirect as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, SynthesisError as _a, getDockerImageBySourceHash as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, S3StateBackend as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, LocalInvokeBuildError as aa, describeDockerExecFailure as ai, s3BucketDomainName as an, dynamicReferenceTokens as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, normalizeAwsError as ba, getDefaultStateBucketName as bi, hasReadableResources as bn, producerRecordKey as br, startInterruptWatch as bt, replayFailedOperations as c, MalformedProducerRecordRefusalError as ca, formatDockerLoginError as ci, s3BucketWebsiteUrl as cn, isSingleDynamicReferenceToken as cr, IAMRoleProvider as ct, updatePartialMessage as d, ProvisioningError as da, redactDockerArgvValues as di, applyCallerIdentityCredentials as dn, maskSecretsInText as dr, ProviderRegistry as dt, CrossAccountSecretRefusalError as ea, validateAssetBucketName as ei, requireConfigString as en, STATE_SOURCED_CROSS_GENERATION_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, ResourceTimeoutError as fa, runDockerForeground as fi, callerEnvCredentials as fn, recordMaskOnlyValue as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, StateError as ga, AssetManifestLoader as gi, STATE_RESOURCES_MALFORMED as gn, LockManager as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, StackTerminationProtectionError as ha, stripControlChars as hi, INTRINSIC_KEYS as hn, scrubResourceRecord as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, IntrinsicResolutionRefusalError as ia, describeDockerCapturedOutput as ii, s3BucketArn as in, createSecretMasker as ir, secretBearing as it, isFinalSnapshotError as j, __exportAll as ja, ssmResolvedValueType as ji, malformedResourcesWarning as jn, hasReasonlessBaselineRefusal as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, describeAwsFailure as ka, stateBucketExistenceConfirmed as ki, malformedResourceEntriesWarning as kn, exportNamesCarriedFrom as kr, IntrinsicFunctionResolver as kt, replayRollback as l, NestedStackChildDirectDestroyError as la, getDockerCmd as li, applyRoleArnIfSet as ln, markSameGenerationBag as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, StackHasActiveImportsError as ma, escapeRegExp$1 as mi, DiffCalculator as mn, redactSecretsForState as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DeployCancelledError as na, buildDenyExternalAccessPolicy as ni, producerRegionsFromState as nn, TEMPLATE_SOURCED_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, LocalStartServiceError as oa, describeDockerFailure as oi, s3BucketDualStackDomainName as on, errorCauseChain as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, ResourceUpdateNotSupportedError as pa, runDockerStreaming as pi, envCredentialsAreAssumedRole as pn, recoverMaskedOutput as pr, createMaskedRetryLogger as pt, formatResourceLine as q, AwsClients as qi, findActionableSilentDrops as qn, BOOTSTRAP_MARKER_PREFIX as qr, configBooleanRefusal as qt, DeployEngine as r, DynamicReferenceRegionAmbiguousError as ra, buildDockerImage as ri, withSharedDrainBudget as rn, carriesSecretMask as rr, isExportAliasCollision as rt, planRollback as s, LockError as sa, dockerSpawnEnvWithSensitive as si, s3BucketRegionalDomainName as sn, identityKeyFor as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DependencyError as ta, validateContainerRepoName as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_READBACK_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, PartialFailureError as ua, partitionSensitiveEnv as ui, AWS_CREDENTIAL_ENV_KEYS as un, maskSecretsInError as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, formatError as va, Synthesizer as vi, displayLogicalId as vn, rebuildClientForBucketRegion as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isThrottlingError as wa, resolveCaptureObservedState as wi, malformedLocalOutputsWarning as wn, forceQuitRecoveryClause as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, withErrorHandling as xa, getLegacyStateBucketName as xi, isReadableResourceEntry as xn, UNREPRODUCIBLE_LOCK_CLAUSE as xr, CloudControlProvider as xt, keptWholeReasonText as y, isCdkdError as ya, synthesisStatusMessage as yi, hasReadableOutputs as yn, producerCoordinateKey as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, expectedOwnerParam as zi, refuseMalformedResourcesForDestroy as zn, AssetPublisher as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-RoGuHEgf.js.map
+export { yellow as $, getAwsClients as $i, STATE_SOURCED_BASELINE_RULES as $n, validateContainerRepoName as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, isTransientServerError as Aa, ssmResolvedValueType as Ai, malformedResourcePropertiesWarning as An, hasUnverifiableParameterRefusal as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, producerRecordKey as Bi, refuseMalformedState as Bn, buildAssetRedirectMap as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, formatError as Ca, resolveCaptureObservedState as Ci, malformedExportSourceWarning as Cn, formatLockExpiry as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, isMarkedNonRetryable as Da, resolveUseCdkBootstrapAssets as Di, malformedOutputsWarning as Dn, exportNamesCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, withErrorHandling as Ea, resolveStateBucketWithDefaultAndSource as Ei, malformedOutputsRefusalMessage as En, DEFAULT_STATE_PREFIX as Er, deleteSkipReason as Et, extractDeploymentEventError as F, safeStringify$1 as Fa, uploadCfnTemplate as Fi, refuseMalformedOutputs as Fn, orphansCarriedFrom as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, derivePartitionAndUrlSuffix as Gi, safeRegion as Gn, BOOTSTRAP_MARKER_PREFIX as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, expectedOwnerParam as Hi, repairMalformedResourceEntriesForReadOnly as Hn, loadPublishableAssetManifest as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, __exportAll as Ia, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ii, refuseMalformedOutputsForDestroy as In, shouldRetainResource as Ir, isNamelessDynamicReferenceError as It, bold as J, renderAssemblyPathEscape as Ji, findSilentDropProperties as Jn, getBootstrapMarkerKey as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, AssemblyReader as Ki, safeStackName as Kn, assertAssetBucketRegion as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, injectiveKey as Li, refuseMalformedResourceEntries as Ln, AssetPublisher as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, markRedactedCause as Ma, CFN_TEMPLATE_URL_LIMIT as Mi, malformedStateRefusalMessage as Mn, importableOutputs as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, retryClassificationText as Na, MIGRATE_TMP_PREFIX as Ni, refuseDivergentRecordRegionForDestroy as Nn, isReadableBag as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, isRetryableTransientError as Oa, stateBucketExistenceConfirmed as Oi, malformedRenderedContainersWarning as On, hasReadableExportSet as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, describeAwsFailure as Pa, findLargeInlineResources as Pi, refuseMalformedNestedChildOutputs as Pn, orphansAfterRollback as Pr, getAccountInfo as Pt, red as Q, AwsClients as Qi, TemplateParser as Qn, validateAssetBucketName as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, injectiveKeyPrefix as Ri, refuseMalformedResourcePropertiesForOrphan as Rn, stringifyValue as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, SynthesisError as Sa, resolveAutoAssetStorage as Si, malformedExportNamesWarning as Sn, forceQuitRecoveryClause as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, normalizeAwsError as Ta, resolveStateBucketWithDefault as Ti, malformedOrphanRecordsWarning as Tn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, PARTITION_TABLE as Ui, repairMalformedResourcePropertiesForReadOnly as Un, rewriteTemplateAssetReferences as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, decodeListingKey as Vi, repairMalformedOutputsForReadOnly as Vn, createAssetRedirectResolver as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, canonicalizeRegion as Wi, repairMalformedResourcesForReadOnly as Wn, AssetModeResolver as Wr, assertRegionMatch as Wt, gray as X, clearBucketRegionCache as Xi, withRetry as Xn, parseBootstrapMarker as Xr, readConfigString as Xt, cyan as Y, resolveAssemblyPath as Yi, describeTypeWithThrottleRetry as Yn, isCrossRegionRedirect as Yr, configStringRefusal as Yt, green as Z, resolveBucketRegion as Zi, DagBuilder as Zn, readBootstrapMarkerBody as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ResourceTimeoutError as _a, Synthesizer as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, S3StateBackend as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as aa, describeDockerFailure as ai, s3BucketDomainName as an, dynamicReferenceTokens as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, StackTerminationProtectionError as ba, getLegacyStateBucketName as bi, hasReadableResources as bn, buildForceUnlockCommand as br, startInterruptWatch as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ca, getDockerCmd as ci, s3BucketWebsiteUrl as cn, isSingleDynamicReferenceToken as cr, IAMRoleProvider as ct, updatePartialMessage as d, LocalStartServiceError as da, runDockerForeground as di, applyCallerIdentityCredentials as dn, maskSecretsInText as dr, ProviderRegistry as dt, resetAwsClients as ea, buildDenyExternalAccessPolicy as ei, requireConfigString as en, STATE_SOURCED_CROSS_GENERATION_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, LockError as fa, runDockerStreaming as fi, callerEnvCredentials as fn, recordMaskOnlyValue as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, ProvisioningError as ga, getDockerImageBySourceHash as gi, STATE_RESOURCES_MALFORMED as gn, LockManager as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, PartialFailureError as ha, AssetManifestLoader as hi, INTRINSIC_KEYS as hn, scrubResourceRecord as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, ConfigError as ia, describeDockerExecFailure as ii, s3BucketArn as in, createSecretMasker as ir, secretBearing as it, isFinalSnapshotError as j, markNonRetryable as ja, CFN_TEMPLATE_BODY_LIMIT as ji, malformedResourcesWarning as jn, importableOutputKeys as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, isThrottlingError as ka, warnDeprecatedNoPrefixCliFlag as ki, malformedResourceEntriesWarning as kn, hasReasonlessBaselineRefusal as kr, IntrinsicFunctionResolver as kt, replayRollback as l, IntrinsicResolutionRefusalError as la, partitionSensitiveEnv as li, applyRoleArnIfSet as ln, markSameGenerationBag as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, NestedStackChildDirectDestroyError as ma, stripControlChars as mi, DiffCalculator as mn, redactSecretsForState as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as na, resolveDockerContextDirectory as ni, producerRegionsFromState as nn, TEMPLATE_SOURCED_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, DependencyError as oa, dockerSpawnEnvWithSensitive as oi, s3BucketDualStackDomainName as on, errorCauseChain as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, MalformedProducerRecordRefusalError as pa, escapeRegExp$1 as pi, envCredentialsAreAssumedRole as pn, recoverMaskedOutput as pr, createMaskedRetryLogger as pt, formatResourceLine as q, processStackMessages as qi, findActionableSilentDrops as qn, ensureAssetStorage as qr, configBooleanRefusal as qt, DeployEngine as r, CdkdError as ra, describeDockerCapturedOutput as ri, withSharedDrainBudget as rn, carriesSecretMask as rr, isExportAliasCollision as rt, planRollback as s, DeployCancelledError as sa, formatDockerLoginError as si, s3BucketRegionalDomainName as sn, identityKeyFor as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ta, buildDockerImage as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_READBACK_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, LocalInvokeBuildError as ua, redactDockerArgvValues as ui, AWS_CREDENTIAL_ENV_KEYS as un, maskSecretsInError as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, ResourceUpdateNotSupportedError as va, synthesisStatusMessage as vi, displayLogicalId as vn, rebuildClientForBucketRegion as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isCdkdError as wa, resolveSkipPrefix as wi, malformedLocalOutputsWarning as wn, shellQuote as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, StateError as xa, resolveApp as xi, isReadableResourceEntry as xn, buildLockContentionMessage as xr, CloudControlProvider as xt, keptWholeReasonText as y, StackHasActiveImportsError as ya, getDefaultStateBucketName as yi, hasReadableOutputs as yn, UNREPRODUCIBLE_LOCK_CLAUSE as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, producerCoordinateKey as zi, refuseMalformedResourcesForDestroy as zn, WorkGraph as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-Bw8VoyEi.js.map