@go-to-k/cdkd 0.290.42 → 0.290.44

package/dist/{deploy-engine-C1dgx124.js → deploy-engine-CMD4BtQe.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-D-2HeLmd.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-DjBU2Ap3.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-Divizw1k.js";
+import { t as getCdkdVersion } from "./version-4uhXCFhs.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -25,7 +25,9 @@ import { CreateClusterSnapshotCommand, DescribeClusterSnapshotsCommand, Describe
 import { CreateSnapshotCommand as CreateSnapshotCommand$1, DescribeReplicationGroupsCommand, DescribeSnapshotsCommand as DescribeSnapshotsCommand$1, ElastiCacheClient } from "@aws-sdk/client-elasticache";
 import { ACMClient } from "@aws-sdk/client-acm";
 import { LambdaMicrovmsClient } from "@aws-sdk/client-lambda-microvms";
+import * as fs from "node:fs";
 import { createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
 import { basename, isAbsolute, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { homedir, tmpdir } from "node:os";
@@ -33,7 +35,6 @@ import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } fro
 import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBalancingV2Client } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
-import { join as join$1 } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
 import { inspect } from "node:util";
 import { hostname } from "os";
@@ -2803,6 +2804,316 @@ function parseEnvironment(env) {
 	};
 }
 
+//#endregion
+//#region src/utils/assembly-path.ts
+/**
+* `true` when `candidate` names something strictly beneath `base`, both given
+* as already-resolved absolute paths.
+*
+* The `..` test is SEPARATOR-AWARE rather than a bare `startsWith('..')`,
+* which would also reject a legitimate sibling named `..foo`. The empty-string
+* case is `base` itself: a directory is never a template, a manifest or a
+* metadata side file, so `.` and `./` are refused rather than read.
+*/
+function isInside(base, candidate) {
+	const rel = path.relative(base, candidate);
+	if (rel === "" || rel === "..") return false;
+	if (rel.startsWith(`..${path.sep}`)) return false;
+	return !path.isAbsolute(rel);
+}
+/**
+* `realpath(3)`, or `undefined` for a path that does not fully resolve.
+*
+* `.native` IS load-bearing and must not be simplified to `fs.realpathSync`.
+* The plain form is a JavaScript walker that folds `..` LEXICALLY — the same
+* mistake this module's own model branch is careful not to make — so it
+* disagrees with the kernel on a target carrying a `..` after a symlinked
+* component, in both directions:
+*
+* - It answers `ENOENT` for a path the kernel resolves and `readFileSync`
+*   then reads. With `cdk.out/a -> <outside>/sub` and
+*   `cdk.out/LINK.json -> a/../c.json` (both live), the JS walker folds to
+*   `cdk.out/c.json`, finds nothing, and the verdict falls through to the
+*   model — which folds the same way and calls it CONTAINED while the read
+*   returns `<outside>/c.json`. That is go-to-k/cdkd#3489's original defect,
+*   reopened by the guard meant to close it.
+* - On a case-insensitive filesystem (APFS by default) the same shape can make
+*   it SPIN. A `try`/`catch` cannot catch a spin, so a hand-modified assembly
+*   hung the very commands this check protects.
+*
+* `.native` is libuv's `realpath(3)` (`GetFinalPathNameByHandle` on Windows),
+* available since Node 8 against a floor of 22, and throws the same
+* `ENOENT` / `ELOOP` / `EACCES`. Using it is what makes the "exact whenever
+* the path resolves" claim above TRUE rather than aspirational.
+*/
+function tryRealpath(p) {
+	try {
+		return fs.realpathSync.native(p);
+	} catch {
+		return;
+	}
+}
+/** `fs.readlinkSync`, or `undefined` when `p` is not a symbolic link. */
+function tryReadlink(p) {
+	try {
+		return fs.readlinkSync(p);
+	} catch {
+		return;
+	}
+}
+/**
+* Link follows before the walk gives up and reports the path as unresolvable.
+* It does NOT refuse: an exhausted budget answers `undefined`, which leaves
+* the symlink arm silent and the lexical verdict standing. That is safe
+* because the OS gives up first — macOS caps at 32 (`ELOOP`) — so a chain that
+* reaches this cap is one nothing can read or create through anyway.
+*/
+const MAX_LINK_HOPS = 40;
+/**
+* Unresolvable path COMPONENTS the climb walks before giving up. Bounds the
+* recursion below, which is one frame per component: 20 000 components raised
+* an uncaught `RangeError` and 5 000 cost ~200 ms per call. Like the hop cap
+* this gives up rather than refusing, which is safe for the same reason —
+* nothing can read or create through a path that deep.
+*/
+const MAX_PATH_COMPONENTS = 1e3;
+/**
+* Where `target` REALLY points, for a path that may not exist yet.
+*
+* `fs.realpathSync` answers only for a path that fully resolves, and it throws
+* `ENOENT` for a DANGLING symbolic link exactly as it does for an absent file
+* — the two are indistinguishable from its result. That difference is the
+* whole point here: a write FOLLOWS a dangling link and creates the file at
+* its target, so `cdk.out/Foo.template.json -> ~/.ssh/authorized_keys` (target
+* absent) is an out-of-directory write that a realpath-only check reports as
+* contained. Measured: `cdkd synth --verbose` created the victim file.
+*
+* So each unresolvable component is handled by hand: climb to the deepest
+* ancestor that DOES resolve, then re-apply the remaining components,
+* following any symbolic link with `readlink` and re-resolving its target.
+* `undefined` means the walk could not resolve the path at all, which for
+* every caller means their own open fails too.
+*
+* KNOW WHAT THIS IS EXACT ABOUT, because the distinction is what bounds it:
+*
+* - For a path that FULLY RESOLVES, the answer is `fs.realpathSync`'s and is
+*   therefore exact. Every READ site is in this case by construction — a file
+*   that does not resolve cannot be read — so the containment verdict there is
+*   the kernel's, not this function's. The BASE side is exact there too: every
+*   one is either user-supplied (`-a`, `--output`, `cdkOutDir`) or the
+*   `dirname` of a file cdkd has just read successfully, so neither operand of
+*   a read is in the model's territory.
+* - For a path that does NOT exist yet, this is a best-effort MODEL of kernel
+*   resolution, and a model can be wrong at an edge. The known one: `..` INSIDE
+*   an unresolvable link's target is folded lexically here, while the kernel
+*   folds it only after following each preceding component, so a target of
+*   `a/../c.json` under a symlinked `a` diverges.
+*
+* That edge decides which of the TWO sites that WRITE needs a second check,
+* and the difference is the BASE rather than the act of writing:
+*
+* - `resolveVerboseTemplatePath` (`src/cli/commands/synth.ts`) writes into
+*   `--output`, which may be a pre-existing directory the assembly's author
+*   supplied, so the leaf CAN already be a symbolic link. It therefore asks
+*   the kernel directly with `lstat` and refuses one whatever it points at. A
+*   path-string model can be argued around; `lstat` cannot.
+* - `resolveInlineCodeFilePath` (`src/cli/commands/local-invoke.ts`) writes
+*   into a `mkdtemp` cdkd has just created, mode 0700 and empty, so no
+*   component of the candidate can be a symbolic link at all and the edge is
+*   unreachable. It needs no `lstat`.
+*
+* **A third write site over a base cdkd did not create needs the `lstat`**,
+* and inherits nothing from this function that would give it one.
+*
+* That second site is also the repo's first caller to `mkdirSync(...,
+* { recursive: true })` through a resolved path, which an earlier revision of
+* this comment leaned on not existing. It is still safe: the climb charges no
+* hop for a component, and exhausting `MAX_PATH_COMPONENTS` gives up into the
+* lexical verdict, which a freshly created directory has no link to defeat.
+*/
+function resolveThroughLinks(target, hops = 0, climbs = 0) {
+	const direct = tryRealpath(target);
+	if (direct !== void 0) return direct;
+	if (hops >= MAX_LINK_HOPS) return void 0;
+	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
+	const parent = path.dirname(target);
+	if (parent === target) return void 0;
+	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
+	if (realParent === void 0) return void 0;
+	const link = tryReadlink(target);
+	if (link === void 0) return path.join(realParent, path.basename(target));
+	return resolveThroughLinks(path.resolve(realParent, link), hops + 1, climbs);
+}
+/**
+* Resolve an assembly-supplied `candidate` against `dir` and report whether
+* the result stays inside it.
+*
+* The lexical arm joins exactly the way the call sites used to
+* (`path.join`, NOT `path.resolve`), so the verdict is about the path the
+* caller will actually open. `join`'s handling of an absolute candidate makes
+* this arm strictly more permissive than a `resolve`-based one would be; an
+* absolute value therefore stays a matter for each site's own tripwire.
+*
+* The SYMLINK arm exists because the lexical arm alone leaves an equivalent
+* hole: `cdk.out/link -> /etc` plus a candidate of `link/passwd` is lexically
+* contained and still reads `/etc/passwd`. Both sides go through
+* {@link resolveThroughLinks}, so an assembly directory REACHED through a link
+* (macOS spells `/tmp` as `/private/tmp`; a user may symlink `cdk.out` itself)
+* is unaffected, while a candidate that does not exist YET — the shape
+* `cdkd synth --verbose` writes, and the shape a DANGLING link presents — is
+* still resolved to where it would actually land. A real `cdk synth` writes no symbolic link
+* along any of these paths (measured against a CDK 2.268 assembly carrying a
+* Stage, two nesting levels and an asset manifest), so the arm costs a
+* legitimate assembly nothing.
+*
+* Windows shapes need no special case HERE: `path.relative` is the platform's
+* own, so a drive-relative or UNC candidate is judged by `path.win32` on
+* Windows, while on POSIX `C:\evil` and `..\..\evil` are single filename
+* components that no `readFileSync` can follow out of the directory.
+*
+* The verdict is about the assembly AS IT SITS ON DISK, which is the whole
+* threat model: a hand-modified or third-party `cdk.out` the user then points
+* cdkd at. It is NOT a defence against a process rewriting that directory
+* concurrently — the caller opens by path after this returns, so a link
+* swapped in between is outside what any check here can see.
+*/
+function resolveAssemblyPath(dir, candidate, options) {
+	const base = path.resolve(dir);
+	const bound = options?.containWithin === void 0 ? base : path.resolve(options.containWithin);
+	const joined = path.resolve(path.join(base, candidate));
+	if (!isInside(bound, joined)) return {
+		contained: false,
+		escape: "lexical",
+		path: joined
+	};
+	const realBase = resolveThroughLinks(bound);
+	if (realBase !== void 0) {
+		const realTarget = resolveThroughLinks(joined);
+		if (realTarget !== void 0 && !isInside(realBase, realTarget)) return {
+			contained: false,
+			escape: "symlink",
+			path: joined,
+			realPath: realTarget
+		};
+	}
+	return {
+		contained: true,
+		path: joined
+	};
+}
+/**
+* The shared tail of every containment refusal: what the value resolved to,
+* what it escaped, and why that means the assembly is not CDK-generated. Each
+* call site supplies its own subject ("Stack 'X' has templateFile='...' which
+* ") and its own error class, because the sites throw four different types.
+* `action` completes "Refusing to ..." for a caller that declines something
+* other than loading the file — `renderNestedTemplateTreeDefect` says "deploy"
+* or "diff", matching its own sibling refusals.
+*
+* Every interpolation goes through `displaySafe` for the reason
+* `AssemblyReader`'s own refusals give (go-to-k/cdkd#3277): this text exists
+* FOR a hand-modified assembly, so the candidate, the resolved path and even
+* `dir` (below a Stage it derives from the manifest's `directoryName`) are all
+* attacker-chosen, and `formatError` sanitizes only an error's `cause`, never
+* its own `message`.
+*/
+function renderAssemblyPathEscape(escape, dir, action = "load", provenanceOverride) {
+	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const base = path.resolve(dir);
+	const realBase = resolveThroughLinks(base) ?? base;
+	if (escape.escape === "symlink") {
+		if (escape.realPath === realBase) return `resolves to '${displaySafe(escape.path)}', a symbolic link to the directory '${displaySafe(base)}' itself rather than to a file inside it. ${provenance}`;
+		return `resolves to '${displaySafe(escape.path)}', which leads through a symbolic link to '${displaySafe(escape.realPath)}', outside '${displaySafe(base)}'. ${provenance}`;
+	}
+	if (escape.path === base) return `names the directory '${displaySafe(base)}' itself rather than a file inside it. ${provenance}`;
+	return `resolves to '${displaySafe(escape.path)}', outside '${displaySafe(base)}'. ${provenance}`;
+}
+
+//#endregion
+//#region src/utils/own-keys.ts
+/**
+* Own-key helpers for the bags that reach cdkd through `JSON.parse` — a
+* `state.json` record, a Cloud Control `Properties` document, a template — and
+* for the raw SDK readbacks compared against them.
+*
+* `JSON.parse` yields a key literally named `__proto__` as an ORDINARY own
+* data property, and every comparator / rebuild walk over such a bag has to
+* keep treating it as one. Two idioms silently do not:
+*
+* - **Rebuilding onto a `{}` literal.** `out[k] = v` with `k === '__proto__'`
+*   runs `Object.prototype`'s accessor, SETS the node's prototype and DROPS
+*   the key — on BOTH comparison sides when the walk is a canonicalizer, so a
+*   drift at that key is invisible (issue
+*   [#3121](https://github.com/go-to-k/cdkd/issues/3121)), and on the WRITE
+*   path the member vanishes from the payload (issue
+*   [#2899](https://github.com/go-to-k/cdkd/issues/2899)). Rebuild onto
+*   {@link nullPrototypeRecord} (no accessor there, so plain assignment
+*   defines an own key) or, onto an existing plain object, define the key
+*   with {@link defineOwnKey}.
+* - **`key in bag` membership.** `in` reads the prototype chain, so a key
+*   named `constructor` / `toString` answers `true` for every plain object
+*   and the recursion then walks `Object`'s function. {@link hasOwnKey} asks
+*   the bag alone; {@link ownValue} is the matching read.
+*
+* And ONE shape test every such walk needs FIRST: {@link hasPlainPrototype}.
+* A non-plain object (`Date`, `Uint8Array`, `Map`, a class instance) has no
+* own enumerable keys, so a key-walk over one FABRICATES `{}` (or an index
+* map) and any two of them compare equal. Such a value is returned by
+* IDENTITY and compared as itself.
+*
+* Extracted from `src/cli/commands/drift.ts` (issue #2899, swept by PR #3124)
+* so the analyzer-side canonicalizers (#3121) share ONE spelling rather than a
+* fourth copy. A LEAF module, deliberately, and it must stay one: a value
+* import from a module other suites `vi.mock` wholesale reds those suites
+* with a missing-export failure (which is why `secret-redaction.ts` keeps its
+* own `hasPlainPrototype` — several drift suites mock that module).
+*/
+/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
+function hasOwnKey(target, key) {
+	return Object.prototype.hasOwnProperty.call(target, key);
+}
+/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
+function ownValue(target, key) {
+	return hasOwnKey(target, key) ? target[key] : void 0;
+}
+/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+}
+/**
+* Does this value carry an ORDINARY object prototype?
+*
+* `typeof v === 'object'` admits `Date` / `Map` / `Set` / `Uint8Array` / class
+* instances, whose own enumerable keys are `[]` — so a key-walk over one
+* reports "no contradiction" between two values that actually differ, and a
+* rebuild over one fabricates `{}`. A NULL prototype counts as plain: it is
+* what {@link nullPrototypeRecord} yields, and a walk must be able to re-walk
+* its own output.
+*/
+function hasPlainPrototype$1(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/**
+* A fresh rebuild target with NO prototype, so `out['__proto__'] = v` defines
+* an own key instead of setting the prototype. `JSON.stringify`,
+* `Object.keys` / `entries` and `structuredClone` all read it like a plain
+* object; only `instanceof Object` and a direct `.hasOwnProperty()` method call
+* do not, and no consumer on the drift path uses either.
+*
+* The type parameter spares a caller with a narrower value type an `as` cast at
+* every call — `nullPrototypeRecord<string>()` for a logical-id-to-path index.
+* It defaults to `unknown`, so a zero-argument call is unchanged.
+*/
+function nullPrototypeRecord() {
+	return Object.create(null);
+}
+
 //#endregion
 //#region src/synthesis/stack-messages.ts
 /**
@@ -2833,7 +3144,9 @@ const MESSAGE_ENTRY_TYPES = {
 function collectStackMessages(assemblyDir, artifact) {
 	const merged = { ...artifact.metadata ?? {} };
 	if (artifact.additionalMetadataFile) {
-		const metadataPath = join(assemblyDir, artifact.additionalMetadataFile);
+		const resolved = resolveAssemblyPath(assemblyDir, artifact.additionalMetadataFile);
+		if (!resolved.contained) throw new SynthesisError(`Stack metadata file '${displaySafe(artifact.additionalMetadataFile)}' ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+		const metadataPath = resolved.path;
 		let sideFile;
 		try {
 			sideFile = JSON.parse(readFileSync(metadataPath, "utf-8"));
@@ -2895,9 +3208,160 @@ function processStackMessages(stacks, logger, options = {}) {
 	if (hasWarnings && failAt === "warn") throw new SynthesisError("Found warnings (--strict mode)");
 }
 
+//#endregion
+//#region src/synthesis/failed-stages.ts
+/**
+* Marks an error that already names the Stage it was raised under, so an outer
+* Stage does not prepend its own name on the way out. Follows the marker shape
+* of `markNonRetryable` in `src/deployment/retryable-errors.ts`: a
+* non-enumerable own property, read by presence.
+*/
+const STAGE_SCOPED_MARKER = Symbol.for("cdkd.stageScopedError");
+/**
+* Re-raise a refusal caught while reading the CONTENTS of a Stage, with the
+* Stage named (issue [#3482](https://github.com/go-to-k/cdkd/issues/3482)).
+*
+* This is NOT a downgrade: every caller throws what this returns. The refusal
+* texts name the STACK — the stack a Stage produced carries a physical name
+* that need not embed the Stage's path, so without this the user is not told
+* which Stage directory to look in.
+*
+* The INNERMOST Stage wins: an error arriving already marked is returned
+* unchanged, so `Outer` does not restate what `Outer/Inner` said more
+* precisely. `stagePath` is the RAW path and is rendered here, for the reason
+* {@link FailedStage.stagePath} gives.
+*
+* The caught text goes through `displaySafe` although every throw reachable
+* from the recursion sanitizes at its own origin today: this catch's error
+* population is the whole recursive subtree, so the guard belongs to the CATCH
+* rather than to today's set of throws under it. It is therefore the identity
+* and a mutation probe on it finds no discrimination — stated so the next
+* reader gets the reason instead of the puzzle.
+*
+* No `cause`: the message already embeds the original's text in full, and
+* `formatError` renders a cause as a `Caused by:` line, which would print the
+* same sentence twice.
+*/
+function stageScopedError(stagePath, error) {
+	if (error instanceof Error && STAGE_SCOPED_MARKER in error) return error;
+	const message = displaySafe(error instanceof Error ? error.message : String(error));
+	const scoped = new SynthesisError(`Stage ${renderStagePath(stagePath)}: ${message}`);
+	if (error instanceof Error && typeof error.stack === "string") {
+		const headerLines = `${error.name}: ${error.message}`.split("\n").length;
+		const frames = error.stack.split("\n").slice(headerLines).join("\n");
+		if (frames.length > 0) scoped.stack = `${scoped.name}: ${scoped.message}\n${frames}`;
+	}
+	if (Object.isExtensible(scoped)) Object.defineProperty(scoped, STAGE_SCOPED_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return scoped;
+}
+/**
+* Render the sentence a stack-selection failure appends when a stage failed to
+* load, so the message reports the failed stage instead of answering "not
+* found" for a stack that may well exist under it.
+*
+* Returns `''` — appending nothing — when no stage failed, which is every
+* ordinary run. Otherwise it opens with `. ` so it reads as its own sentence
+* after a head that ends in a stack list.
+*
+* When one of the selection `patterns` targets a failed stage, that stage is
+* named as the explanation. Otherwise every failed stage is listed behind a
+* `Possibly unrelated:` hedge, since a physical stack name carries no stage
+* path and the link therefore cannot be proven from the pattern alone (see
+* `patternTargetsStage`). The sentence itself is spelled the same either way,
+* so one substring finds it.
+*/
+function failedStageNote(patterns, failedStages) {
+	if (!failedStages || failedStages.length === 0) return "";
+	const targeted = patterns.length === 0 ? failedStages : failedStages.filter((stage) => patterns.some((pattern) => patternTargetsStage(pattern, stage.stagePath)));
+	const named = targeted.length > 0 ? targeted : failedStages;
+	return ". " + (targeted.length > 0 ? "" : "Possibly unrelated: ") + named.map((stage) => `Stage ${renderStagePath(stage.stagePath)} failed to load, so stacks under it are missing from this list rather than missing from the app: ${stage.reason}`).join(" ");
+}
+/**
+* Render a Stage path into a message.
+*
+* `displayIdent` without quotes of ours, and with the cap a legitimately long
+* hierarchical name needs — the same argument `STACK_REF_MAX_CODE_POINTS`
+* exists for. See {@link FailedStage.stagePath} for why the stored value stays
+* raw and only this rendering is sanitized.
+*/
+function renderStagePath(stagePath) {
+	return displayIdent(stagePath, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+}
+/**
+* Whether a user-supplied selection pattern could name a stack under
+* `stagePath`.
+*
+* Mirrors the routing rule in `src/cli/stack-matcher.ts`: a pattern WITHOUT
+* `/` is matched against the PHYSICAL CloudFormation stack name, which carries
+* no stage path at all (`MyStage-MyStack` is not decomposable — a stack may
+* override its own `stackName`), so such a pattern is never attributed to a
+* stage. A pattern WITH `/` is a display path, and its leading segments are
+* compared against the stage's, wildcard by wildcard, so `MyStage/MyStack` and
+* `MyStage/*` both attribute to `MyStage`.
+*/
+function patternTargetsStage(pattern, stagePath) {
+	if (!pattern.includes("/")) return false;
+	const patternSegments = pattern.split("/");
+	const stageSegments = stagePath.split("/");
+	if (patternSegments.length < stageSegments.length) return false;
+	return stageSegments.every((segment, i) => segmentMatches(patternSegments[i], segment));
+}
+/**
+* Wildcard-aware comparison of ONE path segment, matching how
+* `stackMatchesPattern` expands `*` in `src/cli/stack-matcher.ts`. The pattern
+* is the USER's own input, not an assembly-supplied value, so it is expanded
+* there the same way — metacharacters and all, so the two cannot disagree
+* about what a pattern means.
+*
+* The construction is guarded because SPLITTING on `/` can make an invalid
+* segment out of a valid pattern (`'(*x/y*)'` splits into `'(*x'`), and this
+* helper runs when the stack list is EMPTY, which is exactly when
+* `stackMatchesPattern` never evaluates and therefore never raises first. An
+* unusable pattern is simply not attributed: the note still prints, hedged,
+* instead of a `SyntaxError` replacing the message the user needed.
+*/
+function segmentMatches(patternSegment, segment) {
+	if (!patternSegment.includes("*")) return patternSegment === segment;
+	try {
+		return new RegExp("^" + patternSegment.replace(/\*/g, ".*") + "$").test(segment);
+	} catch {
+		return false;
+	}
+}
+
 //#endregion
 //#region src/synthesis/assembly-reader.ts
 /**
+* The failure's own words, carrying NO value the assembly chose.
+*
+* Three branches, and each returns a string cdkd controls:
+*
+* - a filesystem failure is reduced to its `code` (`ENOENT`, `EACCES`,
+*   `EISDIR`), because Node's `message` for one embeds the path, which is the
+*   value being contained;
+* - a `JSON.parse` failure is reduced to `invalid JSON`. V8's `SyntaxError`
+*   carries no path, but it DOES echo a short window of the file's own bytes
+*   verbatim (`Unexpected token '.', ". All 3 st"... is not valid JSON`), and
+*   the file is assembly-chosen too. The snippet buys nothing here: the caller
+*   already names the directory;
+* - anything else answers `unreadable`, and deliberately does NOT fall back to
+*   the wrapper's own message, which is the text this function exists to
+*   exclude. A fallback fires on an input nobody predicted, which is exactly
+*   when the contained value must not come back.
+*/
+function manifestReadFailureText(error) {
+	const cause = error instanceof CdkdError ? error.cause : error;
+	const code = cause?.code;
+	if (typeof code === "string" && code.length > 0) return displaySafe(code);
+	if (cause instanceof SyntaxError) return "invalid JSON";
+	return "unreadable";
+}
+/**
 * Reads and parses Cloud Assembly from cdk.out directory
 *
 * EVERY value this class renders into a message or a log line goes through
@@ -2915,6 +3379,14 @@ function processStackMessages(stacks, logger, options = {}) {
 * still renders in full and byte-identically. The same rule, for the same
 * reason, guards the twin refusals in `src/cli/commands/diff-recursive.ts`
 * (go-to-k/cdkd#3243).
+*
+* ONE value leaves this class UNSANITIZED: a failed Stage's path
+* ([#3482](https://github.com/go-to-k/cdkd/issues/3482)), which is a match key
+* as well as the subject of a sentence. `failed-stages.ts` renders it at each
+* display site with `displayIdent` — it is an IDENTIFIER interpolated into
+* prose rather than free-form text quoted as a value, so the denylist's
+* tolerance of quotes and spaces is a spoof surface there. See
+* `FailedStage.stagePath`.
 */
 var AssemblyReader = class {
 	logger = getLogger().child("AssemblyReader");
@@ -2933,9 +3405,38 @@ var AssemblyReader = class {
 		}
 	}
 	/**
+	* Read an assembly: all its stacks (recursing into nested assemblies /
+	* Stages) plus the Stages that could not be read at all.
+	*
+	* Only ONE failure is tolerated while walking a Stage — the read of the
+	* Stage's own `manifest.json`, which is the legitimate "this Stage
+	* references a directory that was never synthesized" case. Every REFUSAL
+	* raised while reading a Stage's contents propagates out of the recursion
+	* exactly as it does at the top level (issue
+	* [#3482](https://github.com/go-to-k/cdkd/issues/3482)).
+	*/
+	readAssembly(assemblyDir, manifest, assetOutdir = assemblyDir) {
+		const failedStages = [];
+		return {
+			stacks: this.collectStacks(assemblyDir, manifest, assetOutdir, failedStages),
+			failedStages
+		};
+	}
+	/**
 	* Get all stacks from assembly (recursively traverses nested assemblies / Stages)
+	*
+	* Discards the failed-Stage records `readAssembly` returns; a caller that
+	* reports on a selection failure wants that method instead.
+	*/
+	getAllStacks(assemblyDir, manifest, assetOutdir = assemblyDir) {
+		return this.readAssembly(assemblyDir, manifest, assetOutdir).stacks;
+	}
+	/**
+	* The recursive half of `readAssembly`. `failedStages` is the accumulator
+	* shared by every level, so a Stage that fails three levels down is still
+	* reported to the top-level caller.
 	*/
-	getAllStacks(assemblyDir, manifest) {
+	collectStacks(assemblyDir, manifest, assetOutdir, failedStages) {
 		if (!manifest.artifacts) {
 			this.logger.warn("No artifacts found in manifest");
 			return [];
@@ -2943,18 +3444,31 @@ var AssemblyReader = class {
 		const assetManifestMap = this.buildAssetManifestMap(assemblyDir, manifest);
 		const stacks = [];
 		for (const [artifactId, artifact] of Object.entries(manifest.artifacts)) if (artifact.type === "aws:cloudformation:stack") {
-			const stackInfo = this.extractStackInfo(assemblyDir, artifactId, artifact, manifest, assetManifestMap);
+			const stackInfo = this.extractStackInfo(assemblyDir, artifactId, artifact, manifest, assetManifestMap, assetOutdir);
 			stacks.push(stackInfo);
 		} else if (artifact.type === "cdk:cloud-assembly") {
 			const props = artifact.properties;
 			if (props?.directoryName) {
-				const nestedDir = join(assemblyDir, props.directoryName);
+				const resolved = resolveAssemblyPath(assemblyDir, props.directoryName);
+				if (!resolved.contained) throw new SynthesisError(`Nested assembly ${renderStagePath(props.directoryName)} ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				const nestedDir = resolved.path;
+				const stagePath = typeof props.displayName === "string" && props.displayName.length > 0 ? props.displayName : artifactId;
+				let nestedManifest;
 				try {
-					const nestedManifest = this.readManifest(nestedDir);
-					const nestedStacks = this.getAllStacks(nestedDir, nestedManifest);
-					stacks.push(...nestedStacks);
+					nestedManifest = this.readManifest(nestedDir);
 				} catch (error) {
-					this.logger.warn(`Failed to read nested assembly '${displaySafe(props.directoryName)}': ${displaySafe(error instanceof Error ? error.message : String(error))}`);
+					const reason = `${manifestReadFailureText(error)} reading ${renderStagePath(props.directoryName)}/manifest.json`;
+					this.logger.warn(`Failed to read nested assembly: ${reason}`);
+					failedStages.push({
+						stagePath,
+						reason
+					});
+					continue;
+				}
+				try {
+					stacks.push(...this.collectStacks(nestedDir, nestedManifest, assetOutdir, failedStages));
+				} catch (error) {
+					throw stageScopedError(stagePath, error);
 				}
 			}
 		}
@@ -2965,9 +3479,9 @@ var AssemblyReader = class {
 	* Get a specific stack by name
 	*/
 	getStack(assemblyDir, manifest, stackName) {
-		const stacks = this.getAllStacks(assemblyDir, manifest);
+		const { stacks, failedStages } = this.readAssembly(assemblyDir, manifest);
 		const stack = stacks.find((s) => s.stackName === stackName);
-		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. Available: ${stacks.map((s) => displaySafe(s.stackName)).join(", ")}`);
+		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. ` + (stacks.length > 0 ? `Available: ${stacks.map((s) => displayIdent(s.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })).join(", ")}` : "The assembly has no stacks") + failedStageNote([stackName], failedStages));
 		return stack;
 	}
 	/**
@@ -2985,19 +3499,25 @@ var AssemblyReader = class {
 		for (const [artifactId, artifact] of Object.entries(manifest.artifacts)) {
 			if (artifact.type !== "cdk:asset-manifest") continue;
 			const props = artifact.properties;
-			if (props?.file) map.set(artifactId, join(assemblyDir, props.file));
+			if (props?.file) {
+				const resolved = resolveAssemblyPath(assemblyDir, props.file);
+				if (!resolved.contained) throw new SynthesisError(`Asset manifest artifact '${displaySafe(artifactId)}' has file='${displaySafe(props.file)}' which ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				map.set(artifactId, resolved.path);
+			}
 		}
 		return map;
 	}
 	/**
 	* Extract stack info from artifact
 	*/
-	extractStackInfo(assemblyDir, artifactId, artifact, manifest, assetManifestMap) {
+	extractStackInfo(assemblyDir, artifactId, artifact, manifest, assetManifestMap, assetOutdir) {
 		const props = artifact.properties;
 		const stackName = props?.stackName || artifactId;
 		const templateFile = props?.templateFile;
 		if (!templateFile) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has no templateFile property`);
-		const templatePath = join(assemblyDir, templateFile);
+		const resolvedTemplate = resolveAssemblyPath(assemblyDir, templateFile);
+		if (!resolvedTemplate.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has templateFile='${displaySafe(templateFile)}' which ${renderAssemblyPathEscape(resolvedTemplate, assemblyDir)}`);
+		const templatePath = resolvedTemplate.path;
 		let template;
 		try {
 			const content = readFileSync(templatePath, "utf-8");
@@ -3025,13 +3545,15 @@ var AssemblyReader = class {
 		if (dependencyNames.length > 0) this.logger.debug(`Stack '${displaySafe(stackName)}' depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
 		if (artifact.environment) env = parseEnvironment(artifact.environment);
-		const nestedTemplates = {};
+		const nestedTemplates = nullPrototypeRecord();
 		for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 			const assetPath = resource.Metadata?.["aws:asset:path"];
 			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
 			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
-			nestedTemplates[logicalId] = join(assemblyDir, assetPath);
+			const resolvedNested = resolveAssemblyPath(assemblyDir, assetPath);
+			if (!resolvedNested.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
+			nestedTemplates[logicalId] = resolvedNested.path;
 		}
 		return {
 			stackName,
@@ -3039,6 +3561,7 @@ var AssemblyReader = class {
 			artifactId,
 			template,
 			assetManifestPath,
+			assetOutdir,
 			dependencyNames,
 			region: env?.region !== "unknown-region" ? env?.region : void 0,
 			account: env?.account !== "unknown-account" ? env?.account : void 0,
@@ -6175,13 +6698,14 @@ var Synthesizer = class {
 		if (isPreSynthesizedAssembly(options.app)) {
 			this.logger.debug(`Using pre-synthesized cloud assembly at ${appPath}`);
 			const manifest = this.assemblyReader.readManifest(appPath);
-			const stacks = this.assemblyReader.getAllStacks(appPath, manifest);
+			const { stacks, failedStages } = this.assemblyReader.readAssembly(appPath, manifest);
 			if (!options.deferMacroExpansion) await this.expandMacrosForStacks(stacks, options);
 			this.logger.debug(`Loaded ${stacks.length} stack(s) from pre-synthesized assembly`);
 			return {
 				manifest,
 				assemblyDir: appPath,
-				stacks
+				stacks,
+				failedStages
 			};
 		}
 		const outputDir = resolve(options.output || "cdk.out");
@@ -6232,7 +6756,7 @@ var Synthesizer = class {
 			});
 			const manifest = this.assemblyReader.readManifest(outputDir);
 			if (!manifest.missing || manifest.missing.length === 0) {
-				const stacks = this.assemblyReader.getAllStacks(outputDir, manifest);
+				const { stacks, failedStages } = this.assemblyReader.readAssembly(outputDir, manifest);
 				if (!options.deferMacroExpansion) await this.expandMacrosForStacks(stacks, options, {
 					region: explicitRegion,
 					...accountId && { accountId }
@@ -6241,7 +6765,8 @@ var Synthesizer = class {
 				return {
 					manifest,
 					assemblyDir: outputDir,
-					stacks
+					stacks,
+					failedStages
 				};
 			}
 			const missingKeys = new Set(manifest.missing.map((m) => m.key));
@@ -6366,6 +6891,24 @@ function setsEqual(a, b) {
 //#endregion
 //#region src/assets/asset-manifest-loader.ts
 /**
+* THE one spelling of "where does this file asset's source live", shared by
+* {@link AssetManifestLoader.getAssetSourcePath} and `FileAssetPublisher`
+* (issue [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
+* Both used to `join(cdkOutputDir, asset.source.path)` independently. The
+* manifest is chosen by whoever wrote the assembly, `path.join` folds `..`,
+* and the publisher ZIPs whatever it finds and `PutObject`s it to a bucket the
+* same manifest names — so an unchecked `source.path` is an exfiltration
+* primitive with the caller's own credentials, which is the harm the manifest
+* FILE's own containment check cites. One function so the loader and the
+* publisher cannot disagree about which file is published.
+*/
+function resolveFileAssetSourcePath(manifestDir, asset, assetOutdir = manifestDir) {
+	const resolved = resolveAssemblyPath(manifestDir, asset.source.path, { containWithin: assetOutdir });
+	if (!resolved.contained) throw new Error(`File asset '${displaySafe(asset.displayName)}' has source.path='${displaySafe(asset.source.path)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
+	return resolved.path;
+}
+/**
 * Whether a file asset's `source.path` is a CloudFormation template asset
 * (the stack template `<Stack>.template.json` or a nested-stack template
 * `<Stack>.<Nested>.nested.template.json`). cdkd deploys templates itself and
@@ -6397,7 +6940,9 @@ var AssetManifestLoader = class {
 	* @returns Asset manifest or null if not found
 	*/
 	async loadManifest(cdkOutputDir, stackName) {
-		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
+		const resolved = resolveAssemblyPath(cdkOutputDir, `${stackName}.assets.json`);
+		if (!resolved.contained) throw new Error(`Asset manifest for stack '${displaySafe(stackName)}' ${renderAssemblyPathEscape(resolved, cdkOutputDir)}`);
+		const manifestPath = resolved.path;
 		try {
 			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
 			const content = await readFile(manifestPath, "utf-8");
@@ -6433,12 +6978,18 @@ var AssetManifestLoader = class {
 	/**
 	* Get asset source path (absolute path)
 	*
+	* Refuses a `source.path` resolving outside `cdkOutputDir` (issue
+	* [#3489](https://github.com/go-to-k/cdkd/issues/3489)). The manifest is
+	* assembly-supplied and `cdkd deploy -a <dir>` consumes a pre-synthesized
+	* one, so a `source.path` of `../../../home/<user>/.aws` would otherwise be
+	* packaged and uploaded to a bucket the SAME manifest names.
+	*
 	* @param cdkOutputDir CDK output directory
 	* @param asset File asset
 	* @returns Absolute path to asset source
 	*/
-	getAssetSourcePath(cdkOutputDir, asset) {
-		return join$1(cdkOutputDir, asset.source.path);
+	getAssetSourcePath(cdkOutputDir, asset, assetOutdir) {
+		return resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir ?? cdkOutputDir);
 	}
 	/**
 	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
@@ -6530,7 +7081,8 @@ var FileAssetPublisher = class {
 	* @param region AWS region
 	* @param profile AWS profile (optional)
 	*/
-	async publish(assetHash, asset, cdkOutputDir, accountId, region, _profile) {
+	async publish(assetHash, asset, cdkOutputDir, accountId, region, _profile, assetOutdir) {
+		const sourcePath = resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir ?? cdkOutputDir);
 		for (const [, dest] of Object.entries(asset.destinations)) {
 			const bucketName = this.resolvePlaceholders(dest.bucketName, accountId, region);
 			const objectKey = this.resolvePlaceholders(dest.objectKey, accountId, region);
@@ -6545,7 +7097,6 @@ var FileAssetPublisher = class {
 					this.logger.debug(`Asset already exists, skipping: s3://${bucketName}/${objectKey}`);
 					continue;
 				}
-				const sourcePath = join(cdkOutputDir, asset.source.path);
 				if (asset.source.packaging === "zip") await this.uploadZip(client, sourcePath, bucketName, objectKey);
 				else await this.uploadFile(client, sourcePath, bucketName, objectKey);
 				this.logger.debug(`✅ Published: s3://${bucketName}/${objectKey}`);
@@ -7865,6 +8416,28 @@ function describeDockerCapturedOutput(error, args, fallback) {
 //#endregion
 //#region src/assets/docker-build.ts
 /**
+* Where a Docker asset's build context lives, refusing a `source.directory`
+* that resolves outside `cdkOutDir` (issue
+* [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
+* The field is assembly-supplied and used BOTH as the executable's cwd and as
+* the `docker build` cwd, so an escaping value sends a directory from outside
+* `cdk.out` to BuildKit and bakes it into the image pushed to a repository the
+* same manifest names. Both sites used raw `${a}/${b}` concatenation, which
+* honours `..` exactly as `join` does; this is the one spelling they share.
+*
+* It throws through the CALLER's `wrapError` so each consumer keeps its own
+* typed error class, exactly as this module's other pre-docker refusals do.
+*
+* Twin of `resolveFileAssetSourcePath` and `resolveVerboseTemplatePath`.
+* Exported for unit testing.
+*/
+function resolveDockerContextDirectory(manifestDir, directory, wrapError, assetOutdir = manifestDir) {
+	const resolved = resolveAssemblyPath(manifestDir, directory, { containWithin: assetOutdir });
+	if (!resolved.contained) throw wrapError(`asset source.directory='${displaySafe(directory)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "build it")}`);
+	return resolved.path;
+}
+/**
 * Build a Docker image from a CDK asset source. Returns the local image
 * tag the caller should use for `docker tag` / `docker push` (publisher)
 * or `docker run` (local-invoke).
@@ -7882,10 +8455,11 @@ function describeDockerCapturedOutput(error, args, fallback) {
 async function buildDockerImage(asset, cdkOutDir, options) {
 	const source = asset.source;
 	const logger = getLogger().child("docker-build");
+	const contextDirectory = (directory) => resolveDockerContextDirectory(cdkOutDir, directory, options.wrapError, options.assetOutdir);
 	if (source.executable && source.executable.length > 0) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
-		const cwd = source.directory ? `${cdkOutDir}/${source.directory}` : cdkOutDir;
+		const cwd = source.directory ? contextDirectory(source.directory) : cdkOutDir;
 		const shownExecutable = redactDockerArgvValues(source.executable).join(" ");
 		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
 		let result;
@@ -7909,9 +8483,9 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	}
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
-	const contextDir = `${cdkOutDir}/${source.directory}`;
+	const contextDir = contextDirectory(source.directory);
 	buildArgs.push(".");
-	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${contextDir})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displaySafe(contextDir)})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
@@ -8041,8 +8615,8 @@ var DockerAssetPublisher = class {
 	* via `docker tag` so the downstream `push()` step (which is wired to
 	* `localTag` at graph-construction time) keeps working unchanged.
 	*/
-	async build(asset, cdkOutputDir, localTag) {
-		await this.buildImage(asset, cdkOutputDir, localTag);
+	async build(asset, cdkOutputDir, localTag, assetOutdir) {
+		await this.buildImage(asset, cdkOutputDir, localTag, assetOutdir);
 	}
 	/**
 	* Push a pre-built Docker image to ECR (public, used by WorkGraph asset-publish nodes)
@@ -8098,9 +8672,10 @@ var DockerAssetPublisher = class {
 	* downstream push step finds the image under the deterministic
 	* `cdkd-asset-<hash>` name it expects.
 	*/
-	async buildImage(asset, cdkOutputDir, tag) {
+	async buildImage(asset, cdkOutputDir, tag, assetOutdir) {
 		const actualTag = await buildDockerImage(asset, cdkOutputDir, {
 			tag,
+			...assetOutdir !== void 0 && { assetOutdir },
 			wrapError: (stderr) => new AssetError(`Docker build failed: ${stderr}`)
 		});
 		if (actualTag !== tag) {
@@ -9473,6 +10048,7 @@ var AssetPublisher = class {
 		const content = readFileSync(manifestPath, "utf-8");
 		const manifest = JSON.parse(content);
 		const cdkOutputDir = manifestPath.replace(/\/[^/]+$/, "");
+		const assetOutdir = options.assetOutdir ?? cdkOutputDir;
 		const prefix = options.nodePrefix || "";
 		const redirect = options.redirect;
 		const nodeIds = [];
@@ -9489,6 +10065,7 @@ var AssetPublisher = class {
 					hash,
 					asset,
 					cdkOutputDir,
+					assetOutdir,
 					accountId: options.accountId,
 					region: options.region,
 					...options.profile && { profile: options.profile }
@@ -9511,6 +10088,7 @@ var AssetPublisher = class {
 					hash,
 					asset,
 					cdkOutputDir,
+					assetOutdir,
 					localTag
 				}
 			});
@@ -9537,8 +10115,8 @@ var AssetPublisher = class {
 	*/
 	async executeNode(node) {
 		const data = node.data;
-		if (data.kind === "file") await this.filePublisher.publish(data.hash, data.asset, data.cdkOutputDir, data.accountId, data.region, data.profile);
-		else if (data.kind === "docker-build") await this.dockerPublisher.build(data.asset, data.cdkOutputDir, data.localTag);
+		if (data.kind === "file") await this.filePublisher.publish(data.hash, data.asset, data.cdkOutputDir, data.accountId, data.region, data.profile, data.assetOutdir);
+		else if (data.kind === "docker-build") await this.dockerPublisher.build(data.asset, data.cdkOutputDir, data.localTag, data.assetOutdir);
 		else if (data.kind === "docker-publish") await this.dockerPublisher.push(data.asset, data.accountId, data.region, data.localTag);
 		this.logger.debug(`✅ ${node.id}`);
 	}
@@ -22041,6 +22619,156 @@ function refuseMalformedOutputs(state, stackName, region) {
 	throw markNonRetryable(new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
 }
 /**
+* The stand-in row a read-only view lists in its `unreadable` set for an
+* `orphans` container it could not read, beside
+* {@link UNREADABLE_RESOURCES_MAP_ROW}'s row for the resource map.
+*/
+const UNREADABLE_ORPHANS_CONTAINER_ROW = "(orphans container)";
+/**
+* Whether the `orphans` CONTAINER is the list every reader of it assumes
+* (issue go-to-k/cdkd#3379).
+*
+* `parseStateBody` validates the record root and its schema version and returns
+* the cast record otherwise unchanged, so a hand-edited or planted
+* `"orphans": "abc"`, `5`, `{}` or `{"length": 1}` survives the load and every
+* reader reaches it on a bare `?? []`, `?.length` or `?.map`.
+*
+* ABSENT IS READABLE, for the reason {@link hasReadableOutputs}'s note gives
+* for its own container and one that is sharper here: an absent `orphans` is
+* the ORDINARY record. A stack that never had a failed deploy has no orphan
+* list at all, `JSON.stringify` drops the key when it is undefined, and
+* `orphansAfterRollback` returns `{}` on `previous.orphans === undefined`
+* WITH nothing newly orphaned — the pair of conditions that keeps such a
+* record byte-identical. Warning or refusing on absence would fire on
+* almost every record in a bucket.
+*
+* `null` is NOT readable, which is where this parts from a bare `?? []`: that
+* admits `null` silently, and the shapes this exists to catch are exactly the
+* ones it cannot see.
+*
+* The ENTRIES are a separate question with a separate answer —
+* `orphans[<i>].properties` is go-to-k/cdkd#3344, and
+* {@link refuseMalformedResourcePropertiesForOrphan} is the guard there. This
+* one says only that the container is a list.
+*/
+function hasReadableOrphans(state) {
+	return state.orphans === void 0 || Array.isArray(state.orphans);
+}
+/**
+* For a READ-ONLY command: replace an unreadable `orphans` container with an
+* empty list so the command can report the rest of the record, and return
+* whether it did, so the caller can warn with
+* {@link malformedOrphansWarning} and list
+* {@link UNREADABLE_ORPHANS_CONTAINER_ROW} among what it could not read.
+*
+* AT THE LOAD, the placement rule
+* {@link repairMalformedResourcesForReadOnly}'s note records: `cdkd diff`
+* reaches the container through `currentState.orphans?.length` before its
+* adoption preview, so a guard written at the preview leaves the dereference
+* above it — and for a STRING that dereference is the one that lies, since
+* `'abc'.length` is 3 and the preview then walks characters.
+*
+* READ-ONLY commands only, for the reason {@link refuseMalformedState} gives:
+* a container laundered into a well-formed empty one is permanent, and for
+* this container it also erases the only record that resources were left
+* behind in AWS by an earlier failed deploy.
+*/
+function repairMalformedOrphansForReadOnly(state) {
+	if (hasReadableOrphans(state)) return false;
+	state.orphans = [];
+	return true;
+}
+/**
+* The warning a caller of {@link repairMalformedOrphansForReadOnly} emits.
+*
+* Its own text rather than any of the three above, the rule this module's
+* every message follows: what continuing EMPTY costs here is not a diff's
+* left-hand side or a rendered view's rows but the record's evidence that
+* resources from an earlier failed deploy are still live in AWS. A reader who
+* sees no adoption preview and no orphan warning will conclude the stack has
+* none.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOrphansWarning(stackName, region) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'orphans' list — the record is malformed or truncated. Readers reach it on a bare '?? []' or '?.length', which admits a string, a number, a plain object and null alike: a string is WALKED, one garbage orphan per character, and the others read as no orphans at all. Continuing with it EMPTY: this view previews no adoption and names no orphan, which is NOT the same as the record holding none — resources from an earlier failed deploy may still be live in AWS. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The refusal text for a command that can WRITE the record.
+*
+* A DIFFERENT text from the warning because the danger is different and worse:
+* the reshaping reader is also a writer. `orphansAfterRollback` walks the
+* container with `for...of`, so over `"abc"` it returns a list holding `"c"`,
+* and `cdkd rollback` SAVES that record — a damaged container rewritten into a
+* differently damaged one, silently. `cdkd deploy`'s adoption pass assigns
+* `currentState.orphans` from what it read, and `cdkd destroy` proceeds through
+* resource deletion to `deleteState` having never reported the orphans it could
+* not read.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOrphansRefusalMessage(stackName, region) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'orphans' list — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: a string container is WALKED one character at a time and written back as a list of character-shaped orphan records, and every other unreadable shape reads as no orphans at all — so a run would delete or adopt against a record whose evidence of resources left live in AWS by an earlier failed deploy it never read. Repair or remove the record first, and no cdkd command repairs this container: rewriting it to [] by hand discards the very evidence this refusal is protecting. Inspect the record with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The DESTROY refusal text for this container (go-to-k/cdkd#3379 review).
+*
+* Its own text rather than {@link malformedOrphansRefusalMessage}, for the
+* reason every text in this module is its own: that one says the container
+* would be RESHAPED and written back, which is the rollback mechanism, and a
+* destroy never reshapes it — `buildDestroySnapshot` carries the container
+* verbatim through `...rest` into every save it makes, and then either REMOVES
+* the record (the clean path) or writes that snapshot as the final state, with
+* the container intact, on the error / interrupt / skip arm. What a destroy
+* does with the container instead is DECIDE: the count feeds `stillEmpty`, and
+* the orphan warning above it is the operator's only notice that resources from
+* an earlier failed deploy are still live in AWS.
+*
+* It also owes the remedy the sibling destroy refusal owes, and for the same
+* reason go-to-k/cdkd#3161 raised against refusing a cleanup command at all: an
+* operator who wants the record gone needs a way to do it. `cdkd state orphan`
+* is that way and reads no `orphans` container, so pointing at it is sound —
+* the same exactness split as {@link malformedDestroyResourcesRefusalMessage},
+* since a name that does not render faithfully must not become a command
+* against a record that may not be the damaged one.
+*/
+function malformedDestroyOrphansRefusalMessage(stackName, region) {
+	const exact = safeStackName(stackName) === stackName && safeRegion(region) === region;
+	return `${`${stackClause(exact ? stackName : void 0, exact ? region : void 0)} has no readable 'orphans' list — the record is malformed or truncated.`} This command DELETES state, so it refuses rather than continuing: an unreadable container counts as no orphans, so the run would proceed through resource deletion to removing state.json while the record's evidence that an earlier failed deploy left resources live in AWS was never read — and that evidence goes with the record. Reading it as EMPTY is that outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? `To drop the record deliberately and leave every live resource standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out as 'cdkd state orphan <stack> --stack-region <region>' rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing. Inspect it with: ${inspectCommand(stackName, region)}` : `This record's stack name or region does NOT render exactly, so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long' and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+}
+/**
+* The destroy-path twin of {@link refuseMalformedOrphans}, carrying the text
+* above. Both destroy reads take this one: the entry read and the under-lock
+* re-read, which is the record `stillEmpty` and `deleteState` act on.
+*/
+function refuseMalformedOrphansForDestroy(state, stackName, region) {
+	if (hasReadableOrphans(state)) return;
+	throw markNonRetryable(new CdkdError(malformedDestroyOrphansRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
+* For a command that can WRITE state: refuse a record whose `orphans` container
+* cannot be read.
+*
+* A SIBLING of {@link refuseMalformedState} and {@link refuseMalformedOutputs}
+* rather than a widening of either, for the reason that pair already records: a
+* record can be malformed in one container alone, and the refusal a user sees
+* must name the container that is broken.
+*
+* CALL IT AT THE LOAD, above the first expression that reads the container, and
+* on a destroy at the UNDER-LOCK re-read as well — that re-read is the record
+* the run goes on to act on.
+*/
+function refuseMalformedOrphans(state, stackName, region) {
+	if (hasReadableOrphans(state)) return;
+	throw markNonRetryable(new CdkdError(malformedOrphansRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
 * The DESTROY refusal text (issue
 * [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
 *
@@ -33683,7 +34411,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Cms9Daqn.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BwN09Zcn.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -45368,6 +46096,7 @@ var DeployEngine = class DeployEngine {
 			this.healBaseline = currentState.resources ?? {};
 			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 			refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
+			refuseMalformedOrphans(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -47391,5 +48120,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, AssetError as $i, STATE_SOURCED_BASELINE_RULES as $n, validateContainerRepoName as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, retryClassificationText as Aa, CFN_TEMPLATE_BODY_LIMIT as Ai, malformedResourcePropertiesWarning as An, hasUnverifiableParameterRefusal as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, decodeListingKey as Bi, refuseMalformedState as Bn, buildAssetRedirectMap as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, withErrorHandling as Ca, resolveSkipPrefix as Ci, malformedExportSourceWarning as Cn, formatLockExpiry as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, isTransientServerError as Da, stateBucketExistenceConfirmed as Di, malformedOutputsWarning as Dn, exportNamesCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, isThrottlingError as Ea, resolveUseCdkBootstrapAssets as Ei, malformedOutputsRefusalMessage as En, DEFAULT_STATE_PREFIX as Er, deleteSkipReason as Et, extractDeploymentEventError as F, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Fi, refuseMalformedOutputs as Fn, orphansCarriedFrom as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, AssemblyReader as Gi, safeRegion as Gn, BOOTSTRAP_MARKER_PREFIX as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, PARTITION_TABLE as Hi, repairMalformedResourceEntriesForReadOnly as Hn, loadPublishableAssetManifest as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, injectiveKey as Ii, refuseMalformedOutputsForDestroy as In, shouldRetainResource as Ir, isNamelessDynamicReferenceError as It, bold as J, resolveBucketRegion as Ji, findSilentDropProperties as Jn, getBootstrapMarkerKey as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, processStackMessages as Ki, safeStackName as Kn, assertAssetBucketRegion as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, injectiveKeyPrefix as Li, refuseMalformedResourceEntries as Ln, AssetPublisher as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, safeStringify$1 as Ma, MIGRATE_TMP_PREFIX as Mi, malformedStateRefusalMessage as Mn, importableOutputs as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, __exportAll as Na, findLargeInlineResources as Ni, refuseDivergentRecordRegionForDestroy as Nn, isReadableBag as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, markNonRetryable as Oa, warnDeprecatedNoPrefixCliFlag as Oi, malformedRenderedContainersWarning as On, hasReadableExportSet as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, uploadCfnTemplate as Pi, refuseMalformedNestedChildOutputs as Pn, orphansAfterRollback as Pr, getAccountInfo as Pt, red as Q, setAwsClients as Qi, TemplateParser as Qn, validateAssetBucketName as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, producerCoordinateKey as Ri, refuseMalformedResourcePropertiesForOrphan as Rn, stringifyValue as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, normalizeAwsError as Sa, resolveCaptureObservedState as Si, malformedExportNamesWarning as Sn, forceQuitRecoveryClause as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, isRetryableTransientError as Ta, resolveStateBucketWithDefaultAndSource as Ti, malformedOrphanRecordsWarning as Tn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, canonicalizeRegion as Ui, repairMalformedResourcePropertiesForReadOnly as Un, rewriteTemplateAssetReferences as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, expectedOwnerParam as Vi, repairMalformedOutputsForReadOnly as Vn, createAssetRedirectResolver as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, derivePartitionAndUrlSuffix as Wi, repairMalformedResourcesForReadOnly as Wn, AssetModeResolver as Wr, assertRegionMatch as Wt, gray as X, getAwsClients as Xi, withRetry as Xn, parseBootstrapMarker as Xr, readConfigString as Xt, cyan as Y, AwsClients as Yi, describeTypeWithThrottleRetry as Yn, isCrossRegionRedirect as Yr, configStringRefusal as Yt, green as Z, resetAwsClients as Zi, DagBuilder as Zn, readBootstrapMarkerBody as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, StackTerminationProtectionError as _a, synthesisStatusMessage as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, S3StateBackend as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, DynamicReferenceRegionAmbiguousError as aa, dockerSpawnEnvWithSensitive as ai, s3BucketDomainName as an, dynamicReferenceTokens as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, formatError as ba, resolveApp as bi, hasReadableResources as bn, buildForceUnlockCommand as br, startInterruptWatch as bt, replayFailedOperations as c, LocalStartServiceError as ca, partitionSensitiveEnv as ci, s3BucketWebsiteUrl as cn, isSingleDynamicReferenceToken as cr, IAMRoleProvider as ct, updatePartialMessage as d, NestedStackChildDirectDestroyError as da, runDockerStreaming as di, applyCallerIdentityCredentials as dn, maskSecretsInText as dr, ProviderRegistry as dt, CdkdError as ea, buildDenyExternalAccessPolicy as ei, requireConfigString as en, STATE_SOURCED_CROSS_GENERATION_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, PartialFailureError as fa, escapeRegExp$1 as fi, callerEnvCredentials as fn, recordMaskOnlyValue as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, StackHasActiveImportsError as ga, Synthesizer as gi, STATE_RESOURCES_MALFORMED as gn, LockManager as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, ResourceUpdateNotSupportedError as ha, getDockerImageBySourceHash as hi, INTRINSIC_KEYS as hn, scrubResourceRecord as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, DeployCancelledError as ia, describeDockerFailure as ii, s3BucketArn as in, createSecretMasker as ir, secretBearing as it, isFinalSnapshotError as j, describeAwsFailure as ja, CFN_TEMPLATE_URL_LIMIT as ji, malformedResourcesWarning as jn, importableOutputKeys as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, markRedactedCause as ka, ssmResolvedValueType as ki, malformedResourceEntriesWarning as kn, hasReasonlessBaselineRefusal as kr, IntrinsicFunctionResolver as kt, replayRollback as l, LockError as la, redactDockerArgvValues as li, applyRoleArnIfSet as ln, markSameGenerationBag as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, ResourceTimeoutError as ma, AssetManifestLoader as mi, DiffCalculator as mn, redactSecretsForState as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CrossAccountSecretRefusalError as na, describeDockerCapturedOutput as ni, producerRegionsFromState as nn, TEMPLATE_SOURCED_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, IntrinsicResolutionRefusalError as oa, formatDockerLoginError as oi, s3BucketDualStackDomainName as on, errorCauseChain as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, ProvisioningError as pa, stripControlChars as pi, envCredentialsAreAssumedRole as pn, recoverMaskedOutput as pr, createMaskedRetryLogger as pt, formatResourceLine as q, clearBucketRegionCache as qi, findActionableSilentDrops as qn, ensureAssetStorage as qr, configBooleanRefusal as qt, DeployEngine as r, DependencyError as ra, describeDockerExecFailure as ri, withSharedDrainBudget as rn, carriesSecretMask as rr, isExportAliasCollision as rt, planRollback as s, LocalInvokeBuildError as sa, getDockerCmd as si, s3BucketRegionalDomainName as sn, identityKeyFor as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ConfigError as ta, buildDockerImage as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_READBACK_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, MalformedProducerRecordRefusalError as ua, runDockerForeground as ui, AWS_CREDENTIAL_ENV_KEYS as un, maskSecretsInError as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, StateError as va, getDefaultStateBucketName as vi, displayLogicalId as vn, rebuildClientForBucketRegion as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isMarkedNonRetryable as wa, resolveStateBucketWithDefault as wi, malformedLocalOutputsWarning as wn, shellQuote as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, isCdkdError as xa, resolveAutoAssetStorage as xi, isReadableResourceEntry as xn, buildLockContentionMessage as xr, CloudControlProvider as xt, keptWholeReasonText as y, SynthesisError as ya, getLegacyStateBucketName as yi, hasReadableOutputs as yn, UNREPRODUCIBLE_LOCK_CLAUSE as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, producerRecordKey as zi, refuseMalformedResourcesForDestroy as zn, WorkGraph as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-C1dgx124.js.map
+export { yellow as $, AssemblyReader as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, ResourceTimeoutError as Aa, resolveCaptureObservedState as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, isMarkedNonRetryable as Ba, MIGRATE_TMP_PREFIX as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, LocalInvokeBuildError as Ca, getDockerImageBySourceHash as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, NestedStackChildDirectDestroyError as Da, getLegacyStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, MalformedProducerRecordRefusalError as Ea, getDefaultStateBucketName as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, SynthesisError as Fa, stateBucketExistenceConfirmed as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, markRedactedCause as Ga, injectiveKeyPrefix as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isThrottlingError as Ha, uploadCfnTemplate as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, formatError as Ia, warnDeprecatedNoPrefixCliFlag as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, safeStringify$1 as Ja, decodeListingKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, retryClassificationText as Ka, producerCoordinateKey as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, isCdkdError as La, ssmResolvedValueType as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, StackHasActiveImportsError as Ma, resolveStateBucketWithDefault as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, StackTerminationProtectionError as Na, resolveStateBucketWithDefaultAndSource as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, PartialFailureError as Oa, resolveApp as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StateError as Pa, resolveUseCdkBootstrapAssets as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, derivePartitionAndUrlSuffix as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, normalizeAwsError as Ra, CFN_TEMPLATE_BODY_LIMIT as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, IntrinsicResolutionRefusalError as Sa, AssetManifestLoader as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LockError as Ta, synthesisStatusMessage as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isTransientServerError as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, isRetryableTransientError as Va, findLargeInlineResources as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, markNonRetryable as Wa, injectiveKey as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, PARTITION_TABLE as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, __exportAll as Ya, expectedOwnerParam as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, canonicalizeRegion as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ConfigError as _a, redactDockerArgvValues as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, nullPrototypeRecord as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, DeployCancelledError as ba, escapeRegExp$1 as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, resolveAssemblyPath as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, AwsClients as da, describeDockerExecFailure as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, failedStageNote as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, getAwsClients as fa, describeDockerFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, CdkdError as ga, partitionSensitiveEnv as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, AssetError as ha, getDockerCmd as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasPlainPrototype$1 as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ResourceUpdateNotSupportedError as ja, resolveSkipPrefix as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, ProvisioningError as ka, resolveAutoAssetStorage as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, clearBucketRegionCache as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, setAwsClients as ma, formatDockerLoginError as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, defineOwnKey as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, ownValue as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, resetAwsClients as pa, dockerSpawnEnvWithSensitive as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, describeAwsFailure as qa, producerRecordKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, hasOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, renderAssemblyPathEscape as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveBucketRegion as ua, describeDockerCapturedOutput as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CrossAccountSecretRefusalError as va, runDockerForeground as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, LocalStartServiceError as wa, Synthesizer as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DynamicReferenceRegionAmbiguousError as xa, stripControlChars as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, DependencyError as ya, runDockerStreaming as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, withErrorHandling as za, CFN_TEMPLATE_URL_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-CMD4BtQe.js.map