@go-to-k/cdkd 0.290.42 → 0.290.44

package/dist/{program-HtHlEaZm.js → program-CGhtrsw6.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $n as STATE_SOURCED_BASELINE_RULES, $r as validateContainerRepoName, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as retryClassificationText, Ai as CFN_TEMPLATE_BODY_LIMIT, An as malformedResourcePropertiesWarning, Ar as hasUnverifiableParameterRefusal, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as decodeListingKey, Bn as refuseMalformedState, Br as buildAssetRedirectMap, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as withErrorHandling, Ci as resolveSkipPrefix, Cn as malformedExportSourceWarning, Cr as formatLockExpiry, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as isTransientServerError, Di as stateBucketExistenceConfirmed, Dn as malformedOutputsWarning, Dr as exportNamesCarriedFrom, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as isThrottlingError, Ei as resolveUseCdkBootstrapAssets, En as malformedOutputsRefusalMessage, Er as DEFAULT_STATE_PREFIX, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Fn as refuseMalformedOutputs, Fr as orphansCarriedFrom, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as AssemblyReader, Gn as safeRegion, Gr as BOOTSTRAP_MARKER_PREFIX, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as PARTITION_TABLE, Hn as repairMalformedResourceEntriesForReadOnly, Hr as loadPublishableAssetManifest, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as injectiveKey, In as refuseMalformedOutputsForDestroy, Ir as shouldRetainResource, It as isNamelessDynamicReferenceError, J as bold, Ji as resolveBucketRegion, Jn as findSilentDropProperties, Jr as getBootstrapMarkerKey, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as processStackMessages, Kn as safeStackName, Kr as assertAssetBucketRegion, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as injectiveKeyPrefix, Ln as refuseMalformedResourceEntries, Lr as AssetPublisher, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as safeStringify, Mi as MIGRATE_TMP_PREFIX, Mn as malformedStateRefusalMessage, Mr as importableOutputs, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Ni as findLargeInlineResources, Nn as refuseDivergentRecordRegionForDestroy, Nr as isReadableBag, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as markNonRetryable, Oi as warnDeprecatedNoPrefixCliFlag, On as malformedRenderedContainersWarning, Or as hasReadableExportSet, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as uploadCfnTemplate, Pn as refuseMalformedNestedChildOutputs, Pr as orphansAfterRollback, Pt as getAccountInfo, Q as red, Qi as setAwsClients, Qn as TemplateParser, Qr as validateAssetBucketName, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as producerCoordinateKey, Rn as refuseMalformedResourcePropertiesForOrphan, Rr as stringifyValue, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as normalizeAwsError, Si as resolveCaptureObservedState, Sn as malformedExportNamesWarning, Sr as forceQuitRecoveryClause, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as isRetryableTransientError, Ti as resolveStateBucketWithDefaultAndSource, Tn as malformedOrphanRecordsWarning, Tr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as canonicalizeRegion, Un as repairMalformedResourcePropertiesForReadOnly, Ur as rewriteTemplateAssetReferences, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as expectedOwnerParam, Vn as repairMalformedOutputsForReadOnly, Vr as createAssetRedirectResolver, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as derivePartitionAndUrlSuffix, Wn as repairMalformedResourcesForReadOnly, Wr as AssetModeResolver, Wt as assertRegionMatch, X as gray, Xi as getAwsClients, Xn as withRetry, Xr as parseBootstrapMarker, Xt as readConfigString, Y as cyan, Yi as AwsClients, Yn as describeTypeWithThrottleRetry, Yr as isCrossRegionRedirect, Yt as configStringRefusal, Z as green, Zi as resetAwsClients, Zn as DagBuilder, Zr as readBootstrapMarkerBody, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as StackTerminationProtectionError, _i as synthesisStatusMessage, _n as UNREADABLE_RESOURCES_MAP_ROW, _r as S3StateBackend, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as DynamicReferenceRegionAmbiguousError, ai as dockerSpawnEnvWithSensitive, an as s3BucketDomainName, ar as dynamicReferenceTokens, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, bi as resolveApp, bn as hasReadableResources, br as buildForceUnlockCommand, bt as startInterruptWatch, c as replayFailedOperations, ca as LocalStartServiceError, ci as partitionSensitiveEnv, cn as s3BucketWebsiteUrl, cr as isSingleDynamicReferenceToken, ct as IAMRoleProvider, d as updatePartialMessage, da as NestedStackChildDirectDestroyError, di as runDockerStreaming, dn as applyCallerIdentityCredentials, dr as maskSecretsInText, dt as ProviderRegistry, ea as CdkdError, ei as buildDenyExternalAccessPolicy, en as requireConfigString, er as STATE_SOURCED_CROSS_GENERATION_RULES, et as collectDeclaredOutputNames, f as updatePartialReason, fa as PartialFailureError, fi as escapeRegExp, fn as callerEnvCredentials, fr as recordMaskOnlyValue, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as StackHasActiveImportsError, gi as Synthesizer, gn as STATE_RESOURCES_MALFORMED, gr as LockManager, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as ResourceUpdateNotSupportedError, hi as getDockerImageBySourceHash, hn as INTRINSIC_KEYS, hr as scrubResourceRecord, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as DeployCancelledError, ii as describeDockerFailure, in as s3BucketArn, ir as createSecretMasker, it as secretBearing, j as isFinalSnapshotError, ja as describeAwsFailure, ji as CFN_TEMPLATE_URL_LIMIT, jn as malformedResourcesWarning, jr as importableOutputKeys, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as markRedactedCause, ki as ssmResolvedValueType, kn as malformedResourceEntriesWarning, kr as hasReasonlessBaselineRefusal, kt as IntrinsicFunctionResolver, l as replayRollback, li as redactDockerArgvValues, ln as applyRoleArnIfSet, lr as markSameGenerationBag, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as ResourceTimeoutError, mi as AssetManifestLoader, mn as DiffCalculator, mr as redactSecretsForState, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as CrossAccountSecretRefusalError, ni as describeDockerCapturedOutput, nn as producerRegionsFromState, nr as TEMPLATE_SOURCED_RULES, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as IntrinsicResolutionRefusalError, oi as formatDockerLoginError, on as s3BucketDualStackDomainName, or as errorCauseChain, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as ProvisioningError, pi as stripControlChars, pn as envCredentialsAreAssumedRole, pr as recoverMaskedOutput, pt as createMaskedRetryLogger, q as formatResourceLine, qn as findActionableSilentDrops, qr as ensureAssetStorage, qt as configBooleanRefusal, r as DeployEngine, ri as describeDockerExecFailure, rn as withSharedDrainBudget, rr as carriesSecretMask, rt as isExportAliasCollision, s as planRollback, sa as LocalInvokeBuildError$1, si as getDockerCmd, sn as s3BucketRegionalDomainName, sr as identityKeyFor, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as buildDockerImage, tn as classifyReplaySecretRegion, tr as STATE_SOURCED_READBACK_RULES, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as MalformedProducerRecordRefusalError, ui as runDockerForeground, un as AWS_CREDENTIAL_ENV_KEYS, ur as maskSecretsInError, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, vi as getDefaultStateBucketName, vn as displayLogicalId, vr as rebuildClientForBucketRegion, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as isMarkedNonRetryable, wi as resolveStateBucketWithDefault, wn as malformedLocalOutputsWarning, wr as shellQuote, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as resolveAutoAssetStorage, xn as isReadableResourceEntry, xr as buildLockContentionMessage, xt as CloudControlProvider, y as keptWholeReasonText, ya as SynthesisError, yi as getLegacyStateBucketName, yn as hasReadableOutputs, yr as UNREPRODUCIBLE_LOCK_CLAUSE, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as producerRecordKey, zn as refuseMalformedResourcesForDestroy, zr as WorkGraph, zt as refStateLookupFromResource } from "./deploy-engine-C1dgx124.js";
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-D-2HeLmd.js";
+import { $ as yellow, $i as AssemblyReader, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as ResourceTimeoutError, Ai as resolveCaptureObservedState, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as isMarkedNonRetryable, Bi as MIGRATE_TMP_PREFIX, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as LocalInvokeBuildError$1, Ci as getDockerImageBySourceHash, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as NestedStackChildDirectDestroyError, Di as getLegacyStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as MalformedProducerRecordRefusalError, Ei as getDefaultStateBucketName, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as SynthesisError, Fi as stateBucketExistenceConfirmed, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as markRedactedCause, Gi as injectiveKeyPrefix, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isThrottlingError, Hi as uploadCfnTemplate, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as warnDeprecatedNoPrefixCliFlag, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as safeStringify, Ji as decodeListingKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as retryClassificationText, Ki as producerCoordinateKey, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as ssmResolvedValueType, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as StackHasActiveImportsError, Mi as resolveStateBucketWithDefault, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as StackTerminationProtectionError, Ni as resolveStateBucketWithDefaultAndSource, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as PartialFailureError, Oi as resolveApp, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as resolveUseCdkBootstrapAssets, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as derivePartitionAndUrlSuffix, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as normalizeAwsError, Ri as CFN_TEMPLATE_BODY_LIMIT, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as IntrinsicResolutionRefusalError, Si as AssetManifestLoader, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as synthesisStatusMessage, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isTransientServerError, Ui as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as isRetryableTransientError, Vi as findLargeInlineResources, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as markNonRetryable, Wi as injectiveKey, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xi as PARTITION_TABLE, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Yi as expectedOwnerParam, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as canonicalizeRegion, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as redactDockerArgvValues, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as nullPrototypeRecord, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as DeployCancelledError, bi as escapeRegExp, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as resolveAssemblyPath, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, da as AwsClients, di as describeDockerExecFailure, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as failedStageNote, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as getAwsClients, fi as describeDockerFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as CdkdError, gi as partitionSensitiveEnv, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as getDockerCmd, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasPlainPrototype, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ResourceUpdateNotSupportedError, ji as resolveSkipPrefix, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as ProvisioningError, ki as resolveAutoAssetStorage, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as setAwsClients, mi as formatDockerLoginError, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as defineOwnKey, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as ownValue, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as resetAwsClients, pi as dockerSpawnEnvWithSensitive, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as describeAwsFailure, qi as producerRecordKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as hasOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as renderAssemblyPathEscape, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as processStackMessages, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveBucketRegion, ui as describeDockerCapturedOutput, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CrossAccountSecretRefusalError, vi as runDockerForeground, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as LocalStartServiceError, wi as Synthesizer, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as DynamicReferenceRegionAmbiguousError, xi as stripControlChars, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerStreaming, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as withErrorHandling, zi as CFN_TEMPLATE_URL_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-CMD4BtQe.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-DjBU2Ap3.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-Divizw1k.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Cms9Daqn.js";
+import { t as getCdkdVersion } from "./version-4uhXCFhs.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BwN09Zcn.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -34,7 +34,6 @@ import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
-import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import { isDeepStrictEqual, promisify } from "node:util";
 import graphlib from "graphlib";
@@ -42,7 +41,6 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBCluster
 import { Command, InvalidArgumentError, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
-import { writeFileSync as writeFileSync$1 } from "fs";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
@@ -2265,7 +2263,35 @@ function countDeployableResources(template) {
 	return Object.values(template.Resources ?? {}).filter((r) => r.Type !== "AWS::CDK::Metadata").length;
 }
 /**
-* Synth command implementation
+* Where `cdkd synth --verbose` writes one stack's template, refusing a path
+* that leaves `outputDir` (issue
+* [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
+* `stackName` is the assembly manifest's own `properties.stackName`, falling
+* back to the artifact id, so it is chosen by whoever wrote the assembly — and
+* this is the ONE place cdkd turns such a string into a path it WRITES. A
+* `../../../..`-bearing name would put attacker-chosen JSON outside the output
+* directory, clobbering whatever `<name>.template.json` it can reach.
+*
+* Exported for unit testing.
+*/
+function resolveVerboseTemplatePath(outputDir, stackName) {
+	const resolved = resolveAssemblyPath(outputDir, `${stackName}.template.json`);
+	if (!resolved.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' would write its template to a path that ${renderAssemblyPathEscape(resolved, outputDir, "write it")}`);
+	let linked = false;
+	try {
+		linked = lstatSync(resolved.path).isSymbolicLink();
+	} catch {}
+	if (linked) throw new SynthesisError(`Stack '${displaySafe(stackName)}' would write its template over a symbolic link at '${displaySafe(resolved.path)}'. cdkd writes a stack's template as a regular file beside the assembly; a symbolic link there redirects the write to wherever it points, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to write it.`);
+	return resolved.path;
+}
+/**
+* Synth command implementation.
+*
+* Exported for the wiring test that pins `--verbose` writing through
+* {@link resolveVerboseTemplatePath} rather than a bare `path.join`
+* (go-to-k/cdkd#3489): the guard has its own cases, but reverting the CALL
+* SITE left the suite green.
 */
 async function synthCommand(options) {
 	const logger = getLogger();
@@ -2311,9 +2337,9 @@ async function synthCommand(options) {
 		logger.info(`    - Outputs: ${outputCount}`);
 		logger.info(`    - Has assets: ${assemblyReader.hasAssets(stack) ? "Yes" : "No"}`);
 		if (options.verbose) {
-			const templatePath = join$1(options.output, `${stack.stackName}.template.json`);
-			writeFileSync$1(templatePath, JSON.stringify(stack.template, null, 2));
-			logger.debug(`    - Template written to: ${templatePath}`);
+			const templatePath = resolveVerboseTemplatePath(options.output, stack.stackName);
+			writeFileSync(templatePath, JSON.stringify(stack.template, null, 2));
+			logger.debug(`    - Template written to: ${displaySafe(templatePath)}`);
 		}
 	}
 	logger.info(`\nOutput: ${assemblyDir}`);
@@ -2335,6 +2361,25 @@ function createSynthCommand() {
 
 //#endregion
 //#region src/cli/stack-matcher.ts
+/**
+* Match stacks against user-supplied name patterns.
+*
+* Patterns are evaluated against two fields:
+*
+* - `stackName` — the physical CloudFormation stack name (e.g. `MyStage-MyStack`)
+* - `displayName` — the hierarchical CDK path (e.g. `MyStage/MyStack`); falls
+*   back to `stackName` when the assembly does not carry one
+*
+* Routing is decided by whether the pattern contains `/`:
+*
+* - Pattern contains `/` → matched only against `displayName` (a `/` cannot
+*   appear in a CloudFormation stack name, so this is unambiguous)
+* - Pattern contains no `/` → matched only against `stackName`
+*
+* Wildcards (`*`) are supported in either case. Results are de-duplicated by
+* `stackName`, so a pattern that incidentally matches the same stack via both
+* fields is returned only once.
+*/
 function matchStacks(stacks, patterns) {
 	if (patterns.length === 0) return [];
 	const seen = /* @__PURE__ */ new Set();
@@ -2349,10 +2394,57 @@ function matchStacks(stacks, patterns) {
 * Render a stack for diagnostic messages. When `displayName` differs from the
 * physical name, both are shown so the user can see which forms are valid as
 * patterns (e.g. `MyStage-Api (MyStage/Api)`).
+*
+* Both names come from the Cloud Assembly, and every one of this helper's
+* render sites interpolates the result into PROSE cdkd authors — `Available:
+* ...`, `Multiple stacks found: ...`, `Publishing assets for stack: ...`, the
+* last of which prints on a normal run rather than only on an error. So they
+* go through `displayIdent` ([#3277](https://github.com/go-to-k/cdkd/issues/3277)):
+* a `stackName` carrying `ESC [ 2 K` plus a carriage return ERASES cdkd's own
+* line and a newline forges a second one, and a value carrying quotes and
+* periods writes a cdkd-sounding clause.
+*
+* It is the identity on every legitimate `stackName` — a CloudFormation stack
+* name is `[A-Za-z0-9-]`, inside `PLAIN_IDENT`. It is NOT the identity on
+* every legitimate `displayName`: CDK sets that to the construct path, and
+* `constructs` rewrites only `/` in an id, so `new Stack(app, 'My Stack')` is
+* legal and prints `MyStack ("My Stack")`. Those quotes are not part of any
+* pattern, in a clause whose job is to say which forms ARE valid as patterns —
+* accepted, because the alternative is `displaySafe`, which passes the quotes
+* and spaces a crafted value needs, and the pattern still matches the RAW
+* name either way (`matchStacks` never sees this rendering).
+*
+* Sanitizing HERE rather than at the call sites is what keeps the rule whole:
+* the sites include `scrub.ts` and `destroy.ts`, which this change does not
+* touch, and a rule widened by hand is how the class survived being closed
+* twice already.
 */
 function describeStack(stack) {
-	if (stack.displayName && stack.displayName !== stack.stackName) return `${stack.stackName} (${stack.displayName})`;
-	return stack.stackName;
+	const name = displayIdent(stack.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayIdent(stack.displayName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`;
+	return name;
+}
+/**
+* The message a command raises when SELECTION came back empty — shared by
+* `deploy`, `diff`, `list` and `publish-assets`, which all built the identical
+* string by hand.
+*
+* `assembly` is required AND so is its `failedStages` member, which is the
+* point: a Stage that failed to load dropped every stack under it from
+* `available`, so "no stacks matching" names the wrong problem unless the
+* failure is reported with it (issue
+* [#3482](https://github.com/go-to-k/cdkd/issues/3482)). A REQUIRED member,
+* not an optional one — `{ failedStages?: ... }` accepts `{}`, so it fences
+* the argument while leaving the content unfenced, which is the wiring hole
+* this signature exists to close. `SynthesisResult.failedStages` is required
+* for the same reason, so passing the result satisfies it and an ad-hoc `{}`
+* does not.
+*
+* What it does NOT fence: a caller passing a STALE or empty list. That is
+* behaviour, not shape, and it is covered by a wiring test per command.
+*/
+function renderNoStackMatch(patterns, available, assembly) {
+	return (patterns.length > 0 ? `No stacks matching ${patterns.join(", ")} found in assembly. ` + (available.length > 0 ? `Available: ${available.map(describeStack).join(", ")}` : "The assembly has no stacks") : "No stacks found in assembly") + failedStageNote(patterns, assembly.failedStages);
 }
 function stackMatchesPattern(stack, pattern) {
 	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
@@ -2430,10 +2522,11 @@ async function listCommand(patterns, options) {
 		...Object.keys(context).length > 0 && { context },
 		deferMacroExpansion: true
 	};
-	const allStacks = (await synthesizer.synthesize(synthOptions)).stacks;
-	if (allStacks.length === 0) throw new Error("No stacks found in assembly");
+	const result = await synthesizer.synthesize(synthOptions);
+	const allStacks = result.stacks;
+	if (allStacks.length === 0) throw new Error(renderNoStackMatch(patterns, allStacks, result));
 	const selected = patterns.length > 0 ? matchStacks(allStacks, patterns) : allStacks;
-	if (selected.length === 0) throw new Error(`No stacks matching ${patterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}`);
+	if (selected.length === 0) throw new Error(renderNoStackMatch(patterns, allStacks, result));
 	const sorted = sortByDependency(selected);
 	if (options.long) {
 		emitStructured(sorted.map((s) => toLongRecord(s, options.showDependencies)), options.json);
@@ -3444,7 +3537,7 @@ function templateIdentity(templatePath) {
 	const dir = path.dirname(templatePath);
 	let realDir;
 	try {
-		realDir = fs.realpathSync(dir);
+		realDir = fs.realpathSync.native(dir);
 	} catch {
 		realDir = path.resolve(dir);
 	}
@@ -3567,7 +3660,16 @@ function findNestedTemplateTreeDefect(nestedTemplates, ancestorTemplatePaths = [
 						logicalId: row.logicalId,
 						assetPath: row.assetPath
 					};
-					const defect = visit(row.logicalId, path.join(dir, row.assetPath));
+					const resolved = resolveAssemblyPath(dir, row.assetPath);
+					if (!resolved.contained) return {
+						kind: "escaping-path",
+						chain: [...chain],
+						logicalId: row.logicalId,
+						assetPath: row.assetPath,
+						escape: resolved,
+						dir
+					};
+					const defect = visit(row.logicalId, resolved.path);
 					if (defect) return defect;
 				}
 			} finally {
@@ -3626,6 +3728,7 @@ function renderNestedTemplateTreeDefect(defect, stackName, action) {
 	}
 	if (defect.kind === "too-large") return `The nested template tree under stack '${displaySafe(stackName)}' has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
 	if (defect.kind === "too-deep") return `The nested template tree under stack '${displaySafe(stackName)}' nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
+	if (defect.kind === "escaping-path") return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']='${displaySafe(defect.assetPath)}' which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
 	return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']='${displaySafe(defect.assetPath)}' which is absolute. ${provenance}`;
 }
 
@@ -63959,6 +64062,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const guardIndeterminateTargets = /* @__PURE__ */ new Set();
 	const regionForState = state.region ?? ctx.baseRegion;
 	refuseMalformedResourcesForDestroy(state, stackName, regionForState);
+	refuseMalformedOrphansForDestroy(state, stackName, regionForState);
 	refuseDivergentRecordRegionForDestroy(state, stackName, regionForState, ctx.divergentBodyRegion);
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
@@ -64009,7 +64113,10 @@ async function runDestroyForStack(stackName, state, ctx) {
 		emptyLockHeld = true;
 		try {
 			const recheck = await ctx.stateBackend.getState(stackName, regionForState);
-			if (recheck) refuseMalformedResourcesForDestroy(recheck.state, stackName, regionForState);
+			if (recheck) {
+				refuseMalformedResourcesForDestroy(recheck.state, stackName, regionForState);
+				refuseMalformedOrphansForDestroy(recheck.state, stackName, regionForState);
+			}
 			const recheckResources = recheck ? Object.keys(recheck.state.resources).length : 0;
 			const recheckOrphans = recheck ? (recheck.state.orphans ?? []).length : 0;
 			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack '${stackName}' (${regionForState}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
@@ -64984,7 +65091,9 @@ var NestedStackProvider = class {
 		const result = Object.create(null);
 		for (const { logicalId: grandLogicalId, assetPath } of listNestedTemplateRows(childTemplate)) {
 			if (isAbsoluteCrossPlatform$1(assetPath)) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`));
-			result[grandLogicalId] = path.join(dir, assetPath);
+			const resolved = resolveAssemblyPath(dir, assetPath);
+			if (!resolved.contained) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`));
+			result[grandLogicalId] = resolved.path;
 		}
 		return result;
 	}
@@ -65996,11 +66105,12 @@ async function deployCommand(stacks, options) {
 		logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
+		if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 		if (options.all) targetStacks = allStacks;
 		else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
-		if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+		if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 		const inferredCrossStackDeps = inferCrossStackStackDeps(allStacks);
 		const effectiveStackDeps = (stackName, deps) => {
 			const union = new Set(deps);
@@ -66097,7 +66207,8 @@ async function deployCommand(stacks, options) {
 							region: assetRegion,
 							...options.profile && { profile: options.profile },
 							nodePrefix: `${stack.stackName}:`,
-							...redirect && { redirect }
+							...redirect && { redirect },
+							...stack.assetOutdir !== void 0 && { assetOutdir: stack.assetOutdir }
 						});
 						for (const id of nodeIds) stackDeps.add(id);
 					}
@@ -66248,7 +66359,7 @@ async function deployCommand(stacks, options) {
 					awsClients: stackAwsClients,
 					stateBucket,
 					exportIndexStore,
-					nestedTemplates: stackInfo.nestedTemplates ?? {},
+					nestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
 					dagBuilder,
 					diffCalculator,
 					options: deployEngineOptions,
@@ -67863,13 +67974,15 @@ function readNestedTemplate(templatePath) {
 */
 function indexNestedChildTemplates(template, templatePath) {
 	const dir = path.dirname(templatePath);
-	const result = {};
+	const result = nullPrototypeRecord();
 	for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
 		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
-		result[logicalId] = path.join(dir, assetPath);
+		const resolved = resolveAssemblyPath(dir, assetPath);
+		if (!resolved.contained) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`);
+		result[logicalId] = resolved.path;
 	}
 	return result;
 }
@@ -67890,6 +68003,10 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
 		if (unreadableProps.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
 		if (repairMalformedOutputsForReadOnly(result.state)) logger.warn(malformedOutputsWarning(stackName, region));
+		if (repairMalformedOrphansForReadOnly(result.state)) {
+			logger.warn(malformedOrphansWarning(stackName, region));
+			unreadable.push(UNREADABLE_ORPHANS_CONTAINER_ROW);
+		}
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
 		return {
 			state: result.state,
@@ -68666,10 +68783,10 @@ function renderDiffTree(node, isRoot, logFn) {
 		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
 		if (node.adoptedOrphans.length > 0) logFn(`${node.adoptedOrphans.length} resource(s) to adopt from a previous rollback: ${node.adoptedOrphans.map(stripControlChars).join(", ")}`);
 		if (node.unreadable.length > 0) {
-			const named = node.unreadable.slice(0, UNREADABLE_PREVIEW_NAMES).map((id) => id === "(resources map)" ? id : displayLogicalId(id));
+			const named = node.unreadable.slice(0, UNREADABLE_PREVIEW_NAMES).map((id) => id === "(resources map)" || id === "(orphans container)" ? id : displayLogicalId(id));
 			const rest = node.unreadable.length - named.length;
-			const onlyTheMap = node.unreadable.length === 1 && node.unreadable[0] === "(resources map)";
-			logFn(`${node.unreadable.length} state record row(s) could not be read: ${named.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}.` + (onlyTheMap ? "" : " One the template still declares is shown above as a create; one it no longer declares is not shown above."));
+			const onlyContainerRows = node.unreadable.every((id) => id === "(resources map)" || id === "(orphans container)");
+			logFn(`${node.unreadable.length} state record row(s) could not be read: ${named.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}.` + (onlyContainerRows ? "" : " One the template still declares is shown above as a create; one it no longer declares is not shown above."));
 		}
 	}
 	if (node.blocking.length > 0) {
@@ -68763,15 +68880,17 @@ async function diffCommand(stacks, options) {
 			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
 			deferMacroExpansion: true
 		};
-		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
+		const result = await synthesizer.synthesize(synthOptions);
+		const { stacks: allStacks } = result;
 		logger.info(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
+		if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 		if (options.all) targetStacks = allStacks;
 		else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
-		if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+		if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const stateConfig = {
 			bucket: stateBucket,
@@ -68835,7 +68954,7 @@ async function diffCommand(stacks, options) {
 				displayName: stackInfo.stackName,
 				region: stackRegion,
 				template: stackInfo.template,
-				nestedTemplates: stackInfo.nestedTemplates ?? {},
+				nestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
 				recursive,
 				stateBackend,
 				diffCalculator,
@@ -69245,6 +69364,12 @@ async function scrubCommand(stacks, options) {
 	*/
 	const malformedOutputRecords = [];
 	/**
+	* Stacks whose `orphans` CONTAINER could not be read (go-to-k/cdkd#3379).
+	* Its own list for the reason `malformedOutputRecords` is its own: the
+	* audited error names the container that is broken.
+	*/
+	const malformedOrphanRecords = [];
+	/**
 	* Stacks whose scrub met a PRODUCER record with an unreadable `outputs` map
 	* (go-to-k/cdkd#3192 review round 5).
 	*
@@ -69332,6 +69457,7 @@ async function scrubCommand(stacks, options) {
 		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.malformedOutputs) malformedOutputRecords.push(stack.stackName);
+		if (scrubbed.malformedOrphans) malformedOrphanRecords.push(stack.stackName);
 		if (scrubbed.unverifiableLeaves > 0) {
 			totalStacksWithUnverifiableLeaves++;
 			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${stack.stackName} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
@@ -69367,7 +69493,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0 && malformedOrphanRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -69391,7 +69517,7 @@ async function scrubCommand(stacks, options) {
 		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
-		if (malformedRecords.length > 0 || malformedOutputRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords);
+		if (malformedRecords.length > 0 || malformedOutputRecords.length > 0 || malformedOrphanRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords, malformedOrphanRecords);
 		if (damagedProducerStacks.length > 0) throw damagedProducerRecordsError(damagedProducerStacks);
 		if (options.fail) throw new ScrubNeededError();
 		return;
@@ -69400,7 +69526,7 @@ async function scrubCommand(stacks, options) {
 	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
-	if (malformedRecords.length > 0 || malformedOutputRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords);
+	if (malformedRecords.length > 0 || malformedOutputRecords.length > 0 || malformedOrphanRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords, malformedOrphanRecords);
 	if (damagedProducerStacks.length > 0) throw damagedProducerRecordsError(damagedProducerStacks);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0 || totalStacksWithUnverifiableLeaves > 0)) throw new ScrubNeededError();
 }
@@ -70022,11 +70148,12 @@ function damagedProducerRecordsError(stackNames) {
 	const names = stackNames.map((n) => displayIdent(n)).join(", ");
 	return new ScrubRefusalError(`${stackNames.length} stack(s) import a value from a PRODUCER whose state record has no readable 'outputs' map, so this run could not tell whether that producer still holds the plaintext: ${names}. Those stacks were scrubbed for everything else and are NOT reported clean. Repair the producer record and scrub it first, then re-run. See the warnings above for which producer.`, "SCRUB_PRODUCER_RECORD_UNREADABLE");
 }
-function malformedRecordsAuditedError(stackNames, outputStackNames) {
+function malformedRecordsAuditedError(stackNames, outputStackNames, orphanStackNames) {
 	const safeNames = (names) => names.map((n) => displayIdent(n)).join(", ");
 	const parts = [];
 	if (stackNames.length > 0) parts.push(`${stackNames.length} stack(s) were audited with an EMPTY resource set because their state record has no readable 'resources' map: ${safeNames(stackNames)}. The report above describes their outputs only — nothing is known about their resources, so this run cannot certify them clean.`);
 	if (outputStackNames.length > 0) parts.push(`${outputStackNames.length} stack(s) were audited with an EMPTY outputs bag because their state record has no readable 'outputs' map: ${safeNames(outputStackNames)}. The report above describes their resources only — nothing is known about the values their outputs hold, and those values are what the exports index republishes to consumer stacks, so this run cannot certify them clean.`);
+	if (orphanStackNames.length > 0) parts.push(`${orphanStackNames.length} stack(s) were audited with an EMPTY orphan list because their state record has no readable 'orphans' list: ${safeNames(orphanStackNames)}. Nothing is known about resources an earlier failed deploy may have left live in AWS for them, so this run cannot certify them clean.`);
 	return new ScrubRefusalError(`${parts.join(" ")} See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
 }
 /**
@@ -71519,6 +71646,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				logger.warn(malformedOutputsWarning(stack.stackName, region));
 			}
 		} else if (!hasReadableOutputs(state)) throw new ScrubRefusalError(malformedOutputsRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		let malformedOrphans;
+		if (opts.dryRun) {
+			if (repairMalformedOrphansForReadOnly(state)) {
+				malformedOrphans = true;
+				logger.warn(malformedOrphansWarning(stack.stackName, region));
+			}
+		} else if (!hasReadableOrphans(state)) throw new ScrubRefusalError(malformedOrphansRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
 		const resolvers = new ScrubResolvers(region);
@@ -71735,6 +71869,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				unverifiableLeaves,
 				...malformedResources ? { malformedResources } : {},
 				...malformedOutputs ? { malformedOutputs } : {},
+				...malformedOrphans ? { malformedOrphans } : {},
 				outputs: state.outputs,
 				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
@@ -71813,6 +71948,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			unverifiableLeaves,
 			...malformedResources ? { malformedResources } : {},
 			...malformedOutputs ? { malformedOutputs } : {},
+			...malformedOrphans ? { malformedOrphans } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
@@ -71838,87 +71974,6 @@ function createScrubCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/utils/own-keys.ts
-/**
-* Own-key helpers for the bags that reach cdkd through `JSON.parse` — a
-* `state.json` record, a Cloud Control `Properties` document, a template — and
-* for the raw SDK readbacks compared against them.
-*
-* `JSON.parse` yields a key literally named `__proto__` as an ORDINARY own
-* data property, and every comparator / rebuild walk over such a bag has to
-* keep treating it as one. Two idioms silently do not:
-*
-* - **Rebuilding onto a `{}` literal.** `out[k] = v` with `k === '__proto__'`
-*   runs `Object.prototype`'s accessor, SETS the node's prototype and DROPS
-*   the key — on BOTH comparison sides when the walk is a canonicalizer, so a
-*   drift at that key is invisible (issue
-*   [#3121](https://github.com/go-to-k/cdkd/issues/3121)), and on the WRITE
-*   path the member vanishes from the payload (issue
-*   [#2899](https://github.com/go-to-k/cdkd/issues/2899)). Rebuild onto
-*   {@link nullPrototypeRecord} (no accessor there, so plain assignment
-*   defines an own key) or, onto an existing plain object, define the key
-*   with {@link defineOwnKey}.
-* - **`key in bag` membership.** `in` reads the prototype chain, so a key
-*   named `constructor` / `toString` answers `true` for every plain object
-*   and the recursion then walks `Object`'s function. {@link hasOwnKey} asks
-*   the bag alone; {@link ownValue} is the matching read.
-*
-* And ONE shape test every such walk needs FIRST: {@link hasPlainPrototype}.
-* A non-plain object (`Date`, `Uint8Array`, `Map`, a class instance) has no
-* own enumerable keys, so a key-walk over one FABRICATES `{}` (or an index
-* map) and any two of them compare equal. Such a value is returned by
-* IDENTITY and compared as itself.
-*
-* Extracted from `src/cli/commands/drift.ts` (issue #2899, swept by PR #3124)
-* so the analyzer-side canonicalizers (#3121) share ONE spelling rather than a
-* fourth copy. A LEAF module, deliberately, and it must stay one: a value
-* import from a module other suites `vi.mock` wholesale reds those suites
-* with a missing-export failure (which is why `secret-redaction.ts` keeps its
-* own `hasPlainPrototype` — several drift suites mock that module).
-*/
-/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
-function hasOwnKey(target, key) {
-	return Object.prototype.hasOwnProperty.call(target, key);
-}
-/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
-function ownValue(target, key) {
-	return hasOwnKey(target, key) ? target[key] : void 0;
-}
-/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
-function defineOwnKey(target, key, value) {
-	Object.defineProperty(target, key, {
-		value,
-		writable: true,
-		enumerable: true,
-		configurable: true
-	});
-}
-/**
-* Does this value carry an ORDINARY object prototype?
-*
-* `typeof v === 'object'` admits `Date` / `Map` / `Set` / `Uint8Array` / class
-* instances, whose own enumerable keys are `[]` — so a key-walk over one
-* reports "no contradiction" between two values that actually differ, and a
-* rebuild over one fabricates `{}`. A NULL prototype counts as plain: it is
-* what {@link nullPrototypeRecord} yields, and a walk must be able to re-walk
-* its own output.
-*/
-function hasPlainPrototype(value) {
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/**
-* A fresh rebuild target with NO prototype, so `out['__proto__'] = v` defines
-* an own key instead of setting the prototype. `JSON.stringify`,
-* `Object.keys` / `entries` and `structuredClone` all read it like a plain
-* object; only `instanceof Object` and a direct `.hasOwnProperty()` method call
-* do not, and no consumer on the drift path uses either.
-*/
-function nullPrototypeRecord() {
-	return Object.create(null);
-}
-
 //#endregion
 //#region src/analyzer/drift-normalize.ts
 /**
@@ -78112,7 +78167,7 @@ async function exportCommand(stackArg, options) {
 		let synthedRegion;
 		let templateFormat = "json";
 		let allSynthStacks = [];
-		let rootNestedTemplatePaths = {};
+		let rootNestedTemplatePaths = nullPrototypeRecord();
 		if (options.template) {
 			if (!stackArg) throw new Error("--template requires a stack name as a positional argument to identify the cdkd state record.");
 			const parsed = parseTemplateFile(options.template);
@@ -78141,7 +78196,7 @@ async function exportCommand(stackArg, options) {
 			template = stackInfo.template;
 			resolvedStackName = stackInfo.stackName;
 			synthedRegion = stackInfo.region;
-			rootNestedTemplatePaths = stackInfo.nestedTemplates ?? {};
+			rootNestedTemplatePaths = stackInfo.nestedTemplates ?? nullPrototypeRecord();
 			allSynthStacks = result.stacks.map((s) => ({
 				stackName: s.stackName,
 				template: s.template
@@ -78717,11 +78772,16 @@ function readNestedChildTemplateFile(templatePath, childLogicalId) {
 * non-CDK toolchain — `path.join(dir, '/abs/foo')` would silently bypass
 * the `dir` argument).
 *
+* Also refuses a path that RESOLVES outside `templateDir`, which the absolute
+* check cannot see — `path.join` folds `..`
+* ([#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
 * Sibling of `indexGrandchildTemplatePaths` in `import.ts`. Same rationale
-* for separate definitions as `readNestedChildTemplateFile` above.
+* for separate definitions as `readNestedChildTemplateFile` above. Exported
+* for unit testing.
 */
 function indexNestedTemplatePaths(template, templateDir) {
-	const result = {};
+	const result = nullPrototypeRecord();
 	const resources = template["Resources"];
 	if (!resources || typeof resources !== "object" || Array.isArray(resources)) return result;
 	for (const [logicalId, resource] of Object.entries(resources)) {
@@ -78730,8 +78790,10 @@ function indexNestedTemplatePaths(template, templateDir) {
 		if (r.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = r.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (path.isAbsolute(assetPath)) throw new Error(`cdkd export: nested-stack '${logicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates.`);
-		result[logicalId] = path.join(templateDir, assetPath);
+		if (path.isAbsolute(assetPath)) throw new Error(`cdkd export: nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates.`);
+		const resolved = resolveAssemblyPath(templateDir, assetPath);
+		if (!resolved.contained) throw new Error(`cdkd export: nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, templateDir)}`);
+		result[logicalId] = resolved.path;
 	}
 	return result;
 }
@@ -82987,6 +83049,7 @@ async function rollbackCommand(stackArg, options) {
 			if (!stateData) throw new Error(`Rollback journal exists for '${safeStack(stackName)}' (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			const baseState = stateData.state;
 			refuseMalformedState(baseState, stackName, region);
+			refuseMalformedOrphans(baseState, stackName, region);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -85692,15 +85755,17 @@ async function publishAssetsCommand(stacks, options) {
 		...options.profile && { profile: options.profile },
 		...Object.keys(context).length > 0 && { context }
 	};
-	const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
+	const result = await synthesizer.synthesize(synthOptions);
+	const { stacks: allStacks } = result;
 	logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 	const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 	let targetStacks;
+	if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 	if (options.all) targetStacks = allStacks;
 	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
 	else if (allStacks.length === 1) targetStacks = allStacks;
 	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
-	if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+	if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 	const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const stsClient = new STSClient({
@@ -85781,7 +85846,8 @@ async function publishAssetsCommand(stacks, options) {
 						region: stack.region || baseRegion,
 						...options.profile && { profile: options.profile },
 						nodePrefix: `${stack.stackName}:`,
-						...redirect && { redirect }
+						...redirect && { redirect },
+						...stack.assetOutdir !== void 0 && { assetOutdir: stack.assetOutdir }
 					});
 				} catch (err) {
 					if (err.code === "ENOENT") {
@@ -86201,7 +86267,7 @@ async function importCommand(stackArg, options) {
 				overrides
 			});
 			logger.info(`Resolved ${mergeStats.derived} physical ID(s) from CloudFormation` + formatCfnOverrideMergeDetail(mergeStats));
-			validateNestedStackShape(template, migrationTree, stackInfo.stackName, stackInfo.nestedTemplates ?? {});
+			validateNestedStackShape(template, migrationTree, stackInfo.stackName, stackInfo.nestedTemplates ?? nullPrototypeRecord());
 		}
 		let accountIdForNestedSynth;
 		if (migrationTree && migrationTree.nested.size > 0) {
@@ -86229,6 +86295,7 @@ async function importCommand(stackArg, options) {
 		const existingState = existingResult?.state ?? null;
 		if (existingState) refuseMalformedState(existingState, stackInfo.stackName, targetRegion);
 		if (existingState) refuseMalformedOutputs(existingState, stackInfo.stackName, targetRegion);
+		if (existingState) refuseMalformedOrphans(existingState, stackInfo.stackName, targetRegion);
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
 		if (existingState) {
@@ -86319,7 +86386,7 @@ async function importCommand(stackArg, options) {
 				lockRecovery,
 				parentStackName: stackInfo.stackName,
 				parentRegion: targetRegion,
-				parentNestedTemplates: stackInfo.nestedTemplates ?? {},
+				parentNestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
 				parentTree: migrationTree,
 				stateBackend,
 				lockManager,
@@ -87597,16 +87664,23 @@ function readNestedChildTemplate(templatePath, childLogicalId) {
 * does: an absolute path indicates the synth output was hand-modified or
 * generated by a non-CDK toolchain — `path.join(dir, '/abs/foo')` would
 * silently bypass our `dir` resolution and point outside cdk.out.
+*
+* Also refuses a path that RESOLVES outside `dir`, which the absolute check
+* cannot see — `path.join` folds `..`
+* ([#3489](https://github.com/go-to-k/cdkd/issues/3489)). Exported for unit
+* testing.
 */
 function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 	const dir = path.dirname(childTemplatePath);
-	const result = {};
+	const result = nullPrototypeRecord();
 	for (const [grandLogicalId, resource] of Object.entries(childTemplate.Resources)) {
 		if (resource.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (path.isAbsolute(assetPath)) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${grandLogicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates.`);
-		result[grandLogicalId] = path.join(dir, assetPath);
+		if (path.isAbsolute(assetPath)) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates.`);
+		const resolved = resolveAssemblyPath(dir, assetPath);
+		if (!resolved.contained) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`);
+		result[grandLogicalId] = resolved.path;
 	}
 	return result;
 }
@@ -88825,7 +88899,7 @@ function notFoundError$1(target, stack, resources) {
 */
 function copyLayerTreeLastWins(src, dest) {
 	mkdirSync(dest, { recursive: true });
-	copyDirLastWins(realpathSync(src), dest);
+	copyDirLastWins(realpathSync.native(src), dest);
 }
 function copyDirLastWins(fromDir, toDir) {
 	for (const entry of readdirSync(fromDir, { withFileTypes: true })) {
@@ -92591,7 +92665,7 @@ function materializeInlineCode$1(handler, source, fileExtension, tmpDirsOut) {
 	const modulePath = handler.substring(0, lastDot);
 	const dir = mkdtempSync(path.join(tmpdir(), "cdkd-local-start-api-"));
 	tmpDirsOut.add(dir);
-	const filePath = path.join(dir, `${modulePath}${fileExtension}`);
+	const filePath = resolveInlineCodeFilePath(dir, modulePath, fileExtension, handler);
 	mkdirSync(path.dirname(filePath), { recursive: true });
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
@@ -93781,8 +93855,9 @@ async function prepareOneImage(task, container, options) {
 			const tag = `cdkd-local-run-task-${(image.assetHash ?? "single").slice(0, 16)}`;
 			const actualTag = await buildDockerImage(asset, cdkOutDir, {
 				tag,
+				...task.stack.assetOutdir !== void 0 && { assetOutdir: task.stack.assetOutdir },
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${container.name}' (${asset.source.directory ?? (asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0)}): ${stderr}`)
+				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${displaySafe(container.name)}' (${asset.source.directory !== void 0 ? displaySafe(asset.source.directory) : asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0}): ${displaySafe(stderr)}`)
 			});
 			if (actualTag !== tag) {
 				const tagArgs = [
@@ -93793,7 +93868,7 @@ async function prepareOneImage(task, container, options) {
 				try {
 					await runDockerStreaming(tagArgs);
 				} catch (err) {
-					throw new LocalInvokeBuildError$1(`docker tag failed re-tagging '${actualTag}' → '${tag}' for ECS container '${container.name}': ${describeDockerFailure(err, tagArgs)}`);
+					throw new LocalInvokeBuildError$1(`docker tag failed re-tagging '${displaySafe(actualTag)}' → '${displaySafe(tag)}' for ECS container '${displaySafe(container.name)}': ${displaySafe(describeDockerFailure(err, tagArgs))}`);
 				}
 			}
 			return tag;
@@ -94711,13 +94786,16 @@ async function loadAgentCoreAssetContext(args) {
 	const { resolvedTarget, resolved, stacks, cdkOutDir, assetLoader, oldAssetHash } = args;
 	const newCandidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
 	if (!newCandidate) return void 0;
+	const cdkdRecord = stacks.find((s) => s.stackName === newCandidate.stackName);
+	const manifestDir = cdkdRecord?.assetManifestPath ? dirname(cdkdRecord.assetManifestPath) : cdkOutDir;
+	const assetOutdir = cdkdRecord?.assetOutdir ?? manifestDir;
 	if (resolved.codeArtifact) {
 		if (resolved.codeArtifact.s3Source) return void 0;
-		const manifest = await assetLoader.loadManifest(cdkOutDir, newCandidate.stackName);
+		const manifest = await assetLoader.loadManifest(manifestDir, newCandidate.stackName);
 		if (!manifest) return void 0;
 		const asset = assetLoader.getFileAssets(manifest).get(resolved.codeArtifact.codeAssetHash);
 		if (!asset) return void 0;
-		const sourceDir = assetLoader.getAssetSourcePath(cdkOutDir, asset);
+		const sourceDir = assetLoader.getAssetSourcePath(manifestDir, asset, assetOutdir);
 		return {
 			...oldAssetHash !== void 0 && { oldAssetHash },
 			newAssetHash: resolved.codeArtifact.codeAssetHash,
@@ -94726,13 +94804,13 @@ async function loadAgentCoreAssetContext(args) {
 		};
 	}
 	if (resolved.containerUri === void 0) return void 0;
-	const manifest = await assetLoader.loadManifest(cdkOutDir, newCandidate.stackName);
+	const manifest = await assetLoader.loadManifest(manifestDir, newCandidate.stackName);
 	if (!manifest) return void 0;
 	const dockerImageEntry = getDockerImageBySourceHash(manifest, resolved.containerUri);
 	if (!dockerImageEntry) return void 0;
 	const newDockerImage = dockerImageEntry.asset;
 	if (!newDockerImage.source.directory) return void 0;
-	const newAssetSourceDir = resolve(cdkOutDir, newDockerImage.source.directory);
+	const newAssetSourceDir = resolveDockerContextDirectory(manifestDir, newDockerImage.source.directory, (message) => new Error(message), assetOutdir);
 	return {
 		...oldAssetHash !== void 0 && { oldAssetHash },
 		newAssetHash: dockerImageEntry.hash,
@@ -94749,6 +94827,9 @@ async function loadAgentCoreAssetContext(args) {
 * "force rebuild", which is the conservative default.
 *
 * NOT exported from `cdk-local/internal`, so copied locally.
+*
+* @internal — exported so its manifest lookup can be fenced beside
+* {@link loadAgentCoreAssetContext}'s, which is its twin.
 */
 async function deriveOldAssetHash(args) {
 	const { resolvedTarget, resolved, stacks, cdkOutDir, assetLoader } = args;
@@ -94756,7 +94837,9 @@ async function deriveOldAssetHash(args) {
 	if (resolved.containerUri === void 0) return void 0;
 	const candidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
 	if (!candidate) return void 0;
-	const manifest = await assetLoader.loadManifest(cdkOutDir, candidate.stackName);
+	const manifestFile = stacks.find((s) => s.stackName === candidate.stackName)?.assetManifestPath;
+	const manifestDir = manifestFile !== void 0 ? dirname(manifestFile) : cdkOutDir;
+	const manifest = await assetLoader.loadManifest(manifestDir, candidate.stackName);
 	if (!manifest) return void 0;
 	return getDockerImageBySourceHash(manifest, resolved.containerUri)?.hash;
 }
@@ -94841,7 +94924,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 			...options.profile && { profile: options.profile },
 			...Object.keys(context).length > 0 && { context }
 		};
-		const { stacks } = await synthesizer.synthesize(synthOpts);
+		const { stacks, assemblyDir } = await synthesizer.synthesize(synthOpts);
 		const resolvedTarget = await resolveSingleTarget(target, {
 			entries: listTargets(stacks).agentCoreRuntimes,
 			message: "Select an AgentCore Runtime to invoke",
@@ -94879,6 +94962,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 		const boot = await bootAgentCoreContainer({
 			resolved,
 			options,
+			assemblyDir,
 			profileCredentials,
 			profileCredsFile,
 			stateProvider,
@@ -95089,9 +95173,9 @@ function isAgentCoreWatchEligible(protocol) {
 */
 async function bootAgentCoreContainer(args) {
 	const logger = getLogger();
-	const { resolved, options, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext, isMcp, isA2a } = args;
+	const { resolved, options, assemblyDir, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext, isMcp, isA2a } = args;
 	await resolveFromS3BucketIntrinsic(resolved, stateProvider, loadedState, imageContext);
-	const image = await resolveAgentCoreImage(resolved, options, loadedState);
+	const image = await resolveAgentCoreImage(resolved, options, assemblyDir, loadedState);
 	const { env: dockerEnv, sensitiveEnvKeys } = await buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext);
 	const hostPort = await pickFreePort();
 	const containerHost = options.containerHost;
@@ -95138,7 +95222,7 @@ async function bootAgentCoreContainer(args) {
 async function rebuildAgentCoreContainer(args) {
 	const { cleanupBefore, resolvedTarget, options, synthesizer, synthOpts, profileCredentials, profileCredsFile, stateProvider, isMcp, isA2a } = args;
 	await cleanupBefore();
-	const { stacks: newStacks } = await synthesizer.synthesize(synthOpts);
+	const { stacks: newStacks, assemblyDir: newAssemblyDir } = await synthesizer.synthesize(synthOpts);
 	const newCandidate = pickAgentCoreCandidateStack$1(resolvedTarget, newStacks);
 	const { context: newImageContext, loaded: newLoaded } = stateProvider && newCandidate ? await buildAgentCoreImageContext(newCandidate, stateProvider, options) : {
 		context: void 0,
@@ -95148,6 +95232,7 @@ async function rebuildAgentCoreContainer(args) {
 		...await bootAgentCoreContainer({
 			resolved: resolveAgentCoreTarget(resolvedTarget, newStacks, newImageContext),
 			options,
+			assemblyDir: newAssemblyDir,
 			profileCredentials,
 			profileCredsFile,
 			stateProvider,
@@ -95328,11 +95413,18 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 * `loaded` is the `--from-cfn-stack` state record (when available) — threaded
 * through so a bare `--assume-role` can resolve the execution-role ARN from
 * state for the fromS3 download.
+*
+* `assemblyDir` is the ASSEMBLY ROOT as `Synthesizer.synthesize` reported it,
+* and is the containment bound for an asset path read out of the manifest
+* (issue go-to-k/cdkd#3489). It is NOT `options.output`: under
+* `-a <pre-synthesized dir>` synthesis is skipped and the assembly root is
+* `resolve(options.app)` while `--output` keeps its `cdk.out` default, so
+* binding to `--output` would refuse every asset of an untouched assembly.
 */
-async function resolveAgentCoreImage(resolved, options, loaded) {
+async function resolveAgentCoreImage(resolved, options, assemblyDir, loaded) {
 	const logger = getLogger();
 	const architecture = platformToArchitecture(options.platform);
-	if (resolved.codeArtifact) return resolveAgentCoreCodeImage(resolved, resolved.codeArtifact, options, architecture, loaded);
+	if (resolved.codeArtifact) return resolveAgentCoreCodeImage(resolved, resolved.codeArtifact, options, architecture, assemblyDir, loaded);
 	const containerUri = resolved.containerUri;
 	if (containerUri === void 0) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' has neither a container image nor a code artifact to run.`, "LOCAL_INVOKE_AGENTCORE_NO_ARTIFACT");
 	const manifestPath = resolved.stack.assetManifestPath;
@@ -95368,7 +95460,7 @@ async function resolveAgentCoreImage(resolved, options, loaded) {
 *   run the same from-source build (generated Dockerfile → install deps → run
 *   EntryPoint).
 */
-async function resolveAgentCoreCodeImage(resolved, code, options, architecture, loaded) {
+async function resolveAgentCoreCodeImage(resolved, code, options, architecture, assemblyDir, loaded) {
 	if (code.s3Source) return resolveAgentCoreCodeImageFromS3(resolved, code, code.s3Source, options, architecture, loaded);
 	const manifestPath = resolved.stack.assetManifestPath;
 	if (!manifestPath) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' uses a code artifact, but its stack has no asset manifest in cdk.out to read the bundle source from.`, "LOCAL_INVOKE_AGENTCORE_CODE_NO_MANIFEST");
@@ -95378,8 +95470,8 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
-	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset);
-	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' code bundle source '${sourceDir}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
+	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, assemblyDir);
+	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle source '${displaySafe(sourceDir)}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
 		runtime: code.runtime,
@@ -97037,6 +97129,31 @@ function applyProfileCredentialsOverlay(env, profileCreds, assumeRoleActive) {
 	else delete env["AWS_SESSION_TOKEN"];
 }
 /**
+* Where an inline `Code.ZipFile` body is written inside `dir`, refusing a
+* `Handler` whose module path escapes it (issue
+* [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
+* `Handler` is template-supplied, and `materializeInlineCode` turned it into a
+* FILENAME and then `mkdirSync(dirname, { recursive: true })` + `writeFileSync`
+* — so `Handler: '../../victim/evil.handler'` wrote attacker-chosen JavaScript
+* to an arbitrary host path. Measured: the file was created outside the temp
+* directory. That is a write, not the "we run their handler in a container"
+* trade cdkd already accepts.
+*
+* `dir` is a temp directory cdkd just created rather than the assembly, but
+* the containment question is identical and `resolveAssemblyPath` answers it
+* unchanged: `mkdtemp` sits under `/var/folders/...`, reached through macOS's
+* `/var -> /private/var` link, and the helper realpaths BOTH sides so that is
+* a no-op. Only the refusal's provenance differs, so it is passed explicitly.
+*
+* Exported for unit testing.
+*/
+function resolveInlineCodeFilePath(dir, modulePath, fileExtension, handler) {
+	const resolved = resolveAssemblyPath(dir, `${modulePath}${fileExtension}`);
+	if (!resolved.contained) throw new Error(`Handler '${displaySafe(handler)}' names a module path that ${renderAssemblyPathEscape(resolved, dir, "materialize it", "A Handler's module path names a file inside the function's own code directory; one that leaves it would write the inline Code.ZipFile body to an arbitrary path on this machine. Refusing to materialize it.")}`);
+	return resolved.path;
+}
+/**
 * Materialize an inline Lambda body (`Code.ZipFile`) to a tmpdir and
 * return the directory the container should mount at /var/task. The
 * filename is derived from the function's Handler property and the
@@ -97058,9 +97175,19 @@ function materializeInlineCode(handler, source, fileExtension) {
 	if (lastDot <= 0) throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
 	const dir = mkdtempSync(path.join(tmpdir(), "cdkd-local-invoke-"));
-	const filePath = path.join(dir, `${modulePath}${fileExtension}`);
-	mkdirSync(path.dirname(filePath), { recursive: true });
-	writeFileSync(filePath, source, "utf-8");
+	try {
+		const filePath = resolveInlineCodeFilePath(dir, modulePath, fileExtension, handler);
+		mkdirSync(path.dirname(filePath), { recursive: true });
+		writeFileSync(filePath, source, "utf-8");
+	} catch (e) {
+		try {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+		throw e;
+	}
 	return dir;
 }
 /**
@@ -97234,4 +97361,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-HtHlEaZm.js.map
+//# sourceMappingURL=program-CGhtrsw6.js.map