@go-to-k/cdkd 0.290.43 → 0.290.44

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-ChfV4K6h.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-4uhXCFhs.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-Bh8a5wjj.js");
+	const { buildProgram } = await import("./program-CGhtrsw6.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-Bw8VoyEi.js → deploy-engine-CMD4BtQe.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-D-2HeLmd.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-DjBU2Ap3.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-ChfV4K6h.js";
+import { t as getCdkdVersion } from "./version-4uhXCFhs.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3029,6 +3029,91 @@ function renderAssemblyPathEscape(escape, dir, action = "load", provenanceOverri
 	return `resolves to '${displaySafe(escape.path)}', outside '${displaySafe(base)}'. ${provenance}`;
 }
 
+//#endregion
+//#region src/utils/own-keys.ts
+/**
+* Own-key helpers for the bags that reach cdkd through `JSON.parse` — a
+* `state.json` record, a Cloud Control `Properties` document, a template — and
+* for the raw SDK readbacks compared against them.
+*
+* `JSON.parse` yields a key literally named `__proto__` as an ORDINARY own
+* data property, and every comparator / rebuild walk over such a bag has to
+* keep treating it as one. Two idioms silently do not:
+*
+* - **Rebuilding onto a `{}` literal.** `out[k] = v` with `k === '__proto__'`
+*   runs `Object.prototype`'s accessor, SETS the node's prototype and DROPS
+*   the key — on BOTH comparison sides when the walk is a canonicalizer, so a
+*   drift at that key is invisible (issue
+*   [#3121](https://github.com/go-to-k/cdkd/issues/3121)), and on the WRITE
+*   path the member vanishes from the payload (issue
+*   [#2899](https://github.com/go-to-k/cdkd/issues/2899)). Rebuild onto
+*   {@link nullPrototypeRecord} (no accessor there, so plain assignment
+*   defines an own key) or, onto an existing plain object, define the key
+*   with {@link defineOwnKey}.
+* - **`key in bag` membership.** `in` reads the prototype chain, so a key
+*   named `constructor` / `toString` answers `true` for every plain object
+*   and the recursion then walks `Object`'s function. {@link hasOwnKey} asks
+*   the bag alone; {@link ownValue} is the matching read.
+*
+* And ONE shape test every such walk needs FIRST: {@link hasPlainPrototype}.
+* A non-plain object (`Date`, `Uint8Array`, `Map`, a class instance) has no
+* own enumerable keys, so a key-walk over one FABRICATES `{}` (or an index
+* map) and any two of them compare equal. Such a value is returned by
+* IDENTITY and compared as itself.
+*
+* Extracted from `src/cli/commands/drift.ts` (issue #2899, swept by PR #3124)
+* so the analyzer-side canonicalizers (#3121) share ONE spelling rather than a
+* fourth copy. A LEAF module, deliberately, and it must stay one: a value
+* import from a module other suites `vi.mock` wholesale reds those suites
+* with a missing-export failure (which is why `secret-redaction.ts` keeps its
+* own `hasPlainPrototype` — several drift suites mock that module).
+*/
+/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
+function hasOwnKey(target, key) {
+	return Object.prototype.hasOwnProperty.call(target, key);
+}
+/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
+function ownValue(target, key) {
+	return hasOwnKey(target, key) ? target[key] : void 0;
+}
+/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+}
+/**
+* Does this value carry an ORDINARY object prototype?
+*
+* `typeof v === 'object'` admits `Date` / `Map` / `Set` / `Uint8Array` / class
+* instances, whose own enumerable keys are `[]` — so a key-walk over one
+* reports "no contradiction" between two values that actually differ, and a
+* rebuild over one fabricates `{}`. A NULL prototype counts as plain: it is
+* what {@link nullPrototypeRecord} yields, and a walk must be able to re-walk
+* its own output.
+*/
+function hasPlainPrototype$1(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/**
+* A fresh rebuild target with NO prototype, so `out['__proto__'] = v` defines
+* an own key instead of setting the prototype. `JSON.stringify`,
+* `Object.keys` / `entries` and `structuredClone` all read it like a plain
+* object; only `instanceof Object` and a direct `.hasOwnProperty()` method call
+* do not, and no consumer on the drift path uses either.
+*
+* The type parameter spares a caller with a narrower value type an `as` cast at
+* every call — `nullPrototypeRecord<string>()` for a logical-id-to-path index.
+* It defaults to `unknown`, so a zero-argument call is unchanged.
+*/
+function nullPrototypeRecord() {
+	return Object.create(null);
+}
+
 //#endregion
 //#region src/synthesis/stack-messages.ts
 /**
@@ -3123,9 +3208,160 @@ function processStackMessages(stacks, logger, options = {}) {
 	if (hasWarnings && failAt === "warn") throw new SynthesisError("Found warnings (--strict mode)");
 }
 
+//#endregion
+//#region src/synthesis/failed-stages.ts
+/**
+* Marks an error that already names the Stage it was raised under, so an outer
+* Stage does not prepend its own name on the way out. Follows the marker shape
+* of `markNonRetryable` in `src/deployment/retryable-errors.ts`: a
+* non-enumerable own property, read by presence.
+*/
+const STAGE_SCOPED_MARKER = Symbol.for("cdkd.stageScopedError");
+/**
+* Re-raise a refusal caught while reading the CONTENTS of a Stage, with the
+* Stage named (issue [#3482](https://github.com/go-to-k/cdkd/issues/3482)).
+*
+* This is NOT a downgrade: every caller throws what this returns. The refusal
+* texts name the STACK — the stack a Stage produced carries a physical name
+* that need not embed the Stage's path, so without this the user is not told
+* which Stage directory to look in.
+*
+* The INNERMOST Stage wins: an error arriving already marked is returned
+* unchanged, so `Outer` does not restate what `Outer/Inner` said more
+* precisely. `stagePath` is the RAW path and is rendered here, for the reason
+* {@link FailedStage.stagePath} gives.
+*
+* The caught text goes through `displaySafe` although every throw reachable
+* from the recursion sanitizes at its own origin today: this catch's error
+* population is the whole recursive subtree, so the guard belongs to the CATCH
+* rather than to today's set of throws under it. It is therefore the identity
+* and a mutation probe on it finds no discrimination — stated so the next
+* reader gets the reason instead of the puzzle.
+*
+* No `cause`: the message already embeds the original's text in full, and
+* `formatError` renders a cause as a `Caused by:` line, which would print the
+* same sentence twice.
+*/
+function stageScopedError(stagePath, error) {
+	if (error instanceof Error && STAGE_SCOPED_MARKER in error) return error;
+	const message = displaySafe(error instanceof Error ? error.message : String(error));
+	const scoped = new SynthesisError(`Stage ${renderStagePath(stagePath)}: ${message}`);
+	if (error instanceof Error && typeof error.stack === "string") {
+		const headerLines = `${error.name}: ${error.message}`.split("\n").length;
+		const frames = error.stack.split("\n").slice(headerLines).join("\n");
+		if (frames.length > 0) scoped.stack = `${scoped.name}: ${scoped.message}\n${frames}`;
+	}
+	if (Object.isExtensible(scoped)) Object.defineProperty(scoped, STAGE_SCOPED_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return scoped;
+}
+/**
+* Render the sentence a stack-selection failure appends when a stage failed to
+* load, so the message reports the failed stage instead of answering "not
+* found" for a stack that may well exist under it.
+*
+* Returns `''` — appending nothing — when no stage failed, which is every
+* ordinary run. Otherwise it opens with `. ` so it reads as its own sentence
+* after a head that ends in a stack list.
+*
+* When one of the selection `patterns` targets a failed stage, that stage is
+* named as the explanation. Otherwise every failed stage is listed behind a
+* `Possibly unrelated:` hedge, since a physical stack name carries no stage
+* path and the link therefore cannot be proven from the pattern alone (see
+* `patternTargetsStage`). The sentence itself is spelled the same either way,
+* so one substring finds it.
+*/
+function failedStageNote(patterns, failedStages) {
+	if (!failedStages || failedStages.length === 0) return "";
+	const targeted = patterns.length === 0 ? failedStages : failedStages.filter((stage) => patterns.some((pattern) => patternTargetsStage(pattern, stage.stagePath)));
+	const named = targeted.length > 0 ? targeted : failedStages;
+	return ". " + (targeted.length > 0 ? "" : "Possibly unrelated: ") + named.map((stage) => `Stage ${renderStagePath(stage.stagePath)} failed to load, so stacks under it are missing from this list rather than missing from the app: ${stage.reason}`).join(" ");
+}
+/**
+* Render a Stage path into a message.
+*
+* `displayIdent` without quotes of ours, and with the cap a legitimately long
+* hierarchical name needs — the same argument `STACK_REF_MAX_CODE_POINTS`
+* exists for. See {@link FailedStage.stagePath} for why the stored value stays
+* raw and only this rendering is sanitized.
+*/
+function renderStagePath(stagePath) {
+	return displayIdent(stagePath, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+}
+/**
+* Whether a user-supplied selection pattern could name a stack under
+* `stagePath`.
+*
+* Mirrors the routing rule in `src/cli/stack-matcher.ts`: a pattern WITHOUT
+* `/` is matched against the PHYSICAL CloudFormation stack name, which carries
+* no stage path at all (`MyStage-MyStack` is not decomposable — a stack may
+* override its own `stackName`), so such a pattern is never attributed to a
+* stage. A pattern WITH `/` is a display path, and its leading segments are
+* compared against the stage's, wildcard by wildcard, so `MyStage/MyStack` and
+* `MyStage/*` both attribute to `MyStage`.
+*/
+function patternTargetsStage(pattern, stagePath) {
+	if (!pattern.includes("/")) return false;
+	const patternSegments = pattern.split("/");
+	const stageSegments = stagePath.split("/");
+	if (patternSegments.length < stageSegments.length) return false;
+	return stageSegments.every((segment, i) => segmentMatches(patternSegments[i], segment));
+}
+/**
+* Wildcard-aware comparison of ONE path segment, matching how
+* `stackMatchesPattern` expands `*` in `src/cli/stack-matcher.ts`. The pattern
+* is the USER's own input, not an assembly-supplied value, so it is expanded
+* there the same way — metacharacters and all, so the two cannot disagree
+* about what a pattern means.
+*
+* The construction is guarded because SPLITTING on `/` can make an invalid
+* segment out of a valid pattern (`'(*x/y*)'` splits into `'(*x'`), and this
+* helper runs when the stack list is EMPTY, which is exactly when
+* `stackMatchesPattern` never evaluates and therefore never raises first. An
+* unusable pattern is simply not attributed: the note still prints, hedged,
+* instead of a `SyntaxError` replacing the message the user needed.
+*/
+function segmentMatches(patternSegment, segment) {
+	if (!patternSegment.includes("*")) return patternSegment === segment;
+	try {
+		return new RegExp("^" + patternSegment.replace(/\*/g, ".*") + "$").test(segment);
+	} catch {
+		return false;
+	}
+}
+
 //#endregion
 //#region src/synthesis/assembly-reader.ts
 /**
+* The failure's own words, carrying NO value the assembly chose.
+*
+* Three branches, and each returns a string cdkd controls:
+*
+* - a filesystem failure is reduced to its `code` (`ENOENT`, `EACCES`,
+*   `EISDIR`), because Node's `message` for one embeds the path, which is the
+*   value being contained;
+* - a `JSON.parse` failure is reduced to `invalid JSON`. V8's `SyntaxError`
+*   carries no path, but it DOES echo a short window of the file's own bytes
+*   verbatim (`Unexpected token '.', ". All 3 st"... is not valid JSON`), and
+*   the file is assembly-chosen too. The snippet buys nothing here: the caller
+*   already names the directory;
+* - anything else answers `unreadable`, and deliberately does NOT fall back to
+*   the wrapper's own message, which is the text this function exists to
+*   exclude. A fallback fires on an input nobody predicted, which is exactly
+*   when the contained value must not come back.
+*/
+function manifestReadFailureText(error) {
+	const cause = error instanceof CdkdError ? error.cause : error;
+	const code = cause?.code;
+	if (typeof code === "string" && code.length > 0) return displaySafe(code);
+	if (cause instanceof SyntaxError) return "invalid JSON";
+	return "unreadable";
+}
+/**
 * Reads and parses Cloud Assembly from cdk.out directory
 *
 * EVERY value this class renders into a message or a log line goes through
@@ -3143,6 +3379,14 @@ function processStackMessages(stacks, logger, options = {}) {
 * still renders in full and byte-identically. The same rule, for the same
 * reason, guards the twin refusals in `src/cli/commands/diff-recursive.ts`
 * (go-to-k/cdkd#3243).
+*
+* ONE value leaves this class UNSANITIZED: a failed Stage's path
+* ([#3482](https://github.com/go-to-k/cdkd/issues/3482)), which is a match key
+* as well as the subject of a sentence. `failed-stages.ts` renders it at each
+* display site with `displayIdent` — it is an IDENTIFIER interpolated into
+* prose rather than free-form text quoted as a value, so the denylist's
+* tolerance of quotes and spaces is a spoof surface there. See
+* `FailedStage.stagePath`.
 */
 var AssemblyReader = class {
 	logger = getLogger().child("AssemblyReader");
@@ -3161,9 +3405,38 @@ var AssemblyReader = class {
 		}
 	}
 	/**
+	* Read an assembly: all its stacks (recursing into nested assemblies /
+	* Stages) plus the Stages that could not be read at all.
+	*
+	* Only ONE failure is tolerated while walking a Stage — the read of the
+	* Stage's own `manifest.json`, which is the legitimate "this Stage
+	* references a directory that was never synthesized" case. Every REFUSAL
+	* raised while reading a Stage's contents propagates out of the recursion
+	* exactly as it does at the top level (issue
+	* [#3482](https://github.com/go-to-k/cdkd/issues/3482)).
+	*/
+	readAssembly(assemblyDir, manifest, assetOutdir = assemblyDir) {
+		const failedStages = [];
+		return {
+			stacks: this.collectStacks(assemblyDir, manifest, assetOutdir, failedStages),
+			failedStages
+		};
+	}
+	/**
 	* Get all stacks from assembly (recursively traverses nested assemblies / Stages)
+	*
+	* Discards the failed-Stage records `readAssembly` returns; a caller that
+	* reports on a selection failure wants that method instead.
 	*/
 	getAllStacks(assemblyDir, manifest, assetOutdir = assemblyDir) {
+		return this.readAssembly(assemblyDir, manifest, assetOutdir).stacks;
+	}
+	/**
+	* The recursive half of `readAssembly`. `failedStages` is the accumulator
+	* shared by every level, so a Stage that fails three levels down is still
+	* reported to the top-level caller.
+	*/
+	collectStacks(assemblyDir, manifest, assetOutdir, failedStages) {
 		if (!manifest.artifacts) {
 			this.logger.warn("No artifacts found in manifest");
 			return [];
@@ -3177,14 +3450,25 @@ var AssemblyReader = class {
 			const props = artifact.properties;
 			if (props?.directoryName) {
 				const resolved = resolveAssemblyPath(assemblyDir, props.directoryName);
-				if (!resolved.contained) throw new SynthesisError(`Nested assembly '${displaySafe(props.directoryName)}' ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				if (!resolved.contained) throw new SynthesisError(`Nested assembly ${renderStagePath(props.directoryName)} ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
 				const nestedDir = resolved.path;
+				const stagePath = typeof props.displayName === "string" && props.displayName.length > 0 ? props.displayName : artifactId;
+				let nestedManifest;
+				try {
+					nestedManifest = this.readManifest(nestedDir);
+				} catch (error) {
+					const reason = `${manifestReadFailureText(error)} reading ${renderStagePath(props.directoryName)}/manifest.json`;
+					this.logger.warn(`Failed to read nested assembly: ${reason}`);
+					failedStages.push({
+						stagePath,
+						reason
+					});
+					continue;
+				}
 				try {
-					const nestedManifest = this.readManifest(nestedDir);
-					const nestedStacks = this.getAllStacks(nestedDir, nestedManifest, assetOutdir);
-					stacks.push(...nestedStacks);
+					stacks.push(...this.collectStacks(nestedDir, nestedManifest, assetOutdir, failedStages));
 				} catch (error) {
-					this.logger.warn(`Failed to read nested assembly '${displaySafe(props.directoryName)}': ${displaySafe(error instanceof Error ? error.message : String(error))}`);
+					throw stageScopedError(stagePath, error);
 				}
 			}
 		}
@@ -3195,9 +3479,9 @@ var AssemblyReader = class {
 	* Get a specific stack by name
 	*/
 	getStack(assemblyDir, manifest, stackName) {
-		const stacks = this.getAllStacks(assemblyDir, manifest);
+		const { stacks, failedStages } = this.readAssembly(assemblyDir, manifest);
 		const stack = stacks.find((s) => s.stackName === stackName);
-		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. Available: ${stacks.map((s) => displaySafe(s.stackName)).join(", ")}`);
+		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. ` + (stacks.length > 0 ? `Available: ${stacks.map((s) => displayIdent(s.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })).join(", ")}` : "The assembly has no stacks") + failedStageNote([stackName], failedStages));
 		return stack;
 	}
 	/**
@@ -3261,7 +3545,7 @@ var AssemblyReader = class {
 		if (dependencyNames.length > 0) this.logger.debug(`Stack '${displaySafe(stackName)}' depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
 		if (artifact.environment) env = parseEnvironment(artifact.environment);
-		const nestedTemplates = {};
+		const nestedTemplates = nullPrototypeRecord();
 		for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 			const assetPath = resource.Metadata?.["aws:asset:path"];
@@ -6414,13 +6698,14 @@ var Synthesizer = class {
 		if (isPreSynthesizedAssembly(options.app)) {
 			this.logger.debug(`Using pre-synthesized cloud assembly at ${appPath}`);
 			const manifest = this.assemblyReader.readManifest(appPath);
-			const stacks = this.assemblyReader.getAllStacks(appPath, manifest);
+			const { stacks, failedStages } = this.assemblyReader.readAssembly(appPath, manifest);
 			if (!options.deferMacroExpansion) await this.expandMacrosForStacks(stacks, options);
 			this.logger.debug(`Loaded ${stacks.length} stack(s) from pre-synthesized assembly`);
 			return {
 				manifest,
 				assemblyDir: appPath,
-				stacks
+				stacks,
+				failedStages
 			};
 		}
 		const outputDir = resolve(options.output || "cdk.out");
@@ -6471,7 +6756,7 @@ var Synthesizer = class {
 			});
 			const manifest = this.assemblyReader.readManifest(outputDir);
 			if (!manifest.missing || manifest.missing.length === 0) {
-				const stacks = this.assemblyReader.getAllStacks(outputDir, manifest);
+				const { stacks, failedStages } = this.assemblyReader.readAssembly(outputDir, manifest);
 				if (!options.deferMacroExpansion) await this.expandMacrosForStacks(stacks, options, {
 					region: explicitRegion,
 					...accountId && { accountId }
@@ -6480,7 +6765,8 @@ var Synthesizer = class {
 				return {
 					manifest,
 					assemblyDir: outputDir,
-					stacks
+					stacks,
+					failedStages
 				};
 			}
 			const missingKeys = new Set(manifest.missing.map((m) => m.key));
@@ -22333,6 +22619,156 @@ function refuseMalformedOutputs(state, stackName, region) {
 	throw markNonRetryable(new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
 }
 /**
+* The stand-in row a read-only view lists in its `unreadable` set for an
+* `orphans` container it could not read, beside
+* {@link UNREADABLE_RESOURCES_MAP_ROW}'s row for the resource map.
+*/
+const UNREADABLE_ORPHANS_CONTAINER_ROW = "(orphans container)";
+/**
+* Whether the `orphans` CONTAINER is the list every reader of it assumes
+* (issue go-to-k/cdkd#3379).
+*
+* `parseStateBody` validates the record root and its schema version and returns
+* the cast record otherwise unchanged, so a hand-edited or planted
+* `"orphans": "abc"`, `5`, `{}` or `{"length": 1}` survives the load and every
+* reader reaches it on a bare `?? []`, `?.length` or `?.map`.
+*
+* ABSENT IS READABLE, for the reason {@link hasReadableOutputs}'s note gives
+* for its own container and one that is sharper here: an absent `orphans` is
+* the ORDINARY record. A stack that never had a failed deploy has no orphan
+* list at all, `JSON.stringify` drops the key when it is undefined, and
+* `orphansAfterRollback` returns `{}` on `previous.orphans === undefined`
+* WITH nothing newly orphaned — the pair of conditions that keeps such a
+* record byte-identical. Warning or refusing on absence would fire on
+* almost every record in a bucket.
+*
+* `null` is NOT readable, which is where this parts from a bare `?? []`: that
+* admits `null` silently, and the shapes this exists to catch are exactly the
+* ones it cannot see.
+*
+* The ENTRIES are a separate question with a separate answer —
+* `orphans[<i>].properties` is go-to-k/cdkd#3344, and
+* {@link refuseMalformedResourcePropertiesForOrphan} is the guard there. This
+* one says only that the container is a list.
+*/
+function hasReadableOrphans(state) {
+	return state.orphans === void 0 || Array.isArray(state.orphans);
+}
+/**
+* For a READ-ONLY command: replace an unreadable `orphans` container with an
+* empty list so the command can report the rest of the record, and return
+* whether it did, so the caller can warn with
+* {@link malformedOrphansWarning} and list
+* {@link UNREADABLE_ORPHANS_CONTAINER_ROW} among what it could not read.
+*
+* AT THE LOAD, the placement rule
+* {@link repairMalformedResourcesForReadOnly}'s note records: `cdkd diff`
+* reaches the container through `currentState.orphans?.length` before its
+* adoption preview, so a guard written at the preview leaves the dereference
+* above it — and for a STRING that dereference is the one that lies, since
+* `'abc'.length` is 3 and the preview then walks characters.
+*
+* READ-ONLY commands only, for the reason {@link refuseMalformedState} gives:
+* a container laundered into a well-formed empty one is permanent, and for
+* this container it also erases the only record that resources were left
+* behind in AWS by an earlier failed deploy.
+*/
+function repairMalformedOrphansForReadOnly(state) {
+	if (hasReadableOrphans(state)) return false;
+	state.orphans = [];
+	return true;
+}
+/**
+* The warning a caller of {@link repairMalformedOrphansForReadOnly} emits.
+*
+* Its own text rather than any of the three above, the rule this module's
+* every message follows: what continuing EMPTY costs here is not a diff's
+* left-hand side or a rendered view's rows but the record's evidence that
+* resources from an earlier failed deploy are still live in AWS. A reader who
+* sees no adoption preview and no orphan warning will conclude the stack has
+* none.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOrphansWarning(stackName, region) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'orphans' list — the record is malformed or truncated. Readers reach it on a bare '?? []' or '?.length', which admits a string, a number, a plain object and null alike: a string is WALKED, one garbage orphan per character, and the others read as no orphans at all. Continuing with it EMPTY: this view previews no adoption and names no orphan, which is NOT the same as the record holding none — resources from an earlier failed deploy may still be live in AWS. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The refusal text for a command that can WRITE the record.
+*
+* A DIFFERENT text from the warning because the danger is different and worse:
+* the reshaping reader is also a writer. `orphansAfterRollback` walks the
+* container with `for...of`, so over `"abc"` it returns a list holding `"c"`,
+* and `cdkd rollback` SAVES that record — a damaged container rewritten into a
+* differently damaged one, silently. `cdkd deploy`'s adoption pass assigns
+* `currentState.orphans` from what it read, and `cdkd destroy` proceeds through
+* resource deletion to `deleteState` having never reported the orphans it could
+* not read.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOrphansRefusalMessage(stackName, region) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'orphans' list — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: a string container is WALKED one character at a time and written back as a list of character-shaped orphan records, and every other unreadable shape reads as no orphans at all — so a run would delete or adopt against a record whose evidence of resources left live in AWS by an earlier failed deploy it never read. Repair or remove the record first, and no cdkd command repairs this container: rewriting it to [] by hand discards the very evidence this refusal is protecting. Inspect the record with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The DESTROY refusal text for this container (go-to-k/cdkd#3379 review).
+*
+* Its own text rather than {@link malformedOrphansRefusalMessage}, for the
+* reason every text in this module is its own: that one says the container
+* would be RESHAPED and written back, which is the rollback mechanism, and a
+* destroy never reshapes it — `buildDestroySnapshot` carries the container
+* verbatim through `...rest` into every save it makes, and then either REMOVES
+* the record (the clean path) or writes that snapshot as the final state, with
+* the container intact, on the error / interrupt / skip arm. What a destroy
+* does with the container instead is DECIDE: the count feeds `stillEmpty`, and
+* the orphan warning above it is the operator's only notice that resources from
+* an earlier failed deploy are still live in AWS.
+*
+* It also owes the remedy the sibling destroy refusal owes, and for the same
+* reason go-to-k/cdkd#3161 raised against refusing a cleanup command at all: an
+* operator who wants the record gone needs a way to do it. `cdkd state orphan`
+* is that way and reads no `orphans` container, so pointing at it is sound —
+* the same exactness split as {@link malformedDestroyResourcesRefusalMessage},
+* since a name that does not render faithfully must not become a command
+* against a record that may not be the damaged one.
+*/
+function malformedDestroyOrphansRefusalMessage(stackName, region) {
+	const exact = safeStackName(stackName) === stackName && safeRegion(region) === region;
+	return `${`${stackClause(exact ? stackName : void 0, exact ? region : void 0)} has no readable 'orphans' list — the record is malformed or truncated.`} This command DELETES state, so it refuses rather than continuing: an unreadable container counts as no orphans, so the run would proceed through resource deletion to removing state.json while the record's evidence that an earlier failed deploy left resources live in AWS was never read — and that evidence goes with the record. Reading it as EMPTY is that outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? `To drop the record deliberately and leave every live resource standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out as 'cdkd state orphan <stack> --stack-region <region>' rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing. Inspect it with: ${inspectCommand(stackName, region)}` : `This record's stack name or region does NOT render exactly, so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long' and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+}
+/**
+* The destroy-path twin of {@link refuseMalformedOrphans}, carrying the text
+* above. Both destroy reads take this one: the entry read and the under-lock
+* re-read, which is the record `stillEmpty` and `deleteState` act on.
+*/
+function refuseMalformedOrphansForDestroy(state, stackName, region) {
+	if (hasReadableOrphans(state)) return;
+	throw markNonRetryable(new CdkdError(malformedDestroyOrphansRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
+* For a command that can WRITE state: refuse a record whose `orphans` container
+* cannot be read.
+*
+* A SIBLING of {@link refuseMalformedState} and {@link refuseMalformedOutputs}
+* rather than a widening of either, for the reason that pair already records: a
+* record can be malformed in one container alone, and the refusal a user sees
+* must name the container that is broken.
+*
+* CALL IT AT THE LOAD, above the first expression that reads the container, and
+* on a destroy at the UNDER-LOCK re-read as well — that re-read is the record
+* the run goes on to act on.
+*/
+function refuseMalformedOrphans(state, stackName, region) {
+	if (hasReadableOrphans(state)) return;
+	throw markNonRetryable(new CdkdError(malformedOrphansRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
 * The DESTROY refusal text (issue
 * [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
 *
@@ -33975,7 +34411,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C9R-ND4b.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BwN09Zcn.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -45660,6 +46096,7 @@ var DeployEngine = class DeployEngine {
 			this.healBaseline = currentState.resources ?? {};
 			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 			refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
+			refuseMalformedOrphans(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -47683,5 +48120,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, getAwsClients as $i, STATE_SOURCED_BASELINE_RULES as $n, validateContainerRepoName as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, isTransientServerError as Aa, ssmResolvedValueType as Ai, malformedResourcePropertiesWarning as An, hasUnverifiableParameterRefusal as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, producerRecordKey as Bi, refuseMalformedState as Bn, buildAssetRedirectMap as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, formatError as Ca, resolveCaptureObservedState as Ci, malformedExportSourceWarning as Cn, formatLockExpiry as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, isMarkedNonRetryable as Da, resolveUseCdkBootstrapAssets as Di, malformedOutputsWarning as Dn, exportNamesCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, withErrorHandling as Ea, resolveStateBucketWithDefaultAndSource as Ei, malformedOutputsRefusalMessage as En, DEFAULT_STATE_PREFIX as Er, deleteSkipReason as Et, extractDeploymentEventError as F, safeStringify$1 as Fa, uploadCfnTemplate as Fi, refuseMalformedOutputs as Fn, orphansCarriedFrom as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, derivePartitionAndUrlSuffix as Gi, safeRegion as Gn, BOOTSTRAP_MARKER_PREFIX as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, expectedOwnerParam as Hi, repairMalformedResourceEntriesForReadOnly as Hn, loadPublishableAssetManifest as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, __exportAll as Ia, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ii, refuseMalformedOutputsForDestroy as In, shouldRetainResource as Ir, isNamelessDynamicReferenceError as It, bold as J, renderAssemblyPathEscape as Ji, findSilentDropProperties as Jn, getBootstrapMarkerKey as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, AssemblyReader as Ki, safeStackName as Kn, assertAssetBucketRegion as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, injectiveKey as Li, refuseMalformedResourceEntries as Ln, AssetPublisher as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, markRedactedCause as Ma, CFN_TEMPLATE_URL_LIMIT as Mi, malformedStateRefusalMessage as Mn, importableOutputs as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, retryClassificationText as Na, MIGRATE_TMP_PREFIX as Ni, refuseDivergentRecordRegionForDestroy as Nn, isReadableBag as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, isRetryableTransientError as Oa, stateBucketExistenceConfirmed as Oi, malformedRenderedContainersWarning as On, hasReadableExportSet as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, describeAwsFailure as Pa, findLargeInlineResources as Pi, refuseMalformedNestedChildOutputs as Pn, orphansAfterRollback as Pr, getAccountInfo as Pt, red as Q, AwsClients as Qi, TemplateParser as Qn, validateAssetBucketName as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, injectiveKeyPrefix as Ri, refuseMalformedResourcePropertiesForOrphan as Rn, stringifyValue as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, SynthesisError as Sa, resolveAutoAssetStorage as Si, malformedExportNamesWarning as Sn, forceQuitRecoveryClause as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, normalizeAwsError as Ta, resolveStateBucketWithDefault as Ti, malformedOrphanRecordsWarning as Tn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, PARTITION_TABLE as Ui, repairMalformedResourcePropertiesForReadOnly as Un, rewriteTemplateAssetReferences as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, decodeListingKey as Vi, repairMalformedOutputsForReadOnly as Vn, createAssetRedirectResolver as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, canonicalizeRegion as Wi, repairMalformedResourcesForReadOnly as Wn, AssetModeResolver as Wr, assertRegionMatch as Wt, gray as X, clearBucketRegionCache as Xi, withRetry as Xn, parseBootstrapMarker as Xr, readConfigString as Xt, cyan as Y, resolveAssemblyPath as Yi, describeTypeWithThrottleRetry as Yn, isCrossRegionRedirect as Yr, configStringRefusal as Yt, green as Z, resolveBucketRegion as Zi, DagBuilder as Zn, readBootstrapMarkerBody as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ResourceTimeoutError as _a, Synthesizer as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, S3StateBackend as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as aa, describeDockerFailure as ai, s3BucketDomainName as an, dynamicReferenceTokens as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, StackTerminationProtectionError as ba, getLegacyStateBucketName as bi, hasReadableResources as bn, buildForceUnlockCommand as br, startInterruptWatch as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ca, getDockerCmd as ci, s3BucketWebsiteUrl as cn, isSingleDynamicReferenceToken as cr, IAMRoleProvider as ct, updatePartialMessage as d, LocalStartServiceError as da, runDockerForeground as di, applyCallerIdentityCredentials as dn, maskSecretsInText as dr, ProviderRegistry as dt, resetAwsClients as ea, buildDenyExternalAccessPolicy as ei, requireConfigString as en, STATE_SOURCED_CROSS_GENERATION_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, LockError as fa, runDockerStreaming as fi, callerEnvCredentials as fn, recordMaskOnlyValue as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, ProvisioningError as ga, getDockerImageBySourceHash as gi, STATE_RESOURCES_MALFORMED as gn, LockManager as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, PartialFailureError as ha, AssetManifestLoader as hi, INTRINSIC_KEYS as hn, scrubResourceRecord as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, ConfigError as ia, describeDockerExecFailure as ii, s3BucketArn as in, createSecretMasker as ir, secretBearing as it, isFinalSnapshotError as j, markNonRetryable as ja, CFN_TEMPLATE_BODY_LIMIT as ji, malformedResourcesWarning as jn, importableOutputKeys as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, isThrottlingError as ka, warnDeprecatedNoPrefixCliFlag as ki, malformedResourceEntriesWarning as kn, hasReasonlessBaselineRefusal as kr, IntrinsicFunctionResolver as kt, replayRollback as l, IntrinsicResolutionRefusalError as la, partitionSensitiveEnv as li, applyRoleArnIfSet as ln, markSameGenerationBag as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, NestedStackChildDirectDestroyError as ma, stripControlChars as mi, DiffCalculator as mn, redactSecretsForState as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as na, resolveDockerContextDirectory as ni, producerRegionsFromState as nn, TEMPLATE_SOURCED_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, DependencyError as oa, dockerSpawnEnvWithSensitive as oi, s3BucketDualStackDomainName as on, errorCauseChain as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, MalformedProducerRecordRefusalError as pa, escapeRegExp$1 as pi, envCredentialsAreAssumedRole as pn, recoverMaskedOutput as pr, createMaskedRetryLogger as pt, formatResourceLine as q, processStackMessages as qi, findActionableSilentDrops as qn, ensureAssetStorage as qr, configBooleanRefusal as qt, DeployEngine as r, CdkdError as ra, describeDockerCapturedOutput as ri, withSharedDrainBudget as rn, carriesSecretMask as rr, isExportAliasCollision as rt, planRollback as s, DeployCancelledError as sa, formatDockerLoginError as si, s3BucketRegionalDomainName as sn, identityKeyFor as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ta, buildDockerImage as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_READBACK_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, LocalInvokeBuildError as ua, redactDockerArgvValues as ui, AWS_CREDENTIAL_ENV_KEYS as un, maskSecretsInError as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, ResourceUpdateNotSupportedError as va, synthesisStatusMessage as vi, displayLogicalId as vn, rebuildClientForBucketRegion as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isCdkdError as wa, resolveSkipPrefix as wi, malformedLocalOutputsWarning as wn, shellQuote as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, StateError as xa, resolveApp as xi, isReadableResourceEntry as xn, buildLockContentionMessage as xr, CloudControlProvider as xt, keptWholeReasonText as y, StackHasActiveImportsError as ya, getDefaultStateBucketName as yi, hasReadableOutputs as yn, UNREPRODUCIBLE_LOCK_CLAUSE as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, producerCoordinateKey as zi, refuseMalformedResourcesForDestroy as zn, WorkGraph as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-Bw8VoyEi.js.map
+export { yellow as $, AssemblyReader as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, ResourceTimeoutError as Aa, resolveCaptureObservedState as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, isMarkedNonRetryable as Ba, MIGRATE_TMP_PREFIX as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, LocalInvokeBuildError as Ca, getDockerImageBySourceHash as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, NestedStackChildDirectDestroyError as Da, getLegacyStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, MalformedProducerRecordRefusalError as Ea, getDefaultStateBucketName as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, SynthesisError as Fa, stateBucketExistenceConfirmed as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, markRedactedCause as Ga, injectiveKeyPrefix as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isThrottlingError as Ha, uploadCfnTemplate as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, formatError as Ia, warnDeprecatedNoPrefixCliFlag as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, safeStringify$1 as Ja, decodeListingKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, retryClassificationText as Ka, producerCoordinateKey as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, isCdkdError as La, ssmResolvedValueType as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, StackHasActiveImportsError as Ma, resolveStateBucketWithDefault as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, StackTerminationProtectionError as Na, resolveStateBucketWithDefaultAndSource as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, PartialFailureError as Oa, resolveApp as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StateError as Pa, resolveUseCdkBootstrapAssets as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, derivePartitionAndUrlSuffix as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, normalizeAwsError as Ra, CFN_TEMPLATE_BODY_LIMIT as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, IntrinsicResolutionRefusalError as Sa, AssetManifestLoader as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LockError as Ta, synthesisStatusMessage as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isTransientServerError as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, isRetryableTransientError as Va, findLargeInlineResources as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, markNonRetryable as Wa, injectiveKey as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, PARTITION_TABLE as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, __exportAll as Ya, expectedOwnerParam as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, canonicalizeRegion as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ConfigError as _a, redactDockerArgvValues as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, nullPrototypeRecord as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, DeployCancelledError as ba, escapeRegExp$1 as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, resolveAssemblyPath as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, AwsClients as da, describeDockerExecFailure as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, failedStageNote as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, getAwsClients as fa, describeDockerFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, CdkdError as ga, partitionSensitiveEnv as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, AssetError as ha, getDockerCmd as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasPlainPrototype$1 as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ResourceUpdateNotSupportedError as ja, resolveSkipPrefix as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, ProvisioningError as ka, resolveAutoAssetStorage as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, clearBucketRegionCache as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, setAwsClients as ma, formatDockerLoginError as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, defineOwnKey as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, ownValue as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, resetAwsClients as pa, dockerSpawnEnvWithSensitive as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, describeAwsFailure as qa, producerRecordKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, hasOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, renderAssemblyPathEscape as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveBucketRegion as ua, describeDockerCapturedOutput as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CrossAccountSecretRefusalError as va, runDockerForeground as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, LocalStartServiceError as wa, Synthesizer as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DynamicReferenceRegionAmbiguousError as xa, stripControlChars as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, DependencyError as ya, runDockerStreaming as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, withErrorHandling as za, CFN_TEMPLATE_URL_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-CMD4BtQe.js.map