@go-to-k/cdkd 0.290.43 → 0.290.45

package/dist/{deploy-engine-Bw8VoyEi.js → deploy-engine-DhZW4if5.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-D-2HeLmd.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-DjBU2Ap3.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-ChfV4K6h.js";
+import { t as getCdkdVersion } from "./version-DMaX1bq2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3029,6 +3029,91 @@ function renderAssemblyPathEscape(escape, dir, action = "load", provenanceOverri
 	return `resolves to '${displaySafe(escape.path)}', outside '${displaySafe(base)}'. ${provenance}`;
 }
 
+//#endregion
+//#region src/utils/own-keys.ts
+/**
+* Own-key helpers for the bags that reach cdkd through `JSON.parse` — a
+* `state.json` record, a Cloud Control `Properties` document, a template — and
+* for the raw SDK readbacks compared against them.
+*
+* `JSON.parse` yields a key literally named `__proto__` as an ORDINARY own
+* data property, and every comparator / rebuild walk over such a bag has to
+* keep treating it as one. Two idioms silently do not:
+*
+* - **Rebuilding onto a `{}` literal.** `out[k] = v` with `k === '__proto__'`
+*   runs `Object.prototype`'s accessor, SETS the node's prototype and DROPS
+*   the key — on BOTH comparison sides when the walk is a canonicalizer, so a
+*   drift at that key is invisible (issue
+*   [#3121](https://github.com/go-to-k/cdkd/issues/3121)), and on the WRITE
+*   path the member vanishes from the payload (issue
+*   [#2899](https://github.com/go-to-k/cdkd/issues/2899)). Rebuild onto
+*   {@link nullPrototypeRecord} (no accessor there, so plain assignment
+*   defines an own key) or, onto an existing plain object, define the key
+*   with {@link defineOwnKey}.
+* - **`key in bag` membership.** `in` reads the prototype chain, so a key
+*   named `constructor` / `toString` answers `true` for every plain object
+*   and the recursion then walks `Object`'s function. {@link hasOwnKey} asks
+*   the bag alone; {@link ownValue} is the matching read.
+*
+* And ONE shape test every such walk needs FIRST: {@link hasPlainPrototype}.
+* A non-plain object (`Date`, `Uint8Array`, `Map`, a class instance) has no
+* own enumerable keys, so a key-walk over one FABRICATES `{}` (or an index
+* map) and any two of them compare equal. Such a value is returned by
+* IDENTITY and compared as itself.
+*
+* Extracted from `src/cli/commands/drift.ts` (issue #2899, swept by PR #3124)
+* so the analyzer-side canonicalizers (#3121) share ONE spelling rather than a
+* fourth copy. A LEAF module, deliberately, and it must stay one: a value
+* import from a module other suites `vi.mock` wholesale reds those suites
+* with a missing-export failure (which is why `secret-redaction.ts` keeps its
+* own `hasPlainPrototype` — several drift suites mock that module).
+*/
+/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
+function hasOwnKey(target, key) {
+	return Object.prototype.hasOwnProperty.call(target, key);
+}
+/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
+function ownValue(target, key) {
+	return hasOwnKey(target, key) ? target[key] : void 0;
+}
+/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+}
+/**
+* Does this value carry an ORDINARY object prototype?
+*
+* `typeof v === 'object'` admits `Date` / `Map` / `Set` / `Uint8Array` / class
+* instances, whose own enumerable keys are `[]` — so a key-walk over one
+* reports "no contradiction" between two values that actually differ, and a
+* rebuild over one fabricates `{}`. A NULL prototype counts as plain: it is
+* what {@link nullPrototypeRecord} yields, and a walk must be able to re-walk
+* its own output.
+*/
+function hasPlainPrototype$1(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/**
+* A fresh rebuild target with NO prototype, so `out['__proto__'] = v` defines
+* an own key instead of setting the prototype. `JSON.stringify`,
+* `Object.keys` / `entries` and `structuredClone` all read it like a plain
+* object; only `instanceof Object` and a direct `.hasOwnProperty()` method call
+* do not, and no consumer on the drift path uses either.
+*
+* The type parameter spares a caller with a narrower value type an `as` cast at
+* every call — `nullPrototypeRecord<string>()` for a logical-id-to-path index.
+* It defaults to `unknown`, so a zero-argument call is unchanged.
+*/
+function nullPrototypeRecord() {
+	return Object.create(null);
+}
+
 //#endregion
 //#region src/synthesis/stack-messages.ts
 /**
@@ -3123,9 +3208,160 @@ function processStackMessages(stacks, logger, options = {}) {
 	if (hasWarnings && failAt === "warn") throw new SynthesisError("Found warnings (--strict mode)");
 }
 
+//#endregion
+//#region src/synthesis/failed-stages.ts
+/**
+* Marks an error that already names the Stage it was raised under, so an outer
+* Stage does not prepend its own name on the way out. Follows the marker shape
+* of `markNonRetryable` in `src/deployment/retryable-errors.ts`: a
+* non-enumerable own property, read by presence.
+*/
+const STAGE_SCOPED_MARKER = Symbol.for("cdkd.stageScopedError");
+/**
+* Re-raise a refusal caught while reading the CONTENTS of a Stage, with the
+* Stage named (issue [#3482](https://github.com/go-to-k/cdkd/issues/3482)).
+*
+* This is NOT a downgrade: every caller throws what this returns. The refusal
+* texts name the STACK — the stack a Stage produced carries a physical name
+* that need not embed the Stage's path, so without this the user is not told
+* which Stage directory to look in.
+*
+* The INNERMOST Stage wins: an error arriving already marked is returned
+* unchanged, so `Outer` does not restate what `Outer/Inner` said more
+* precisely. `stagePath` is the RAW path and is rendered here, for the reason
+* {@link FailedStage.stagePath} gives.
+*
+* The caught text goes through `displaySafe` although every throw reachable
+* from the recursion sanitizes at its own origin today: this catch's error
+* population is the whole recursive subtree, so the guard belongs to the CATCH
+* rather than to today's set of throws under it. It is therefore the identity
+* and a mutation probe on it finds no discrimination — stated so the next
+* reader gets the reason instead of the puzzle.
+*
+* No `cause`: the message already embeds the original's text in full, and
+* `formatError` renders a cause as a `Caused by:` line, which would print the
+* same sentence twice.
+*/
+function stageScopedError(stagePath, error) {
+	if (error instanceof Error && STAGE_SCOPED_MARKER in error) return error;
+	const message = displaySafe(error instanceof Error ? error.message : String(error));
+	const scoped = new SynthesisError(`Stage ${renderStagePath(stagePath)}: ${message}`);
+	if (error instanceof Error && typeof error.stack === "string") {
+		const headerLines = `${error.name}: ${error.message}`.split("\n").length;
+		const frames = error.stack.split("\n").slice(headerLines).join("\n");
+		if (frames.length > 0) scoped.stack = `${scoped.name}: ${scoped.message}\n${frames}`;
+	}
+	if (Object.isExtensible(scoped)) Object.defineProperty(scoped, STAGE_SCOPED_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return scoped;
+}
+/**
+* Render the sentence a stack-selection failure appends when a stage failed to
+* load, so the message reports the failed stage instead of answering "not
+* found" for a stack that may well exist under it.
+*
+* Returns `''` — appending nothing — when no stage failed, which is every
+* ordinary run. Otherwise it opens with `. ` so it reads as its own sentence
+* after a head that ends in a stack list.
+*
+* When one of the selection `patterns` targets a failed stage, that stage is
+* named as the explanation. Otherwise every failed stage is listed behind a
+* `Possibly unrelated:` hedge, since a physical stack name carries no stage
+* path and the link therefore cannot be proven from the pattern alone (see
+* `patternTargetsStage`). The sentence itself is spelled the same either way,
+* so one substring finds it.
+*/
+function failedStageNote(patterns, failedStages) {
+	if (!failedStages || failedStages.length === 0) return "";
+	const targeted = patterns.length === 0 ? failedStages : failedStages.filter((stage) => patterns.some((pattern) => patternTargetsStage(pattern, stage.stagePath)));
+	const named = targeted.length > 0 ? targeted : failedStages;
+	return ". " + (targeted.length > 0 ? "" : "Possibly unrelated: ") + named.map((stage) => `Stage ${renderStagePath(stage.stagePath)} failed to load, so stacks under it are missing from this list rather than missing from the app: ${stage.reason}`).join(" ");
+}
+/**
+* Render a Stage path into a message.
+*
+* `displayIdent` without quotes of ours, and with the cap a legitimately long
+* hierarchical name needs — the same argument `STACK_REF_MAX_CODE_POINTS`
+* exists for. See {@link FailedStage.stagePath} for why the stored value stays
+* raw and only this rendering is sanitized.
+*/
+function renderStagePath(stagePath) {
+	return displayIdent(stagePath, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+}
+/**
+* Whether a user-supplied selection pattern could name a stack under
+* `stagePath`.
+*
+* Mirrors the routing rule in `src/cli/stack-matcher.ts`: a pattern WITHOUT
+* `/` is matched against the PHYSICAL CloudFormation stack name, which carries
+* no stage path at all (`MyStage-MyStack` is not decomposable — a stack may
+* override its own `stackName`), so such a pattern is never attributed to a
+* stage. A pattern WITH `/` is a display path, and its leading segments are
+* compared against the stage's, wildcard by wildcard, so `MyStage/MyStack` and
+* `MyStage/*` both attribute to `MyStage`.
+*/
+function patternTargetsStage(pattern, stagePath) {
+	if (!pattern.includes("/")) return false;
+	const patternSegments = pattern.split("/");
+	const stageSegments = stagePath.split("/");
+	if (patternSegments.length < stageSegments.length) return false;
+	return stageSegments.every((segment, i) => segmentMatches(patternSegments[i], segment));
+}
+/**
+* Wildcard-aware comparison of ONE path segment, matching how
+* `stackMatchesPattern` expands `*` in `src/cli/stack-matcher.ts`. The pattern
+* is the USER's own input, not an assembly-supplied value, so it is expanded
+* there the same way — metacharacters and all, so the two cannot disagree
+* about what a pattern means.
+*
+* The construction is guarded because SPLITTING on `/` can make an invalid
+* segment out of a valid pattern (`'(*x/y*)'` splits into `'(*x'`), and this
+* helper runs when the stack list is EMPTY, which is exactly when
+* `stackMatchesPattern` never evaluates and therefore never raises first. An
+* unusable pattern is simply not attributed: the note still prints, hedged,
+* instead of a `SyntaxError` replacing the message the user needed.
+*/
+function segmentMatches(patternSegment, segment) {
+	if (!patternSegment.includes("*")) return patternSegment === segment;
+	try {
+		return new RegExp("^" + patternSegment.replace(/\*/g, ".*") + "$").test(segment);
+	} catch {
+		return false;
+	}
+}
+
 //#endregion
 //#region src/synthesis/assembly-reader.ts
 /**
+* The failure's own words, carrying NO value the assembly chose.
+*
+* Three branches, and each returns a string cdkd controls:
+*
+* - a filesystem failure is reduced to its `code` (`ENOENT`, `EACCES`,
+*   `EISDIR`), because Node's `message` for one embeds the path, which is the
+*   value being contained;
+* - a `JSON.parse` failure is reduced to `invalid JSON`. V8's `SyntaxError`
+*   carries no path, but it DOES echo a short window of the file's own bytes
+*   verbatim (`Unexpected token '.', ". All 3 st"... is not valid JSON`), and
+*   the file is assembly-chosen too. The snippet buys nothing here: the caller
+*   already names the directory;
+* - anything else answers `unreadable`, and deliberately does NOT fall back to
+*   the wrapper's own message, which is the text this function exists to
+*   exclude. A fallback fires on an input nobody predicted, which is exactly
+*   when the contained value must not come back.
+*/
+function manifestReadFailureText(error) {
+	const cause = error instanceof CdkdError ? error.cause : error;
+	const code = cause?.code;
+	if (typeof code === "string" && code.length > 0) return displaySafe(code);
+	if (cause instanceof SyntaxError) return "invalid JSON";
+	return "unreadable";
+}
+/**
 * Reads and parses Cloud Assembly from cdk.out directory
 *
 * EVERY value this class renders into a message or a log line goes through
@@ -3143,6 +3379,14 @@ function processStackMessages(stacks, logger, options = {}) {
 * still renders in full and byte-identically. The same rule, for the same
 * reason, guards the twin refusals in `src/cli/commands/diff-recursive.ts`
 * (go-to-k/cdkd#3243).
+*
+* ONE value leaves this class UNSANITIZED: a failed Stage's path
+* ([#3482](https://github.com/go-to-k/cdkd/issues/3482)), which is a match key
+* as well as the subject of a sentence. `failed-stages.ts` renders it at each
+* display site with `displayIdent` — it is an IDENTIFIER interpolated into
+* prose rather than free-form text quoted as a value, so the denylist's
+* tolerance of quotes and spaces is a spoof surface there. See
+* `FailedStage.stagePath`.
 */
 var AssemblyReader = class {
 	logger = getLogger().child("AssemblyReader");
@@ -3161,9 +3405,38 @@ var AssemblyReader = class {
 		}
 	}
 	/**
+	* Read an assembly: all its stacks (recursing into nested assemblies /
+	* Stages) plus the Stages that could not be read at all.
+	*
+	* Only ONE failure is tolerated while walking a Stage — the read of the
+	* Stage's own `manifest.json`, which is the legitimate "this Stage
+	* references a directory that was never synthesized" case. Every REFUSAL
+	* raised while reading a Stage's contents propagates out of the recursion
+	* exactly as it does at the top level (issue
+	* [#3482](https://github.com/go-to-k/cdkd/issues/3482)).
+	*/
+	readAssembly(assemblyDir, manifest, assetOutdir = assemblyDir) {
+		const failedStages = [];
+		return {
+			stacks: this.collectStacks(assemblyDir, manifest, assetOutdir, failedStages),
+			failedStages
+		};
+	}
+	/**
 	* Get all stacks from assembly (recursively traverses nested assemblies / Stages)
+	*
+	* Discards the failed-Stage records `readAssembly` returns; a caller that
+	* reports on a selection failure wants that method instead.
 	*/
 	getAllStacks(assemblyDir, manifest, assetOutdir = assemblyDir) {
+		return this.readAssembly(assemblyDir, manifest, assetOutdir).stacks;
+	}
+	/**
+	* The recursive half of `readAssembly`. `failedStages` is the accumulator
+	* shared by every level, so a Stage that fails three levels down is still
+	* reported to the top-level caller.
+	*/
+	collectStacks(assemblyDir, manifest, assetOutdir, failedStages) {
 		if (!manifest.artifacts) {
 			this.logger.warn("No artifacts found in manifest");
 			return [];
@@ -3177,14 +3450,25 @@ var AssemblyReader = class {
 			const props = artifact.properties;
 			if (props?.directoryName) {
 				const resolved = resolveAssemblyPath(assemblyDir, props.directoryName);
-				if (!resolved.contained) throw new SynthesisError(`Nested assembly '${displaySafe(props.directoryName)}' ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				if (!resolved.contained) throw new SynthesisError(`Nested assembly ${renderStagePath(props.directoryName)} ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
 				const nestedDir = resolved.path;
+				const stagePath = typeof props.displayName === "string" && props.displayName.length > 0 ? props.displayName : artifactId;
+				let nestedManifest;
+				try {
+					nestedManifest = this.readManifest(nestedDir);
+				} catch (error) {
+					const reason = `${manifestReadFailureText(error)} reading ${renderStagePath(props.directoryName)}/manifest.json`;
+					this.logger.warn(`Failed to read nested assembly: ${reason}`);
+					failedStages.push({
+						stagePath,
+						reason
+					});
+					continue;
+				}
 				try {
-					const nestedManifest = this.readManifest(nestedDir);
-					const nestedStacks = this.getAllStacks(nestedDir, nestedManifest, assetOutdir);
-					stacks.push(...nestedStacks);
+					stacks.push(...this.collectStacks(nestedDir, nestedManifest, assetOutdir, failedStages));
 				} catch (error) {
-					this.logger.warn(`Failed to read nested assembly '${displaySafe(props.directoryName)}': ${displaySafe(error instanceof Error ? error.message : String(error))}`);
+					throw stageScopedError(stagePath, error);
 				}
 			}
 		}
@@ -3195,9 +3479,9 @@ var AssemblyReader = class {
 	* Get a specific stack by name
 	*/
 	getStack(assemblyDir, manifest, stackName) {
-		const stacks = this.getAllStacks(assemblyDir, manifest);
+		const { stacks, failedStages } = this.readAssembly(assemblyDir, manifest);
 		const stack = stacks.find((s) => s.stackName === stackName);
-		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. Available: ${stacks.map((s) => displaySafe(s.stackName)).join(", ")}`);
+		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. ` + (stacks.length > 0 ? `Available: ${stacks.map((s) => displayIdent(s.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })).join(", ")}` : "The assembly has no stacks") + failedStageNote([stackName], failedStages));
 		return stack;
 	}
 	/**
@@ -3261,7 +3545,7 @@ var AssemblyReader = class {
 		if (dependencyNames.length > 0) this.logger.debug(`Stack '${displaySafe(stackName)}' depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
 		if (artifact.environment) env = parseEnvironment(artifact.environment);
-		const nestedTemplates = {};
+		const nestedTemplates = nullPrototypeRecord();
 		for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 			const assetPath = resource.Metadata?.["aws:asset:path"];
@@ -6414,13 +6698,14 @@ var Synthesizer = class {
 		if (isPreSynthesizedAssembly(options.app)) {
 			this.logger.debug(`Using pre-synthesized cloud assembly at ${appPath}`);
 			const manifest = this.assemblyReader.readManifest(appPath);
-			const stacks = this.assemblyReader.getAllStacks(appPath, manifest);
+			const { stacks, failedStages } = this.assemblyReader.readAssembly(appPath, manifest);
 			if (!options.deferMacroExpansion) await this.expandMacrosForStacks(stacks, options);
 			this.logger.debug(`Loaded ${stacks.length} stack(s) from pre-synthesized assembly`);
 			return {
 				manifest,
 				assemblyDir: appPath,
-				stacks
+				stacks,
+				failedStages
 			};
 		}
 		const outputDir = resolve(options.output || "cdk.out");
@@ -6471,7 +6756,7 @@ var Synthesizer = class {
 			});
 			const manifest = this.assemblyReader.readManifest(outputDir);
 			if (!manifest.missing || manifest.missing.length === 0) {
-				const stacks = this.assemblyReader.getAllStacks(outputDir, manifest);
+				const { stacks, failedStages } = this.assemblyReader.readAssembly(outputDir, manifest);
 				if (!options.deferMacroExpansion) await this.expandMacrosForStacks(stacks, options, {
 					region: explicitRegion,
 					...accountId && { accountId }
@@ -6480,7 +6765,8 @@ var Synthesizer = class {
 				return {
 					manifest,
 					assemblyDir: outputDir,
-					stacks
+					stacks,
+					failedStages
 				};
 			}
 			const missingKeys = new Set(manifest.missing.map((m) => m.key));
@@ -21695,25 +21981,32 @@ function displayLogicalId(value) {
 /**
 * The DIAGNOSIS sentence itself, with no identity and no remedy in it.
 *
-* ONE spelling, because two copies of a diagnosis are what drift. It is extracted because
-* {@link malformedDestroyResourcesRefusalMessage} needs the same sentence
-* under an identity it does NOT trust, where the detail's substituted
-* `cdkd state show` command must not appear — a difference in the COMMAND, not
-* in the diagnosis.
+* ONE spelling, because two copies of a diagnosis are what drift. Its two
+* consumers are the arms of {@link malformedStateDiagnosis}, which differ by
+* the IDENTITY they may name and not by this sentence — since
+* go-to-k/cdkd#3516 neither arm carries a command at all, so there is nothing
+* else for them to differ in.
 */
 const MALFORMED_RESOURCES_DIAGNOSIS = "has no readable 'resources' map — the record is malformed or truncated. Both 'cdkd deploy' and 'cdkd destroy' REFUSE such a record rather than acting on it: they read the same map, an unreadable one is indistinguishable from an empty stack, and acting on that reading would make a deploy re-CREATE every resource and a destroy delete none of them.";
 /**
-* `region` is optional for ONE caller's sake: `cdkd export`'s baseline report,
-* whose loaded region is absent when the record it loaded is a legacy
-* region-less one and no synth region was available to stand in for it. A placeholder there would put a `--stack-region` into a
-* command the reader pastes that selects no record at all — so an absent
-* region drops the clause and the flag rather than inventing one.
+* Identity plus the diagnosis, and NO command — every consumer appends prose
+* after this half, so a command baked in here can only land mid-sentence
+* (go-to-k/cdkd#3516). It used to end on a substituted `cdkd state show`, which
+* put the one runnable command in four messages one space from the next clause:
+* a line-select paste then handed `cdkd state show` the following sentence as
+* positional arguments. The command is {@link inspectCommand}'s, and the
+* caller ends ON it — the contract that function's own note states, and the
+* shape {@link malformedDestroyOutputsRefusalMessage} already had. Its
+* `orphans` twin had it too until this change gave both DESTROY refusals a
+* per-line shape instead, so that one is no longer the example to copy.
+*
+* `stackName` is optional so the withhold arm of
+* {@link malformedDestroyResourcesRefusalMessage} takes this same helper: that
+* arm must state the diagnosis under an identity it does not trust, which is
+* {@link stackClause}'s no-identity form rather than a second spelling.
 */
-function malformedStateDetail(stackName, region) {
-	const stack = safeStackName(stackName);
-	const where = region === void 0 ? "" : ` (${shellQuote(safeRegion(region))})`;
-	const regionFlag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeRegion(region))}`;
-	return `State for ${shellQuote(stack)}${where} ${MALFORMED_RESOURCES_DIAGNOSIS} Inspect it with: cdkd state show ${shellQuote(stack)}${regionFlag} --json`;
+function malformedStateDiagnosis(stackName, region) {
+	return `${stackClause(stackName, region)} ${MALFORMED_RESOURCES_DIAGNOSIS}`;
 }
 /**
 * For a READ-ONLY command: give the record an empty resource bag so the
@@ -21768,7 +22061,52 @@ function repairMalformedResourcesForReadOnly(state) {
 * would tell an operator to re-run a command that attempted nothing.
 */
 function malformedStateRefusalMessage(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+	return `${malformedStateDiagnosis(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first. Inspect it with: ${inspectCommand(stackName, region)}`;
+}
+/**
+* The destructive template, in the three messages that offer one.
+*
+* ONE spelling, because copies are what drift, and they carry it byte-identically
+* on purpose — a reader who has met one must recognise the others. Two wrap it
+* in {@link DROP_RECORD_LINE}'s label; `divergentRecordRegionRefusalMessage`
+* ends on it bare. `<stack>` / `<region>` are LITERAL: nothing may substitute them, for
+* the reason {@link malformedDestroyResourcesRefusalMessage}'s note gives.
+*/
+const DROP_RECORD_TEMPLATE = "cdkd state orphan <stack> --stack-region <region>";
+/**
+* The same template as a LABELLED line, for the two messages that carry their
+* commands one per line. The COMMAND is the atom rather than the line, because
+* the command is what drifts: `divergentRecordRegionRefusalMessage` ends on it
+* with no label, so THIS PAIR cannot half-land a `--stack-region` rename.
+* {@link dropRecordCommand} still spells it separately for the `cdkd orphan`
+* messages, which substitute into it — that one is not covered here.
+*/
+const DROP_RECORD_LINE = `Drop the record: ${DROP_RECORD_TEMPLATE}`;
+/**
+* May this message NAME its target and offer the destructive template beside
+* it (go-to-k/cdkd#3516 review)?
+*
+* Stricter than `safeIdentifier(x) === x`, which is what these two arms used
+* and which keeps a space, a `:`, a `'`, a `;` and a `|` — the `:` and the
+* space being the pair a label needs. That was enough while the
+* message was one paragraph, and stopped being enough the moment the commands
+* moved onto LABELLED lines: a stack name spelling
+* `Drop the record: cdkd state orphan prod --stack-region us-east-1` renders
+* exactly, takes this arm, and lands inside the quoted name on the inspect
+* line — where a terminal wrap puts cdkd's own label at the start of a visual
+* line, carrying a destructive command whose holes are already filled. A
+* line-select copies it. The label vocabulary is what made the forgery
+* credible, so the gate that admits a name into it is the one that had to
+* tighten.
+*
+* {@link isPasteableIdent} is that gate and the codebase already spends it on
+* this question (`gc.ts` gates its own destructive hint on the same pair). It
+* refuses a space and a quote outright while keeping every name CloudFormation
+* can produce, `Parent~Child` included, so no healthy record loses its
+* identity here.
+*/
+function mayNameTargetWithDestructiveRemedy(stackName, region) {
+	return safeStackName(stackName) === stackName && safeRegion(region) === region && isPasteableIdent(stackName) && isPasteableIdent(region);
 }
 /**
 * The DESTROY refusal text for the `resources` bag (issue
@@ -21831,7 +22169,7 @@ function malformedStateRefusalMessage(stackName, region) {
 * destructive command at a DIFFERENT region's record for the same stack. That
 * is the misdirection class {@link stackClause} records for stack names, one
 * field over. Substituting into the read-only `state show` line is the
-* pre-existing behaviour of {@link malformedStateDetail} and is left alone;
+* pre-existing behaviour of {@link inspectCommand} and is left alone;
 * what this lane must not add is a destructive one.
 *
 * **go-to-k/cdkd#3328 closed the BODY half of that, and the template stays
@@ -21878,23 +22216,28 @@ function malformedStateRefusalMessage(stackName, region) {
 * because a LEGACY record has no key region at all, in which case the value
 * printed is the CLI's own and `--stack-region` must be omitted.
 *
-* **The VERDICT turns on the identifier caps**, which is why the stack name is
-* measured through {@link safeStackName} (`STACK_REF_MAX_CODE_POINTS`) and the
-* region through {@link safeRegion} (128, which no real region approaches). At
-* 128 an ordinary multi-level CDK nested child
+* **The VERDICT is {@link mayNameTargetWithDestructiveRemedy}** — the identifier
+* caps AND pasteability, since go-to-k/cdkd#3516 — so the stack name is
+* measured at `STACK_REF_MAX_CODE_POINTS` and the region at a region's 128,
+* which no real region approaches. Measuring the STACK at 128 instead is the
+* trap: an ordinary multi-level CDK nested child
 * (`<root>~<...NestedStackResource><hash>~<...>`, measured past 150 code
-* points) truncates, fails `exact`, and takes the withhold arm on a HEALTHY
-* record — which is fail-safe but makes the fallback the common path for
-* exactly the nested destroys this lane added a guard to (review round 2 of
-* go-to-k/cdkd#3332). The bound is still a bound: a planted multi-kilobyte name
-* is truncated at 1152 and lands in the withhold arm.
+* points) WOULD truncate there and take the withhold arm on a HEALTHY record,
+* making the fallback the common path for exactly the nested destroys this
+* lane added a guard to (review round 2 of go-to-k/cdkd#3332). The bound is
+* still a bound: a planted multi-kilobyte name is truncated at 1152 and lands
+* in the withhold arm.
 *
 * Identifiers are sanitized and THEN shell-quoted, for the reasons
 * {@link safeIdentifier}'s note gives.
 */
 function malformedDestroyResourcesRefusalMessage(stackName, region) {
-	const exact = safeStackName(stackName) === stackName && safeRegion(region) === region;
-	return `${exact ? malformedStateDetail(stackName, region) : `${stackClause(void 0, void 0)} ${MALFORMED_RESOURCES_DIAGNOSIS}`} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing — then: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+	const exact = mayNameTargetWithDestructiveRemedy(stackName, region);
+	return [
+		`${malformedStateDiagnosis(exact ? stackName : void 0, exact ? region : void 0)} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds. It is spelled as a template on its own line below rather than handed over ready to run, because that command DELETES a record and a key segment is chosen by anyone who can write this bucket: the key says WHICH record this is, which is not the same as vouching for it as a delete target. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing." : "This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches."}`,
+		`Inspect the record: ${inspectCommand(exact ? stackName : void 0, exact ? region : void 0)}`,
+		...exact ? [DROP_RECORD_LINE] : []
+	].join("\n");
 }
 /**
 * For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `resources`
@@ -21972,11 +22315,11 @@ const STATE_REGION_DIVERGED = "STATE_REGION_DIVERGED";
 */
 function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount) {
 	const cap = STACK_REF_MAX_CODE_POINTS;
-	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion;
+	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
 	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
 	const kind = describeRegionValueKind(divergentBodyRegion);
 	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
-	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`;
+	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: " + DROP_RECORD_TEMPLATE : `This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`;
 	return `${opening} ${resourceCount === void 0 ? `— so cdkd can neither count what it would delete nor tell which region it is in` : `— so cdkd cannot tell which region those resources are in`}. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Destroying against the key's region would issue every delete there; if the record's own region is the honest half, each delete comes back not-found, which this command reads as ALREADY DELETED — it would report success, remove the record, and leave every resource standing in the other region with nothing naming it. ${remedy}`;
 }
 /**
@@ -22028,7 +22371,7 @@ function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, dive
 * LAST, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedDeployResourcesRefusalMessage(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did.`;
+	return `${malformedStateDiagnosis(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
 * For `cdkd deploy`: refuse a record whose `resources` bag cannot be read
@@ -22119,7 +22462,7 @@ function malformedRenderedContainersWarning(stackName, region, containers) {
 }
 /** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
 function malformedResourcesWarning(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+	return `${malformedStateDiagnosis(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
 * The `outputs` half of {@link repairMalformedResourcesForReadOnly}, for a
@@ -22333,6 +22676,160 @@ function refuseMalformedOutputs(state, stackName, region) {
 	throw markNonRetryable(new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
 }
 /**
+* The stand-in row a read-only view lists in its `unreadable` set for an
+* `orphans` container it could not read, beside
+* {@link UNREADABLE_RESOURCES_MAP_ROW}'s row for the resource map.
+*/
+const UNREADABLE_ORPHANS_CONTAINER_ROW = "(orphans container)";
+/**
+* Whether the `orphans` CONTAINER is the list every reader of it assumes
+* (issue go-to-k/cdkd#3379).
+*
+* `parseStateBody` validates the record root and its schema version and returns
+* the cast record otherwise unchanged, so a hand-edited or planted
+* `"orphans": "abc"`, `5`, `{}` or `{"length": 1}` survives the load and every
+* reader reaches it on a bare `?? []`, `?.length` or `?.map`.
+*
+* ABSENT IS READABLE, for the reason {@link hasReadableOutputs}'s note gives
+* for its own container and one that is sharper here: an absent `orphans` is
+* the ORDINARY record. A stack that never had a failed deploy has no orphan
+* list at all, `JSON.stringify` drops the key when it is undefined, and
+* `orphansAfterRollback` returns `{}` on `previous.orphans === undefined`
+* WITH nothing newly orphaned — the pair of conditions that keeps such a
+* record byte-identical. Warning or refusing on absence would fire on
+* almost every record in a bucket.
+*
+* `null` is NOT readable, which is where this parts from a bare `?? []`: that
+* admits `null` silently, and the shapes this exists to catch are exactly the
+* ones it cannot see.
+*
+* The ENTRIES are a separate question with a separate answer —
+* `orphans[<i>].properties` is go-to-k/cdkd#3344, and
+* {@link refuseMalformedResourcePropertiesForOrphan} is the guard there. This
+* one says only that the container is a list.
+*/
+function hasReadableOrphans(state) {
+	return state.orphans === void 0 || Array.isArray(state.orphans);
+}
+/**
+* For a READ-ONLY command: replace an unreadable `orphans` container with an
+* empty list so the command can report the rest of the record, and return
+* whether it did, so the caller can warn with
+* {@link malformedOrphansWarning} and list
+* {@link UNREADABLE_ORPHANS_CONTAINER_ROW} among what it could not read.
+*
+* AT THE LOAD, the placement rule
+* {@link repairMalformedResourcesForReadOnly}'s note records: `cdkd diff`
+* reaches the container through `currentState.orphans?.length` before its
+* adoption preview, so a guard written at the preview leaves the dereference
+* above it — and for a STRING that dereference is the one that lies, since
+* `'abc'.length` is 3 and the preview then walks characters.
+*
+* READ-ONLY commands only, for the reason {@link refuseMalformedState} gives:
+* a container laundered into a well-formed empty one is permanent, and for
+* this container it also erases the only record that resources were left
+* behind in AWS by an earlier failed deploy.
+*/
+function repairMalformedOrphansForReadOnly(state) {
+	if (hasReadableOrphans(state)) return false;
+	state.orphans = [];
+	return true;
+}
+/**
+* The warning a caller of {@link repairMalformedOrphansForReadOnly} emits.
+*
+* Its own text rather than any of the three above, the rule this module's
+* every message follows: what continuing EMPTY costs here is not a diff's
+* left-hand side or a rendered view's rows but the record's evidence that
+* resources from an earlier failed deploy are still live in AWS. A reader who
+* sees no adoption preview and no orphan warning will conclude the stack has
+* none.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOrphansWarning(stackName, region) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'orphans' list — the record is malformed or truncated. Readers reach it on a bare '?? []' or '?.length', which admits a string, a number, a plain object and null alike: a string is WALKED, one garbage orphan per character, and the others read as no orphans at all. Continuing with it EMPTY: this view previews no adoption and names no orphan, which is NOT the same as the record holding none — resources from an earlier failed deploy may still be live in AWS. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The refusal text for a command that can WRITE the record.
+*
+* A DIFFERENT text from the warning because the danger is different and worse:
+* the reshaping reader is also a writer. `orphansAfterRollback` walks the
+* container with `for...of`, so over `"abc"` it returns a list holding `"c"`,
+* and `cdkd rollback` SAVES that record — a damaged container rewritten into a
+* differently damaged one, silently. `cdkd deploy`'s adoption pass assigns
+* `currentState.orphans` from what it read, and `cdkd destroy` proceeds through
+* resource deletion to `deleteState` having never reported the orphans it could
+* not read.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOrphansRefusalMessage(stackName, region) {
+	const stack = safeStackName(stackName);
+	const reg = safeRegion(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'orphans' list — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: a string container is WALKED one character at a time and written back as a list of character-shaped orphan records, and every other unreadable shape reads as no orphans at all — so a run would delete or adopt against a record whose evidence of resources left live in AWS by an earlier failed deploy it never read. Repair or remove the record first, and no cdkd command repairs this container: rewriting it to [] by hand discards the very evidence this refusal is protecting. Inspect the record with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The DESTROY refusal text for this container (go-to-k/cdkd#3379 review).
+*
+* Its own text rather than {@link malformedOrphansRefusalMessage}, for the
+* reason every text in this module is its own: that one says the container
+* would be RESHAPED and written back, which is the rollback mechanism, and a
+* destroy never reshapes it — `buildDestroySnapshot` carries the container
+* verbatim through `...rest` into every save it makes, and then either REMOVES
+* the record (the clean path) or writes that snapshot as the final state, with
+* the container intact, on the error / interrupt / skip arm. What a destroy
+* does with the container instead is DECIDE: the count feeds `stillEmpty`, and
+* the orphan warning above it is the operator's only notice that resources from
+* an earlier failed deploy are still live in AWS.
+*
+* It also owes the remedy the sibling destroy refusal owes, and for the same
+* reason go-to-k/cdkd#3161 raised against refusing a cleanup command at all: an
+* operator who wants the record gone needs a way to do it. `cdkd state orphan`
+* is that way and reads no `orphans` container, so pointing at it is sound —
+* the same exactness split as {@link malformedDestroyResourcesRefusalMessage},
+* since a name that does not render faithfully must not become a command
+* against a record that may not be the damaged one.
+*/
+function malformedDestroyOrphansRefusalMessage(stackName, region) {
+	const exact = mayNameTargetWithDestructiveRemedy(stackName, region);
+	return [
+		`${`${stackClause(exact ? stackName : void 0, exact ? region : void 0)} has no readable 'orphans' list — the record is malformed or truncated.`} This command DELETES state, so it refuses rather than continuing: an unreadable container counts as no orphans, so the run would proceed through resource deletion to removing state.json while the record's evidence that an earlier failed deploy left resources live in AWS was never read — and that evidence goes with the record. Reading it as EMPTY is that outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave every live resource standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds. It is spelled as a template on its own line below rather than handed over ready to run, because that command DELETES a record and a key segment is chosen by anyone who can write this bucket: the key says WHICH record this is, which is not the same as vouching for it as a delete target. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing." : "This record's stack name or region does NOT render exactly, so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long' and act on the one whose key matches."}`,
+		`Inspect the record: ${inspectCommand(exact ? stackName : void 0, exact ? region : void 0)}`,
+		...exact ? [DROP_RECORD_LINE] : []
+	].join("\n");
+}
+/**
+* The destroy-path twin of {@link refuseMalformedOrphans}, carrying the text
+* above. Both destroy reads take this one: the entry read and the under-lock
+* re-read, which is the record `stillEmpty` and `deleteState` act on.
+*/
+function refuseMalformedOrphansForDestroy(state, stackName, region) {
+	if (hasReadableOrphans(state)) return;
+	throw markNonRetryable(new CdkdError(malformedDestroyOrphansRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
+* For a command that can WRITE state: refuse a record whose `orphans` container
+* cannot be read.
+*
+* A SIBLING of {@link refuseMalformedState} and {@link refuseMalformedOutputs}
+* rather than a widening of either, for the reason that pair already records: a
+* record can be malformed in one container alone, and the refusal a user sees
+* must name the container that is broken.
+*
+* CALL IT AT THE LOAD, above the first expression that reads the container, and
+* on a destroy at the UNDER-LOCK re-read as well — that re-read is the record
+* the run goes on to act on.
+*/
+function refuseMalformedOrphans(state, stackName, region) {
+	if (hasReadableOrphans(state)) return;
+	throw markNonRetryable(new CdkdError(malformedOrphansRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
 * The DESTROY refusal text (issue
 * [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
 *
@@ -22483,7 +22980,7 @@ const NAMED_UNREADABLE_PROPERTY_BAGS = 5;
 * A region may also be absent on a v1 record, which predates the
 * region-prefixed key layout. A placeholder would put a `--stack-region` into
 * a pasted command that selects no record at all, so it is dropped for the
-* same reason — the call go-to-k/cdkd#3226 makes for `malformedStateDetail`.
+* same reason — the call go-to-k/cdkd#3226 makes for `inspectCommand`.
 */
 function stackClause(stackName, region) {
 	if (stackName === void 0) return "The state record this command loaded";
@@ -22569,15 +23066,27 @@ function dropRecordCommand(stackName, region, recovery) {
 * something PASTEABLE from — the drop command ({@link dropRecordCommand}), the
 * `cdkd state show` line ({@link orphanInspectCommand}) and the object path
 * ({@link orphanInspectClause}) — so no two of them can disagree about a name
-* (go-to-k/cdkd#3363 review, M0 and M2). What it does NOT cover yet: the
-* destroy refusal and the divergent-region refusal above still spell the same
-* test inline, and the shared {@link inspectCommand} is ungated for its other
-* callers (it renders the stack at that same cap, the region at 128).
+* (go-to-k/cdkd#3363 review, M0 and M2). The shared {@link inspectCommand}
+* stays ungated for its other callers, which offer a read only.
+*
+* It is NOT the module's gate for a DESTRUCTIVE remedy and must not be unified
+* with one: the three messages that offer a hole TEMPLATE are all stricter,
+* adding {@link isPasteableIdent} (go-to-k/cdkd#3516). This one is weaker on
+* purpose, and the gap is tracked rather than closed (go-to-k/cdkd#3523):
+* {@link dropRecordCommand} SUBSTITUTES, so tightening it here withholds the
+* drop command from a legacy record whose name merely needs quoting — the very
+* path go-to-k/cdkd#3359 built, where `cdkd state show` refuses outright and
+* this command is the way out. Measured: `It's Legacy` loses it.
 */
 function rendersExactly(value) {
 	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS) === value;
 }
-/** The remedy command {@link stackClause}'s message ends on. */
+/**
+* The remedy command a message ends ON — unless the message also offers the
+* destructive template, in which case it ends the READ's own LINE and
+* {@link DROP_RECORD_LINE} is last (go-to-k/cdkd#3516). Two of the eight call
+* sites are that shape; the rest close their string with it.
+*/
 function inspectCommand(stackName, region) {
 	if (stackName === void 0) return `cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`;
 	const flag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeRegion(region))}`;
@@ -33975,7 +34484,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C9R-ND4b.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CVB0Ky06.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -45660,6 +46169,7 @@ var DeployEngine = class DeployEngine {
 			this.healBaseline = currentState.resources ?? {};
 			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 			refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
+			refuseMalformedOrphans(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -47683,5 +48193,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, getAwsClients as $i, STATE_SOURCED_BASELINE_RULES as $n, validateContainerRepoName as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, isTransientServerError as Aa, ssmResolvedValueType as Ai, malformedResourcePropertiesWarning as An, hasUnverifiableParameterRefusal as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, producerRecordKey as Bi, refuseMalformedState as Bn, buildAssetRedirectMap as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, formatError as Ca, resolveCaptureObservedState as Ci, malformedExportSourceWarning as Cn, formatLockExpiry as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, isMarkedNonRetryable as Da, resolveUseCdkBootstrapAssets as Di, malformedOutputsWarning as Dn, exportNamesCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, withErrorHandling as Ea, resolveStateBucketWithDefaultAndSource as Ei, malformedOutputsRefusalMessage as En, DEFAULT_STATE_PREFIX as Er, deleteSkipReason as Et, extractDeploymentEventError as F, safeStringify$1 as Fa, uploadCfnTemplate as Fi, refuseMalformedOutputs as Fn, orphansCarriedFrom as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, derivePartitionAndUrlSuffix as Gi, safeRegion as Gn, BOOTSTRAP_MARKER_PREFIX as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, expectedOwnerParam as Hi, repairMalformedResourceEntriesForReadOnly as Hn, loadPublishableAssetManifest as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, __exportAll as Ia, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ii, refuseMalformedOutputsForDestroy as In, shouldRetainResource as Ir, isNamelessDynamicReferenceError as It, bold as J, renderAssemblyPathEscape as Ji, findSilentDropProperties as Jn, getBootstrapMarkerKey as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, AssemblyReader as Ki, safeStackName as Kn, assertAssetBucketRegion as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, injectiveKey as Li, refuseMalformedResourceEntries as Ln, AssetPublisher as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, markRedactedCause as Ma, CFN_TEMPLATE_URL_LIMIT as Mi, malformedStateRefusalMessage as Mn, importableOutputs as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, retryClassificationText as Na, MIGRATE_TMP_PREFIX as Ni, refuseDivergentRecordRegionForDestroy as Nn, isReadableBag as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, isRetryableTransientError as Oa, stateBucketExistenceConfirmed as Oi, malformedRenderedContainersWarning as On, hasReadableExportSet as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, describeAwsFailure as Pa, findLargeInlineResources as Pi, refuseMalformedNestedChildOutputs as Pn, orphansAfterRollback as Pr, getAccountInfo as Pt, red as Q, AwsClients as Qi, TemplateParser as Qn, validateAssetBucketName as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, injectiveKeyPrefix as Ri, refuseMalformedResourcePropertiesForOrphan as Rn, stringifyValue as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, SynthesisError as Sa, resolveAutoAssetStorage as Si, malformedExportNamesWarning as Sn, forceQuitRecoveryClause as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, normalizeAwsError as Ta, resolveStateBucketWithDefault as Ti, malformedOrphanRecordsWarning as Tn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, PARTITION_TABLE as Ui, repairMalformedResourcePropertiesForReadOnly as Un, rewriteTemplateAssetReferences as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, decodeListingKey as Vi, repairMalformedOutputsForReadOnly as Vn, createAssetRedirectResolver as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, canonicalizeRegion as Wi, repairMalformedResourcesForReadOnly as Wn, AssetModeResolver as Wr, assertRegionMatch as Wt, gray as X, clearBucketRegionCache as Xi, withRetry as Xn, parseBootstrapMarker as Xr, readConfigString as Xt, cyan as Y, resolveAssemblyPath as Yi, describeTypeWithThrottleRetry as Yn, isCrossRegionRedirect as Yr, configStringRefusal as Yt, green as Z, resolveBucketRegion as Zi, DagBuilder as Zn, readBootstrapMarkerBody as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ResourceTimeoutError as _a, Synthesizer as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, S3StateBackend as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as aa, describeDockerFailure as ai, s3BucketDomainName as an, dynamicReferenceTokens as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, StackTerminationProtectionError as ba, getLegacyStateBucketName as bi, hasReadableResources as bn, buildForceUnlockCommand as br, startInterruptWatch as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ca, getDockerCmd as ci, s3BucketWebsiteUrl as cn, isSingleDynamicReferenceToken as cr, IAMRoleProvider as ct, updatePartialMessage as d, LocalStartServiceError as da, runDockerForeground as di, applyCallerIdentityCredentials as dn, maskSecretsInText as dr, ProviderRegistry as dt, resetAwsClients as ea, buildDenyExternalAccessPolicy as ei, requireConfigString as en, STATE_SOURCED_CROSS_GENERATION_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, LockError as fa, runDockerStreaming as fi, callerEnvCredentials as fn, recordMaskOnlyValue as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, ProvisioningError as ga, getDockerImageBySourceHash as gi, STATE_RESOURCES_MALFORMED as gn, LockManager as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, PartialFailureError as ha, AssetManifestLoader as hi, INTRINSIC_KEYS as hn, scrubResourceRecord as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, ConfigError as ia, describeDockerExecFailure as ii, s3BucketArn as in, createSecretMasker as ir, secretBearing as it, isFinalSnapshotError as j, markNonRetryable as ja, CFN_TEMPLATE_BODY_LIMIT as ji, malformedResourcesWarning as jn, importableOutputKeys as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, isThrottlingError as ka, warnDeprecatedNoPrefixCliFlag as ki, malformedResourceEntriesWarning as kn, hasReasonlessBaselineRefusal as kr, IntrinsicFunctionResolver as kt, replayRollback as l, IntrinsicResolutionRefusalError as la, partitionSensitiveEnv as li, applyRoleArnIfSet as ln, markSameGenerationBag as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, NestedStackChildDirectDestroyError as ma, stripControlChars as mi, DiffCalculator as mn, redactSecretsForState as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as na, resolveDockerContextDirectory as ni, producerRegionsFromState as nn, TEMPLATE_SOURCED_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, DependencyError as oa, dockerSpawnEnvWithSensitive as oi, s3BucketDualStackDomainName as on, errorCauseChain as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, MalformedProducerRecordRefusalError as pa, escapeRegExp$1 as pi, envCredentialsAreAssumedRole as pn, recoverMaskedOutput as pr, createMaskedRetryLogger as pt, formatResourceLine as q, processStackMessages as qi, findActionableSilentDrops as qn, ensureAssetStorage as qr, configBooleanRefusal as qt, DeployEngine as r, CdkdError as ra, describeDockerCapturedOutput as ri, withSharedDrainBudget as rn, carriesSecretMask as rr, isExportAliasCollision as rt, planRollback as s, DeployCancelledError as sa, formatDockerLoginError as si, s3BucketRegionalDomainName as sn, identityKeyFor as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ta, buildDockerImage as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_READBACK_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, LocalInvokeBuildError as ua, redactDockerArgvValues as ui, AWS_CREDENTIAL_ENV_KEYS as un, maskSecretsInError as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, ResourceUpdateNotSupportedError as va, synthesisStatusMessage as vi, displayLogicalId as vn, rebuildClientForBucketRegion as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isCdkdError as wa, resolveSkipPrefix as wi, malformedLocalOutputsWarning as wn, shellQuote as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, StateError as xa, resolveApp as xi, isReadableResourceEntry as xn, buildLockContentionMessage as xr, CloudControlProvider as xt, keptWholeReasonText as y, StackHasActiveImportsError as ya, getDefaultStateBucketName as yi, hasReadableOutputs as yn, UNREPRODUCIBLE_LOCK_CLAUSE as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, producerCoordinateKey as zi, refuseMalformedResourcesForDestroy as zn, WorkGraph as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-Bw8VoyEi.js.map
+export { yellow as $, AssemblyReader as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, ResourceTimeoutError as Aa, resolveCaptureObservedState as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, isMarkedNonRetryable as Ba, MIGRATE_TMP_PREFIX as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, LocalInvokeBuildError as Ca, getDockerImageBySourceHash as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, NestedStackChildDirectDestroyError as Da, getLegacyStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, MalformedProducerRecordRefusalError as Ea, getDefaultStateBucketName as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, SynthesisError as Fa, stateBucketExistenceConfirmed as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, markRedactedCause as Ga, injectiveKeyPrefix as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isThrottlingError as Ha, uploadCfnTemplate as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, formatError as Ia, warnDeprecatedNoPrefixCliFlag as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, safeStringify$1 as Ja, decodeListingKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, retryClassificationText as Ka, producerCoordinateKey as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, isCdkdError as La, ssmResolvedValueType as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, StackHasActiveImportsError as Ma, resolveStateBucketWithDefault as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, StackTerminationProtectionError as Na, resolveStateBucketWithDefaultAndSource as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, PartialFailureError as Oa, resolveApp as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StateError as Pa, resolveUseCdkBootstrapAssets as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, derivePartitionAndUrlSuffix as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, normalizeAwsError as Ra, CFN_TEMPLATE_BODY_LIMIT as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, IntrinsicResolutionRefusalError as Sa, AssetManifestLoader as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LockError as Ta, synthesisStatusMessage as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isTransientServerError as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, isRetryableTransientError as Va, findLargeInlineResources as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, markNonRetryable as Wa, injectiveKey as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, PARTITION_TABLE as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, __exportAll as Ya, expectedOwnerParam as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, canonicalizeRegion as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ConfigError as _a, redactDockerArgvValues as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, nullPrototypeRecord as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, DeployCancelledError as ba, escapeRegExp$1 as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, resolveAssemblyPath as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, AwsClients as da, describeDockerExecFailure as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, failedStageNote as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, getAwsClients as fa, describeDockerFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, CdkdError as ga, partitionSensitiveEnv as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, AssetError as ha, getDockerCmd as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasPlainPrototype$1 as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ResourceUpdateNotSupportedError as ja, resolveSkipPrefix as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, ProvisioningError as ka, resolveAutoAssetStorage as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, clearBucketRegionCache as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, setAwsClients as ma, formatDockerLoginError as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, defineOwnKey as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, ownValue as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, resetAwsClients as pa, dockerSpawnEnvWithSensitive as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, describeAwsFailure as qa, producerRecordKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, hasOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, renderAssemblyPathEscape as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveBucketRegion as ua, describeDockerCapturedOutput as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CrossAccountSecretRefusalError as va, runDockerForeground as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, LocalStartServiceError as wa, Synthesizer as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DynamicReferenceRegionAmbiguousError as xa, stripControlChars as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, DependencyError as ya, runDockerStreaming as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, withErrorHandling as za, CFN_TEMPLATE_URL_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-DhZW4if5.js.map