@go-to-k/cdkd 0.290.43 → 0.290.45

package/dist/{program-Bh8a5wjj.js → program-BDy35kIL.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as getAwsClients, $n as STATE_SOURCED_BASELINE_RULES, $r as validateContainerRepoName, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as isTransientServerError, Ai as ssmResolvedValueType, An as malformedResourcePropertiesWarning, Ar as hasUnverifiableParameterRefusal, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as producerRecordKey, Bn as refuseMalformedState, Br as buildAssetRedirectMap, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as resolveCaptureObservedState, Cn as malformedExportSourceWarning, Cr as formatLockExpiry, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as isMarkedNonRetryable, Di as resolveUseCdkBootstrapAssets, Dn as malformedOutputsWarning, Dr as exportNamesCarriedFrom, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as withErrorHandling, Ei as resolveStateBucketWithDefaultAndSource, En as malformedOutputsRefusalMessage, Er as DEFAULT_STATE_PREFIX, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as safeStringify, Fi as uploadCfnTemplate, Fn as refuseMalformedOutputs, Fr as orphansCarriedFrom, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as derivePartitionAndUrlSuffix, Gn as safeRegion, Gr as BOOTSTRAP_MARKER_PREFIX, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as expectedOwnerParam, Hn as repairMalformedResourceEntriesForReadOnly, Hr as loadPublishableAssetManifest, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, In as refuseMalformedOutputsForDestroy, Ir as shouldRetainResource, It as isNamelessDynamicReferenceError, J as bold, Ji as renderAssemblyPathEscape, Jn as findSilentDropProperties, Jr as getBootstrapMarkerKey, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as AssemblyReader, Kn as safeStackName, Kr as assertAssetBucketRegion, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as injectiveKey, Ln as refuseMalformedResourceEntries, Lr as AssetPublisher, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as markRedactedCause, Mi as CFN_TEMPLATE_URL_LIMIT, Mn as malformedStateRefusalMessage, Mr as importableOutputs, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as retryClassificationText, Ni as MIGRATE_TMP_PREFIX, Nn as refuseDivergentRecordRegionForDestroy, Nr as isReadableBag, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as isRetryableTransientError, Oi as stateBucketExistenceConfirmed, On as malformedRenderedContainersWarning, Or as hasReadableExportSet, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as describeAwsFailure, Pi as findLargeInlineResources, Pn as refuseMalformedNestedChildOutputs, Pr as orphansAfterRollback, Pt as getAccountInfo, Q as red, Qi as AwsClients, Qn as TemplateParser, Qr as validateAssetBucketName, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as injectiveKeyPrefix, Rn as refuseMalformedResourcePropertiesForOrphan, Rr as stringifyValue, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as SynthesisError, Si as resolveAutoAssetStorage, Sn as malformedExportNamesWarning, Sr as forceQuitRecoveryClause, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as normalizeAwsError, Ti as resolveStateBucketWithDefault, Tn as malformedOrphanRecordsWarning, Tr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as PARTITION_TABLE, Un as repairMalformedResourcePropertiesForReadOnly, Ur as rewriteTemplateAssetReferences, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as decodeListingKey, Vn as repairMalformedOutputsForReadOnly, Vr as createAssetRedirectResolver, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as canonicalizeRegion, Wn as repairMalformedResourcesForReadOnly, Wr as AssetModeResolver, Wt as assertRegionMatch, X as gray, Xn as withRetry, Xr as parseBootstrapMarker, Xt as readConfigString, Y as cyan, Yi as resolveAssemblyPath, Yn as describeTypeWithThrottleRetry, Yr as isCrossRegionRedirect, Yt as configStringRefusal, Z as green, Zi as resolveBucketRegion, Zn as DagBuilder, Zr as readBootstrapMarkerBody, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as ResourceTimeoutError, _i as Synthesizer, _n as UNREADABLE_RESOURCES_MAP_ROW, _r as S3StateBackend, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as CrossAccountSecretRefusalError, ai as describeDockerFailure, an as s3BucketDomainName, ar as dynamicReferenceTokens, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as StackTerminationProtectionError, bi as getLegacyStateBucketName, bn as hasReadableResources, br as buildForceUnlockCommand, bt as startInterruptWatch, c as replayFailedOperations, ca as DynamicReferenceRegionAmbiguousError, ci as getDockerCmd, cn as s3BucketWebsiteUrl, cr as isSingleDynamicReferenceToken, ct as IAMRoleProvider, d as updatePartialMessage, da as LocalStartServiceError, di as runDockerForeground, dn as applyCallerIdentityCredentials, dr as maskSecretsInText, dt as ProviderRegistry, ea as resetAwsClients, ei as buildDenyExternalAccessPolicy, en as requireConfigString, er as STATE_SOURCED_CROSS_GENERATION_RULES, et as collectDeclaredOutputNames, f as updatePartialReason, fi as runDockerStreaming, fn as callerEnvCredentials, fr as recordMaskOnlyValue, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as ProvisioningError, gi as getDockerImageBySourceHash, gn as STATE_RESOURCES_MALFORMED, gr as LockManager, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as PartialFailureError, hi as AssetManifestLoader, hn as INTRINSIC_KEYS, hr as scrubResourceRecord, ht as maskerOrIdentity, i as DeploymentEventsReader, ii as describeDockerExecFailure, in as s3BucketArn, ir as createSecretMasker, it as secretBearing, j as isFinalSnapshotError, ja as markNonRetryable, ji as CFN_TEMPLATE_BODY_LIMIT, jn as malformedResourcesWarning, jr as importableOutputKeys, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as isThrottlingError, ki as warnDeprecatedNoPrefixCliFlag, kn as malformedResourceEntriesWarning, kr as hasReasonlessBaselineRefusal, kt as IntrinsicFunctionResolver, l as replayRollback, la as IntrinsicResolutionRefusalError, li as partitionSensitiveEnv, ln as applyRoleArnIfSet, lr as markSameGenerationBag, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as NestedStackChildDirectDestroyError, mi as stripControlChars, mn as DiffCalculator, mr as redactSecretsForState, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as resolveDockerContextDirectory, nn as producerRegionsFromState, nr as TEMPLATE_SOURCED_RULES, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oi as dockerSpawnEnvWithSensitive, on as s3BucketDualStackDomainName, or as errorCauseChain, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as MalformedProducerRecordRefusalError, pi as escapeRegExp, pn as envCredentialsAreAssumedRole, pr as recoverMaskedOutput, pt as createMaskedRetryLogger, q as formatResourceLine, qi as processStackMessages, qn as findActionableSilentDrops, qr as ensureAssetStorage, qt as configBooleanRefusal, r as DeployEngine, ra as CdkdError, ri as describeDockerCapturedOutput, rn as withSharedDrainBudget, rr as carriesSecretMask, rt as isExportAliasCollision, s as planRollback, sa as DeployCancelledError, si as formatDockerLoginError, sn as s3BucketRegionalDomainName, sr as identityKeyFor, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as setAwsClients, ti as buildDockerImage, tn as classifyReplaySecretRegion, tr as STATE_SOURCED_READBACK_RULES, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as LocalInvokeBuildError$1, ui as redactDockerArgvValues, un as AWS_CREDENTIAL_ENV_KEYS, ur as maskSecretsInError, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as ResourceUpdateNotSupportedError, vi as synthesisStatusMessage, vn as displayLogicalId, vr as rebuildClientForBucketRegion, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as resolveSkipPrefix, wn as malformedLocalOutputsWarning, wr as shellQuote, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as resolveApp, xn as isReadableResourceEntry, xr as buildLockContentionMessage, xt as CloudControlProvider, y as keptWholeReasonText, ya as StackHasActiveImportsError, yi as getDefaultStateBucketName, yn as hasReadableOutputs, yr as UNREPRODUCIBLE_LOCK_CLAUSE, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as producerCoordinateKey, zn as refuseMalformedResourcesForDestroy, zr as WorkGraph, zt as refStateLookupFromResource } from "./deploy-engine-Bw8VoyEi.js";
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-D-2HeLmd.js";
+import { $ as yellow, $i as AssemblyReader, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as ResourceTimeoutError, Ai as resolveCaptureObservedState, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as isMarkedNonRetryable, Bi as MIGRATE_TMP_PREFIX, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as LocalInvokeBuildError$1, Ci as getDockerImageBySourceHash, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as NestedStackChildDirectDestroyError, Di as getLegacyStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as MalformedProducerRecordRefusalError, Ei as getDefaultStateBucketName, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as SynthesisError, Fi as stateBucketExistenceConfirmed, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as markRedactedCause, Gi as injectiveKeyPrefix, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isThrottlingError, Hi as uploadCfnTemplate, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as warnDeprecatedNoPrefixCliFlag, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as safeStringify, Ji as decodeListingKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as retryClassificationText, Ki as producerCoordinateKey, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as ssmResolvedValueType, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as StackHasActiveImportsError, Mi as resolveStateBucketWithDefault, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as StackTerminationProtectionError, Ni as resolveStateBucketWithDefaultAndSource, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as PartialFailureError, Oi as resolveApp, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as resolveUseCdkBootstrapAssets, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as derivePartitionAndUrlSuffix, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as normalizeAwsError, Ri as CFN_TEMPLATE_BODY_LIMIT, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as IntrinsicResolutionRefusalError, Si as AssetManifestLoader, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as synthesisStatusMessage, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isTransientServerError, Ui as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as isRetryableTransientError, Vi as findLargeInlineResources, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as markNonRetryable, Wi as injectiveKey, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xi as PARTITION_TABLE, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Yi as expectedOwnerParam, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as canonicalizeRegion, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as redactDockerArgvValues, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as nullPrototypeRecord, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as DeployCancelledError, bi as escapeRegExp, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as resolveAssemblyPath, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, da as AwsClients, di as describeDockerExecFailure, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as failedStageNote, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as getAwsClients, fi as describeDockerFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as CdkdError, gi as partitionSensitiveEnv, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as getDockerCmd, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasPlainPrototype, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ResourceUpdateNotSupportedError, ji as resolveSkipPrefix, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as ProvisioningError, ki as resolveAutoAssetStorage, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as setAwsClients, mi as formatDockerLoginError, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as defineOwnKey, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as ownValue, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as resetAwsClients, pi as dockerSpawnEnvWithSensitive, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as describeAwsFailure, qi as producerRecordKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as hasOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as renderAssemblyPathEscape, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as processStackMessages, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveBucketRegion, ui as describeDockerCapturedOutput, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CrossAccountSecretRefusalError, vi as runDockerForeground, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as LocalStartServiceError, wi as Synthesizer, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as DynamicReferenceRegionAmbiguousError, xi as stripControlChars, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerStreaming, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as withErrorHandling, zi as CFN_TEMPLATE_URL_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-DhZW4if5.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-DjBU2Ap3.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-ChfV4K6h.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-C9R-ND4b.js";
+import { t as getCdkdVersion } from "./version-DMaX1bq2.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CVB0Ky06.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2361,6 +2361,25 @@ function createSynthCommand() {
 
 //#endregion
 //#region src/cli/stack-matcher.ts
+/**
+* Match stacks against user-supplied name patterns.
+*
+* Patterns are evaluated against two fields:
+*
+* - `stackName` — the physical CloudFormation stack name (e.g. `MyStage-MyStack`)
+* - `displayName` — the hierarchical CDK path (e.g. `MyStage/MyStack`); falls
+*   back to `stackName` when the assembly does not carry one
+*
+* Routing is decided by whether the pattern contains `/`:
+*
+* - Pattern contains `/` → matched only against `displayName` (a `/` cannot
+*   appear in a CloudFormation stack name, so this is unambiguous)
+* - Pattern contains no `/` → matched only against `stackName`
+*
+* Wildcards (`*`) are supported in either case. Results are de-duplicated by
+* `stackName`, so a pattern that incidentally matches the same stack via both
+* fields is returned only once.
+*/
 function matchStacks(stacks, patterns) {
 	if (patterns.length === 0) return [];
 	const seen = /* @__PURE__ */ new Set();
@@ -2375,10 +2394,57 @@ function matchStacks(stacks, patterns) {
 * Render a stack for diagnostic messages. When `displayName` differs from the
 * physical name, both are shown so the user can see which forms are valid as
 * patterns (e.g. `MyStage-Api (MyStage/Api)`).
+*
+* Both names come from the Cloud Assembly, and every one of this helper's
+* render sites interpolates the result into PROSE cdkd authors — `Available:
+* ...`, `Multiple stacks found: ...`, `Publishing assets for stack: ...`, the
+* last of which prints on a normal run rather than only on an error. So they
+* go through `displayIdent` ([#3277](https://github.com/go-to-k/cdkd/issues/3277)):
+* a `stackName` carrying `ESC [ 2 K` plus a carriage return ERASES cdkd's own
+* line and a newline forges a second one, and a value carrying quotes and
+* periods writes a cdkd-sounding clause.
+*
+* It is the identity on every legitimate `stackName` — a CloudFormation stack
+* name is `[A-Za-z0-9-]`, inside `PLAIN_IDENT`. It is NOT the identity on
+* every legitimate `displayName`: CDK sets that to the construct path, and
+* `constructs` rewrites only `/` in an id, so `new Stack(app, 'My Stack')` is
+* legal and prints `MyStack ("My Stack")`. Those quotes are not part of any
+* pattern, in a clause whose job is to say which forms ARE valid as patterns —
+* accepted, because the alternative is `displaySafe`, which passes the quotes
+* and spaces a crafted value needs, and the pattern still matches the RAW
+* name either way (`matchStacks` never sees this rendering).
+*
+* Sanitizing HERE rather than at the call sites is what keeps the rule whole:
+* the sites include `scrub.ts` and `destroy.ts`, which this change does not
+* touch, and a rule widened by hand is how the class survived being closed
+* twice already.
 */
 function describeStack(stack) {
-	if (stack.displayName && stack.displayName !== stack.stackName) return `${stack.stackName} (${stack.displayName})`;
-	return stack.stackName;
+	const name = displayIdent(stack.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayIdent(stack.displayName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`;
+	return name;
+}
+/**
+* The message a command raises when SELECTION came back empty — shared by
+* `deploy`, `diff`, `list` and `publish-assets`, which all built the identical
+* string by hand.
+*
+* `assembly` is required AND so is its `failedStages` member, which is the
+* point: a Stage that failed to load dropped every stack under it from
+* `available`, so "no stacks matching" names the wrong problem unless the
+* failure is reported with it (issue
+* [#3482](https://github.com/go-to-k/cdkd/issues/3482)). A REQUIRED member,
+* not an optional one — `{ failedStages?: ... }` accepts `{}`, so it fences
+* the argument while leaving the content unfenced, which is the wiring hole
+* this signature exists to close. `SynthesisResult.failedStages` is required
+* for the same reason, so passing the result satisfies it and an ad-hoc `{}`
+* does not.
+*
+* What it does NOT fence: a caller passing a STALE or empty list. That is
+* behaviour, not shape, and it is covered by a wiring test per command.
+*/
+function renderNoStackMatch(patterns, available, assembly) {
+	return (patterns.length > 0 ? `No stacks matching ${patterns.join(", ")} found in assembly. ` + (available.length > 0 ? `Available: ${available.map(describeStack).join(", ")}` : "The assembly has no stacks") : "No stacks found in assembly") + failedStageNote(patterns, assembly.failedStages);
 }
 function stackMatchesPattern(stack, pattern) {
 	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
@@ -2456,10 +2522,11 @@ async function listCommand(patterns, options) {
 		...Object.keys(context).length > 0 && { context },
 		deferMacroExpansion: true
 	};
-	const allStacks = (await synthesizer.synthesize(synthOptions)).stacks;
-	if (allStacks.length === 0) throw new Error("No stacks found in assembly");
+	const result = await synthesizer.synthesize(synthOptions);
+	const allStacks = result.stacks;
+	if (allStacks.length === 0) throw new Error(renderNoStackMatch(patterns, allStacks, result));
 	const selected = patterns.length > 0 ? matchStacks(allStacks, patterns) : allStacks;
-	if (selected.length === 0) throw new Error(`No stacks matching ${patterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}`);
+	if (selected.length === 0) throw new Error(renderNoStackMatch(patterns, allStacks, result));
 	const sorted = sortByDependency(selected);
 	if (options.long) {
 		emitStructured(sorted.map((s) => toLongRecord(s, options.showDependencies)), options.json);
@@ -63995,6 +64062,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const guardIndeterminateTargets = /* @__PURE__ */ new Set();
 	const regionForState = state.region ?? ctx.baseRegion;
 	refuseMalformedResourcesForDestroy(state, stackName, regionForState);
+	refuseMalformedOrphansForDestroy(state, stackName, regionForState);
 	refuseDivergentRecordRegionForDestroy(state, stackName, regionForState, ctx.divergentBodyRegion);
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
@@ -64045,7 +64113,10 @@ async function runDestroyForStack(stackName, state, ctx) {
 		emptyLockHeld = true;
 		try {
 			const recheck = await ctx.stateBackend.getState(stackName, regionForState);
-			if (recheck) refuseMalformedResourcesForDestroy(recheck.state, stackName, regionForState);
+			if (recheck) {
+				refuseMalformedResourcesForDestroy(recheck.state, stackName, regionForState);
+				refuseMalformedOrphansForDestroy(recheck.state, stackName, regionForState);
+			}
 			const recheckResources = recheck ? Object.keys(recheck.state.resources).length : 0;
 			const recheckOrphans = recheck ? (recheck.state.orphans ?? []).length : 0;
 			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack '${stackName}' (${regionForState}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
@@ -66034,11 +66105,12 @@ async function deployCommand(stacks, options) {
 		logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
+		if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 		if (options.all) targetStacks = allStacks;
 		else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
-		if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+		if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 		const inferredCrossStackDeps = inferCrossStackStackDeps(allStacks);
 		const effectiveStackDeps = (stackName, deps) => {
 			const union = new Set(deps);
@@ -66287,7 +66359,7 @@ async function deployCommand(stacks, options) {
 					awsClients: stackAwsClients,
 					stateBucket,
 					exportIndexStore,
-					nestedTemplates: stackInfo.nestedTemplates ?? {},
+					nestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
 					dagBuilder,
 					diffCalculator,
 					options: deployEngineOptions,
@@ -67902,7 +67974,7 @@ function readNestedTemplate(templatePath) {
 */
 function indexNestedChildTemplates(template, templatePath) {
 	const dir = path.dirname(templatePath);
-	const result = {};
+	const result = nullPrototypeRecord();
 	for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
@@ -67931,6 +68003,10 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
 		if (unreadableProps.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
 		if (repairMalformedOutputsForReadOnly(result.state)) logger.warn(malformedOutputsWarning(stackName, region));
+		if (repairMalformedOrphansForReadOnly(result.state)) {
+			logger.warn(malformedOrphansWarning(stackName, region));
+			unreadable.push(UNREADABLE_ORPHANS_CONTAINER_ROW);
+		}
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
 		return {
 			state: result.state,
@@ -68707,10 +68783,10 @@ function renderDiffTree(node, isRoot, logFn) {
 		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
 		if (node.adoptedOrphans.length > 0) logFn(`${node.adoptedOrphans.length} resource(s) to adopt from a previous rollback: ${node.adoptedOrphans.map(stripControlChars).join(", ")}`);
 		if (node.unreadable.length > 0) {
-			const named = node.unreadable.slice(0, UNREADABLE_PREVIEW_NAMES).map((id) => id === "(resources map)" ? id : displayLogicalId(id));
+			const named = node.unreadable.slice(0, UNREADABLE_PREVIEW_NAMES).map((id) => id === "(resources map)" || id === "(orphans container)" ? id : displayLogicalId(id));
 			const rest = node.unreadable.length - named.length;
-			const onlyTheMap = node.unreadable.length === 1 && node.unreadable[0] === "(resources map)";
-			logFn(`${node.unreadable.length} state record row(s) could not be read: ${named.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}.` + (onlyTheMap ? "" : " One the template still declares is shown above as a create; one it no longer declares is not shown above."));
+			const onlyContainerRows = node.unreadable.every((id) => id === "(resources map)" || id === "(orphans container)");
+			logFn(`${node.unreadable.length} state record row(s) could not be read: ${named.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}.` + (onlyContainerRows ? "" : " One the template still declares is shown above as a create; one it no longer declares is not shown above."));
 		}
 	}
 	if (node.blocking.length > 0) {
@@ -68804,15 +68880,17 @@ async function diffCommand(stacks, options) {
 			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
 			deferMacroExpansion: true
 		};
-		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
+		const result = await synthesizer.synthesize(synthOptions);
+		const { stacks: allStacks } = result;
 		logger.info(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
+		if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 		if (options.all) targetStacks = allStacks;
 		else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
-		if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+		if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const stateConfig = {
 			bucket: stateBucket,
@@ -68876,7 +68954,7 @@ async function diffCommand(stacks, options) {
 				displayName: stackInfo.stackName,
 				region: stackRegion,
 				template: stackInfo.template,
-				nestedTemplates: stackInfo.nestedTemplates ?? {},
+				nestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
 				recursive,
 				stateBackend,
 				diffCalculator,
@@ -69286,6 +69364,12 @@ async function scrubCommand(stacks, options) {
 	*/
 	const malformedOutputRecords = [];
 	/**
+	* Stacks whose `orphans` CONTAINER could not be read (go-to-k/cdkd#3379).
+	* Its own list for the reason `malformedOutputRecords` is its own: the
+	* audited error names the container that is broken.
+	*/
+	const malformedOrphanRecords = [];
+	/**
 	* Stacks whose scrub met a PRODUCER record with an unreadable `outputs` map
 	* (go-to-k/cdkd#3192 review round 5).
 	*
@@ -69373,6 +69457,7 @@ async function scrubCommand(stacks, options) {
 		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.malformedOutputs) malformedOutputRecords.push(stack.stackName);
+		if (scrubbed.malformedOrphans) malformedOrphanRecords.push(stack.stackName);
 		if (scrubbed.unverifiableLeaves > 0) {
 			totalStacksWithUnverifiableLeaves++;
 			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${stack.stackName} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
@@ -69408,7 +69493,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0 && malformedOrphanRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -69432,7 +69517,7 @@ async function scrubCommand(stacks, options) {
 		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
-		if (malformedRecords.length > 0 || malformedOutputRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords);
+		if (malformedRecords.length > 0 || malformedOutputRecords.length > 0 || malformedOrphanRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords, malformedOrphanRecords);
 		if (damagedProducerStacks.length > 0) throw damagedProducerRecordsError(damagedProducerStacks);
 		if (options.fail) throw new ScrubNeededError();
 		return;
@@ -69441,7 +69526,7 @@ async function scrubCommand(stacks, options) {
 	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
-	if (malformedRecords.length > 0 || malformedOutputRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords);
+	if (malformedRecords.length > 0 || malformedOutputRecords.length > 0 || malformedOrphanRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords, malformedOrphanRecords);
 	if (damagedProducerStacks.length > 0) throw damagedProducerRecordsError(damagedProducerStacks);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0 || totalStacksWithUnverifiableLeaves > 0)) throw new ScrubNeededError();
 }
@@ -70063,11 +70148,12 @@ function damagedProducerRecordsError(stackNames) {
 	const names = stackNames.map((n) => displayIdent(n)).join(", ");
 	return new ScrubRefusalError(`${stackNames.length} stack(s) import a value from a PRODUCER whose state record has no readable 'outputs' map, so this run could not tell whether that producer still holds the plaintext: ${names}. Those stacks were scrubbed for everything else and are NOT reported clean. Repair the producer record and scrub it first, then re-run. See the warnings above for which producer.`, "SCRUB_PRODUCER_RECORD_UNREADABLE");
 }
-function malformedRecordsAuditedError(stackNames, outputStackNames) {
+function malformedRecordsAuditedError(stackNames, outputStackNames, orphanStackNames) {
 	const safeNames = (names) => names.map((n) => displayIdent(n)).join(", ");
 	const parts = [];
 	if (stackNames.length > 0) parts.push(`${stackNames.length} stack(s) were audited with an EMPTY resource set because their state record has no readable 'resources' map: ${safeNames(stackNames)}. The report above describes their outputs only — nothing is known about their resources, so this run cannot certify them clean.`);
 	if (outputStackNames.length > 0) parts.push(`${outputStackNames.length} stack(s) were audited with an EMPTY outputs bag because their state record has no readable 'outputs' map: ${safeNames(outputStackNames)}. The report above describes their resources only — nothing is known about the values their outputs hold, and those values are what the exports index republishes to consumer stacks, so this run cannot certify them clean.`);
+	if (orphanStackNames.length > 0) parts.push(`${orphanStackNames.length} stack(s) were audited with an EMPTY orphan list because their state record has no readable 'orphans' list: ${safeNames(orphanStackNames)}. Nothing is known about resources an earlier failed deploy may have left live in AWS for them, so this run cannot certify them clean.`);
 	return new ScrubRefusalError(`${parts.join(" ")} See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
 }
 /**
@@ -71560,6 +71646,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				logger.warn(malformedOutputsWarning(stack.stackName, region));
 			}
 		} else if (!hasReadableOutputs(state)) throw new ScrubRefusalError(malformedOutputsRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		let malformedOrphans;
+		if (opts.dryRun) {
+			if (repairMalformedOrphansForReadOnly(state)) {
+				malformedOrphans = true;
+				logger.warn(malformedOrphansWarning(stack.stackName, region));
+			}
+		} else if (!hasReadableOrphans(state)) throw new ScrubRefusalError(malformedOrphansRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
 		const resolvers = new ScrubResolvers(region);
@@ -71776,6 +71869,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				unverifiableLeaves,
 				...malformedResources ? { malformedResources } : {},
 				...malformedOutputs ? { malformedOutputs } : {},
+				...malformedOrphans ? { malformedOrphans } : {},
 				outputs: state.outputs,
 				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
@@ -71854,6 +71948,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			unverifiableLeaves,
 			...malformedResources ? { malformedResources } : {},
 			...malformedOutputs ? { malformedOutputs } : {},
+			...malformedOrphans ? { malformedOrphans } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
@@ -71879,87 +71974,6 @@ function createScrubCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/utils/own-keys.ts
-/**
-* Own-key helpers for the bags that reach cdkd through `JSON.parse` — a
-* `state.json` record, a Cloud Control `Properties` document, a template — and
-* for the raw SDK readbacks compared against them.
-*
-* `JSON.parse` yields a key literally named `__proto__` as an ORDINARY own
-* data property, and every comparator / rebuild walk over such a bag has to
-* keep treating it as one. Two idioms silently do not:
-*
-* - **Rebuilding onto a `{}` literal.** `out[k] = v` with `k === '__proto__'`
-*   runs `Object.prototype`'s accessor, SETS the node's prototype and DROPS
-*   the key — on BOTH comparison sides when the walk is a canonicalizer, so a
-*   drift at that key is invisible (issue
-*   [#3121](https://github.com/go-to-k/cdkd/issues/3121)), and on the WRITE
-*   path the member vanishes from the payload (issue
-*   [#2899](https://github.com/go-to-k/cdkd/issues/2899)). Rebuild onto
-*   {@link nullPrototypeRecord} (no accessor there, so plain assignment
-*   defines an own key) or, onto an existing plain object, define the key
-*   with {@link defineOwnKey}.
-* - **`key in bag` membership.** `in` reads the prototype chain, so a key
-*   named `constructor` / `toString` answers `true` for every plain object
-*   and the recursion then walks `Object`'s function. {@link hasOwnKey} asks
-*   the bag alone; {@link ownValue} is the matching read.
-*
-* And ONE shape test every such walk needs FIRST: {@link hasPlainPrototype}.
-* A non-plain object (`Date`, `Uint8Array`, `Map`, a class instance) has no
-* own enumerable keys, so a key-walk over one FABRICATES `{}` (or an index
-* map) and any two of them compare equal. Such a value is returned by
-* IDENTITY and compared as itself.
-*
-* Extracted from `src/cli/commands/drift.ts` (issue #2899, swept by PR #3124)
-* so the analyzer-side canonicalizers (#3121) share ONE spelling rather than a
-* fourth copy. A LEAF module, deliberately, and it must stay one: a value
-* import from a module other suites `vi.mock` wholesale reds those suites
-* with a missing-export failure (which is why `secret-redaction.ts` keeps its
-* own `hasPlainPrototype` — several drift suites mock that module).
-*/
-/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
-function hasOwnKey(target, key) {
-	return Object.prototype.hasOwnProperty.call(target, key);
-}
-/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
-function ownValue(target, key) {
-	return hasOwnKey(target, key) ? target[key] : void 0;
-}
-/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
-function defineOwnKey(target, key, value) {
-	Object.defineProperty(target, key, {
-		value,
-		writable: true,
-		enumerable: true,
-		configurable: true
-	});
-}
-/**
-* Does this value carry an ORDINARY object prototype?
-*
-* `typeof v === 'object'` admits `Date` / `Map` / `Set` / `Uint8Array` / class
-* instances, whose own enumerable keys are `[]` — so a key-walk over one
-* reports "no contradiction" between two values that actually differ, and a
-* rebuild over one fabricates `{}`. A NULL prototype counts as plain: it is
-* what {@link nullPrototypeRecord} yields, and a walk must be able to re-walk
-* its own output.
-*/
-function hasPlainPrototype(value) {
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/**
-* A fresh rebuild target with NO prototype, so `out['__proto__'] = v` defines
-* an own key instead of setting the prototype. `JSON.stringify`,
-* `Object.keys` / `entries` and `structuredClone` all read it like a plain
-* object; only `instanceof Object` and a direct `.hasOwnProperty()` method call
-* do not, and no consumer on the drift path uses either.
-*/
-function nullPrototypeRecord() {
-	return Object.create(null);
-}
-
 //#endregion
 //#region src/analyzer/drift-normalize.ts
 /**
@@ -78153,7 +78167,7 @@ async function exportCommand(stackArg, options) {
 		let synthedRegion;
 		let templateFormat = "json";
 		let allSynthStacks = [];
-		let rootNestedTemplatePaths = {};
+		let rootNestedTemplatePaths = nullPrototypeRecord();
 		if (options.template) {
 			if (!stackArg) throw new Error("--template requires a stack name as a positional argument to identify the cdkd state record.");
 			const parsed = parseTemplateFile(options.template);
@@ -78182,7 +78196,7 @@ async function exportCommand(stackArg, options) {
 			template = stackInfo.template;
 			resolvedStackName = stackInfo.stackName;
 			synthedRegion = stackInfo.region;
-			rootNestedTemplatePaths = stackInfo.nestedTemplates ?? {};
+			rootNestedTemplatePaths = stackInfo.nestedTemplates ?? nullPrototypeRecord();
 			allSynthStacks = result.stacks.map((s) => ({
 				stackName: s.stackName,
 				template: s.template
@@ -78767,7 +78781,7 @@ function readNestedChildTemplateFile(templatePath, childLogicalId) {
 * for unit testing.
 */
 function indexNestedTemplatePaths(template, templateDir) {
-	const result = {};
+	const result = nullPrototypeRecord();
 	const resources = template["Resources"];
 	if (!resources || typeof resources !== "object" || Array.isArray(resources)) return result;
 	for (const [logicalId, resource] of Object.entries(resources)) {
@@ -83035,6 +83049,7 @@ async function rollbackCommand(stackArg, options) {
 			if (!stateData) throw new Error(`Rollback journal exists for '${safeStack(stackName)}' (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			const baseState = stateData.state;
 			refuseMalformedState(baseState, stackName, region);
+			refuseMalformedOrphans(baseState, stackName, region);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -85740,15 +85755,17 @@ async function publishAssetsCommand(stacks, options) {
 		...options.profile && { profile: options.profile },
 		...Object.keys(context).length > 0 && { context }
 	};
-	const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
+	const result = await synthesizer.synthesize(synthOptions);
+	const { stacks: allStacks } = result;
 	logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 	const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 	let targetStacks;
+	if (allStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 	if (options.all) targetStacks = allStacks;
 	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
 	else if (allStacks.length === 1) targetStacks = allStacks;
 	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
-	if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+	if (targetStacks.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
 	const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const stsClient = new STSClient({
@@ -86250,7 +86267,7 @@ async function importCommand(stackArg, options) {
 				overrides
 			});
 			logger.info(`Resolved ${mergeStats.derived} physical ID(s) from CloudFormation` + formatCfnOverrideMergeDetail(mergeStats));
-			validateNestedStackShape(template, migrationTree, stackInfo.stackName, stackInfo.nestedTemplates ?? {});
+			validateNestedStackShape(template, migrationTree, stackInfo.stackName, stackInfo.nestedTemplates ?? nullPrototypeRecord());
 		}
 		let accountIdForNestedSynth;
 		if (migrationTree && migrationTree.nested.size > 0) {
@@ -86278,6 +86295,7 @@ async function importCommand(stackArg, options) {
 		const existingState = existingResult?.state ?? null;
 		if (existingState) refuseMalformedState(existingState, stackInfo.stackName, targetRegion);
 		if (existingState) refuseMalformedOutputs(existingState, stackInfo.stackName, targetRegion);
+		if (existingState) refuseMalformedOrphans(existingState, stackInfo.stackName, targetRegion);
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
 		if (existingState) {
@@ -86368,7 +86386,7 @@ async function importCommand(stackArg, options) {
 				lockRecovery,
 				parentStackName: stackInfo.stackName,
 				parentRegion: targetRegion,
-				parentNestedTemplates: stackInfo.nestedTemplates ?? {},
+				parentNestedTemplates: stackInfo.nestedTemplates ?? nullPrototypeRecord(),
 				parentTree: migrationTree,
 				stateBackend,
 				lockManager,
@@ -87654,7 +87672,7 @@ function readNestedChildTemplate(templatePath, childLogicalId) {
 */
 function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 	const dir = path.dirname(childTemplatePath);
-	const result = {};
+	const result = nullPrototypeRecord();
 	for (const [grandLogicalId, resource] of Object.entries(childTemplate.Resources)) {
 		if (resource.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
@@ -97343,4 +97361,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Bh8a5wjj.js.map
+//# sourceMappingURL=program-BDy35kIL.js.map