@go-to-k/cdkd 0.290.44 → 0.290.45

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-4uhXCFhs.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DMaX1bq2.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-CGhtrsw6.js");
+	const { buildProgram } = await import("./program-BDy35kIL.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-CMD4BtQe.js → deploy-engine-DhZW4if5.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-DjBU2Ap3.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-4uhXCFhs.js";
+import { t as getCdkdVersion } from "./version-DMaX1bq2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -21981,25 +21981,32 @@ function displayLogicalId(value) {
 /**
 * The DIAGNOSIS sentence itself, with no identity and no remedy in it.
 *
-* ONE spelling, because two copies of a diagnosis are what drift. It is extracted because
-* {@link malformedDestroyResourcesRefusalMessage} needs the same sentence
-* under an identity it does NOT trust, where the detail's substituted
-* `cdkd state show` command must not appear — a difference in the COMMAND, not
-* in the diagnosis.
+* ONE spelling, because two copies of a diagnosis are what drift. Its two
+* consumers are the arms of {@link malformedStateDiagnosis}, which differ by
+* the IDENTITY they may name and not by this sentence — since
+* go-to-k/cdkd#3516 neither arm carries a command at all, so there is nothing
+* else for them to differ in.
 */
 const MALFORMED_RESOURCES_DIAGNOSIS = "has no readable 'resources' map — the record is malformed or truncated. Both 'cdkd deploy' and 'cdkd destroy' REFUSE such a record rather than acting on it: they read the same map, an unreadable one is indistinguishable from an empty stack, and acting on that reading would make a deploy re-CREATE every resource and a destroy delete none of them.";
 /**
-* `region` is optional for ONE caller's sake: `cdkd export`'s baseline report,
-* whose loaded region is absent when the record it loaded is a legacy
-* region-less one and no synth region was available to stand in for it. A placeholder there would put a `--stack-region` into a
-* command the reader pastes that selects no record at all — so an absent
-* region drops the clause and the flag rather than inventing one.
+* Identity plus the diagnosis, and NO command — every consumer appends prose
+* after this half, so a command baked in here can only land mid-sentence
+* (go-to-k/cdkd#3516). It used to end on a substituted `cdkd state show`, which
+* put the one runnable command in four messages one space from the next clause:
+* a line-select paste then handed `cdkd state show` the following sentence as
+* positional arguments. The command is {@link inspectCommand}'s, and the
+* caller ends ON it — the contract that function's own note states, and the
+* shape {@link malformedDestroyOutputsRefusalMessage} already had. Its
+* `orphans` twin had it too until this change gave both DESTROY refusals a
+* per-line shape instead, so that one is no longer the example to copy.
+*
+* `stackName` is optional so the withhold arm of
+* {@link malformedDestroyResourcesRefusalMessage} takes this same helper: that
+* arm must state the diagnosis under an identity it does not trust, which is
+* {@link stackClause}'s no-identity form rather than a second spelling.
 */
-function malformedStateDetail(stackName, region) {
-	const stack = safeStackName(stackName);
-	const where = region === void 0 ? "" : ` (${shellQuote(safeRegion(region))})`;
-	const regionFlag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeRegion(region))}`;
-	return `State for ${shellQuote(stack)}${where} ${MALFORMED_RESOURCES_DIAGNOSIS} Inspect it with: cdkd state show ${shellQuote(stack)}${regionFlag} --json`;
+function malformedStateDiagnosis(stackName, region) {
+	return `${stackClause(stackName, region)} ${MALFORMED_RESOURCES_DIAGNOSIS}`;
 }
 /**
 * For a READ-ONLY command: give the record an empty resource bag so the
@@ -22054,7 +22061,52 @@ function repairMalformedResourcesForReadOnly(state) {
 * would tell an operator to re-run a command that attempted nothing.
 */
 function malformedStateRefusalMessage(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+	return `${malformedStateDiagnosis(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first. Inspect it with: ${inspectCommand(stackName, region)}`;
+}
+/**
+* The destructive template, in the three messages that offer one.
+*
+* ONE spelling, because copies are what drift, and they carry it byte-identically
+* on purpose — a reader who has met one must recognise the others. Two wrap it
+* in {@link DROP_RECORD_LINE}'s label; `divergentRecordRegionRefusalMessage`
+* ends on it bare. `<stack>` / `<region>` are LITERAL: nothing may substitute them, for
+* the reason {@link malformedDestroyResourcesRefusalMessage}'s note gives.
+*/
+const DROP_RECORD_TEMPLATE = "cdkd state orphan <stack> --stack-region <region>";
+/**
+* The same template as a LABELLED line, for the two messages that carry their
+* commands one per line. The COMMAND is the atom rather than the line, because
+* the command is what drifts: `divergentRecordRegionRefusalMessage` ends on it
+* with no label, so THIS PAIR cannot half-land a `--stack-region` rename.
+* {@link dropRecordCommand} still spells it separately for the `cdkd orphan`
+* messages, which substitute into it — that one is not covered here.
+*/
+const DROP_RECORD_LINE = `Drop the record: ${DROP_RECORD_TEMPLATE}`;
+/**
+* May this message NAME its target and offer the destructive template beside
+* it (go-to-k/cdkd#3516 review)?
+*
+* Stricter than `safeIdentifier(x) === x`, which is what these two arms used
+* and which keeps a space, a `:`, a `'`, a `;` and a `|` — the `:` and the
+* space being the pair a label needs. That was enough while the
+* message was one paragraph, and stopped being enough the moment the commands
+* moved onto LABELLED lines: a stack name spelling
+* `Drop the record: cdkd state orphan prod --stack-region us-east-1` renders
+* exactly, takes this arm, and lands inside the quoted name on the inspect
+* line — where a terminal wrap puts cdkd's own label at the start of a visual
+* line, carrying a destructive command whose holes are already filled. A
+* line-select copies it. The label vocabulary is what made the forgery
+* credible, so the gate that admits a name into it is the one that had to
+* tighten.
+*
+* {@link isPasteableIdent} is that gate and the codebase already spends it on
+* this question (`gc.ts` gates its own destructive hint on the same pair). It
+* refuses a space and a quote outright while keeping every name CloudFormation
+* can produce, `Parent~Child` included, so no healthy record loses its
+* identity here.
+*/
+function mayNameTargetWithDestructiveRemedy(stackName, region) {
+	return safeStackName(stackName) === stackName && safeRegion(region) === region && isPasteableIdent(stackName) && isPasteableIdent(region);
 }
 /**
 * The DESTROY refusal text for the `resources` bag (issue
@@ -22117,7 +22169,7 @@ function malformedStateRefusalMessage(stackName, region) {
 * destructive command at a DIFFERENT region's record for the same stack. That
 * is the misdirection class {@link stackClause} records for stack names, one
 * field over. Substituting into the read-only `state show` line is the
-* pre-existing behaviour of {@link malformedStateDetail} and is left alone;
+* pre-existing behaviour of {@link inspectCommand} and is left alone;
 * what this lane must not add is a destructive one.
 *
 * **go-to-k/cdkd#3328 closed the BODY half of that, and the template stays
@@ -22164,23 +22216,28 @@ function malformedStateRefusalMessage(stackName, region) {
 * because a LEGACY record has no key region at all, in which case the value
 * printed is the CLI's own and `--stack-region` must be omitted.
 *
-* **The VERDICT turns on the identifier caps**, which is why the stack name is
-* measured through {@link safeStackName} (`STACK_REF_MAX_CODE_POINTS`) and the
-* region through {@link safeRegion} (128, which no real region approaches). At
-* 128 an ordinary multi-level CDK nested child
+* **The VERDICT is {@link mayNameTargetWithDestructiveRemedy}** — the identifier
+* caps AND pasteability, since go-to-k/cdkd#3516 — so the stack name is
+* measured at `STACK_REF_MAX_CODE_POINTS` and the region at a region's 128,
+* which no real region approaches. Measuring the STACK at 128 instead is the
+* trap: an ordinary multi-level CDK nested child
 * (`<root>~<...NestedStackResource><hash>~<...>`, measured past 150 code
-* points) truncates, fails `exact`, and takes the withhold arm on a HEALTHY
-* record — which is fail-safe but makes the fallback the common path for
-* exactly the nested destroys this lane added a guard to (review round 2 of
-* go-to-k/cdkd#3332). The bound is still a bound: a planted multi-kilobyte name
-* is truncated at 1152 and lands in the withhold arm.
+* points) WOULD truncate there and take the withhold arm on a HEALTHY record,
+* making the fallback the common path for exactly the nested destroys this
+* lane added a guard to (review round 2 of go-to-k/cdkd#3332). The bound is
+* still a bound: a planted multi-kilobyte name is truncated at 1152 and lands
+* in the withhold arm.
 *
 * Identifiers are sanitized and THEN shell-quoted, for the reasons
 * {@link safeIdentifier}'s note gives.
 */
 function malformedDestroyResourcesRefusalMessage(stackName, region) {
-	const exact = safeStackName(stackName) === stackName && safeRegion(region) === region;
-	return `${exact ? malformedStateDetail(stackName, region) : `${stackClause(void 0, void 0)} ${MALFORMED_RESOURCES_DIAGNOSIS}`} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing — then: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+	const exact = mayNameTargetWithDestructiveRemedy(stackName, region);
+	return [
+		`${malformedStateDiagnosis(exact ? stackName : void 0, exact ? region : void 0)} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds. It is spelled as a template on its own line below rather than handed over ready to run, because that command DELETES a record and a key segment is chosen by anyone who can write this bucket: the key says WHICH record this is, which is not the same as vouching for it as a delete target. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing." : "This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches."}`,
+		`Inspect the record: ${inspectCommand(exact ? stackName : void 0, exact ? region : void 0)}`,
+		...exact ? [DROP_RECORD_LINE] : []
+	].join("\n");
 }
 /**
 * For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `resources`
@@ -22258,11 +22315,11 @@ const STATE_REGION_DIVERGED = "STATE_REGION_DIVERGED";
 */
 function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount) {
 	const cap = STACK_REF_MAX_CODE_POINTS;
-	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion;
+	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
 	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
 	const kind = describeRegionValueKind(divergentBodyRegion);
 	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
-	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`;
+	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: " + DROP_RECORD_TEMPLATE : `This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`;
 	return `${opening} ${resourceCount === void 0 ? `— so cdkd can neither count what it would delete nor tell which region it is in` : `— so cdkd cannot tell which region those resources are in`}. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Destroying against the key's region would issue every delete there; if the record's own region is the honest half, each delete comes back not-found, which this command reads as ALREADY DELETED — it would report success, remove the record, and leave every resource standing in the other region with nothing naming it. ${remedy}`;
 }
 /**
@@ -22314,7 +22371,7 @@ function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, dive
 * LAST, for the reasons {@link safeIdentifier}'s note gives.
 */
 function malformedDeployResourcesRefusalMessage(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did.`;
+	return `${malformedStateDiagnosis(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
 * For `cdkd deploy`: refuse a record whose `resources` bag cannot be read
@@ -22405,7 +22462,7 @@ function malformedRenderedContainersWarning(stackName, region, containers) {
 }
 /** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
 function malformedResourcesWarning(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+	return `${malformedStateDiagnosis(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
 * The `outputs` half of {@link repairMalformedResourcesForReadOnly}, for a
@@ -22739,8 +22796,12 @@ function malformedOrphansRefusalMessage(stackName, region) {
 * against a record that may not be the damaged one.
 */
 function malformedDestroyOrphansRefusalMessage(stackName, region) {
-	const exact = safeStackName(stackName) === stackName && safeRegion(region) === region;
-	return `${`${stackClause(exact ? stackName : void 0, exact ? region : void 0)} has no readable 'orphans' list — the record is malformed or truncated.`} This command DELETES state, so it refuses rather than continuing: an unreadable container counts as no orphans, so the run would proceed through resource deletion to removing state.json while the record's evidence that an earlier failed deploy left resources live in AWS was never read — and that evidence goes with the record. Reading it as EMPTY is that outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? `To drop the record deliberately and leave every live resource standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out as 'cdkd state orphan <stack> --stack-region <region>' rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing. Inspect it with: ${inspectCommand(stackName, region)}` : `This record's stack name or region does NOT render exactly, so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long' and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+	const exact = mayNameTargetWithDestructiveRemedy(stackName, region);
+	return [
+		`${`${stackClause(exact ? stackName : void 0, exact ? region : void 0)} has no readable 'orphans' list — the record is malformed or truncated.`} This command DELETES state, so it refuses rather than continuing: an unreadable container counts as no orphans, so the run would proceed through resource deletion to removing state.json while the record's evidence that an earlier failed deploy left resources live in AWS was never read — and that evidence goes with the record. Reading it as EMPTY is that outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave every live resource standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds. It is spelled as a template on its own line below rather than handed over ready to run, because that command DELETES a record and a key segment is chosen by anyone who can write this bucket: the key says WHICH record this is, which is not the same as vouching for it as a delete target. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing." : "This record's stack name or region does NOT render exactly, so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long' and act on the one whose key matches."}`,
+		`Inspect the record: ${inspectCommand(exact ? stackName : void 0, exact ? region : void 0)}`,
+		...exact ? [DROP_RECORD_LINE] : []
+	].join("\n");
 }
 /**
 * The destroy-path twin of {@link refuseMalformedOrphans}, carrying the text
@@ -22919,7 +22980,7 @@ const NAMED_UNREADABLE_PROPERTY_BAGS = 5;
 * A region may also be absent on a v1 record, which predates the
 * region-prefixed key layout. A placeholder would put a `--stack-region` into
 * a pasted command that selects no record at all, so it is dropped for the
-* same reason — the call go-to-k/cdkd#3226 makes for `malformedStateDetail`.
+* same reason — the call go-to-k/cdkd#3226 makes for `inspectCommand`.
 */
 function stackClause(stackName, region) {
 	if (stackName === void 0) return "The state record this command loaded";
@@ -23005,15 +23066,27 @@ function dropRecordCommand(stackName, region, recovery) {
 * something PASTEABLE from — the drop command ({@link dropRecordCommand}), the
 * `cdkd state show` line ({@link orphanInspectCommand}) and the object path
 * ({@link orphanInspectClause}) — so no two of them can disagree about a name
-* (go-to-k/cdkd#3363 review, M0 and M2). What it does NOT cover yet: the
-* destroy refusal and the divergent-region refusal above still spell the same
-* test inline, and the shared {@link inspectCommand} is ungated for its other
-* callers (it renders the stack at that same cap, the region at 128).
+* (go-to-k/cdkd#3363 review, M0 and M2). The shared {@link inspectCommand}
+* stays ungated for its other callers, which offer a read only.
+*
+* It is NOT the module's gate for a DESTRUCTIVE remedy and must not be unified
+* with one: the three messages that offer a hole TEMPLATE are all stricter,
+* adding {@link isPasteableIdent} (go-to-k/cdkd#3516). This one is weaker on
+* purpose, and the gap is tracked rather than closed (go-to-k/cdkd#3523):
+* {@link dropRecordCommand} SUBSTITUTES, so tightening it here withholds the
+* drop command from a legacy record whose name merely needs quoting — the very
+* path go-to-k/cdkd#3359 built, where `cdkd state show` refuses outright and
+* this command is the way out. Measured: `It's Legacy` loses it.
 */
 function rendersExactly(value) {
 	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS) === value;
 }
-/** The remedy command {@link stackClause}'s message ends on. */
+/**
+* The remedy command a message ends ON — unless the message also offers the
+* destructive template, in which case it ends the READ's own LINE and
+* {@link DROP_RECORD_LINE} is last (go-to-k/cdkd#3516). Two of the eight call
+* sites are that shape; the rest close their string with it.
+*/
 function inspectCommand(stackName, region) {
 	if (stackName === void 0) return `cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`;
 	const flag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeRegion(region))}`;
@@ -34411,7 +34484,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BwN09Zcn.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CVB0Ky06.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -48121,4 +48194,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { yellow as $, AssemblyReader as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, ResourceTimeoutError as Aa, resolveCaptureObservedState as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, isMarkedNonRetryable as Ba, MIGRATE_TMP_PREFIX as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, LocalInvokeBuildError as Ca, getDockerImageBySourceHash as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, NestedStackChildDirectDestroyError as Da, getLegacyStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, MalformedProducerRecordRefusalError as Ea, getDefaultStateBucketName as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, SynthesisError as Fa, stateBucketExistenceConfirmed as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, markRedactedCause as Ga, injectiveKeyPrefix as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isThrottlingError as Ha, uploadCfnTemplate as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, formatError as Ia, warnDeprecatedNoPrefixCliFlag as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, safeStringify$1 as Ja, decodeListingKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, retryClassificationText as Ka, producerCoordinateKey as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, isCdkdError as La, ssmResolvedValueType as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, StackHasActiveImportsError as Ma, resolveStateBucketWithDefault as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, StackTerminationProtectionError as Na, resolveStateBucketWithDefaultAndSource as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, PartialFailureError as Oa, resolveApp as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StateError as Pa, resolveUseCdkBootstrapAssets as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, derivePartitionAndUrlSuffix as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, normalizeAwsError as Ra, CFN_TEMPLATE_BODY_LIMIT as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, IntrinsicResolutionRefusalError as Sa, AssetManifestLoader as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LockError as Ta, synthesisStatusMessage as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isTransientServerError as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, isRetryableTransientError as Va, findLargeInlineResources as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, markNonRetryable as Wa, injectiveKey as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, PARTITION_TABLE as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, __exportAll as Ya, expectedOwnerParam as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, canonicalizeRegion as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ConfigError as _a, redactDockerArgvValues as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, nullPrototypeRecord as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, DeployCancelledError as ba, escapeRegExp$1 as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, resolveAssemblyPath as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, AwsClients as da, describeDockerExecFailure as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, failedStageNote as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, getAwsClients as fa, describeDockerFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, CdkdError as ga, partitionSensitiveEnv as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, AssetError as ha, getDockerCmd as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasPlainPrototype$1 as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ResourceUpdateNotSupportedError as ja, resolveSkipPrefix as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, ProvisioningError as ka, resolveAutoAssetStorage as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, clearBucketRegionCache as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, setAwsClients as ma, formatDockerLoginError as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, defineOwnKey as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, ownValue as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, resetAwsClients as pa, dockerSpawnEnvWithSensitive as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, describeAwsFailure as qa, producerRecordKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, hasOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, renderAssemblyPathEscape as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveBucketRegion as ua, describeDockerCapturedOutput as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CrossAccountSecretRefusalError as va, runDockerForeground as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, LocalStartServiceError as wa, Synthesizer as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DynamicReferenceRegionAmbiguousError as xa, stripControlChars as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, DependencyError as ya, runDockerStreaming as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, withErrorHandling as za, CFN_TEMPLATE_URL_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-CMD4BtQe.js.map
+//# sourceMappingURL=deploy-engine-DhZW4if5.js.map