@go-to-k/cdkd 0.290.44 → 0.290.46

package/dist/{deploy-engine-CMD4BtQe.js → deploy-engine-BRy8S7QH.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-DjBU2Ap3.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-4uhXCFhs.js";
+import { t as getCdkdVersion } from "./version-THOL_1Cg.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1887,7 +1887,7 @@ function formatError(error) {
 	if (isCdkdError(error)) {
 		let message = `${error.name}: ${error.message}`;
 		if (error.cause) {
-			const cause = displaySafe(error.cause.message);
+			const cause = displayAwsMessage(error.cause.message);
 			if (cause) message += `\nCaused by: ${cause}`;
 		}
 		return message;
@@ -4331,22 +4331,24 @@ var ContextProviderRegistry = class {
 		const results = {};
 		for (const entry of missing) {
 			const provider = this.providers.get(entry.provider);
+			const shownProvider = displaySafe(entry.provider);
 			if (!provider) {
-				this.logger.warn(`No context provider registered for: ${entry.provider}`);
+				this.logger.warn(`No context provider registered for: ${shownProvider}`);
 				results[entry.key] = {
-					[PROVIDER_ERROR_KEY]: `Unknown context provider: ${entry.provider}`,
+					[PROVIDER_ERROR_KEY]: `Unknown context provider: ${shownProvider}`,
 					[TRANSIENT_CONTEXT_KEY]: true
 				};
 				continue;
 			}
+			const shownKey = displaySafe(entry.key);
 			try {
-				this.logger.debug(`Resolving context: ${entry.provider} (key: ${entry.key})`);
+				this.logger.debug(`Resolving context: ${shownProvider} (key: ${shownKey})`);
 				const value = await provider.resolve(entry.props);
 				results[entry.key] = value;
-				this.logger.debug(`Resolved context: ${entry.key}`);
+				this.logger.debug(`Resolved context: ${shownKey}`);
 			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
-				this.logger.error(`Context provider '${entry.provider}' failed: ${message}`);
+				const message = displayAwsMessage(error instanceof Error ? error.message : String(error));
+				this.logger.error(`Context provider '${shownProvider}' failed: ${message}`);
 				results[entry.key] = {
 					[PROVIDER_ERROR_KEY]: message,
 					[TRANSIENT_CONTEXT_KEY]: true
@@ -5961,6 +5963,21 @@ function ssmResolvedValueType(type) {
 
 //#endregion
 //#region src/synthesis/macro-expander.ts
+/**
+* A transform name comes from the TEMPLATE's own `Transform` / `Fn::Transform`
+* node, so every render of one goes through `displaySafe`, in thrown messages
+* and in the `debug` line alike
+* ([#3479](https://github.com/go-to-k/cdkd/issues/3479)). `displaySafe` neither
+* quotes nor truncates, so a legitimate `AWS::Serverless-2016-10-31` renders
+* byte-identically.
+*
+* A JOINED list sanitizes per ELEMENT so the separator stays
+* byte-exact; `displaySafe`'s own doc carries why that is a formatting rule
+* rather than a safety one.
+*/
+function displaySafeTransforms(names) {
+	return names.map((name) => displaySafe(name)).join(", ");
+}
 /** 600 seconds = 10 minutes. SDK waiter's `maxWaitTime` is in seconds. */
 const WAITER_MAX_WAIT_SECONDS = 600;
 const PARAMETER_PLACEHOLDER = "cdkd-macro-expand-placeholder";
@@ -5978,8 +5995,51 @@ const PARAMETER_PLACEHOLDER = "cdkd-macro-expand-placeholder";
 const EARLY_VALIDATION_MAX_ATTEMPTS = 3;
 const EARLY_VALIDATION_RETRY_BASE_DELAY_MS = 2e3;
 /** Matches the changeset FAILED StatusReason emitted by the hook family. */
+const EARLY_VALIDATION_MARKER = /AWS::EarlyValidation::/;
+/**
+* Where the retry verdict is CARRIED, rather than re-derived from the rendered
+* message.
+*
+* The verdict used to be `EARLY_VALIDATION_MARKER.test(err.message)`, and that
+* became wrong the moment AWS's reply started rendering through
+* `displayAwsMessage` ([#3479](https://github.com/go-to-k/cdkd/issues/3479)):
+* the cap CUTS at `AWS_MESSAGE_MAX_CODE_POINTS`, so a `StatusReason` carrying
+* the hook marker past that point would no longer match, and `cdkd deploy` of a
+* macro stack would hard-fail on attempt 1 where issue
+* [#1151](https://github.com/go-to-k/cdkd/issues/1151) says it must retry. The
+* sanitizer's CHARSET half was never the risk — the marker is plain ASCII —
+* but a decision re-derived from display text inherits every display rule,
+* including ones added later for unrelated reasons.
+*
+* So each throw site tests the RAW text once and records the answer here. A
+* symbol rather than a field on `MacroExpansionError`: the verdict is this
+* module's business, not the shared error class's.
+*
+* IT ALSO CLOSES A PATH THAT PRE-DATES THE CAP, which is the stronger argument
+* for the shape. The old predicate matched the WHOLE message, and two of cdkd's
+* OWN refusals below interpolate template-supplied transform names — so an
+* assembly declaring `Transform: AWS::EarlyValidation::x` made the multi-stage
+* and no-TemplateBody refusals test positive, and a template value steered the
+* retry loop into three CFn changeset round-trips plus the backoff between
+* them. A verdict read from a symbol set out of AWS's own text cannot be
+* steered that way at all.
+*
+* IT RIDES THE INSTANCE, which is the one way a future edit can lose it: a site
+* that catches one of these and wraps it in a NEW `MacroExpansionError` drops
+* the verdict silently — the same shape as the bug above, one indirection over.
+* Re-tag at any such wrap.
+*/
+const EARLY_VALIDATION = Symbol("cdkd.macroExpansion.earlyValidationRejection");
+/**
+* Tag `error` when `rawReason` — AWS's text BEFORE any display helper touches
+* it — names a validation hook.
+*/
+function withEarlyValidationVerdict(error, rawReason) {
+	if (EARLY_VALIDATION_MARKER.test(rawReason)) error[EARLY_VALIDATION] = true;
+	return error;
+}
 function isEarlyValidationRejection(err) {
-	return err instanceof MacroExpansionError && /AWS::EarlyValidation::/.test(err.message);
+	return err instanceof MacroExpansionError && err[EARLY_VALIDATION] === true;
 }
 /** Test seam: overridable sleep so retry tests don't wait wall-clock. */
 const retryDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
@@ -6093,7 +6153,7 @@ async function expandMacros(template, opts) {
 }
 async function expandMacrosAttempt(template, opts, logger) {
 	const macros = enumerateMacros(template);
-	logger.debug(`Macro expansion: detected transforms [${macros.join(", ")}], starting CFn round-trip...`);
+	logger.debug(`Macro expansion: detected transforms [${displaySafeTransforms(macros)}], starting CFn round-trip...`);
 	const transientStackName = `cdkd-macro-expand-${randomUUID().slice(0, 16)}`;
 	const changeSetName = `${transientStackName}-changeset`;
 	const region = opts.region;
@@ -6136,7 +6196,8 @@ async function expandMacrosAttempt(template, opts, logger) {
 				...parameters.length > 0 && { Parameters: parameters }
 			}));
 		} catch (err) {
-			throw new MacroExpansionError(`CloudFormation rejected the macro-expansion changeset: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+			const rawMessage = err instanceof Error ? err.message : String(err);
+			throw withEarlyValidationVerdict(new MacroExpansionError(`CloudFormation rejected the macro-expansion changeset: ${displayAwsMessage(rawMessage)}`, err instanceof Error ? err : void 0), rawMessage);
 		}
 		let waiterFailed = false;
 		let waiterError;
@@ -6159,20 +6220,21 @@ async function expandMacrosAttempt(template, opts, logger) {
 				StackName: transientStackName,
 				ChangeSetName: changeSetName
 			})).catch(() => void 0);
-			const reason = desc?.StatusReason ?? "unknown (DescribeChangeSet failed)";
-			const status = desc?.Status ?? "UNKNOWN";
-			throw new MacroExpansionError(`CloudFormation macro expansion failed (status=${status}): ${reason}`, waiterError instanceof Error ? waiterError : void 0);
+			const rawReason = desc?.StatusReason ?? "unknown (DescribeChangeSet failed)";
+			const reason = displayAwsMessage(rawReason);
+			const status = displaySafe(desc?.Status ?? "UNKNOWN");
+			throw withEarlyValidationVerdict(new MacroExpansionError(`CloudFormation macro expansion failed (status=${status}): ${reason}`, waiterError instanceof Error ? waiterError : void 0), rawReason);
 		}
 		const tpl = await cfn.send(new GetTemplateCommand({
 			StackName: transientStackName,
 			ChangeSetName: changeSetName,
 			TemplateStage: "Processed"
 		}));
-		if (tpl.TemplateBody === void 0 || tpl.TemplateBody === null) throw new MacroExpansionError(`CloudFormation returned no Processed-stage template body for the macro-expansion changeset. This typically indicates a CFn-side regression — re-run, and if the failure persists open an issue with the transforms involved: [${macros.join(", ")}].`);
+		if (tpl.TemplateBody === void 0 || tpl.TemplateBody === null) throw new MacroExpansionError(`CloudFormation returned no Processed-stage template body for the macro-expansion changeset. This typically indicates a CFn-side regression — re-run, and if the failure persists open an issue with the transforms involved: [${displaySafeTransforms(macros)}].`);
 		const expanded = parseTemplateBody(tpl.TemplateBody);
 		if (containsMacro(expanded)) {
 			const inner = enumerateMacros(expanded);
-			throw new MacroExpansionError(`Macro expansion produced a template that still contains macros [${inner.join(", ")}]. Multi-stage macros (a macro whose expansion emits another macro reference) are intentionally out of scope in cdkd v1 — see https://github.com/go-to-k/cdkd/issues/463. If you need this pattern, manually pre-expand the template and deploy the result.`);
+			throw new MacroExpansionError(`Macro expansion produced a template that still contains macros [${displaySafeTransforms(inner)}]. Multi-stage macros (a macro whose expansion emits another macro reference) are intentionally out of scope in cdkd v1 — see https://github.com/go-to-k/cdkd/issues/463. If you need this pattern, manually pre-expand the template and deploy the result.`);
 		}
 		logger.debug(`Macro expansion: success — ${Object.keys(expanded.Resources ?? {}).length} resources after expansion.`);
 		return expanded;
@@ -6243,7 +6305,7 @@ function stringifyParamDefault(value, type, paramKey, logger) {
 			if (inner !== void 0 && isListParameterType(inner)) return "placeholder,placeholder";
 			return "placeholder";
 		}
-		logger.warn(`Parameter '${paramKey}' has unrecognized CFn Type '${type}'; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
+		logger.warn(`Parameter '${displaySafe(paramKey)}' has unrecognized CFn Type '${displaySafe(type)}'; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
 		return PARAMETER_PLACEHOLDER;
 	}
 	return PARAMETER_PLACEHOLDER;
@@ -6260,7 +6322,7 @@ function parseTemplateBody(body) {
 	if (typeof body === "string") try {
 		parsed = JSON.parse(body);
 	} catch (err) {
-		throw new MacroExpansionError(`CloudFormation returned a non-JSON Processed-stage template body. cdkd's macro-expansion path only supports JSON-shaped synth templates (CDK apps emit JSON by default). Cause: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+		throw new MacroExpansionError(`CloudFormation returned a non-JSON Processed-stage template body. cdkd's macro-expansion path only supports JSON-shaped synth templates (CDK apps emit JSON by default). Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`, err instanceof Error ? err : void 0);
 	}
 	else if (body && typeof body === "object" && !Array.isArray(body)) parsed = body;
 	else throw new MacroExpansionError(`CloudFormation returned an unexpected TemplateBody shape (${typeof body}). Expected a JSON string or parsed object.`);
@@ -6270,7 +6332,7 @@ function parseTemplateBody(body) {
 	return parsed;
 }
 function formatErr(err) {
-	return err instanceof Error ? err.message : String(err);
+	return displayAwsMessage(err instanceof Error ? err.message : String(err));
 }
 
 //#endregion
@@ -6644,6 +6706,26 @@ async function probeBucket(client, bucketName, deps) {
 //#endregion
 //#region src/synthesis/synthesizer.ts
 /**
+* Every manifest- or template-derived value this module RENDERS goes through
+* `displaySafe` — thrown messages and ordinary `logger.info` lines alike
+* ([#3479](https://github.com/go-to-k/cdkd/issues/3479)). Two reasons it is the
+* DEFAULT here rather than a judgement per message:
+*
+* - The "only where the input is untrusted" boundary keeps being drawn wrong. The
+*   macro-expansion line below is a DEFAULT-verbosity `logger.info` on a normal
+*   run, and a `stackName` carrying `ESC [ 2 K` plus a carriage return erases
+*   cdkd's own line while a trailing line terminator forges another. Nothing
+*   about the message being "operational" protects it, and `formatError`
+*   sanitizes only an error's `cause`, never its own `message`.
+* - The cost is in the helper, not the scope: `displaySafe` neither quotes nor
+*   truncates, so it is the identity on every legitimate stack name, context key
+*   and transform name.
+*
+* A JOINED list sanitizes per ELEMENT so the separator stays
+* byte-exact; `displaySafe`'s own doc carries why that is a formatting rule
+* rather than a safety one.
+*/
+/**
 * CDK CLI compatibility: a `--app` value pointing at an existing directory is
 * treated as a pre-synthesized cloud assembly — synthesis (the subprocess
 * execution) is skipped and the manifest is read directly. A `--app` value that
@@ -6771,7 +6853,7 @@ var Synthesizer = class {
 			}
 			const missingKeys = new Set(manifest.missing.map((m) => m.key));
 			this.logger.debug(`Missing context: ${manifest.missing.length} value(s)`);
-			if (previousMissingKeys && setsEqual(missingKeys, previousMissingKeys)) throw new SynthesisError(`Context resolution made no progress. Missing context keys: ${[...missingKeys].join(", ")}. Ensure cdk.context.json is correctly configured or required AWS permissions are granted.`);
+			if (previousMissingKeys && setsEqual(missingKeys, previousMissingKeys)) throw new SynthesisError(`Context resolution made no progress. Missing context keys: ${[...missingKeys].map((k) => displaySafe(k)).join(", ")}. Ensure cdk.context.json is correctly configured or required AWS permissions are granted.`);
 			previousMissingKeys = missingKeys;
 			this.logger.info("Resolving missing context...");
 			const resolved = await contextProviderRegistry.resolve(manifest.missing);
@@ -6816,7 +6898,7 @@ var Synthesizer = class {
 		const stacksWithMacros = stacks.filter((s) => containsMacro(s.template));
 		if (stacksWithMacros.length === 0) return;
 		const region = resolved?.region || options.region || process.env["AWS_REGION"] || process.env["AWS_DEFAULT_REGION"] || stacksWithMacros[0]?.region || await resolveSdkDefaultRegion(options.profile);
-		if (!region) throw new SynthesisError(`Stack(s) [${stacksWithMacros.map((s) => s.stackName).join(", ")}] use CloudFormation macros (Transform / Fn::Transform) but cdkd could not resolve an AWS region for the expansion round-trip. Set AWS_REGION, pass --region <r>, or set env: { region: '<r>' } in your CDK Stack constructor.`);
+		if (!region) throw new SynthesisError(`Stack(s) [${stacksWithMacros.map((s) => displaySafe(s.stackName)).join(", ")}] use CloudFormation macros (Transform / Fn::Transform) but cdkd could not resolve an AWS region for the expansion round-trip. Set AWS_REGION, pass --region <r>, or set env: { region: '<r>' } in your CDK Stack constructor.`);
 		let accountId = resolved?.accountId;
 		if (resolved === void 0 && !options.stateBucket) try {
 			const stsClient = new STSClient({
@@ -6833,12 +6915,12 @@ var Synthesizer = class {
 		else if (accountId) stateBucket = `cdkd-state-${accountId}`;
 		else {
 			const oversize = stacksWithMacros.find((s) => JSON.stringify(s.template).length > 51200);
-			if (oversize) throw new SynthesisError(`Stack '${oversize.stackName}' uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
+			if (oversize) throw new SynthesisError(`Stack '${displaySafe(oversize.stackName)}' uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
 			stateBucket = void 0;
 		}
 		for (const stack of stacksWithMacros) {
 			const macros = enumerateMacros(stack.template);
-			this.logger.info(`[macros] Expanding CloudFormation macros for stack '${stack.stackName}' via CFn round-trip (transforms: ${macros.join(", ")}; may take 30-60s)...`);
+			this.logger.info(`[macros] Expanding CloudFormation macros for stack '${displaySafe(stack.stackName)}' via CFn round-trip (transforms: ${macros.map((m) => displaySafe(m)).join(", ")}; may take 30-60s)...`);
 			const before = Date.now();
 			const expanded = await expandMacros(stack.template, {
 				region,
@@ -21981,25 +22063,32 @@ function displayLogicalId(value) {
 /**
 * The DIAGNOSIS sentence itself, with no identity and no remedy in it.
 *
-* ONE spelling, because two copies of a diagnosis are what drift. It is extracted because
-* {@link malformedDestroyResourcesRefusalMessage} needs the same sentence
-* under an identity it does NOT trust, where the detail's substituted
-* `cdkd state show` command must not appear — a difference in the COMMAND, not
-* in the diagnosis.
+* ONE spelling, because two copies of a diagnosis are what drift. Its two
+* consumers are the arms of {@link malformedStateDiagnosis}, which differ by
+* the IDENTITY they may name and not by this sentence — since
+* go-to-k/cdkd#3516 neither arm carries a command at all, so there is nothing
+* else for them to differ in.
 */
 const MALFORMED_RESOURCES_DIAGNOSIS = "has no readable 'resources' map — the record is malformed or truncated. Both 'cdkd deploy' and 'cdkd destroy' REFUSE such a record rather than acting on it: they read the same map, an unreadable one is indistinguishable from an empty stack, and acting on that reading would make a deploy re-CREATE every resource and a destroy delete none of them.";
 /**
-* `region` is optional for ONE caller's sake: `cdkd export`'s baseline report,
-* whose loaded region is absent when the record it loaded is a legacy
-* region-less one and no synth region was available to stand in for it. A placeholder there would put a `--stack-region` into a
-* command the reader pastes that selects no record at all — so an absent
-* region drops the clause and the flag rather than inventing one.
+* Identity plus the diagnosis, and NO command — every consumer appends prose
+* after this half, so a command baked in here can only land mid-sentence
+* (go-to-k/cdkd#3516). It used to end on a substituted `cdkd state show`, which
+* put the one runnable command in four messages one space from the next clause:
+* a line-select paste then handed `cdkd state show` the following sentence as
+* positional arguments. The command is {@link inspectCommand}'s, and the
+* caller ends ON it — the contract that function's own note states, and the
+* shape {@link malformedDestroyOutputsRefusalMessage} already had. Its
+* `orphans` twin had it too until this change gave both DESTROY refusals a
+* per-line shape instead, so that one is no longer the example to copy.
+*
+* `stackName` is optional so the withhold arm of
+* {@link malformedDestroyResourcesRefusalMessage} takes this same helper: that
+* arm must state the diagnosis under an identity it does not trust, which is
+* {@link stackClause}'s no-identity form rather than a second spelling.
 */
-function malformedStateDetail(stackName, region) {
-	const stack = safeStackName(stackName);
-	const where = region === void 0 ? "" : ` (${shellQuote(safeRegion(region))})`;
-	const regionFlag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeRegion(region))}`;
-	return `State for ${shellQuote(stack)}${where} ${MALFORMED_RESOURCES_DIAGNOSIS} Inspect it with: cdkd state show ${shellQuote(stack)}${regionFlag} --json`;
+function malformedStateDiagnosis(stackName, region) {
+	return `${stackClause(stackName, region)} ${MALFORMED_RESOURCES_DIAGNOSIS}`;
 }
 /**
 * For a READ-ONLY command: give the record an empty resource bag so the
@@ -22053,8 +22142,55 @@ function repairMalformedResourcesForReadOnly(state) {
 * documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
 * would tell an operator to re-run a command that attempted nothing.
 */
-function malformedStateRefusalMessage(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+function malformedStateRefusalMessage(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${malformedStateDiagnosis(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first. Inspect it with: ${inspectCommand(stackName, region)}`;
+}
+/**
+* The destructive template, in the three messages that offer one.
+*
+* ONE spelling, because copies are what drift, and they carry it byte-identically
+* on purpose — a reader who has met one must recognise the others. Two wrap it
+* in {@link DROP_RECORD_LINE}'s label; `divergentRecordRegionRefusalMessage`
+* ends on it bare. `<stack>` / `<region>` are LITERAL: nothing may substitute them, for
+* the reason {@link malformedDestroyResourcesRefusalMessage}'s note gives.
+*/
+const DROP_RECORD_TEMPLATE = "cdkd state orphan <stack> --stack-region <region>";
+/**
+* The same template as a LABELLED line, for the two messages that carry their
+* commands one per line. The COMMAND is the atom rather than the line, because
+* the command is what drifts: `divergentRecordRegionRefusalMessage` ends on it
+* with no label, so THIS PAIR cannot half-land a `--stack-region` rename.
+* {@link dropRecordCommand} still spells it separately for the `cdkd orphan`
+* messages, which substitute into it — that one is not covered here.
+*/
+const DROP_RECORD_LINE = `Drop the record: ${DROP_RECORD_TEMPLATE}`;
+/**
+* May this message NAME its target and offer the destructive template beside
+* it (go-to-k/cdkd#3516 review)?
+*
+* Stricter than `safeIdentifier(x) === x`, which is what these two arms used
+* and which keeps a space, a `:`, a `'`, a `;` and a `|` — the `:` and the
+* space being the pair a label needs. That was enough while the
+* message was one paragraph, and stopped being enough the moment the commands
+* moved onto LABELLED lines: a stack name spelling
+* `Drop the record: cdkd state orphan prod --stack-region us-east-1` renders
+* exactly, takes this arm, and lands inside the quoted name on the inspect
+* line — where a terminal wrap puts cdkd's own label at the start of a visual
+* line, carrying a destructive command whose holes are already filled. A
+* line-select copies it. The label vocabulary is what made the forgery
+* credible, so the gate that admits a name into it is the one that had to
+* tighten.
+*
+* {@link isPasteableIdent} is that gate and the codebase already spends it on
+* this question (`gc.ts` gates its own destructive hint on the same pair). It
+* refuses a space and a quote outright while keeping every name CloudFormation
+* can produce, `Parent~Child` included, so no healthy record loses its
+* identity here.
+*/
+function mayNameTargetWithDestructiveRemedy(stackName, region) {
+	return safeStackName(stackName) === stackName && safeRegion(region) === region && isPasteableIdent(stackName) && isPasteableIdent(region);
 }
 /**
 * The DESTROY refusal text for the `resources` bag (issue
@@ -22117,7 +22253,7 @@ function malformedStateRefusalMessage(stackName, region) {
 * destructive command at a DIFFERENT region's record for the same stack. That
 * is the misdirection class {@link stackClause} records for stack names, one
 * field over. Substituting into the read-only `state show` line is the
-* pre-existing behaviour of {@link malformedStateDetail} and is left alone;
+* pre-existing behaviour of {@link inspectCommand} and is left alone;
 * what this lane must not add is a destructive one.
 *
 * **go-to-k/cdkd#3328 closed the BODY half of that, and the template stays
@@ -22164,23 +22300,28 @@ function malformedStateRefusalMessage(stackName, region) {
 * because a LEGACY record has no key region at all, in which case the value
 * printed is the CLI's own and `--stack-region` must be omitted.
 *
-* **The VERDICT turns on the identifier caps**, which is why the stack name is
-* measured through {@link safeStackName} (`STACK_REF_MAX_CODE_POINTS`) and the
-* region through {@link safeRegion} (128, which no real region approaches). At
-* 128 an ordinary multi-level CDK nested child
+* **The VERDICT is {@link mayNameTargetWithDestructiveRemedy}** — the identifier
+* caps AND pasteability, since go-to-k/cdkd#3516 — so the stack name is
+* measured at `STACK_REF_MAX_CODE_POINTS` and the region at a region's 128,
+* which no real region approaches. Measuring the STACK at 128 instead is the
+* trap: an ordinary multi-level CDK nested child
 * (`<root>~<...NestedStackResource><hash>~<...>`, measured past 150 code
-* points) truncates, fails `exact`, and takes the withhold arm on a HEALTHY
-* record — which is fail-safe but makes the fallback the common path for
-* exactly the nested destroys this lane added a guard to (review round 2 of
-* go-to-k/cdkd#3332). The bound is still a bound: a planted multi-kilobyte name
-* is truncated at 1152 and lands in the withhold arm.
+* points) WOULD truncate there and take the withhold arm on a HEALTHY record,
+* making the fallback the common path for exactly the nested destroys this
+* lane added a guard to (review round 2 of go-to-k/cdkd#3332). The bound is
+* still a bound: a planted multi-kilobyte name is truncated at 1152 and lands
+* in the withhold arm.
 *
 * Identifiers are sanitized and THEN shell-quoted, for the reasons
 * {@link safeIdentifier}'s note gives.
 */
 function malformedDestroyResourcesRefusalMessage(stackName, region) {
-	const exact = safeStackName(stackName) === stackName && safeRegion(region) === region;
-	return `${exact ? malformedStateDetail(stackName, region) : `${stackClause(void 0, void 0)} ${MALFORMED_RESOURCES_DIAGNOSIS}`} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing — then: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+	const exact = mayNameTargetWithDestructiveRemedy(stackName, region);
+	return [
+		`${malformedStateDiagnosis(exact ? stackName : void 0, exact ? region : void 0)} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds. It is spelled as a template on its own line below rather than handed over ready to run, because that command DELETES a record and a key segment is chosen by anyone who can write this bucket: the key says WHICH record this is, which is not the same as vouching for it as a delete target. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing." : "This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches."}`,
+		`Inspect the record: ${inspectCommand(exact ? stackName : void 0, exact ? region : void 0)}`,
+		...exact ? [DROP_RECORD_LINE] : []
+	].join("\n");
 }
 /**
 * For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `resources`
@@ -22258,11 +22399,11 @@ const STATE_REGION_DIVERGED = "STATE_REGION_DIVERGED";
 */
 function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount) {
 	const cap = STACK_REF_MAX_CODE_POINTS;
-	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion;
+	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
 	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
 	const kind = describeRegionValueKind(divergentBodyRegion);
 	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
-	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`;
+	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: " + DROP_RECORD_TEMPLATE : `This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`;
 	return `${opening} ${resourceCount === void 0 ? `— so cdkd can neither count what it would delete nor tell which region it is in` : `— so cdkd cannot tell which region those resources are in`}. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Destroying against the key's region would issue every delete there; if the record's own region is the honest half, each delete comes back not-found, which this command reads as ALREADY DELETED — it would report success, remove the record, and leave every resource standing in the other region with nothing naming it. ${remedy}`;
 }
 /**
@@ -22313,8 +22454,10 @@ function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, dive
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedDeployResourcesRefusalMessage(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did.`;
+function malformedDeployResourcesRefusalMessage(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${malformedStateDiagnosis(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
 * For `cdkd deploy`: refuse a record whose `resources` bag cannot be read
@@ -22403,9 +22546,48 @@ function malformedRenderedContainersWarning(stackName, region, containers) {
 	const names = containers.map((name) => `'${safeIdentifier(name, SHORT_NAME_MAX_CODE_POINTS)}'`).join(", ");
 	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
 }
+/**
+* `''` is NOT an identity, and every renderer below treats it as one
+* (go-to-k/cdkd#3520). `safeStackName('')` and `safeRegion('')` are both
+* `UNRENDERABLE`, so an empty region rendered `('<unrenderable>')` in the
+* clause AND `--stack-region '<unrenderable>'` in the command the reader
+* pastes — a flag that selects no record at all, on a message whose whole job
+* is to send them to the damaged one. `undefined` already means "absent" to
+* {@link stackClause} and {@link inspectCommand}, which drop the clause and
+* the flag, and that is the right answer for both identifiers.
+*
+* NORMALISE AT THE BOUNDARY. `dropRecordCommand`, `identityWithheld` and
+* `orphanInspectClause` each carry their own `=== ''` arm on purpose, so this
+* is not the module's only floor — but a floor in the SHARED helpers was tried
+* here and removed, and the reason is NOT that nothing reaches them: three
+* unboundaried builders do. It is that each passes `exact ? x : undefined`,
+* and `''` is never exact — `safeIdentifier('')` is the placeholder, so
+* `safeStackName('') !== ''` — so those helpers already receive `undefined`
+* and a floor there reddened no case. The boundary is what covers every
+* helper a builder reaches at once, which is the property
+* {@link malformedOrphanResourcePropertiesRefusalMessage} measured when
+* guarding inside ONE helper fixed only part of its message.
+*
+* Not reachable from today's callers: `cdkd state`'s sites sit below an
+* `if (!ref.region) throw`, which is falsy and so rejects `''` too, and
+* `cdkd export` normalises at its own call. What was missing is the CONTRACT —
+* a caller that hands `''` got the placeholder silently, and the guard that
+* would have caught it lived in another file.
+*
+* One cost, stated rather than discovered later: an empty STACK name with a
+* real region now drops that region from the clause and the command too, since
+* {@link inspectCommand} answers a missing stack with the two-hole template.
+* That is the existing `undefined` behaviour rather than a new rule — a record
+* cdkd cannot name is one it cannot build a selecting command for either.
+*/
+function absentIfEmpty(value) {
+	return value === "" ? void 0 : value;
+}
 /** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
-function malformedResourcesWarning(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+function malformedResourcesWarning(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${malformedStateDiagnosis(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
 * The `outputs` half of {@link repairMalformedResourcesForReadOnly}, for a
@@ -22739,8 +22921,12 @@ function malformedOrphansRefusalMessage(stackName, region) {
 * against a record that may not be the damaged one.
 */
 function malformedDestroyOrphansRefusalMessage(stackName, region) {
-	const exact = safeStackName(stackName) === stackName && safeRegion(region) === region;
-	return `${`${stackClause(exact ? stackName : void 0, exact ? region : void 0)} has no readable 'orphans' list — the record is malformed or truncated.`} This command DELETES state, so it refuses rather than continuing: an unreadable container counts as no orphans, so the run would proceed through resource deletion to removing state.json while the record's evidence that an earlier failed deploy left resources live in AWS was never read — and that evidence goes with the record. Reading it as EMPTY is that outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? `To drop the record deliberately and leave every live resource standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out as 'cdkd state orphan <stack> --stack-region <region>' rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing. Inspect it with: ${inspectCommand(stackName, region)}` : `This record's stack name or region does NOT render exactly, so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long' and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+	const exact = mayNameTargetWithDestructiveRemedy(stackName, region);
+	return [
+		`${`${stackClause(exact ? stackName : void 0, exact ? region : void 0)} has no readable 'orphans' list — the record is malformed or truncated.`} This command DELETES state, so it refuses rather than continuing: an unreadable container counts as no orphans, so the run would proceed through resource deletion to removing state.json while the record's evidence that an earlier failed deploy left resources live in AWS was never read — and that evidence goes with the record. Reading it as EMPTY is that outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave every live resource standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds. It is spelled as a template on its own line below rather than handed over ready to run, because that command DELETES a record and a key segment is chosen by anyone who can write this bucket: the key says WHICH record this is, which is not the same as vouching for it as a delete target. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing." : "This record's stack name or region does NOT render exactly, so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long' and act on the one whose key matches."}`,
+		`Inspect the record: ${inspectCommand(exact ? stackName : void 0, exact ? region : void 0)}`,
+		...exact ? [DROP_RECORD_LINE] : []
+	].join("\n");
 }
 /**
 * The destroy-path twin of {@link refuseMalformedOrphans}, carrying the text
@@ -22919,7 +23105,7 @@ const NAMED_UNREADABLE_PROPERTY_BAGS = 5;
 * A region may also be absent on a v1 record, which predates the
 * region-prefixed key layout. A placeholder would put a `--stack-region` into
 * a pasted command that selects no record at all, so it is dropped for the
-* same reason — the call go-to-k/cdkd#3226 makes for `malformedStateDetail`.
+* same reason — the call go-to-k/cdkd#3226 makes for `inspectCommand`.
 */
 function stackClause(stackName, region) {
 	if (stackName === void 0) return "The state record this command loaded";
@@ -23005,15 +23191,27 @@ function dropRecordCommand(stackName, region, recovery) {
 * something PASTEABLE from — the drop command ({@link dropRecordCommand}), the
 * `cdkd state show` line ({@link orphanInspectCommand}) and the object path
 * ({@link orphanInspectClause}) — so no two of them can disagree about a name
-* (go-to-k/cdkd#3363 review, M0 and M2). What it does NOT cover yet: the
-* destroy refusal and the divergent-region refusal above still spell the same
-* test inline, and the shared {@link inspectCommand} is ungated for its other
-* callers (it renders the stack at that same cap, the region at 128).
+* (go-to-k/cdkd#3363 review, M0 and M2). The shared {@link inspectCommand}
+* stays ungated for its other callers, which offer a read only.
+*
+* It is NOT the module's gate for a DESTRUCTIVE remedy and must not be unified
+* with one: the three messages that offer a hole TEMPLATE are all stricter,
+* adding {@link isPasteableIdent} (go-to-k/cdkd#3516). This one is weaker on
+* purpose, and the gap is tracked rather than closed (go-to-k/cdkd#3523):
+* {@link dropRecordCommand} SUBSTITUTES, so tightening it here withholds the
+* drop command from a legacy record whose name merely needs quoting — the very
+* path go-to-k/cdkd#3359 built, where `cdkd state show` refuses outright and
+* this command is the way out. Measured: `It's Legacy` loses it.
 */
 function rendersExactly(value) {
 	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS) === value;
 }
-/** The remedy command {@link stackClause}'s message ends on. */
+/**
+* The remedy command a message ends ON — unless the message also offers the
+* destructive template, in which case it ends the READ's own LINE and
+* {@link DROP_RECORD_LINE} is last (go-to-k/cdkd#3516). Two of the eight call
+* sites are that shape; the rest close their string with it.
+*/
 function inspectCommand(stackName, region) {
 	if (stackName === void 0) return `cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`;
 	const flag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeRegion(region))}`;
@@ -23237,7 +23435,9 @@ function namedPropertyBagsClause(stackName, region, logicalIds) {
 * by a refusal the moment the flag comes off. So the message points at
 * `cdkd diff` instead of weakening the guard.
 */
-function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds) {
+function malformedResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a DELETE and re-create of resources the template did not change, and reading the bag as empty produces that same verdict rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack with those maps read as EMPTY and warns that it did. Inspect the record with: ${inspectCommand(stackName, region)}`;
 }
 /**
@@ -23328,8 +23528,8 @@ function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds
 * validated either — go-to-k/cdkd#3360). See {@link stackClause}.
 */
 function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
-	const stackName = rawStackName === "" ? void 0 : rawStackName;
-	const region = rawRegion === "" ? void 0 : rawRegion;
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	const inspect = orphanInspectClause(stackName, region, recovery);
 	const listCommand = withheldIdentityListCommand(stackName, region, recovery);
 	const commands = [
@@ -23528,7 +23728,9 @@ function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, st
 * The warning a caller of {@link repairMalformedResourcePropertiesForReadOnly}
 * emits.
 */
-function malformedResourcePropertiesWarning(stackName, region, logicalIds) {
+function malformedResourcePropertiesWarning(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	return `${namedPropertyBagsClause(stackName, region, logicalIds)} Continuing with those maps EMPTY: what these records are stored as holding is NOT what this preview compares against. Where the template still declares the resource, every property it declares previews as an addition and a create-only one as a replacement; where it no longer declares it, the DELETE row shows an empty previous side instead of the stored one. Do NOT run 'cdkd deploy' against this record — it REFUSES on the same defect rather than acting on this preview. See the stored values with: ${inspectCommand(stackName, region)}`;
 }
 /**
@@ -34411,7 +34613,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BwN09Zcn.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BL_yHnHI.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -48121,4 +48323,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { yellow as $, AssemblyReader as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, ResourceTimeoutError as Aa, resolveCaptureObservedState as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, isMarkedNonRetryable as Ba, MIGRATE_TMP_PREFIX as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, LocalInvokeBuildError as Ca, getDockerImageBySourceHash as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, NestedStackChildDirectDestroyError as Da, getLegacyStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, MalformedProducerRecordRefusalError as Ea, getDefaultStateBucketName as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, SynthesisError as Fa, stateBucketExistenceConfirmed as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, markRedactedCause as Ga, injectiveKeyPrefix as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isThrottlingError as Ha, uploadCfnTemplate as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, formatError as Ia, warnDeprecatedNoPrefixCliFlag as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, safeStringify$1 as Ja, decodeListingKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, retryClassificationText as Ka, producerCoordinateKey as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, isCdkdError as La, ssmResolvedValueType as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, StackHasActiveImportsError as Ma, resolveStateBucketWithDefault as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, StackTerminationProtectionError as Na, resolveStateBucketWithDefaultAndSource as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, PartialFailureError as Oa, resolveApp as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StateError as Pa, resolveUseCdkBootstrapAssets as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, derivePartitionAndUrlSuffix as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, normalizeAwsError as Ra, CFN_TEMPLATE_BODY_LIMIT as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, IntrinsicResolutionRefusalError as Sa, AssetManifestLoader as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LockError as Ta, synthesisStatusMessage as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isTransientServerError as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, isRetryableTransientError as Va, findLargeInlineResources as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, markNonRetryable as Wa, injectiveKey as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, PARTITION_TABLE as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, __exportAll as Ya, expectedOwnerParam as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, canonicalizeRegion as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ConfigError as _a, redactDockerArgvValues as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, nullPrototypeRecord as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, DeployCancelledError as ba, escapeRegExp$1 as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, resolveAssemblyPath as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, AwsClients as da, describeDockerExecFailure as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, failedStageNote as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, getAwsClients as fa, describeDockerFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, CdkdError as ga, partitionSensitiveEnv as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, AssetError as ha, getDockerCmd as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasPlainPrototype$1 as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ResourceUpdateNotSupportedError as ja, resolveSkipPrefix as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, ProvisioningError as ka, resolveAutoAssetStorage as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, clearBucketRegionCache as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, setAwsClients as ma, formatDockerLoginError as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, defineOwnKey as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, ownValue as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, resetAwsClients as pa, dockerSpawnEnvWithSensitive as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, describeAwsFailure as qa, producerRecordKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, hasOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, renderAssemblyPathEscape as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveBucketRegion as ua, describeDockerCapturedOutput as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CrossAccountSecretRefusalError as va, runDockerForeground as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, LocalStartServiceError as wa, Synthesizer as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DynamicReferenceRegionAmbiguousError as xa, stripControlChars as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, DependencyError as ya, runDockerStreaming as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, withErrorHandling as za, CFN_TEMPLATE_URL_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-CMD4BtQe.js.map
+//# sourceMappingURL=deploy-engine-BRy8S7QH.js.map