@go-to-k/cdkd 0.290.45 → 0.290.46

package/dist/{program-BDy35kIL.js → program-OigOAssB.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as AssemblyReader, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as ResourceTimeoutError, Ai as resolveCaptureObservedState, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as isMarkedNonRetryable, Bi as MIGRATE_TMP_PREFIX, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as LocalInvokeBuildError$1, Ci as getDockerImageBySourceHash, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as NestedStackChildDirectDestroyError, Di as getLegacyStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as MalformedProducerRecordRefusalError, Ei as getDefaultStateBucketName, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as SynthesisError, Fi as stateBucketExistenceConfirmed, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as markRedactedCause, Gi as injectiveKeyPrefix, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isThrottlingError, Hi as uploadCfnTemplate, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as warnDeprecatedNoPrefixCliFlag, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as safeStringify, Ji as decodeListingKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as retryClassificationText, Ki as producerCoordinateKey, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as ssmResolvedValueType, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as StackHasActiveImportsError, Mi as resolveStateBucketWithDefault, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as StackTerminationProtectionError, Ni as resolveStateBucketWithDefaultAndSource, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as PartialFailureError, Oi as resolveApp, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as resolveUseCdkBootstrapAssets, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as derivePartitionAndUrlSuffix, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as normalizeAwsError, Ri as CFN_TEMPLATE_BODY_LIMIT, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as IntrinsicResolutionRefusalError, Si as AssetManifestLoader, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as synthesisStatusMessage, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isTransientServerError, Ui as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as isRetryableTransientError, Vi as findLargeInlineResources, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as markNonRetryable, Wi as injectiveKey, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xi as PARTITION_TABLE, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Yi as expectedOwnerParam, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as canonicalizeRegion, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as redactDockerArgvValues, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as nullPrototypeRecord, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as DeployCancelledError, bi as escapeRegExp, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as resolveAssemblyPath, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, da as AwsClients, di as describeDockerExecFailure, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as failedStageNote, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as getAwsClients, fi as describeDockerFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as CdkdError, gi as partitionSensitiveEnv, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as getDockerCmd, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasPlainPrototype, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ResourceUpdateNotSupportedError, ji as resolveSkipPrefix, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as ProvisioningError, ki as resolveAutoAssetStorage, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as setAwsClients, mi as formatDockerLoginError, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as defineOwnKey, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as ownValue, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as resetAwsClients, pi as dockerSpawnEnvWithSensitive, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as describeAwsFailure, qi as producerRecordKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as hasOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as renderAssemblyPathEscape, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as processStackMessages, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveBucketRegion, ui as describeDockerCapturedOutput, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CrossAccountSecretRefusalError, vi as runDockerForeground, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as LocalStartServiceError, wi as Synthesizer, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as DynamicReferenceRegionAmbiguousError, xi as stripControlChars, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerStreaming, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as withErrorHandling, zi as CFN_TEMPLATE_URL_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-DhZW4if5.js";
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-DjBU2Ap3.js";
+import { $ as yellow, $i as AssemblyReader, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as ResourceTimeoutError, Ai as resolveCaptureObservedState, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as isMarkedNonRetryable, Bi as MIGRATE_TMP_PREFIX, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as LocalInvokeBuildError$1, Ci as getDockerImageBySourceHash, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as NestedStackChildDirectDestroyError, Di as getLegacyStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as MalformedProducerRecordRefusalError, Ei as getDefaultStateBucketName, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as SynthesisError, Fi as stateBucketExistenceConfirmed, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as markRedactedCause, Gi as injectiveKeyPrefix, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isThrottlingError, Hi as uploadCfnTemplate, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as warnDeprecatedNoPrefixCliFlag, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as safeStringify, Ji as decodeListingKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as retryClassificationText, Ki as producerCoordinateKey, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as ssmResolvedValueType, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as StackHasActiveImportsError, Mi as resolveStateBucketWithDefault, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as StackTerminationProtectionError, Ni as resolveStateBucketWithDefaultAndSource, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as PartialFailureError, Oi as resolveApp, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as resolveUseCdkBootstrapAssets, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as derivePartitionAndUrlSuffix, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as normalizeAwsError, Ri as CFN_TEMPLATE_BODY_LIMIT, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as IntrinsicResolutionRefusalError, Si as AssetManifestLoader, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as synthesisStatusMessage, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isTransientServerError, Ui as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as isRetryableTransientError, Vi as findLargeInlineResources, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as markNonRetryable, Wi as injectiveKey, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xi as PARTITION_TABLE, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Yi as expectedOwnerParam, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as canonicalizeRegion, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as redactDockerArgvValues, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as nullPrototypeRecord, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as DeployCancelledError, bi as escapeRegExp, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as resolveAssemblyPath, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, da as AwsClients, di as describeDockerExecFailure, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as failedStageNote, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as getAwsClients, fi as describeDockerFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as CdkdError, gi as partitionSensitiveEnv, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as getDockerCmd, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasPlainPrototype, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ResourceUpdateNotSupportedError, ji as resolveSkipPrefix, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as ProvisioningError, ki as resolveAutoAssetStorage, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as setAwsClients, mi as formatDockerLoginError, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as defineOwnKey, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as ownValue, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as resetAwsClients, pi as dockerSpawnEnvWithSensitive, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as describeAwsFailure, qi as producerRecordKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as hasOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as renderAssemblyPathEscape, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as processStackMessages, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveBucketRegion, ui as describeDockerCapturedOutput, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CrossAccountSecretRefusalError, vi as runDockerForeground, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as LocalStartServiceError, wi as Synthesizer, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as DynamicReferenceRegionAmbiguousError, xi as stripControlChars, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerStreaming, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as withErrorHandling, zi as CFN_TEMPLATE_URL_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-BRy8S7QH.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-DMaX1bq2.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CVB0Ky06.js";
+import { t as getCdkdVersion } from "./version-THOL_1Cg.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BL_yHnHI.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2482,17 +2482,58 @@ function sortByDependency(stacks) {
 }
 /**
 * Convert a StackInfo to its `--long` JSON representation.
+*
+* Every field is manifest-derived, so each renders through `displaySafe`
+* ([#3479](https://github.com/go-to-k/cdkd/issues/3479)). **The encoder is not
+* the boundary here** — measured per character rather than assumed: **neither
+* `JSON.stringify` nor `yaml` escapes DEL, the C1 range, `U+2028`/`U+2029` or
+* the bidi overrides.** So a `displayName` carrying `U+009B` reached the
+* terminal as a CSI byte inside what looks like a machine-readable document, on
+* stdout at default verbosity.
+*
+* Stated as the weakest claim that carries the argument, because the stronger
+* one was wrong twice: the two encoders do NOT agree on C0 (`JSON.stringify`
+* escapes all of it; `yaml` escapes NUL, CR and ESC, emits TAB raw and renders a
+* value containing LF as a literal block scalar). That half was never what this
+* rests on.
+*
+* Fidelity costs nothing: `displaySafe` neither quotes nor truncates, so every
+* legitimate name, account, region and dependency name is byte-identical, and
+* the only values it changes are ones no assembly should produce.
+*
+* One residual this does NOT close, recorded rather than implied away: a value
+* with nothing renderable left sanitizes to the EMPTY string, so a control-only
+* `displayName` emits `id: ""` here and a BLANK line in the default mode — which
+* reads as absent rather than as unrenderable. `UNRENDERABLE` is the repo's
+* answer for a field slot, and picking between them per slot is the open
+* "Helper choice, not only helper presence" row on
+* [#3479](https://github.com/go-to-k/cdkd/issues/3479), which covers the same
+* question for `assembly-reader.ts`. Deciding it here alone would leave the two
+* disagreeing.
+*
+* THE RESIDUAL THAT MATTERS HERE IS A COLLISION, not the empty string. This is
+* a MACHINE-READABLE payload, and sanitizing is many-to-one: `Prod<U+0085>Stack`
+* and a genuine `Prod Stack` both emit `name: "Prod Stack"`, and so do `Prod`
+* and `Prod ` (the trim). Pre-PR their bytes differed. So
+* `jq 'select(.name=="Prod Stack") | .environment.account'` can return TWO
+* accounts for what reads as one stack, and a script taking the first may take
+* the planted one. It fails safe for SELECTION — `matchStacks` matches the RAW
+* name, so `cdkd deploy` still resolves to the genuine stack and never the
+* planted one — which is why this is recorded rather than blocking, and why
+* `UNRENDERABLE`-vs-empty-vs-collision is one question rather than three. It is
+* folded into the open "Helper choice, not only helper presence" row on
+* [#3479](https://github.com/go-to-k/cdkd/issues/3479).
 */
 function toLongRecord(stack, includeDeps) {
 	const record = {
-		id: stack.displayName,
-		name: stack.stackName,
+		id: displaySafe(stack.displayName),
+		name: displaySafe(stack.stackName),
 		environment: {
-			account: stack.account ?? "unknown-account",
-			region: stack.region ?? "unknown-region"
+			account: displaySafe(stack.account ?? "unknown-account", { asciiOnly: true }),
+			region: displaySafe(stack.region ?? "unknown-region", { asciiOnly: true })
 		}
 	};
-	if (includeDeps) record.dependencies = [...stack.dependencyNames];
+	if (includeDeps) record.dependencies = stack.dependencyNames.map((name) => displaySafe(name));
 	return record;
 }
 /**
@@ -2535,7 +2576,7 @@ async function listCommand(patterns, options) {
 	if (options.showDependencies) {
 		emitStructured(sorted.map((s) => ({
 			id: formatDisplayId(s),
-			dependencies: [...s.dependencyNames]
+			dependencies: s.dependencyNames.map((name) => displaySafe(name))
 		})), options.json);
 		return;
 	}
@@ -2550,9 +2591,41 @@ async function listCommand(patterns, options) {
 * in parens: `MyStage/MyStack (MyStage-MyStack)`. Otherwise just the display
 * path. CDK CLI does this in `CloudFormationArtifact.displayName`; see
 * aws-cdk-cli/packages/@aws-cdk/cloud-assembly-api/lib/artifacts/cloudformation-artifact.ts.
+*
+* Both names come from the Cloud Assembly and this is the MOST reachable render
+* of either in cdkd: the default mode writes one of these per line to stdout at
+* default verbosity, no error path involved, so `cdkd list -a ./cdk.out` over
+* someone else's assembly prints it. Hence `displaySafe`
+* ([#3479](https://github.com/go-to-k/cdkd/issues/3479)).
+*
+* `displaySafe`, and deliberately NOT `describeStack` from
+* `src/cli/stack-matcher.ts`, which sanitizes the same two fields for every
+* other command. Two reasons, either of which alone decides it:
+*
+* - `describeStack` renders `<stackName> (<displayName>)`; this format is the
+*   other way round, because it is CDK CLI's "display id" and a `cdkd list`
+*   line is fed back to `cdkd deploy`. Routing through the shared helper would
+*   silently swap the two fields in a payload.
+* - `describeStack` uses `displayIdent`, which QUOTES a value that is not a
+*   plain identifier — correct in the prose it serves ("which stack did you
+*   mean"), wrong here: `new Stack(app, 'My Stack')` is legal and would start
+*   printing `"My Stack"` into a stream a shell loop reads.
+*
+* Two residuals, shared with `describeStack` and recorded there too.
+* `displaySafe` TRIMS, so a construct id with a leading or trailing space
+* prints without it and the printed line is then not re-usable verbatim as a
+* pattern. And because sanitizing is MANY-TO-ONE, two distinct manifest entries
+* can print one identical line here — `MyStage/<U+0085>Api` and a genuine
+* `MyStage/ Api` both emit `MyStage/ Api`, so a `sort -u` over this stream
+* collapses them and a per-line consumer sees one stack where the assembly
+* declared two. `matchStacks` matches the RAW name, so SELECTION is unaffected
+* and a pasted line still resolves to the genuine stack; the collision is
+* recorded at `toLongRecord` and folded into the open helper-choice row on
+* [#3479](https://github.com/go-to-k/cdkd/issues/3479).
 */
 function formatDisplayId(stack) {
-	return stack.displayName === stack.stackName ? stack.displayName : `${stack.displayName} (${stack.stackName})`;
+	const displayName = displaySafe(stack.displayName);
+	return stack.displayName === stack.stackName ? displayName : `${displayName} (${displaySafe(stack.stackName)})`;
 }
 /**
 * Emit a structured payload as either YAML (default, CDK CLI parity) or
@@ -85420,6 +85493,108 @@ async function rewriteSubTemplate(template, ownerLogicalId, pathPrefix, orphanSe
 //#endregion
 //#region src/cli/commands/orphan.ts
 /**
+* `cdkd orphan` renders assembly-derived values — a stack's `stackName` /
+* `displayName`, a template logical id, an `aws:cdk:path` from the template's
+* own `Metadata`, a rewritten template VALUE — plus their state-derived
+* neighbours, in thrown messages AND in default-verbosity `logger.info` lines.
+* All of them go through a display helper
+* ([#3479](https://github.com/go-to-k/cdkd/issues/3479)), and which helper is
+* chosen per SENTENCE rather than per value:
+*
+* - `displaySafe` is the default. It neither quotes nor truncates, so every
+*   legitimate value is byte-identical — including in a message whose own prose
+*   already supplies the quotes (`stack '<name>'`), where `displayIdent` would
+*   double-quote.
+* - `displayIdent` (capped at `STACK_REF_MAX_CODE_POINTS`, so a deep nested path
+*   is not cut) serves every UNQUOTED LIST whose job is the value's IDENTITY —
+*   which names the user could have meant. That is each `Available: ...` list
+*   and, since they share one sentence with one, the `missing` half of
+*   `Resource(s) not in state`. There `displaySafe`
+*   is not enough: it maps the stripped character to a space and then TRIMS, so a
+*   planted `us-east-1` plus a line terminator renders byte-identical to the
+*   genuine `us-east-1` and the message lists the very value it says is missing
+*   (measured). This is the same choice `describeStack` makes for the same class
+*   of sentence. The population is `grep displayIdent` — which catches
+*   `displayIdentList` and `displayRegionList` alike — rather than a count here,
+*   which is what goes stale.
+*
+* A JOINED list sanitizes per ELEMENT — load-bearing for `displayIdent`, whose
+* boundary is per value, and a formatting rule for `displaySafe`; its own doc
+* carries the difference.
+*
+* Deliberately NOT sanitized: `pathArgs` and the `<head>` segment parsed out of
+* one. Those are the operator's own argv echoed back, a different trust bucket
+* from the assembly, and `renderNoStackMatch` renders a user-supplied pattern
+* the same way. The one place argv goes into a PASTEABLE command
+* (`cdkd state orphan <p>`) is `isPasteableIdent`'s class rather than this
+* one — [.claude/rules/pasteable-ident.md](../../../.claude/rules/pasteable-ident.md),
+* tracked on go-to-k/cdkd#3436.
+*/
+/** Every element sanitized, then joined with the list separator. */
+function displaySafeList(values) {
+	return values.map((value) => displaySafe(value)).join(", ");
+}
+/**
+* One `Available:` entry per element, each with a visible boundary.
+*
+* **This helper is NOT the identity on every legitimate value**, and the
+* difference is the point: `displayIdent` JSON-quotes anything outside
+* `PLAIN_IDENT`, and a construct id may legitimately carry a space
+* (`new Table(this, 'My Table')` is legal — `constructs` rewrites only `/`), so
+* `MyStack/My Table/Resource` renders quoted in `Available paths:`. Accepted
+* here for the reason `describeStack` accepts it: these sentences exist to say
+* which values are valid, and the alternative passes the spaces and quotes a
+* crafted value needs. It is why `cdkd list`'s PAYLOAD does not use it.
+*/
+function displayIdentList(values, separator) {
+	return values.map((value) => displayIdent(value, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })).join(separator);
+}
+/**
+* The `Available regions: ...` lists, which are identity sentences over a
+* STATE-derived region.
+*
+* A REGION has a known ASCII charset, so every OTHER render of one in this file
+* passes `asciiOnly` — the positive allowlist `display-safe.ts`'s own header
+* asks such a caller for, and the only mode with no invisible-formatter
+* residual. Measured: plain `displaySafe` keeps a zero-width space planted
+* inside a region name; `{ asciiOnly: true }` does not. `displayIdent` already
+* applies that allowlist, so these two lists need no second spelling of it.
+*
+* `displayIdent` for a real region and the bare literal for a legacy ref with
+* none. Measured: `displaySafe('us-east-1' + U+0085)` is `'us-east-1'`, so
+* under `displaySafe` a planted state key makes `pickStackRegion` print
+* `Available regions: us-east-1.` in the sentence that just said that region
+* holds no state, and `multiple regions: us-east-1, us-east-1` in the other.
+* THE CAP IS THE 255 DEFAULT, deliberately, and NOT the
+* `STACK_REF_MAX_CODE_POINTS` its sibling `displayIdentList` passes. A region's
+* grammar is ~25 characters, so the default is already generous, and
+* `display-safe.ts` asks each caller to keep the TIGHTEST cap its grammar
+* allows — a region read out of a planted S3 key segment is unbounded, and the
+* tighter cap is what bounds that payload. The wider one was passed here first
+* for symmetry with the path list, which is the wrong reason: a construct path
+* genuinely exceeds 255 and a region never does.
+*
+* `(legacy)` is cdkd's OWN placeholder, not a value read from anywhere, and it
+* is outside `PLAIN_IDENT`, so routing it through the helper would quote a
+* string no attacker controls. **The carve-out is SAFE because of that same
+* fact**: `PLAIN_IDENT` excludes `(` and `)`, so a state key segment literally
+* named `(legacy)` renders QUOTED through `displayIdent` and cannot be mistaken
+* for this bare placeholder. A future widening of `PLAIN_IDENT` to admit
+* parentheses would silently break that, which is why the dependency is written
+* down rather than left to be re-derived.
+*
+* ONE RENDERING CHANGES, recorded rather than implied away: a ref whose `region`
+* is the EMPTY string used to print an empty slot (`us-east-1, , eu-west-1`) and
+* now prints `<unrenderable>`. `s3-state-backend.ts` only sets `region` when the
+* key segment is non-empty, so it is reachable at most from a hand-written
+* record; and an invisible entry in a comma list is the failure `UNRENDERABLE`
+* exists to prevent, so this is the direction to fail in. `undefined` — the
+* shape a legacy ref actually has — is unaffected.
+*/
+function displayRegionList(refs) {
+	return refs.map((ref) => ref.region === void 0 ? "(legacy)" : displayIdent(ref.region)).join(", ");
+}
+/**
 * `cdkd orphan <constructPath>...` — per-resource orphan, mirrors upstream
 * `cdk orphan --unstable=orphan`.
 *
@@ -85505,7 +85680,7 @@ async function orphanCommand(pathArgs, options) {
 		const stackInfo = resolved.stack;
 		const orphanLogicalIds = resolved.logicalIds;
 		const { region: targetRegion, recordRegion } = await pickStackRegion(stateBackend, stackInfo.stackName, stackInfo.region, options.stackRegion);
-		logger.info(`Target: ${stackInfo.stackName} (${targetRegion}); orphaning ${orphanLogicalIds.length} resource(s): ${orphanLogicalIds.join(", ")}`);
+		logger.info(`Target: ${displaySafe(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })}); orphaning ${orphanLogicalIds.length} resource(s): ${displaySafeList(orphanLogicalIds)}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		const recovery = {
 			profile: options.profile,
@@ -85522,15 +85697,15 @@ async function orphanCommand(pathArgs, options) {
 		}
 		try {
 			const stateData = await stateBackend.getState(stackInfo.stackName, targetRegion);
-			if (!stateData) throw new Error(`No state found for stack '${stackInfo.stackName}' (${targetRegion}). Nothing to orphan. (Did the stack get deployed?)`);
+			if (!stateData) throw new Error(`No state found for stack '${displaySafe(stackInfo.stackName)}' (${displaySafe(targetRegion, { asciiOnly: true })}). Nothing to orphan. (Did the stack get deployed?)`);
 			const { state, etag, migrationPending } = stateData;
 			refuseMalformedState(state, stackInfo.stackName, targetRegion);
 			refuseMalformedOutputs(state, stackInfo.stackName, targetRegion);
 			refuseMalformedResourcePropertiesForOrphan(state, orphanLogicalIds, stackInfo.stackName, recordRegion, recovery);
 			const missing = orphanLogicalIds.filter((id) => !(id in state.resources));
 			if (missing.length > 0) {
-				const have = Object.keys(state.resources ?? {}).join(", ");
-				throw new Error(`Resource(s) not in state for stack '${stackInfo.stackName}' (${targetRegion}): ${missing.join(", ")}.\nAvailable logical IDs: ${have}`);
+				const have = displayIdentList(Object.keys(state.resources), ", ");
+				throw new Error(`Resource(s) not in state for stack '${displaySafe(stackInfo.stackName)}' (${displaySafe(targetRegion, { asciiOnly: true })}): ${displayIdentList(missing, ", ")}.\nAvailable logical IDs: ${have}`);
 			}
 			const providerRegistry = new ProviderRegistry();
 			registerAllProviders(providerRegistry);
@@ -85549,7 +85724,7 @@ async function orphanCommand(pathArgs, options) {
 				return;
 			}
 			if (!options.yes && !options.force) {
-				if (!await confirmPrompt$1(`Orphan ${orphanLogicalIds.length} resource(s) from cdkd state for ${stackInfo.stackName} (${targetRegion})? AWS resources will NOT be deleted.`)) {
+				if (!await confirmPrompt$1(`Orphan ${orphanLogicalIds.length} resource(s) from cdkd state for ${displaySafe(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })})? AWS resources will NOT be deleted.`)) {
 					logger.info("Orphan cancelled.");
 					return;
 				}
@@ -85558,10 +85733,10 @@ async function orphanCommand(pathArgs, options) {
 				expectedEtag: etag,
 				...migrationPending && { migrateLegacy: true }
 			});
-			logger.info(`Orphaned ${orphanLogicalIds.length} resource(s) from state: ${stackInfo.stackName} (${targetRegion}). AWS resources are still in AWS; cdkd will no longer manage them.`);
+			logger.info(`Orphaned ${orphanLogicalIds.length} resource(s) from state: ${displaySafe(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })}). AWS resources are still in AWS; cdkd will no longer manage them.`);
 		} finally {
 			if (!options.dryRun) await lockManager.releaseLock(stackInfo.stackName, targetRegion).catch((err) => {
-				logger.warn(`Failed to release lock: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`Failed to release lock: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`);
 			});
 		}
 	} finally {
@@ -85593,16 +85768,16 @@ function resolveConstructPaths(paths, stacks) {
 		const head = p.slice(0, slash);
 		const candidate = byDisplayName.get(head) ?? byStackName.get(head);
 		if (!candidate) {
-			const available = stacks.map((s) => s.displayName ?? s.stackName).join(", ");
+			const available = displayIdentList(stacks.map((s) => s.displayName ?? s.stackName), ", ");
 			throw new Error(`Construct path '${p}': stack '${head}' not found in synthesized app. Available: ${available}`);
 		}
 		if (stack === void 0) stack = candidate;
-		else if (stack.stackName !== candidate.stackName) throw new Error(`All construct paths must reference the same stack. Got '${stack.stackName}' and '${candidate.stackName}'. Run 'cdkd orphan' once per stack.`);
+		else if (stack.stackName !== candidate.stackName) throw new Error(`All construct paths must reference the same stack. Got '${displaySafe(stack.stackName)}' and '${displaySafe(candidate.stackName)}'. Run 'cdkd orphan' once per stack.`);
 		const index = buildCdkPathIndex(candidate.template);
 		const matches = resolveCdkPathToLogicalIds(p, index);
 		if (matches.length === 0) {
-			const available = [...index.keys()].sort().join("\n  ");
-			throw new Error(`Construct path '${p}' not found in template for stack '${candidate.stackName}'.\nAvailable paths:\n  ${available}`);
+			const available = displayIdentList([...index.keys()].sort(), "\n  ");
+			throw new Error(`Construct path '${p}' not found in template for stack '${displaySafe(candidate.stackName)}'.\nAvailable paths:\n  ${available}`);
 		}
 		for (const { logicalId } of matches) if (!logicalIds.includes(logicalId)) logicalIds.push(logicalId);
 	}
@@ -85629,12 +85804,12 @@ async function pickStackRegion(stateBackend, stackName, synthRegion, flag) {
 			region: synthRegion,
 			recordRegion: synthRegion
 		};
-		throw new Error(`No state found for stack '${stackName}'. Run 'cdkd state list' to see available stacks.`);
+		throw new Error(`No state found for stack '${displaySafe(stackName)}'. Run 'cdkd state list' to see available stacks.`);
 	}
 	if (flag) {
 		if (!refs.find((r) => r.region === flag)) {
-			const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
-			throw new Error(`No state found for stack '${stackName}' in region '${flag}'. Available regions: ${seen}.`);
+			const seen = displayRegionList(refs);
+			throw new Error(`No state found for stack '${displaySafe(stackName)}' in region '${flag}'. Available regions: ${seen}.`);
 		}
 		return {
 			region: flag,
@@ -85654,13 +85829,13 @@ async function pickStackRegion(stateBackend, stackName, synthRegion, flag) {
 			recordRegion
 		};
 	}
-	const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
-	throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
+	const regions = displayRegionList(refs);
+	throw new Error(`Stack '${displaySafe(stackName)}' has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
 }
 function printRewriteSummary(rewrites, orphanLogicalIds) {
 	const logger = getLogger();
 	logger.info("");
-	logger.info(`Orphaning ${orphanLogicalIds.length} resource(s): ${orphanLogicalIds.join(", ")}`);
+	logger.info(`Orphaning ${orphanLogicalIds.length} resource(s): ${displaySafeList(orphanLogicalIds)}`);
 	if (rewrites.length === 0) {
 		logger.info("  No sibling references — every reference was already to a non-orphan resource.");
 		return;
@@ -85669,17 +85844,23 @@ function printRewriteSummary(rewrites, orphanLogicalIds) {
 	for (const r of rewrites) {
 		const before = stringifyForAudit(r.before);
 		const after = r.kind === "dependency" ? "(dropped)" : stringifyForAudit(r.after);
-		logger.info(`  [${r.kind}] ${r.logicalId}.${r.path}: ${before} → ${after}`);
+		logger.info(`  [${r.kind}] ${displaySafe(r.logicalId)}.${displaySafe(r.path)}: ${before} → ${after}`);
 	}
 }
 function printUnresolvable(unresolvable) {
 	const logger = getLogger();
 	logger.error(`${unresolvable.length} reference(s) could not be resolved:`);
-	for (const u of unresolvable) logger.error(`  ${u.logicalId}.${u.path}: ${u.orphanLogicalId}.${u.attribute} — ${u.reason}`);
+	for (const u of unresolvable) logger.error(`  ${displaySafe(u.logicalId)}.${displaySafe(u.path)}: ${displaySafe(u.orphanLogicalId)}.${displaySafe(u.attribute)} — ${displaySafe(u.reason)}`);
 }
+/**
+* A rewrite's before / after is a TEMPLATE value, so it is sanitized after
+* serialization ([#3479](https://github.com/go-to-k/cdkd/issues/3479)).
+* `JSON.stringify` is not the boundary on its own — measured: it escapes C0 but
+* nothing above, so DEL, the C1 range, `U+2028`/`U+2029` and the bidi overrides
+* pass straight through, and `U+009B` is read as CSI by a UTF-8 xterm.
+*/
 function stringifyForAudit(value) {
-	if (typeof value === "string") return JSON.stringify(value);
-	return JSON.stringify(value);
+	return displaySafe(JSON.stringify(value) ?? String(value));
 }
 /**
 * `cdkd orphan`'s confirmation prompt. Its only call site is inside the
@@ -97361,4 +97542,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BDy35kIL.js.map
+//# sourceMappingURL=program-OigOAssB.js.map