@go-to-k/cdkd 0.290.45 → 0.290.47

package/dist/{deploy-engine-DhZW4if5.js → deploy-engine-DzSrzD0b.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-DjBU2Ap3.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-DMaX1bq2.js";
+import { t as getCdkdVersion } from "./version-DpaXQZoG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1887,7 +1887,7 @@ function formatError(error) {
 	if (isCdkdError(error)) {
 		let message = `${error.name}: ${error.message}`;
 		if (error.cause) {
-			const cause = displaySafe(error.cause.message);
+			const cause = displayAwsMessage(error.cause.message);
 			if (cause) message += `\nCaused by: ${cause}`;
 		}
 		return message;
@@ -4331,22 +4331,24 @@ var ContextProviderRegistry = class {
 		const results = {};
 		for (const entry of missing) {
 			const provider = this.providers.get(entry.provider);
+			const shownProvider = displaySafe(entry.provider);
 			if (!provider) {
-				this.logger.warn(`No context provider registered for: ${entry.provider}`);
+				this.logger.warn(`No context provider registered for: ${shownProvider}`);
 				results[entry.key] = {
-					[PROVIDER_ERROR_KEY]: `Unknown context provider: ${entry.provider}`,
+					[PROVIDER_ERROR_KEY]: `Unknown context provider: ${shownProvider}`,
 					[TRANSIENT_CONTEXT_KEY]: true
 				};
 				continue;
 			}
+			const shownKey = displaySafe(entry.key);
 			try {
-				this.logger.debug(`Resolving context: ${entry.provider} (key: ${entry.key})`);
+				this.logger.debug(`Resolving context: ${shownProvider} (key: ${shownKey})`);
 				const value = await provider.resolve(entry.props);
 				results[entry.key] = value;
-				this.logger.debug(`Resolved context: ${entry.key}`);
+				this.logger.debug(`Resolved context: ${shownKey}`);
 			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
-				this.logger.error(`Context provider '${entry.provider}' failed: ${message}`);
+				const message = displayAwsMessage(error instanceof Error ? error.message : String(error));
+				this.logger.error(`Context provider '${shownProvider}' failed: ${message}`);
 				results[entry.key] = {
 					[PROVIDER_ERROR_KEY]: message,
 					[TRANSIENT_CONTEXT_KEY]: true
@@ -5961,6 +5963,21 @@ function ssmResolvedValueType(type) {
 
 //#endregion
 //#region src/synthesis/macro-expander.ts
+/**
+* A transform name comes from the TEMPLATE's own `Transform` / `Fn::Transform`
+* node, so every render of one goes through `displaySafe`, in thrown messages
+* and in the `debug` line alike
+* ([#3479](https://github.com/go-to-k/cdkd/issues/3479)). `displaySafe` neither
+* quotes nor truncates, so a legitimate `AWS::Serverless-2016-10-31` renders
+* byte-identically.
+*
+* A JOINED list sanitizes per ELEMENT so the separator stays
+* byte-exact; `displaySafe`'s own doc carries why that is a formatting rule
+* rather than a safety one.
+*/
+function displaySafeTransforms(names) {
+	return names.map((name) => displaySafe(name)).join(", ");
+}
 /** 600 seconds = 10 minutes. SDK waiter's `maxWaitTime` is in seconds. */
 const WAITER_MAX_WAIT_SECONDS = 600;
 const PARAMETER_PLACEHOLDER = "cdkd-macro-expand-placeholder";
@@ -5978,8 +5995,51 @@ const PARAMETER_PLACEHOLDER = "cdkd-macro-expand-placeholder";
 const EARLY_VALIDATION_MAX_ATTEMPTS = 3;
 const EARLY_VALIDATION_RETRY_BASE_DELAY_MS = 2e3;
 /** Matches the changeset FAILED StatusReason emitted by the hook family. */
+const EARLY_VALIDATION_MARKER = /AWS::EarlyValidation::/;
+/**
+* Where the retry verdict is CARRIED, rather than re-derived from the rendered
+* message.
+*
+* The verdict used to be `EARLY_VALIDATION_MARKER.test(err.message)`, and that
+* became wrong the moment AWS's reply started rendering through
+* `displayAwsMessage` ([#3479](https://github.com/go-to-k/cdkd/issues/3479)):
+* the cap CUTS at `AWS_MESSAGE_MAX_CODE_POINTS`, so a `StatusReason` carrying
+* the hook marker past that point would no longer match, and `cdkd deploy` of a
+* macro stack would hard-fail on attempt 1 where issue
+* [#1151](https://github.com/go-to-k/cdkd/issues/1151) says it must retry. The
+* sanitizer's CHARSET half was never the risk — the marker is plain ASCII —
+* but a decision re-derived from display text inherits every display rule,
+* including ones added later for unrelated reasons.
+*
+* So each throw site tests the RAW text once and records the answer here. A
+* symbol rather than a field on `MacroExpansionError`: the verdict is this
+* module's business, not the shared error class's.
+*
+* IT ALSO CLOSES A PATH THAT PRE-DATES THE CAP, which is the stronger argument
+* for the shape. The old predicate matched the WHOLE message, and two of cdkd's
+* OWN refusals below interpolate template-supplied transform names — so an
+* assembly declaring `Transform: AWS::EarlyValidation::x` made the multi-stage
+* and no-TemplateBody refusals test positive, and a template value steered the
+* retry loop into three CFn changeset round-trips plus the backoff between
+* them. A verdict read from a symbol set out of AWS's own text cannot be
+* steered that way at all.
+*
+* IT RIDES THE INSTANCE, which is the one way a future edit can lose it: a site
+* that catches one of these and wraps it in a NEW `MacroExpansionError` drops
+* the verdict silently — the same shape as the bug above, one indirection over.
+* Re-tag at any such wrap.
+*/
+const EARLY_VALIDATION = Symbol("cdkd.macroExpansion.earlyValidationRejection");
+/**
+* Tag `error` when `rawReason` — AWS's text BEFORE any display helper touches
+* it — names a validation hook.
+*/
+function withEarlyValidationVerdict(error, rawReason) {
+	if (EARLY_VALIDATION_MARKER.test(rawReason)) error[EARLY_VALIDATION] = true;
+	return error;
+}
 function isEarlyValidationRejection(err) {
-	return err instanceof MacroExpansionError && /AWS::EarlyValidation::/.test(err.message);
+	return err instanceof MacroExpansionError && err[EARLY_VALIDATION] === true;
 }
 /** Test seam: overridable sleep so retry tests don't wait wall-clock. */
 const retryDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
@@ -6093,7 +6153,7 @@ async function expandMacros(template, opts) {
 }
 async function expandMacrosAttempt(template, opts, logger) {
 	const macros = enumerateMacros(template);
-	logger.debug(`Macro expansion: detected transforms [${macros.join(", ")}], starting CFn round-trip...`);
+	logger.debug(`Macro expansion: detected transforms [${displaySafeTransforms(macros)}], starting CFn round-trip...`);
 	const transientStackName = `cdkd-macro-expand-${randomUUID().slice(0, 16)}`;
 	const changeSetName = `${transientStackName}-changeset`;
 	const region = opts.region;
@@ -6136,7 +6196,8 @@ async function expandMacrosAttempt(template, opts, logger) {
 				...parameters.length > 0 && { Parameters: parameters }
 			}));
 		} catch (err) {
-			throw new MacroExpansionError(`CloudFormation rejected the macro-expansion changeset: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+			const rawMessage = err instanceof Error ? err.message : String(err);
+			throw withEarlyValidationVerdict(new MacroExpansionError(`CloudFormation rejected the macro-expansion changeset: ${displayAwsMessage(rawMessage)}`, err instanceof Error ? err : void 0), rawMessage);
 		}
 		let waiterFailed = false;
 		let waiterError;
@@ -6159,20 +6220,21 @@ async function expandMacrosAttempt(template, opts, logger) {
 				StackName: transientStackName,
 				ChangeSetName: changeSetName
 			})).catch(() => void 0);
-			const reason = desc?.StatusReason ?? "unknown (DescribeChangeSet failed)";
-			const status = desc?.Status ?? "UNKNOWN";
-			throw new MacroExpansionError(`CloudFormation macro expansion failed (status=${status}): ${reason}`, waiterError instanceof Error ? waiterError : void 0);
+			const rawReason = desc?.StatusReason ?? "unknown (DescribeChangeSet failed)";
+			const reason = displayAwsMessage(rawReason);
+			const status = displaySafe(desc?.Status ?? "UNKNOWN");
+			throw withEarlyValidationVerdict(new MacroExpansionError(`CloudFormation macro expansion failed (status=${status}): ${reason}`, waiterError instanceof Error ? waiterError : void 0), rawReason);
 		}
 		const tpl = await cfn.send(new GetTemplateCommand({
 			StackName: transientStackName,
 			ChangeSetName: changeSetName,
 			TemplateStage: "Processed"
 		}));
-		if (tpl.TemplateBody === void 0 || tpl.TemplateBody === null) throw new MacroExpansionError(`CloudFormation returned no Processed-stage template body for the macro-expansion changeset. This typically indicates a CFn-side regression — re-run, and if the failure persists open an issue with the transforms involved: [${macros.join(", ")}].`);
+		if (tpl.TemplateBody === void 0 || tpl.TemplateBody === null) throw new MacroExpansionError(`CloudFormation returned no Processed-stage template body for the macro-expansion changeset. This typically indicates a CFn-side regression — re-run, and if the failure persists open an issue with the transforms involved: [${displaySafeTransforms(macros)}].`);
 		const expanded = parseTemplateBody(tpl.TemplateBody);
 		if (containsMacro(expanded)) {
 			const inner = enumerateMacros(expanded);
-			throw new MacroExpansionError(`Macro expansion produced a template that still contains macros [${inner.join(", ")}]. Multi-stage macros (a macro whose expansion emits another macro reference) are intentionally out of scope in cdkd v1 — see https://github.com/go-to-k/cdkd/issues/463. If you need this pattern, manually pre-expand the template and deploy the result.`);
+			throw new MacroExpansionError(`Macro expansion produced a template that still contains macros [${displaySafeTransforms(inner)}]. Multi-stage macros (a macro whose expansion emits another macro reference) are intentionally out of scope in cdkd v1 — see https://github.com/go-to-k/cdkd/issues/463. If you need this pattern, manually pre-expand the template and deploy the result.`);
 		}
 		logger.debug(`Macro expansion: success — ${Object.keys(expanded.Resources ?? {}).length} resources after expansion.`);
 		return expanded;
@@ -6243,7 +6305,7 @@ function stringifyParamDefault(value, type, paramKey, logger) {
 			if (inner !== void 0 && isListParameterType(inner)) return "placeholder,placeholder";
 			return "placeholder";
 		}
-		logger.warn(`Parameter '${paramKey}' has unrecognized CFn Type '${type}'; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
+		logger.warn(`Parameter '${displaySafe(paramKey)}' has unrecognized CFn Type '${displaySafe(type)}'; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
 		return PARAMETER_PLACEHOLDER;
 	}
 	return PARAMETER_PLACEHOLDER;
@@ -6260,7 +6322,7 @@ function parseTemplateBody(body) {
 	if (typeof body === "string") try {
 		parsed = JSON.parse(body);
 	} catch (err) {
-		throw new MacroExpansionError(`CloudFormation returned a non-JSON Processed-stage template body. cdkd's macro-expansion path only supports JSON-shaped synth templates (CDK apps emit JSON by default). Cause: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+		throw new MacroExpansionError(`CloudFormation returned a non-JSON Processed-stage template body. cdkd's macro-expansion path only supports JSON-shaped synth templates (CDK apps emit JSON by default). Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`, err instanceof Error ? err : void 0);
 	}
 	else if (body && typeof body === "object" && !Array.isArray(body)) parsed = body;
 	else throw new MacroExpansionError(`CloudFormation returned an unexpected TemplateBody shape (${typeof body}). Expected a JSON string or parsed object.`);
@@ -6270,7 +6332,7 @@ function parseTemplateBody(body) {
 	return parsed;
 }
 function formatErr(err) {
-	return err instanceof Error ? err.message : String(err);
+	return displayAwsMessage(err instanceof Error ? err.message : String(err));
 }
 
 //#endregion
@@ -6644,6 +6706,26 @@ async function probeBucket(client, bucketName, deps) {
 //#endregion
 //#region src/synthesis/synthesizer.ts
 /**
+* Every manifest- or template-derived value this module RENDERS goes through
+* `displaySafe` — thrown messages and ordinary `logger.info` lines alike
+* ([#3479](https://github.com/go-to-k/cdkd/issues/3479)). Two reasons it is the
+* DEFAULT here rather than a judgement per message:
+*
+* - The "only where the input is untrusted" boundary keeps being drawn wrong. The
+*   macro-expansion line below is a DEFAULT-verbosity `logger.info` on a normal
+*   run, and a `stackName` carrying `ESC [ 2 K` plus a carriage return erases
+*   cdkd's own line while a trailing line terminator forges another. Nothing
+*   about the message being "operational" protects it, and `formatError`
+*   sanitizes only an error's `cause`, never its own `message`.
+* - The cost is in the helper, not the scope: `displaySafe` neither quotes nor
+*   truncates, so it is the identity on every legitimate stack name, context key
+*   and transform name.
+*
+* A JOINED list sanitizes per ELEMENT so the separator stays
+* byte-exact; `displaySafe`'s own doc carries why that is a formatting rule
+* rather than a safety one.
+*/
+/**
 * CDK CLI compatibility: a `--app` value pointing at an existing directory is
 * treated as a pre-synthesized cloud assembly — synthesis (the subprocess
 * execution) is skipped and the manifest is read directly. A `--app` value that
@@ -6771,7 +6853,7 @@ var Synthesizer = class {
 			}
 			const missingKeys = new Set(manifest.missing.map((m) => m.key));
 			this.logger.debug(`Missing context: ${manifest.missing.length} value(s)`);
-			if (previousMissingKeys && setsEqual(missingKeys, previousMissingKeys)) throw new SynthesisError(`Context resolution made no progress. Missing context keys: ${[...missingKeys].join(", ")}. Ensure cdk.context.json is correctly configured or required AWS permissions are granted.`);
+			if (previousMissingKeys && setsEqual(missingKeys, previousMissingKeys)) throw new SynthesisError(`Context resolution made no progress. Missing context keys: ${[...missingKeys].map((k) => displaySafe(k)).join(", ")}. Ensure cdk.context.json is correctly configured or required AWS permissions are granted.`);
 			previousMissingKeys = missingKeys;
 			this.logger.info("Resolving missing context...");
 			const resolved = await contextProviderRegistry.resolve(manifest.missing);
@@ -6816,7 +6898,7 @@ var Synthesizer = class {
 		const stacksWithMacros = stacks.filter((s) => containsMacro(s.template));
 		if (stacksWithMacros.length === 0) return;
 		const region = resolved?.region || options.region || process.env["AWS_REGION"] || process.env["AWS_DEFAULT_REGION"] || stacksWithMacros[0]?.region || await resolveSdkDefaultRegion(options.profile);
-		if (!region) throw new SynthesisError(`Stack(s) [${stacksWithMacros.map((s) => s.stackName).join(", ")}] use CloudFormation macros (Transform / Fn::Transform) but cdkd could not resolve an AWS region for the expansion round-trip. Set AWS_REGION, pass --region <r>, or set env: { region: '<r>' } in your CDK Stack constructor.`);
+		if (!region) throw new SynthesisError(`Stack(s) [${stacksWithMacros.map((s) => displaySafe(s.stackName)).join(", ")}] use CloudFormation macros (Transform / Fn::Transform) but cdkd could not resolve an AWS region for the expansion round-trip. Set AWS_REGION, pass --region <r>, or set env: { region: '<r>' } in your CDK Stack constructor.`);
 		let accountId = resolved?.accountId;
 		if (resolved === void 0 && !options.stateBucket) try {
 			const stsClient = new STSClient({
@@ -6833,12 +6915,12 @@ var Synthesizer = class {
 		else if (accountId) stateBucket = `cdkd-state-${accountId}`;
 		else {
 			const oversize = stacksWithMacros.find((s) => JSON.stringify(s.template).length > 51200);
-			if (oversize) throw new SynthesisError(`Stack '${oversize.stackName}' uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
+			if (oversize) throw new SynthesisError(`Stack '${displaySafe(oversize.stackName)}' uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
 			stateBucket = void 0;
 		}
 		for (const stack of stacksWithMacros) {
 			const macros = enumerateMacros(stack.template);
-			this.logger.info(`[macros] Expanding CloudFormation macros for stack '${stack.stackName}' via CFn round-trip (transforms: ${macros.join(", ")}; may take 30-60s)...`);
+			this.logger.info(`[macros] Expanding CloudFormation macros for stack '${displaySafe(stack.stackName)}' via CFn round-trip (transforms: ${macros.map((m) => displaySafe(m)).join(", ")}; may take 30-60s)...`);
 			const before = Date.now();
 			const expanded = await expandMacros(stack.template, {
 				region,
@@ -22060,7 +22142,9 @@ function repairMalformedResourcesForReadOnly(state) {
 * documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
 * would tell an operator to re-run a command that attempted nothing.
 */
-function malformedStateRefusalMessage(stackName, region) {
+function malformedStateRefusalMessage(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	return `${malformedStateDiagnosis(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
@@ -22370,7 +22454,9 @@ function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, dive
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedDeployResourcesRefusalMessage(stackName, region) {
+function malformedDeployResourcesRefusalMessage(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	return `${malformedStateDiagnosis(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
@@ -22454,14 +22540,61 @@ function refuseMalformedResourcesForDeploy(state, stackName, region) {
 * would mean JSON-quoting a name in the one place the text is meant to read as
 * English (review of go-to-k/cdkd#3190).
 */
-function malformedRenderedContainersWarning(stackName, region, containers) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
+function malformedRenderedContainersWarning(rawStackName, rawRegion, containers) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	const names = containers.map((name) => `'${safeIdentifier(name, SHORT_NAME_MAX_CODE_POINTS)}'`).join(", ");
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+	return `${stackClause(stackName, region)} has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: ` + inspectCommand(stackName, region);
+}
+/**
+* `''` is NOT an identity, and every renderer below treats it as one
+* (go-to-k/cdkd#3520). `safeStackName('')` and `safeRegion('')` are both
+* `UNRENDERABLE`, so an empty region rendered `('<unrenderable>')` in the
+* clause AND `--stack-region '<unrenderable>'` in the command the reader
+* pastes — a flag that selects no record at all, on a message whose whole job
+* is to send them to the damaged one. `undefined` already means "absent" to
+* {@link stackClause} and {@link inspectCommand}, which drop the clause and
+* the flag, and that is the right answer for both identifiers.
+*
+* Every message that renders an identity calls this and then
+* {@link stackClause} / {@link inspectCommand} rather than spelling the clause
+* and the command again (go-to-k/cdkd#3526): for a present identity those two
+* render byte-identically to what each builder used to build by hand, and for
+* an absent one they give the no-identity form and the hole template instead
+* of `<unrenderable>`. That is why the per-site note is one line — the reason
+* lives here.
+*
+* NORMALISE AT THE BOUNDARY. `dropRecordCommand`, `identityWithheld` and
+* `orphanInspectClause` each carry their own `=== ''` arm on purpose, so this
+* is not the module's only floor — but a floor in the SHARED helpers was tried
+* here and removed, and the reason is NOT that nothing reaches them: three
+* unboundaried builders do. It is that each passes `exact ? x : undefined`,
+* and `''` is never exact — `safeIdentifier('')` is the placeholder, so
+* `safeStackName('') !== ''` — so those helpers already receive `undefined`
+* and a floor there reddened no case. The boundary is what covers every
+* helper a builder reaches at once, which is the property
+* {@link malformedOrphanResourcePropertiesRefusalMessage} measured when
+* guarding inside ONE helper fixed only part of its message.
+*
+* Not reachable from today's callers: `cdkd state`'s sites sit below an
+* `if (!ref.region) throw`, which is falsy and so rejects `''` too, and
+* `cdkd export` normalises at its own call. What was missing is the CONTRACT —
+* a caller that hands `''` got the placeholder silently, and the guard that
+* would have caught it lived in another file.
+*
+* One cost, stated rather than discovered later: an empty STACK name with a
+* real region now drops that region from the clause and the command too, since
+* {@link inspectCommand} answers a missing stack with the two-hole template.
+* That is the existing `undefined` behaviour rather than a new rule — a record
+* cdkd cannot name is one it cannot build a selecting command for either.
+*/
+function absentIfEmpty(value) {
+	return value === "" ? void 0 : value;
 }
 /** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
-function malformedResourcesWarning(stackName, region) {
+function malformedResourcesWarning(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	return `${malformedStateDiagnosis(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none. Inspect it with: ${inspectCommand(stackName, region)}`;
 }
 /**
@@ -22537,10 +22670,10 @@ function repairMalformedOutputsForReadOnly(state) {
 * Identifiers are sanitized and then shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedOutputsWarning(stackName, region) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedOutputsWarning(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. See the stored value with: ` + inspectCommand(stackName, region);
 }
 /**
 * For a command that can WRITE state: refuse the record by name instead of
@@ -22584,10 +22717,10 @@ function refuseMalformedState(state, stackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedOutputsRefusalMessage(stackName, region) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedOutputsRefusalMessage(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: ` + inspectCommand(stackName, region);
 }
 /**
 * The line `ExportIndexStore`'s rebuild emits for a producer record whose
@@ -22610,10 +22743,10 @@ function malformedOutputsRefusalMessage(stackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedExportSourceWarning(stackName, region) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedExportSourceWarning(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. See the stored values with: ` + inspectCommand(stackName, region);
 }
 /**
 * The line a READ-ONLY command emits when a record's `exportNames` FIELD could
@@ -22639,10 +22772,10 @@ function malformedExportSourceWarning(stackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedExportNamesWarning(stackName, region) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedExportNamesWarning(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. See the stored value with: ` + inspectCommand(stackName, region);
 }
 /**
 * For a command that can WRITE state: refuse a record whose `outputs` bag
@@ -22748,10 +22881,10 @@ function repairMalformedOrphansForReadOnly(state) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedOrphansWarning(stackName, region) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'orphans' list — the record is malformed or truncated. Readers reach it on a bare '?? []' or '?.length', which admits a string, a number, a plain object and null alike: a string is WALKED, one garbage orphan per character, and the others read as no orphans at all. Continuing with it EMPTY: this view previews no adoption and names no orphan, which is NOT the same as the record holding none — resources from an earlier failed deploy may still be live in AWS. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedOrphansWarning(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} has no readable 'orphans' list — the record is malformed or truncated. Readers reach it on a bare '?? []' or '?.length', which admits a string, a number, a plain object and null alike: a string is WALKED, one garbage orphan per character, and the others read as no orphans at all. Continuing with it EMPTY: this view previews no adoption and names no orphan, which is NOT the same as the record holding none — resources from an earlier failed deploy may still be live in AWS. See the stored value with: ` + inspectCommand(stackName, region);
 }
 /**
 * The refusal text for a command that can WRITE the record.
@@ -22768,10 +22901,10 @@ function malformedOrphansWarning(stackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedOrphansRefusalMessage(stackName, region) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'orphans' list — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: a string container is WALKED one character at a time and written back as a list of character-shaped orphan records, and every other unreadable shape reads as no orphans at all — so a run would delete or adopt against a record whose evidence of resources left live in AWS by an earlier failed deploy it never read. Repair or remove the record first, and no cdkd command repairs this container: rewriting it to [] by hand discards the very evidence this refusal is protecting. Inspect the record with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedOrphansRefusalMessage(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} has no readable 'orphans' list — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: a string container is WALKED one character at a time and written back as a list of character-shaped orphan records, and every other unreadable shape reads as no orphans at all — so a run would delete or adopt against a record whose evidence of resources left live in AWS by an earlier failed deploy it never read. Repair or remove the record first, and no cdkd command repairs this container: rewriting it to [] by hand discards the very evidence this refusal is protecting. Inspect the record with: ` + inspectCommand(stackName, region);
 }
 /**
 * The DESTROY refusal text for this container (go-to-k/cdkd#3379 review).
@@ -22854,10 +22987,10 @@ function refuseMalformedOrphans(state, stackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedDestroyOutputsRefusalMessage(stackName, region) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command DELETES state, so it refuses rather than continuing: it reads this bag to decide whether the stack might export anything, and that decision gates the cross-stack check that refuses to delete a producer another stack still imports from. A string or a list invents one export name per character or element; a null, a number or a boolean reads as 'exports nothing' and SKIPS the check entirely, deleting the record while consumers still resolve against it. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedDestroyOutputsRefusalMessage(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. This command DELETES state, so it refuses rather than continuing: it reads this bag to decide whether the stack might export anything, and that decision gates the cross-stack check that refuses to delete a producer another stack still imports from. A string or a list invents one export name per character or element; a null, a number or a boolean reads as 'exports nothing' and SKIPS the check entirely, deleting the record while consumers still resolve against it. Repair or remove the record first. Inspect it with: ` + inspectCommand(stackName, region);
 }
 /**
 * For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `outputs`
@@ -22896,10 +23029,10 @@ function refuseMalformedOutputsForDestroy(state, stackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedNestedChildOutputsRefusalMessage(childStackName, region) {
-	const stack = safeStackName(childStackName);
-	const reg = safeRegion(region);
-	return `State for nested stack child ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. The parent's 'Outputs.<Key>' attributes are REBUILT from this bag and persisted into the PARENT's record, and 'Object.entries' walks a string or a list as readily as a map — so a six-character value would become six fabricated parent attributes that every Fn::GetAtt against this nested stack then resolves into live AWS calls. The deploy refuses rather than fabricating them. Repair or remove the child's record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedNestedChildOutputsRefusalMessage(rawChildStackName, rawRegion) {
+	const childStackName = absentIfEmpty(rawChildStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(childStackName, region, "nested stack child")} has no readable 'outputs' map — the record is malformed or truncated. The parent's 'Outputs.<Key>' attributes are REBUILT from this bag and persisted into the PARENT's record, and 'Object.entries' walks a string or a list as readily as a map — so a six-character value would become six fabricated parent attributes that every Fn::GetAtt against this nested stack then resolves into live AWS calls. The deploy refuses rather than fabricating them. Repair or remove the child's record first. Inspect it with: ` + inspectCommand(childStackName, region);
 }
 /**
 * For the nested-stack provider: refuse a CHILD record whose `outputs` bag
@@ -22947,10 +23080,10 @@ function refuseMalformedNestedChildOutputs(state, childStackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedLocalOutputsWarning(stackName, region) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so reading it would hand this local run one FABRICATED output per character or element. Continuing with it EMPTY: every reference to an output of this record resolves to nothing and is dropped, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedLocalOutputsWarning(rawStackName, rawRegion) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so reading it would hand this local run one FABRICATED output per character or element. Continuing with it EMPTY: every reference to an output of this record resolves to nothing and is dropped, which is not the same as the record holding none. See the stored value with: ` + inspectCommand(stackName, region);
 }
 /** How many logical ids a `properties` message names before it says "and N more". */
 const NAMED_UNREADABLE_PROPERTY_BAGS = 5;
@@ -22982,10 +23115,10 @@ const NAMED_UNREADABLE_PROPERTY_BAGS = 5;
 * a pasted command that selects no record at all, so it is dropped for the
 * same reason — the call go-to-k/cdkd#3226 makes for `inspectCommand`.
 */
-function stackClause(stackName, region) {
+function stackClause(stackName, region, kind = "") {
 	if (stackName === void 0) return "The state record this command loaded";
 	const where = region === void 0 ? "" : ` (${shellQuote(safeRegion(region))})`;
-	return `State for ${shellQuote(safeStackName(stackName))}${where}`;
+	return `State for ${kind ? `${kind} ` : ""}${shellQuote(safeStackName(stackName))}${where}`;
 }
 /**
 * The DESTRUCTIVE remedy, built the way {@link inspectCommand} builds the
@@ -23310,7 +23443,9 @@ function namedPropertyBagsClause(stackName, region, logicalIds) {
 * by a refusal the moment the flag comes off. So the message points at
 * `cdkd diff` instead of weakening the guard.
 */
-function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds) {
+function malformedResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a DELETE and re-create of resources the template did not change, and reading the bag as empty produces that same verdict rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack with those maps read as EMPTY and warns that it did. Inspect the record with: ${inspectCommand(stackName, region)}`;
 }
 /**
@@ -23401,8 +23536,8 @@ function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds
 * validated either — go-to-k/cdkd#3360). See {@link stackClause}.
 */
 function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
-	const stackName = rawStackName === "" ? void 0 : rawStackName;
-	const region = rawRegion === "" ? void 0 : rawRegion;
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	const inspect = orphanInspectClause(stackName, region, recovery);
 	const listCommand = withheldIdentityListCommand(stackName, region, recovery);
 	const commands = [
@@ -23601,7 +23736,9 @@ function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, st
 * The warning a caller of {@link repairMalformedResourcePropertiesForReadOnly}
 * emits.
 */
-function malformedResourcePropertiesWarning(stackName, region, logicalIds) {
+function malformedResourcePropertiesWarning(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	return `${namedPropertyBagsClause(stackName, region, logicalIds)} Continuing with those maps EMPTY: what these records are stored as holding is NOT what this preview compares against. Where the template still declares the resource, every property it declares previews as an addition and a create-only one as a replacement; where it no longer declares it, the DELETE row shows an empty previous side instead of the stored one. Do NOT run 'cdkd deploy' against this record — it REFUSES on the same defect rather than acting on this preview. See the stored values with: ${inspectCommand(stackName, region)}`;
 }
 /**
@@ -23733,10 +23870,10 @@ function repairMalformedResourceEntriesForReadOnly(state) {
 	return unreadable;
 }
 /** The warning a caller of {@link repairMalformedResourceEntriesForReadOnly} emits. */
-function malformedResourceEntriesWarning(stackName, region, logicalIds) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `${namedEntriesClause(stackName, region, logicalIds)} Continuing WITHOUT them: this command's output describes the remaining resources only, which is not the same as the stack holding none of these. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedResourceEntriesWarning(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${namedEntriesClause(stackName, region, logicalIds)} Continuing WITHOUT them: this command's output describes the remaining resources only, which is not the same as the stack holding none of these. See the stored values with: ` + inspectCommand(stackName, region);
 }
 /**
 * The `orphans[]` twin of {@link malformedResourceEntriesWarning}, and a
@@ -23766,13 +23903,13 @@ function malformedResourceEntriesWarning(stackName, region, logicalIds) {
 * `logicalId` is not a string arrives as `''` and renders as the
 * `UNRENDERABLE` stand-in.
 */
-function malformedOrphanRecordsWarning(stackName, region, logicalIds) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
+function malformedOrphanRecordsWarning(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
 	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
 	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
 	const more = rest > 0 ? ` and ${rest} more` : "";
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${named}${more} — because they are not objects, or carry no resource type. Continuing WITHOUT them: they are not previewed for adoption. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${named}${more} — because they are not objects, or carry no resource type. Continuing WITHOUT them: they are not previewed for adoption. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. See the stored values with: ` + inspectCommand(stackName, region);
 }
 /**
 * The half the refusal and the warning share: what is wrong and which entries.
@@ -23781,12 +23918,10 @@ function malformedOrphanRecordsWarning(stackName, region, logicalIds) {
 * happens NEXT, and a second copy of the diagnosis is what drifts.
 */
 function namedEntriesClause(stackName, region, logicalIds) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
 	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
 	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
 	const more = rest > 0 ? ` and ${rest} more` : "";
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) holds ${logicalIds.length} resource record(s) that cannot be read as resources — ${named}${more} — because they are not objects, or carry no resource type, so nothing can tell what AWS resource they name. The record is malformed or truncated.`;
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} resource record(s) that cannot be read as resources — ${named}${more} — because they are not objects, or carry no resource type, so nothing can tell what AWS resource they name. The record is malformed or truncated.`;
 }
 /**
 * The text {@link refuseMalformedResourceEntries} raises.
@@ -23807,10 +23942,10 @@ function namedEntriesClause(stackName, region, logicalIds) {
 * Exported so a test can pin the wording against the producer rather than
 * re-spelling it, the way the other messages here are consumed.
 */
-function malformedResourceEntriesRefusalMessage(stackName, region, logicalIds) {
-	const stack = safeStackName(stackName);
-	const reg = safeRegion(region);
-	return `${namedEntriesClause(stackName, region, logicalIds)} This command can WRITE state, so it refuses rather than skipping them: saving over the record would report a clean run for entries nothing could read, and would leave the next command to fail on them with no more to go on. Nothing was locked, read from AWS or written FOR THIS STACK. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+function malformedResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${namedEntriesClause(stackName, region, logicalIds)} This command can WRITE state, so it refuses rather than skipping them: saving over the record would report a clean run for entries nothing could read, and would leave the next command to fail on them with no more to go on. Nothing was locked, read from AWS or written FOR THIS STACK. Inspect it with: ` + inspectCommand(stackName, region);
 }
 
 //#endregion
@@ -34484,7 +34619,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CVB0Ky06.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-LZQSJyN2.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -48194,4 +48329,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { yellow as $, AssemblyReader as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, ResourceTimeoutError as Aa, resolveCaptureObservedState as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, isMarkedNonRetryable as Ba, MIGRATE_TMP_PREFIX as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, LocalInvokeBuildError as Ca, getDockerImageBySourceHash as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, NestedStackChildDirectDestroyError as Da, getLegacyStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, MalformedProducerRecordRefusalError as Ea, getDefaultStateBucketName as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, SynthesisError as Fa, stateBucketExistenceConfirmed as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, markRedactedCause as Ga, injectiveKeyPrefix as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isThrottlingError as Ha, uploadCfnTemplate as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, formatError as Ia, warnDeprecatedNoPrefixCliFlag as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, safeStringify$1 as Ja, decodeListingKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, retryClassificationText as Ka, producerCoordinateKey as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, isCdkdError as La, ssmResolvedValueType as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, StackHasActiveImportsError as Ma, resolveStateBucketWithDefault as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, StackTerminationProtectionError as Na, resolveStateBucketWithDefaultAndSource as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, PartialFailureError as Oa, resolveApp as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StateError as Pa, resolveUseCdkBootstrapAssets as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, derivePartitionAndUrlSuffix as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, normalizeAwsError as Ra, CFN_TEMPLATE_BODY_LIMIT as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, IntrinsicResolutionRefusalError as Sa, AssetManifestLoader as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LockError as Ta, synthesisStatusMessage as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isTransientServerError as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, isRetryableTransientError as Va, findLargeInlineResources as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, markNonRetryable as Wa, injectiveKey as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, PARTITION_TABLE as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, __exportAll as Ya, expectedOwnerParam as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, canonicalizeRegion as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, ConfigError as _a, redactDockerArgvValues as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, nullPrototypeRecord as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, DeployCancelledError as ba, escapeRegExp$1 as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, resolveAssemblyPath as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, AwsClients as da, describeDockerExecFailure as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, failedStageNote as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, getAwsClients as fa, describeDockerFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, CdkdError as ga, partitionSensitiveEnv as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, AssetError as ha, getDockerCmd as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasPlainPrototype$1 as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ResourceUpdateNotSupportedError as ja, resolveSkipPrefix as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, ProvisioningError as ka, resolveAutoAssetStorage as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, clearBucketRegionCache as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, setAwsClients as ma, formatDockerLoginError as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, defineOwnKey as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, ownValue as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, resetAwsClients as pa, dockerSpawnEnvWithSensitive as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, describeAwsFailure as qa, producerRecordKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, hasOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, renderAssemblyPathEscape as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveBucketRegion as ua, describeDockerCapturedOutput as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CrossAccountSecretRefusalError as va, runDockerForeground as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, LocalStartServiceError as wa, Synthesizer as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DynamicReferenceRegionAmbiguousError as xa, stripControlChars as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, DependencyError as ya, runDockerStreaming as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, withErrorHandling as za, CFN_TEMPLATE_URL_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-DhZW4if5.js.map
+//# sourceMappingURL=deploy-engine-DzSrzD0b.js.map