@go-to-k/cdkd 0.290.5 → 0.290.6

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EAwDA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Ie;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KCzyBU,uBAAuB;KAsxNvB,gBAAgB;;;UCzzNX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCluC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cC1WrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAiQC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAsYvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UA0GX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCz3BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MAwDR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UCrrBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UCvSN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC9SO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cC+FE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA2UJ;UAyHA;UA8LA;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAyCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCn6FJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;cA8MW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAoOI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UC3oBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCiDE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC9hBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCKK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UCnGe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAuGxC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UAIM;UA4EA;UAwBA;UAQA;UA2DN;;;;UCnzCO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCjHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC1PK;EAEf;EASA;;cA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cCj5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC3YA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCrbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAqUf;UAoJA;iBAkGO;UAsED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCljClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC11BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCrlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAmQW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UA6DnE;UAkJA;UA2EA;UA2CA;UAiBA;UAyGA;iBA6GO;UAgMP;UAoFA;UAyDA;UA+FA;UA2BA;UAkCM;UAiGA;UAsGN;UA0IM;UAs8BA;UAsoBA;UA6FA;UAuDA;UAgCA;UA+BA;UAuCN;UA+BM;UA4CA;UA+UN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAyLA;UAw/DN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EAwDA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Ie;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KCzyBU,uBAAuB;KAsxNvB,gBAAgB;;;UCzzNX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCluC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cC1WrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAiQC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAsYvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UA0GX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCz3BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MAwDR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UCrrBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UCvSN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC9SO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cC+FE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA2UJ;UAyHA;UA8LA;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAyCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCn6FJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;cA8MW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAoOI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UC3oBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCiDE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC9hBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCKK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UCnGe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAuGxC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UAIM;UA4EA;UAwBA;UAQA;UA2DN;;;;UCrzCO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCjHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC1PK;EAEf;EASA;;cA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cCj5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC3YA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCrbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAqUf;UAoJA;iBAkGO;UAsED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCljClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC11BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCrlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAmQW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UA6DnE;UAkJA;UA2EA;UA2CA;UAiBA;UAyGA;iBA6GO;UAgMP;UAoFA;UAyDA;UA+FA;UA2BA;UAkCM;UAiGA;UAsGN;UA0IM;UAs8BA;UAsoBA;UA6FA;UAuDA;UAgCA;UA+BA;UAuCN;UA+BM;UA4CA;UA+UN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAyLA;UAw/DN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $r as CdkdError, En as S3StateBackend, Jr as AwsClients, Kr as clearBucketRegionCache, Qr as AssetError, Tn as LockManager, Vn as AssetPublisher, Wr as AssemblyReader, Xr as resetAwsClients, Yr as getAwsClients, Zr as setAwsClients, _i as SynthesisError, bi as normalizeAwsError, ci as LockError, di as ProvisioningError, ei as ConfigError, en as DiffCalculator, gi as StateError, it as ProviderRegistry, mt as CloudControlProvider, ni as DependencyError, on as DagBuilder, qr as resolveBucketRegion, r as DeployEngine, sn as TemplateParser, tt as IAMRoleProvider, vi as formatError, xr as Synthesizer, yi as isCdkdError } from "./deploy-engine-WFO9o9M0.js";
+import { $r as CdkdError, En as S3StateBackend, Jr as AwsClients, Kr as clearBucketRegionCache, Qr as AssetError, Tn as LockManager, Vn as AssetPublisher, Wr as AssemblyReader, Xr as resetAwsClients, Yr as getAwsClients, Zr as setAwsClients, _i as SynthesisError, bi as normalizeAwsError, ci as LockError, di as ProvisioningError, ei as ConfigError, en as DiffCalculator, gi as StateError, it as ProviderRegistry, mt as CloudControlProvider, ni as DependencyError, on as DagBuilder, qr as resolveBucketRegion, r as DeployEngine, sn as TemplateParser, tt as IAMRoleProvider, vi as formatError, xr as Synthesizer, yi as isCdkdError } from "./deploy-engine-BU7n9_qY.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-th1myfgh.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-D30EPjOn.js → program-Cl3fCD6-.js}

@@ -1,8 +1,8 @@
-import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-WFO9o9M0.js";
+import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-BU7n9_qY.js";
 import { S as truncateCodePoints, _ as withSkipPrefix, b as displayIdent, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BBIkp8ja.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DU7mN-cS.js";
+import { t as getCdkdVersion } from "./version-BvSdNpMz.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CsdVn4cg.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -65348,6 +65348,145 @@ function isStackNotFoundError(err) {
 	return name === "ValidationError" && /does not exist/i.test(message);
 }
 
+//#endregion
+//#region src/state/malformed-resources-bag.ts
+/** The error code every malformed-record refusal carries, whatever its class. */
+const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
+/**
+* Answer the ONE question both helpers below key on: can this record's
+* resource map be read at all?
+*
+* Widened past `null` / `undefined` because the message says "no readable
+* resources map" and a hand-edited record does not stop at those two: a
+* `[]`, a `5` or a `"ab"` all survive `Object.entries` and yield a bag that is
+* empty or, for the string, absurd — repaired silently and warned about
+* nowhere. The predicate is the plain-object test the bag's own type implies.
+*/
+function hasReadableResources(state) {
+	const bag = state.resources;
+	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
+}
+/**
+* The shared explanation, in the terms the reader needs: what is wrong, what
+* to look at, and what NOT to do next.
+*
+* Both identifiers are SANITIZED and THEN SHELL-QUOTED, and the command is
+* emitted LAST and UNWRAPPED — the shape `lock-contention-message.ts` and
+* `.claude/rules/layout-state-types.md` require of any suggestion a user is
+* meant to paste, for two separate reasons.
+*
+* Sanitizing alone is not enough. `displaySafe(..., { asciiOnly: true })` is a
+* printable-ASCII allowlist, so it removes the line- and escape-forgery class
+* but KEEPS `'`, `;`, `|`, `` ` ``, `$` and spaces — and neither name is
+* trusted here, since a stack name reaches the cross-stack read path from an
+* `Fn::GetStackOutput` argument or an S3 key. A name spelled
+* `a'; curl http://x|sh; echo '` would close the quoting and append its own
+* command to the line this text tells the user to RUN.
+*
+* Wrapping the command in `'...'` is not enough either, and is what makes the
+* two compose badly: `shellQuote` does its own quoting, so an outer wrapper
+* produces something unpastable. Hence unwrapped and last.
+*
+* An identifier that sanitizes to EMPTY becomes `UNRENDERABLE` rather than
+* nothing — an empty argument makes `--stack-region` swallow the next flag,
+* turning a remedy into a differently-broken command.
+*/
+function safeIdentifier(value) {
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, 128);
+	return truncated ? `${text}...` : text;
+}
+function malformedStateDetail(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a READ-ONLY command: give the record an empty resource bag so the
+* command can report on it, and say so (issue go-to-k/cdkd#3018).
+*
+* `parseStateBody` deliberately does not validate the inner shape, so a
+* hand-edited or truncated record reaches a command with `resources` absent,
+* `null`, or some other non-object. Every such command then died on a raw
+* `TypeError` from the first `Object.keys` / `in` / index read — the exact
+* wording differs per shape (`Cannot convert undefined or null to object`,
+* `Cannot use 'in' operator`, `Cannot read properties of null`), and none of
+* them names a stack, a key or a remedy, from exactly the commands a user
+* reaches for WHEN the state is broken.
+*
+* WHY AT THE LOAD AND NOT AT EACH LOOP. The first cut of #3018 put `?? {}` on
+* the twelve `Object.entries(state.resources)` loops, which was inert: every
+* one of those flows dereferences the bag EARLIER — `!(id in state.resources)`,
+* `hasOwnProperty.call(...)`, `state.resources[logicalId]` — so the abort still
+* happened one line up and the guards only made it look handled. One call per
+* load dominates the whole flow behind it, including the helpers that take the
+* state as a parameter (`orphan-rewriter`, `diff-calculator`,
+* `collectCcApiRoutes`).
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true`. A silent repair is its own defect — an empty resource set is
+* indistinguishable from a healthy empty stack in every later line of output,
+* so `No changes detected` over an unreadable record is a clean verdict about
+* nothing.
+*
+* **Only for a command that cannot WRITE state.** Anything that can persist
+* uses {@link refuseMalformedState} instead; see its note.
+*/
+function repairMalformedResourcesForReadOnly(state) {
+	if (hasReadableResources(state)) return false;
+	state.resources = {};
+	return true;
+}
+/**
+* The refusal TEXT, for a command whose own exit-code contract means this
+* cannot be a plain `CdkdError`.
+*
+* `cdkd scrub` is the case: its exit `1` is SPOKEN FOR ("--fail found
+* plaintext") and every one of its refusals carries `exitCode = 2`, because a
+* CI gate reading the code alone must be able to tell "scrub looked and found
+* a leak" from "scrub refused to look" — the two call for opposite responses.
+* So scrub tests {@link hasReadableResources} and raises its own class around
+* this text rather than calling {@link refuseMalformedState}.
+*
+* The other three refusing commands do NOT share that need, and giving them a
+* single shared code would be wrong in the other direction: `cdkd rollback`
+* documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
+* would tell an operator to re-run a command that attempted nothing.
+*/
+function malformedStateRefusalMessage(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+}
+/** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
+function malformedResourcesWarning(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+}
+/**
+* For a command that can WRITE state: refuse the record by name instead of
+* repairing it.
+*
+* Repairing is actively DANGEROUS here, and the PR that introduced this module
+* shipped that danger for one round before its security review caught it.
+* `cdkd scrub` gates its `saveState` on `recordsChanged > 0`, which an OUTPUTS
+* change alone satisfies — so a record holding `"resources": null` and a
+* plaintext secret in `outputs` would be scrubbed, and then saved back with a
+* repaired, WELL-FORMED `resources: {}`. The malformed record is the only
+* signal that anything is wrong; laundering it into a legitimate-looking empty
+* one is permanent and silent. The next `cdkd deploy` then reads zero resources
+* and CREATES the whole stack a second time, and the next `cdkd destroy`
+* deletes nothing and orphans every live resource — and the one-shot warning
+* that would have said so is long gone, quite possibly for a different
+* operator. `cdkd import --force` launders it the same way.
+*
+* Refusing still satisfies #3018, whose complaint was the BARE `TypeError`:
+* this names the stack, the region, the defect and the remedy, and exits on a
+* code rather than on a stack trace.
+*/
+function refuseMalformedState(state, stackName, region) {
+	if (hasReadableResources(state)) return;
+	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
 /**
@@ -65468,7 +65607,10 @@ function indexNestedChildTemplates(template, templatePath) {
 /** Load a stack's cdkd state, or synthesize an empty record (→ all CREATE) when none exists. */
 async function loadStateOrEmpty(stackName, region, stateBackend) {
 	const result = await stateBackend.getState(stackName, region);
-	if (result) return result.state;
+	if (result) {
+		if (repairMalformedResourcesForReadOnly(result.state)) logger.warn(malformedResourcesWarning(stackName, region));
+		return result.state;
+	}
 	return {
 		stackName,
 		region,
@@ -65777,7 +65919,7 @@ async function buildDiffTree(args) {
 			parentHasSecretReference: secretBearingAbove
 		}));
 	}
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
 		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove));
@@ -65804,7 +65946,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 		outputChanges,
 		children: []
 	};
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference));
 	}
@@ -66294,7 +66436,7 @@ async function diffCommand(stacks, options) {
 		const previewOrphanAdoption = async (state, effectiveTemplate, orphanStackName, orphanRegion) => {
 			const outcome = await planOrphanAdoption({
 				records: state.orphans ?? [],
-				managedLogicalIds: new Set(Object.keys(state.resources)),
+				managedLogicalIds: new Set(Object.keys(state.resources ?? {})),
 				template: effectiveTemplate,
 				stackName: orphanStackName,
 				region: orphanRegion,
@@ -66735,6 +66877,12 @@ async function scrubCommand(stacks, options) {
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
 	let totalStacksWithUnverifiableReads = 0;
+	/**
+	* Stacks this `--dry-run` proceeded over with an UNREADABLE resources map
+	* (issue go-to-k/cdkd#3018). Tracked exactly like `indexUnreadable`: an
+	* audit this run could not perform is a FINDING, never a clean result.
+	*/
+	const malformedRecords = [];
 	const failures = [];
 	const exportIndexStores = /* @__PURE__ */ new Map();
 	const exportIndexFor = (indexRegion) => {
@@ -66811,6 +66959,7 @@ async function scrubCommand(stacks, options) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
 		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
 			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
@@ -66841,7 +66990,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -66864,6 +67013,7 @@ async function scrubCommand(stacks, options) {
 		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
+		if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
@@ -66871,6 +67021,7 @@ async function scrubCommand(stacks, options) {
 	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
+	if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
 }
 /**
@@ -67461,6 +67612,19 @@ function orderScrubTargets(targets) {
 * through the real backend, so the read-modify-write still sees S3 rather than
 * a cache, and its ETag precondition still means what it says.
 */
+/**
+* The finding a `--dry-run` raises for a record whose resources map it could
+* not read (issue go-to-k/cdkd#3018).
+*
+* `ScrubRefusalError`, so it carries scrub's exit **2**: `1` means "--fail
+* looked and found a leak -- rotate the secret", and this is the opposite
+* remedy ("repair the record and re-run"). Without it the run exits 0, or 1
+* under `--fail` via the SILENT `ScrubNeededError`, whose suppression would
+* also swallow this text.
+*/
+function malformedRecordsAuditedError(stackNames) {
+	return new ScrubRefusalError(`${stackNames.length} stack(s) were audited with an EMPTY resource set because their state record has no readable 'resources' map: ${stackNames.join(", ")}. The report above describes their outputs only — nothing is known about their resources, so this run cannot certify them clean. See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
+}
 function memoizeCrossStackStateReads(backend) {
 	const view = Object.create(backend);
 	let listed;
@@ -68068,6 +68232,80 @@ function isRegionAmbiguousRefusal(err) {
 	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof DynamicReferenceRegionAmbiguousError);
 }
 /**
+* The marker the resolver's NAMELESS-dynamic-reference throw carries
+* (`Dynamic reference: <service> PARAMETER_NAME is required`).
+*
+* Pinned against the resolver's own literal by
+* `tests/unit/cli/scrub-nameless-dynamic-ref.test.ts`, because this is a
+* consumer of a string the resolver owns: a reword there would otherwise make
+* the predicate below silently stop matching and restore the very silence it
+* exists to remove (`.claude/rules/testing.md` -> "A fixture that greps
+* cdkd's OWN output must fail loudly when the format drifts").
+*/
+const NAMELESS_DYNAMIC_REFERENCE_MARKERS = ["PARAMETER_NAME is required", "SECRET_ID is required"];
+/**
+* The prefix a matching message must ALSO carry. Without it the bare tails
+* above are reachable from an unrelated throw: `resolveParameters` raises
+* `Parameter ${name} is required but no value was provided`, so a template
+* parameter literally NAMED `PARAMETER_NAME` would flip an ordinary
+* best-effort miss into a whole-stack refusal.
+*/
+const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
+/**
+* A NAMELESS dynamic reference is NOT a best-effort miss, however unresolvable
+* the rest of the resource is (issue go-to-k/cdkd#2692) — `{{resolve:ssm-secure}}`
+* with no parameter name, or `{{resolve:secretsmanager}}` /
+* `{{resolve:secretsmanager:}}` with no secret id.
+*
+* The resolver raises a bare `Error` for both, so they fall through the
+* typed-refusal test above into the `debug` below and `cdkd scrub` reports the
+* run CLEAN. What makes that wrong is WHERE the throw happens: the token loop
+* in `resolveDynamicReferences` has NO per-token `try`, so either one abandons
+* every remaining `{{resolve:...}}` token in the leaf. A real
+* `{{resolve:secretsmanager:prod/db}}` after it is never fetched and records NO
+* needle — and a legacy plaintext already in `state.json` then survives under
+* `No plaintext secrets found`, exit 0.
+*
+* BOTH spellings are matched, and the second is the DOMINANT one. The first
+* cut matched `PARAMETER_NAME is required` alone, leaving the more common way
+* to write a secret silent — and the fence certified that as deliberate by
+* asserting the marker occurred exactly once in the resolver, which passed
+* precisely BECAUSE the other throw spells it differently.
+*
+* WHY THE SET STOPS AT "is required", having once been widened to the whole
+* `Dynamic reference:` family and reverted. The loop's missing per-token `try`
+* means four SIBLING failures — a deleted SSM parameter, a secret with no
+* `SecretString`, a missing `JSON_KEY`, a non-JSON secret — abandon the leaf
+* exactly the same way, so on the surface they belong here. They do not,
+* because scrub resolves with template DEFAULTS and takes no `--parameters`:
+* an `Fn::Sub` that warn-and-KEEPS its raw `${Field}` produces a JSON_KEY miss
+* on a perfectly healthy stack, so refusing on that class refuses ordinary
+* stacks (measured — it reddened
+* `tests/unit/cli/commands/scrub-cross-region-secret.test.ts`). A nameless
+* reference is far narrower: an UNBOUND variable keeps its literal `${...}`
+* rather than vanishing, so ordinary missing-parameter resolution cannot
+* produce one.
+*
+* That is narrower, NOT universal, and the difference is stated rather than
+* glossed: a parameter DECLARED with `Default: ''` binds the empty string
+* verbatim (`isUnboundTemplateParameter` returns false once `Default` is
+* present), so `{{resolve:ssm-secure:${P}}}` assembles to
+* `{{resolve:ssm-secure:}}` and refuses here — while the same stack deploys
+* fine under `--parameters P=/real/name`. The failure is fail-CLOSED (a
+* refusal, never a silent clean run) and the shape is a rare one, so it is
+* accepted rather than worked around; go-to-k/cdkd#3160 carries it alongside
+* the sibling class, which needs a countable unverifiable-leaf finding rather
+* than a refusal.
+*
+* It is a loudness REGRESSION rather than a new gap: before go-to-k/cdkd#2689
+* fixed `ssmParameterName`, this input produced a bogus `secretName` and
+* therefore an `ambiguous` verdict, whose typed error scrub already re-raises.
+* The old, wrong-in-substance refusal was backstopping this one.
+*/
+function isNamelessDynamicReferenceFailure(err) {
+	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof Error && link.message.includes(DYNAMIC_REFERENCE_PREFIX) && NAMELESS_DYNAMIC_REFERENCE_MARKERS.some((marker) => link.message.includes(marker)));
+}
+/**
 * A secrets map with its OWN identity whose entries ARE `target`'s (issue
 * #2531): every read and write goes to `target`; nothing is stored here.
 *
@@ -68511,6 +68749,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		}
 		const state = loaded.state;
+		let malformedResources;
+		if (opts.dryRun) {
+			if (repairMalformedResourcesForReadOnly(state)) {
+				malformedResources = true;
+				logger.warn(malformedResourcesWarning(stack.stackName, region));
+			}
+		} else if (!hasReadableResources(state)) throw new ScrubRefusalError(malformedStateRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
 		const resolvers = new ScrubResolvers(region);
@@ -68555,7 +68800,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const collisions = [];
 		let outputsSourceUntrusted = false;
 		await withSharedDrainBudget(async () => {
-			for (const logicalId of Object.keys(state.resources)) {
+			for (const logicalId of Object.keys(state.resources ?? {})) {
 				const templateResource = templateResources[logicalId];
 				if (!templateResource?.Properties) continue;
 				const recordedSecretValues = /* @__PURE__ */ new Map();
@@ -68572,7 +68817,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(resolveInput, resourceContext);
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -68594,7 +68839,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(resolveInput, resolverContext(recordedSecretValues));
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of orphan record ${record.logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 			}
@@ -68617,7 +68862,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					try {
 						exportName = await resolver.resolve(nameSource, nameContext);
 					} catch (err) {
-						if (isRegionAmbiguousRefusal(err)) throw err;
+						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 						nameFailed = true;
 						nameError = err;
 					}
@@ -68655,7 +68900,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(valueSource, valueContext);
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 				}
 			}
@@ -68674,12 +68919,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: 0,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			...malformedResources ? { malformedResources } : {},
 			outputs: state.outputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
 		let recordsChanged = 0;
 		const newResources = {};
-		for (const [logicalId, record] of Object.entries(state.resources)) {
+		for (const [logicalId, record] of Object.entries(state.resources ?? {})) {
 			const secrets = perResourceSecrets.get(logicalId);
 			const templateProps = perResourceTemplateProps.get(logicalId);
 			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
@@ -68722,6 +68968,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			...malformedResources ? { malformedResources } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
@@ -79020,6 +79267,7 @@ async function rollbackCommand(stackArg, options) {
 			if (!journal || journal.segments.length === 0) throw new Error(`Nothing to roll back for '${safe(stackName)}' (${safe(region)}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
 			if (!stateData) throw new Error(`Rollback journal exists for '${safe(stackName)}' (${safe(region)}) but its state.json is missing (keys: ${safe(`${setup.prefix}/${stackName}/${region}`)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			const baseState = stateData.state;
+			refuseMalformedState(baseState, stackName, region);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -81156,7 +81404,7 @@ async function rewriteResourceReferences(state, orphanLogicalIds, providerRegist
 	const rewrites = [];
 	const unresolvable = [];
 	const newResources = {};
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (orphanSet.has(logicalId)) continue;
 		const rewrittenProperties = await rewriteValue(resource.properties, `properties`, logicalId, orphanSet, fetcher, rewrites, unresolvable);
 		const rewrittenAttributes = resource.attributes ? await rewriteValue(resource.attributes, `attributes`, logicalId, orphanSet, fetcher, rewrites, unresolvable) : void 0;
@@ -81491,9 +81739,10 @@ async function orphanCommand(pathArgs, options) {
 			const stateData = await stateBackend.getState(stackInfo.stackName, targetRegion);
 			if (!stateData) throw new Error(`No state found for stack '${stackInfo.stackName}' (${targetRegion}). Nothing to orphan. (Did the stack get deployed?)`);
 			const { state, etag, migrationPending } = stateData;
+			refuseMalformedState(state, stackInfo.stackName, targetRegion);
 			const missing = orphanLogicalIds.filter((id) => !(id in state.resources));
 			if (missing.length > 0) {
-				const have = Object.keys(state.resources).join(", ");
+				const have = Object.keys(state.resources ?? {}).join(", ");
 				throw new Error(`Resource(s) not in state for stack '${stackInfo.stackName}' (${targetRegion}): ${missing.join(", ")}.\nAvailable logical IDs: ${have}`);
 			}
 			const providerRegistry = new ProviderRegistry();
@@ -82069,6 +82318,7 @@ async function importCommand(stackArg, options) {
 		}
 		const existingResult = await stateBackend.getState(stackInfo.stackName, targetRegion);
 		const existingState = existingResult?.state ?? null;
+		if (existingState) refuseMalformedState(existingState, stackInfo.stackName, targetRegion);
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
 		if (existingState) {
@@ -82077,7 +82327,7 @@ async function importCommand(stackArg, options) {
 			} else {
 				const conflicts = [...overrides.keys()].filter((id) => Object.prototype.hasOwnProperty.call(existingState.resources, id));
 				if (conflicts.length > 0 && !options.force) throw new Error(`Selective import would overwrite resource(s) already in state: ${conflicts.join(", ")}. Pass --force to confirm the overwrite, or remove these IDs from --resource / --resource-mapping.`);
-				const preservedCount = Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length;
+				const preservedCount = Object.keys(existingState.resources ?? {}).filter((id) => !overrides.has(id)).length;
 				logger.info(`Merging into existing state for ${stackInfo.stackName} (${targetRegion}): preserving ${preservedCount} unlisted resource(s)` + (conflicts.length > 0 ? `, overwriting ${conflicts.length} listed entry(ies)` : ""));
 			}
 		}
@@ -82138,7 +82388,7 @@ async function importCommand(stackArg, options) {
 			}
 			if (!options.yes) {
 				const importedCount = importedRows.length;
-				const preservedCount = selectiveMode && existingState ? Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length : 0;
+				const preservedCount = selectiveMode && existingState ? Object.keys(existingState.resources ?? {}).filter((id) => !overrides.has(id)).length : 0;
 				const totalAfter = importedCount + preservedCount;
 				const breakdown = preservedCount > 0 ? ` (${importedCount} new/overwritten + ${preservedCount} preserved)` : "";
 				if (!await confirmPrompt(`Write state for ${stackInfo.stackName} (${targetRegion}) with ${totalAfter} resource(s)${breakdown}?`)) {
@@ -82705,7 +82955,7 @@ function defaultOnlyParameterTemplate(template) {
 */
 async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
 	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
-	const entries = Object.entries(stackState.resources);
+	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
 	const resolver = new IntrinsicFunctionResolver(region);
 	let parameters = {};
@@ -83121,7 +83371,7 @@ const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
 * [#2828](https://github.com/go-to-k/cdkd/issues/2828)).
 */
 async function captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds, rebuiltLogicalIds) {
-	const entries = Object.entries(stackState.resources);
+	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
 		if (resource.observedBaselineRefused === true && !rebuiltLogicalIds.has(logicalId)) {
@@ -92658,4 +92908,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-D30EPjOn.js.map
+//# sourceMappingURL=program-Cl3fCD6-.js.map