@go-to-k/cdkd 0.290.6 → 0.290.7

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $r as CdkdError, En as S3StateBackend, Jr as AwsClients, Kr as clearBucketRegionCache, Qr as AssetError, Tn as LockManager, Vn as AssetPublisher, Wr as AssemblyReader, Xr as resetAwsClients, Yr as getAwsClients, Zr as setAwsClients, _i as SynthesisError, bi as normalizeAwsError, ci as LockError, di as ProvisioningError, ei as ConfigError, en as DiffCalculator, gi as StateError, it as ProviderRegistry, mt as CloudControlProvider, ni as DependencyError, on as DagBuilder, qr as resolveBucketRegion, r as DeployEngine, sn as TemplateParser, tt as IAMRoleProvider, vi as formatError, xr as Synthesizer, yi as isCdkdError } from "./deploy-engine-BU7n9_qY.js";
+import { $r as CdkdError, En as S3StateBackend, Jr as AwsClients, Kr as clearBucketRegionCache, Qr as AssetError, Tn as LockManager, Vn as AssetPublisher, Wr as AssemblyReader, Xr as resetAwsClients, Yr as getAwsClients, Zr as setAwsClients, _i as SynthesisError, bi as normalizeAwsError, ci as LockError, di as ProvisioningError, ei as ConfigError, en as DiffCalculator, gi as StateError, it as ProviderRegistry, mt as CloudControlProvider, ni as DependencyError, on as DagBuilder, qr as resolveBucketRegion, r as DeployEngine, sn as TemplateParser, tt as IAMRoleProvider, vi as formatError, xr as Synthesizer, yi as isCdkdError } from "./deploy-engine-BMp4b4Vl.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-th1myfgh.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-Cl3fCD6-.js → program-Ckl60p0E.js}

@@ -1,8 +1,8 @@
-import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-BU7n9_qY.js";
+import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-BMp4b4Vl.js";
 import { S as truncateCodePoints, _ as withSkipPrefix, b as displayIdent, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BvSdNpMz.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CsdVn4cg.js";
+import { t as getCdkdVersion } from "./version-XcHj8rQZ.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-JRuQeFtl.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -73789,8 +73789,12 @@ function createStateMigrateCommand() {
 * or destroyed out-of-band) are reported at the root level so they stay
 * visible to `cdkd state list` rather than vanishing silently.
 *
-* A self-link (parent equals self) is treated as a missing parent — the
-* node lands at the root rather than building an infinite tree.
+* Every node on a parent LOOP lands at the root rather than building an
+* infinite tree. A self-link (parent equals self) is the one-node loop. A
+* longer one (A names B, B names A) used to be linked as given, so each member
+* was filed as the other's child, none was a root, and the whole loop vanished
+* from both the text and the JSON view. A node hanging off a loop still sits
+* under its parent, which is now visible (issue #3069).
 *
 * The roots and every child list are sorted alphabetically by `stackName`,
 * then by `region` (legacy `undefined` last), so output is stable across
@@ -73803,14 +73807,27 @@ function buildStackTree(entries) {
 		...entry,
 		children: []
 	});
+	const parentOf = (node) => node.parentStack === void 0 ? void 0 : byKey.get(refKey(node.parentStack, node.parentRegion));
+	const loopMembers = /* @__PURE__ */ new Set();
+	const settled = /* @__PURE__ */ new Set();
+	for (const start of byKey.values()) {
+		const path = [];
+		const onPath = /* @__PURE__ */ new Map();
+		let current = start;
+		while (current !== void 0 && !settled.has(current) && !onPath.has(current)) {
+			onPath.set(current, path.length);
+			path.push(current);
+			current = parentOf(current);
+		}
+		if (current !== void 0 && onPath.has(current)) for (const member of path.slice(onPath.get(current))) loopMembers.add(member);
+		for (const node of path) settled.add(node);
+	}
 	const roots = [];
 	for (const node of byKey.values()) {
-		if (node.parentStack !== void 0) {
-			const parent = byKey.get(refKey(node.parentStack, node.parentRegion));
-			if (parent && parent !== node) {
-				parent.children.push(node);
-				continue;
-			}
+		const parent = parentOf(node);
+		if (parent && !loopMembers.has(node)) {
+			parent.children.push(node);
+			continue;
 		}
 		roots.push(node);
 	}
@@ -77456,14 +77473,81 @@ function createExportCommand() {
 //#endregion
 //#region src/cli/commands/state.ts
 /**
-* Render `Stack` or `Stack (region)` — used by every state subcommand's
-* default output mode and ambiguity error messages.
+* The reasons a `--long` row carries for a failed read. FIXED text, never the
+* caught error's message: `getState`'s invalid-JSON refusal interpolates V8's
+* `SyntaxError`, which quotes bytes of the state body, and anyone with
+* `s3:PutObject` on the bucket chooses those bytes. Sanitizing or truncating
+* that message does not redact it, so a planted plaintext would reach both
+* `--long` and `--long --json` (issue #3069). `cdkd state show` for the one
+* stack is where the specific error is reported.
+*
+* The failure is deliberately not classified further: `getState` wraps a parse
+* refusal, the unsupported-version refusal and an AWS read failure in the same
+* `StateError`, so any finer reason would be a guess about the class.
+*/
+const STATE_READ_FAILED_REASON = "state record could not be read; run `cdkd state show` for the error";
+const LOCK_READ_FAILED_REASON = "lock could not be read; run `cdkd state show` for the error";
+/**
+* The lock reason for a LEGACY row (no region). `cdkd state show` refuses such
+* a record before it reads the lock, so pointing there would send the user to
+* a command that never shows the error.
+*/
+const LEGACY_LOCK_READ_FAILED_REASON = "lock could not be read";
+/**
+* The record-side reason for a record that WAS read but whose `resources` is
+* present and not a JSON object. `parseStateBody` validates nothing inside the
+* root, so `Object.keys` would count a planted string per character or a list
+* per element -- a made-up number, and for a string of millions of characters
+* an array of that many keys, built outside {@link readOrFailure}'s `try`. It
+* reuses `stateReadError` so `resourceCount` stays `null` exactly when a reason
+* is set: the text row never prints `Resources: null`, and the warning counts
+* the row (issue #3069).
+*/
+const RESOURCES_MALFORMED_REASON = "resources is not a JSON object; run `cdkd state show --json` to see the record";
+/**
+* A record's resource count, or `null` when its `resources` is not a JSON
+* object ({@link RESOURCES_MALFORMED_REASON}). An absent or `null` bag counts
+* as zero, the tolerance `docs/cli-state.md` documents for it.
+*/
+function resourceCountOrNull(resources) {
+	if (resources === void 0 || resources === null) return 0;
+	if (typeof resources !== "object" || Array.isArray(resources)) return null;
+	return Object.keys(resources).length;
+}
+/**
+* Run one read and report whether it threw, WITHOUT keeping the error. The
+* error is dropped on purpose ({@link STATE_READ_FAILED_REASON} says why): a
+* caller that never holds it cannot copy it into a row.
+*/
+async function readOrFailure(read) {
+	try {
+		return {
+			ok: true,
+			value: await read()
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+/**
+* A record's `lastModified` as an ISO string, or `null` when it is not a
+* timestamp `Date` can represent. `parseStateBody` does not validate the
+* field, and `toISOString()` THROWS a `RangeError` for any number outside
+* JavaScript's date range (`1e300`, `NaN`-producing values, `-1e20`). That
+* throw sits AFTER {@link readOrFailure} reported success, so without this
+* check one planted record would still reject the whole `--long` listing
+* (issue #3069, security review).
 */
-function formatStackRef(ref) {
-	return ref.region ? `${ref.stackName} (${ref.region})` : ref.stackName;
+function isoTimestampOrNull(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return null;
+	const date = new Date(value);
+	return Number.isNaN(date.getTime()) ? null : date.toISOString();
 }
 /**
-* {@link formatStackRef} for a sentence a CONFIRMATION PROMPT renders.
+* Render `Stack` or `Stack (region)` for a line a terminal renders: a
+* CONFIRMATION PROMPT's sentence, and every `state list` text view -- the
+* default one-reference-per-line listing and the `--long` / `--tree` rows
+* (issue #3069). The unsanitized twin it replaced lost its last caller there.
 *
 * Both halves come from an S3 key segment (or, for a legacy record, a state
 * body), so both are attacker-influenced in exactly the way issue #2170 round
@@ -77621,7 +77705,7 @@ async function stateListCommand(options) {
 			return;
 		}
 		if (!options.long && !options.json) {
-			for (const ref of refs) process.stdout.write(`${formatStackRef(ref)}\n`);
+			for (const ref of refs) process.stdout.write(`${formatStackRefSafe(ref)}\n`);
 			return;
 		}
 		if (options.json && !options.long) {
@@ -77634,30 +77718,35 @@ async function stateListCommand(options) {
 		}
 		const details = await Promise.all(refs.map(async (ref) => {
 			const lookupRegion = ref.region ?? "";
-			const [stateResult, locked] = await Promise.all([lookupRegion ? setup.stateBackend.getState(ref.stackName, lookupRegion) : Promise.resolve(null), setup.lockManager.isLocked(ref.stackName, ref.region)]);
-			const state = stateResult?.state;
+			const [stateRead, lockRead] = await Promise.all([readOrFailure(() => lookupRegion ? setup.stateBackend.getState(ref.stackName, lookupRegion) : Promise.resolve(null)), readOrFailure(() => setup.lockManager.isLocked(ref.stackName, ref.region))]);
+			const state = stateRead.ok ? stateRead.value?.state : void 0;
+			const resourceCount = !stateRead.ok ? null : state ? resourceCountOrNull(state.resources) : 0;
 			return {
 				stackName: ref.stackName,
 				region: ref.region ?? null,
-				resourceCount: state ? Object.keys(state.resources ?? {}).length : 0,
-				lastModified: state && typeof state.lastModified === "number" ? new Date(state.lastModified).toISOString() : null,
-				locked
+				resourceCount,
+				lastModified: state ? isoTimestampOrNull(state.lastModified) : null,
+				locked: lockRead.ok ? lockRead.value : null,
+				stateReadError: !stateRead.ok ? STATE_READ_FAILED_REASON : resourceCount === null ? RESOURCES_MALFORMED_REASON : null,
+				lockReadError: lockRead.ok ? null : ref.region ? LOCK_READ_FAILED_REASON : LEGACY_LOCK_READ_FAILED_REASON
 			};
 		}));
+		const degraded = details.filter((d) => d.stateReadError !== null || d.lockReadError !== null);
+		if (degraded.length > 0) logger.warn(`${degraded.length} of ${details.length} stack(s) could not be fully read or counted; their rows say why.`);
 		if (options.json) {
 			process.stdout.write(`${JSON.stringify(details, null, 2)}\n`);
 			return;
 		}
 		const lines = [];
 		for (const detail of details) {
-			lines.push(formatStackRef({
+			lines.push(formatStackRefSafe({
 				stackName: detail.stackName,
 				...detail.region ? { region: detail.region } : {}
 			}));
-			lines.push(`  Region: ${detail.region ?? "(legacy)"}`);
-			lines.push(`  Resources: ${detail.resourceCount}`);
+			lines.push(`  Region: ${detail.region === null ? "(legacy)" : safe$1(detail.region)}`);
+			lines.push(`  Resources: ${detail.stateReadError !== null ? `unknown (${detail.stateReadError})` : String(detail.resourceCount)}`);
 			lines.push(`  Last Modified: ${detail.lastModified ?? "unknown"}`);
-			lines.push(`  Lock: ${detail.locked ? "locked" : "unlocked"}`);
+			lines.push(`  Lock: ${detail.lockReadError !== null ? `unknown (${detail.lockReadError})` : detail.locked ? "locked" : "unlocked"}`);
 			lines.push("");
 		}
 		if (lines.length > 0) {
@@ -77694,12 +77783,13 @@ async function renderTreeMode(refs, stateBackend, asJson) {
 				region: ref.region
 			};
 		}
+		const linkIsValid = typeof state?.parentStack === "string" && (state.parentRegion === void 0 || typeof state.parentRegion === "string");
 		return {
 			stackName: ref.stackName,
 			region: ref.region,
-			...state?.parentStack !== void 0 && { parentStack: state.parentStack },
-			...state?.parentLogicalId !== void 0 && { parentLogicalId: state.parentLogicalId },
-			...state?.parentRegion !== void 0 && { parentRegion: state.parentRegion }
+			...linkIsValid && { parentStack: state.parentStack },
+			...linkIsValid && typeof state?.parentLogicalId === "string" && { parentLogicalId: state.parentLogicalId },
+			...linkIsValid && typeof state?.parentRegion === "string" && { parentRegion: state.parentRegion }
 		};
 	}));
 	const roots = buildStackTree(entries);
@@ -77708,7 +77798,7 @@ async function renderTreeMode(refs, stateBackend, asJson) {
 		return;
 	}
 	if (roots.length === 0) return;
-	const rendered = renderStackTreeAscii(roots, (node) => formatStackRef({
+	const rendered = renderStackTreeAscii(roots, (node) => formatStackRefSafe({
 		stackName: node.stackName,
 		...node.region ? { region: node.region } : {}
 	}));
@@ -92908,4 +92998,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Cl3fCD6-.js.map
+//# sourceMappingURL=program-Ckl60p0E.js.map