@go-to-k/cdkd 0.291.16 → 0.291.18

package/dist/{deploy-engine-yukC8N_f.js → deploy-engine-BwDlgFRs.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
+import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-Bt0RGDfb.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-Qigb_6I0.js";
+import { t as getCdkdVersion } from "./version-CJkb2usU.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -35,10 +35,9 @@ import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } fro
 import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBalancingV2Client } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
-import { isAbsolute as isAbsolute$1, relative, resolve as resolve$1, sep } from "path";
+import { isAbsolute as isAbsolute$1, resolve as resolve$1 } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
 import { inspect } from "node:util";
-import { realpathSync as realpathSync$1 } from "fs";
 import { hostname } from "os";
 import graphlib from "graphlib";
 import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from "@aws-sdk/client-rds";
@@ -3365,7 +3364,9 @@ function assemblyPathEscape(base, bound, candidate) {
 * Modifier Letters block (U+02BA reads as `"`, U+02BC as `'`) plus the ones
 * outside it (U+0374, U+0559, U+07F4-U+07F5, U+A78B-U+A78C, and the halfwidth
 * sound marks U+FF9E-U+FF9F). Not all of `\p{Lm}`: U+30FC is in it, and it is
-* an ordinary character of a Japanese directory name.
+* an ordinary character of a Japanese directory name. `classify` tests
+* {@link DEFAULT_IGNORABLE} first, so that carve-out is a backstop here, kept
+* so the class matches cdk-local's `displayUntrustedValue`.
 */
 const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
 /**
@@ -3375,6 +3376,14 @@ const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Poin
 */
 const COMBINING_MARK = /^\p{M}$/u;
 /**
+* A default-ignorable code point, which draws as NOTHING. Tested before the
+* mark rule, because some are combining marks (U+034F, U+17B4, U+180B, the
+* variation selectors U+FE00-U+FE0F and U+E0100-U+E01EF): after a letter they
+* would otherwise pass as bare, and `/home/me/.ss\u034fh` would print exactly
+* like `.ssh` while naming a different path (go-to-k/cdkd#3656).
+*/
+const DEFAULT_IGNORABLE = /^\p{Default_Ignorable_Code_Point}$/u;
+/**
 * The ASCII a bare path may carry besides letters and digits. Everything else —
 * any whitespace, any quote, any other symbol — takes the boundary, which
 * costs a legitimate path nothing but a pair of quotes.
@@ -3394,6 +3403,10 @@ const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
 function classify(chars) {
 	let afterLetter = false;
 	return chars.map((ch) => {
+		if (DEFAULT_IGNORABLE.test(ch)) {
+			afterLetter = false;
+			return "escaped";
+		}
 		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
 		afterLetter = VISIBLE_LETTER.test(ch);
 		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
@@ -3944,7 +3957,7 @@ var AssemblyReader = class {
 	getStack(assemblyDir, manifest, stackName) {
 		const { stacks, failedStages } = this.readAssembly(assemblyDir, manifest);
 		const stack = stacks.find((s) => s.stackName === stackName);
-		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. ` + (stacks.length > 0 ? `Available: ${stacks.map((s) => displayIdent(s.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })).join(", ")}` : "The assembly has no stacks") + failedStageNote([stackName], failedStages));
+		if (!stack) throw new SynthesisError(`Stack ${displayStackName(stackName)} not found in assembly. ` + (stacks.length > 0 ? `Available: ${stacks.map((s) => displayIdent(s.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })).join(", ")}` : "The assembly has no stacks") + failedStageNote([stackName], failedStages));
 		return stack;
 	}
 	/**
@@ -3964,7 +3977,7 @@ var AssemblyReader = class {
 			const props = artifact.properties;
 			if (props?.file) {
 				const resolved = resolveAssemblyPath(assemblyDir, props.file);
-				if (!resolved.contained) throw new SynthesisError(`Asset manifest artifact '${displaySafe(artifactId)}' has file=${displayAssemblyPath(props.file)} which ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				if (!resolved.contained) throw new SynthesisError(`Asset manifest artifact ${displayStackName(artifactId)} has file=${displayAssemblyPath(props.file)} which ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
 				map.set(artifactId, resolved.path);
 			}
 		}
@@ -3977,16 +3990,16 @@ var AssemblyReader = class {
 		const props = artifact.properties;
 		const stackName = props?.stackName || artifactId;
 		const templateFile = props?.templateFile;
-		if (!templateFile) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has no templateFile property`);
+		if (!templateFile) throw new SynthesisError(`Stack ${displayStackName(stackName)} has no templateFile property`);
 		const resolvedTemplate = resolveAssemblyPath(assemblyDir, templateFile);
-		if (!resolvedTemplate.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has templateFile=${displayAssemblyPath(templateFile)} which ${renderAssemblyPathEscape(resolvedTemplate, assemblyDir)}`);
+		if (!resolvedTemplate.contained) throw new SynthesisError(`Stack ${displayStackName(stackName)} has templateFile=${displayAssemblyPath(templateFile)} which ${renderAssemblyPathEscape(resolvedTemplate, assemblyDir)}`);
 		const templatePath = resolvedTemplate.path;
 		let template;
 		try {
 			const content = readFileSync(templatePath, "utf-8");
 			template = JSON.parse(content);
 		} catch (error) {
-			throw new SynthesisError(`Failed to read template for stack '${displaySafe(stackName)}': ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
+			throw new SynthesisError(`Failed to read template for stack ${displayStackName(stackName)}: ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
 		this.logger.debug(`Stack: ${displaySafe(stackName)}, Resources: ${Object.keys(template.Resources ?? {}).length}`);
 		let assetManifestPath;
@@ -4005,7 +4018,7 @@ var AssemblyReader = class {
 				if (depName !== stackName) dependencyNames.push(depName);
 			}
 		}
-		if (dependencyNames.length > 0) this.logger.debug(`Stack '${displaySafe(stackName)}' depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
+		if (dependencyNames.length > 0) this.logger.debug(`Stack ${displayStackName(stackName)} depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
 		if (artifact.environment) env = parseEnvironment(artifact.environment);
 		const nestedTemplates = nullPrototypeRecord();
@@ -4013,9 +4026,9 @@ var AssemblyReader = class {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 			const assetPath = resource.Metadata?.["aws:asset:path"];
 			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack ${displayStackName(stackName)} nested-stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 			const resolvedNested = resolveAssemblyPath(assemblyDir, assetPath);
-			if (!resolvedNested.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
+			if (!resolvedNested.contained) throw new SynthesisError(`Stack ${displayStackName(stackName)} nested-stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
 			nestedTemplates[logicalId] = resolvedNested.path;
 		}
 		return {
@@ -5115,6 +5128,10 @@ function canonicalizeRegion(region) {
 * the COMMERCIAL suffix, so `parseEcrRegistryHost` (`src/utils/ecr-uri.ts`)
 * rejected it under the strict host check issue #1758 added and the image was
 * classified `public` — anonymous pull, no `docker login`, opaque failure.
+* `parseEcrRegistryHost` is stricter than this fallback (issue #3670): a
+* region whose PREFIX no partition row knows (`nz-north-1`) is refused there,
+* and reported by `looksLikeEcrHostWithForeignSuffix`, until its partition's
+* `regionRegex` is added to `AWS_REGION_ID` in `src/utils/ecr-uri.ts`.
 *
 * The region is CANONICALIZED through {@link canonicalizeRegion} before the
 * prefix tests (issue [#1795](https://github.com/go-to-k/cdkd/issues/1795)),
@@ -7378,12 +7395,12 @@ var Synthesizer = class {
 		else if (accountId) stateBucket = `cdkd-state-${accountId}`;
 		else {
 			const oversize = stacksWithMacros.find((s) => JSON.stringify(s.template).length > 51200);
-			if (oversize) throw new SynthesisError(`Stack '${displaySafe(oversize.stackName)}' uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
+			if (oversize) throw new SynthesisError(`Stack ${displayStackName(oversize.stackName)} uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
 			stateBucket = void 0;
 		}
 		for (const stack of stacksWithMacros) {
 			const macros = enumerateMacros(stack.template);
-			this.logger.info(`[macros] Expanding CloudFormation macros for stack '${displaySafe(stack.stackName)}' via CFn round-trip (transforms: ${macros.map((m) => displaySafe(m)).join(", ")}; may take 30-60s)...`);
+			this.logger.info(`[macros] Expanding CloudFormation macros for stack ${displayStackName(stack.stackName)} via CFn round-trip (transforms: ${macros.map((m) => displaySafe(m)).join(", ")}; may take 30-60s)...`);
 			const before = Date.now();
 			const expanded = await expandMacros(stack.template, {
 				region,
@@ -7536,14 +7553,14 @@ function resolveFileAssetSourcePath(manifestDir, asset, opts) {
 		const absolute = resolve$1(asset.source.path);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
 		if (escape !== void 0) warnAbsoluteAssetPath({
-			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			subject: `File asset ${displayAssemblyPath(asset.displayName)}`,
 			field: "source.path",
 			absolute,
 			escape,
 			sink
 		});
 		else if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource({
-			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			subject: `File asset ${displayAssemblyPath(asset.displayName)}`,
 			field: "source.path",
 			outdir: absolute,
 			sink
@@ -7553,14 +7570,14 @@ function resolveFileAssetSourcePath(manifestDir, asset, opts) {
 	const resolved = resolveAssemblyPath(manifestDir, asset.source.path, { containWithin: assetOutdir });
 	if (!resolved.contained && namesTheSameDirectory(assetOutdir, resolved.path)) {
 		warnWholeAssemblyAsSource({
-			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			subject: `File asset ${displayAssemblyPath(asset.displayName)}`,
 			field: "source.path",
 			outdir: resolved.path,
 			sink
 		});
 		return resolved.path;
 	}
-	if (!resolved.contained) throw new Error(`File asset '${displaySafe(asset.displayName)}' has source.path=${displayAssemblyPath(asset.source.path)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
+	if (!resolved.contained) throw new Error(`File asset ${displayAssemblyPath(asset.displayName)} has source.path=${displayAssemblyPath(asset.source.path)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
 	return resolved.path;
 }
 /**
@@ -7596,7 +7613,7 @@ var AssetManifestLoader = class {
 	*/
 	async loadManifest(cdkOutputDir, stackName) {
 		const resolved = resolveAssemblyPath(cdkOutputDir, `${stackName}.assets.json`);
-		if (!resolved.contained) throw new Error(`Asset manifest for stack '${displaySafe(stackName)}' ${renderAssemblyPathEscape(resolved, cdkOutputDir)}`);
+		if (!resolved.contained) throw new Error(`Asset manifest for stack ${displayStackName(stackName)} ${renderAssemblyPathEscape(resolved, cdkOutputDir)}`);
 		const manifestPath = resolved.path;
 		try {
 			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
@@ -9559,63 +9576,7 @@ function resolveDockerContextDirectory(opts) {
 }
 /** One spelling of the warning subject, so the two arms cannot drift. */
 function dockerSubject(assetId) {
-	return assetId === void 0 ? "A Docker asset" : `Docker asset '${displaySafe(assetId)}'`;
-}
-/**
-* Refuse a Docker asset whose build context the bundled `cdk-local` engine
-* would take from outside the assembly (issue
-* [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
-*
-* `cdk-local`'s own `buildDockerImage` spells the context (and the
-* `executable` arm's cwd) as `${cdkOutDir}/${source.directory}` with no
-* containment, and cdkd cannot hand it a pre-resolved path without changing
-* the image tag it derives from `source`. So this judges the path the engine
-* WILL open, before the engine runs, through the same
-* {@link resolveDockerContextDirectory} cdkd's own build uses.
-*
-* An ABSOLUTE value is judged by the engine's spelling, not honoured: the
-* concatenation folds it UNDER the manifest directory, so its leading
-* separators are stripped and the remainder takes the relative arm. That
-* keeps a symlink inside the assembly from becoming an escape through an
-* absolute spelling, and keeps the honour-and-warn arm, which describes a
-* build this engine never performs, out of these paths.
-*/
-function assertCdkLocalDockerContextContained(opts) {
-	const { manifestDir, source, assetOutdir, wrapError } = opts;
-	const directory = source.directory;
-	if (!directory) return;
-	const asEngineJoinsIt = isAbsolute$1(directory) ? directory.replace(/^[/\\]+/, "") : directory;
-	resolveDockerContextDirectory({
-		manifestDir,
-		directory: asEngineJoinsIt,
-		wrapError,
-		assetOutdir,
-		sink: source.executable && source.executable.length > 0 ? "run this asset's source.executable with that directory as its working directory" : "send that directory to docker build as the context of an image cdkd then runs locally"
-	});
-	const engineSpelled = `${manifestDir}/${asEngineJoinsIt}`;
-	const physical = tryRealpathNative(engineSpelled);
-	if (physical === void 0) return;
-	const bound = tryRealpathNative(assetOutdir) ?? resolve$1(assetOutdir);
-	const rel = relative(bound, physical);
-	if (rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute$1(rel)) return;
-	throw wrapError(`asset source.directory=${displayAssemblyPath(directory)} which ` + renderAssemblyPathEscape({
-		contained: false,
-		escape: "symlink",
-		path: engineSpelled,
-		realPath: physical
-	}, assetOutdir, "build it"));
-}
-/**
-* `realpath(3)`, or `undefined` when the path does not resolve. `.native` is
-* load-bearing: the JavaScript `realpathSync` folds `..` lexically first,
-* which is the very reading the check above exists to avoid.
-*/
-function tryRealpathNative(p) {
-	try {
-		return realpathSync$1.native(p);
-	} catch {
-		return;
-	}
+	return assetId === void 0 ? "A Docker asset" : `Docker asset ${displayIdent(assetId)}`;
 }
 /**
 * Build a Docker image from a CDK asset source. Returns the local image
@@ -24505,9 +24466,9 @@ function inspectCommand(stackName, region) {
 * entries FIRST ({@link repairMalformedResourceEntriesForReadOnly}), so the
 * row is reported once, as unreadable, rather than warned about as a preview
 * and then dropped. The object test stays here rather than
-* {@link isReadableResourceEntry} because the deploy path takes this
-* predicate WITHOUT the entry one, and narrowing it would let a typeless
-* object with a torn map reach the comparison unrefused. Likewise a `resources` bag that is not readable at all
+* {@link isReadableResourceEntry} so this verdict does not depend on the entry
+* guard running first: narrowing it would let a typeless object with a torn
+* map through any caller that takes this predicate alone. Likewise a `resources` bag that is not readable at all
 * yields `[]` here rather than ids invented from a string's characters — that
 * class is {@link hasReadableResources}'s to report. What a caller must not do
 * is take only this one.
@@ -25165,13 +25126,10 @@ function malformedResourceEntriesWarning(rawStackName, rawRegion, logicalIds) {
 * `logicalId` is not a string arrives as `''` and renders as the
 * `UNRENDERABLE` stand-in.
 */
-function malformedOrphanRecordsWarning(rawStackName, rawRegion, logicalIds) {
+function malformedOrphanRecordsWarning(rawStackName, rawRegion, logicalIds, alsoRejectsTornMaps) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
-	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
-	const more = rest > 0 ? ` and ${rest} more` : "";
-	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${named}${more} — because they are not objects, or carry no resource type. Continuing WITHOUT them: they are not previewed for adoption. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. See the stored values with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${namedOrphanRows(logicalIds)} — because they are not objects, have no string 'logicalId' or share it with another row, or their 'state' is not an object, names no resource type${alsoRejectsTornMaps ? ", has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object" : ` or has no non-empty string 'physicalId'`}. Continuing WITHOUT them: ${alsoRejectsTornMaps ? `they are excluded from the secret scan, so nothing this run does can certify them` : "they are not previewed for adoption, and 'cdkd deploy' refuses the record over them rather than dropping them as this command does"}. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. See the stored values with: ` + inspectCommand(stackName, region);
 }
 /**
 * The half the refusal and the warning share: what is wrong and which entries.
@@ -25210,6 +25168,46 @@ function malformedResourceEntriesRefusalMessage(rawStackName, rawRegion, logical
 	return `${namedEntriesClause(stackName, region, logicalIds)} This command can WRITE state, so it refuses rather than skipping them: saving over the record would report a clean run for entries nothing could read, and would leave the next command to fail on them with no more to go on. Nothing was locked, read from AWS or written FOR THIS STACK. Inspect it with: ` + inspectCommand(stackName, region);
 }
 /**
+* For `cdkd deploy`: refuse a record whose `resources` map holds a ROW that is
+* not a readable resource record (go-to-k/cdkd#3314). TWO call sites, one
+* verdict. `DeployEngine`'s state load is the one a deploy hits: two walks run
+* between the load and the diff (the CLI's prefix-migration gate and the
+* observed-state auto-refresh) and each died on a `null` row with a bare
+* `TypeError`. `DiffCalculator.calculateDiff` also calls it, beside
+* {@link refuseMalformedResourceProperties}, because that is where the verdict
+* is made. Any other caller of the diff that forgets gets the refusal.
+*
+* The harm is the diff's verdict, not a save. The diff looks up each template
+* resource by logical id, so a `null` (or any non-object) row reads as "not in
+* state" and is planned as a CREATE. That either collides with the live
+* resource's name or creates a SECOND copy and orphans the first. A row with no
+* `resourceType` compares unequal to the template's type, so it is planned as a
+* TYPE CHANGE, which is a replacement.
+*
+* A third entry point on the ENTRY class rather than a call to
+* {@link refuseMalformedResourceEntries}, whose text is false here. That text
+* says "Nothing was locked", but the deploy holds its lock at both sites. Same
+* predicate, so the verdict cannot diverge.
+*
+* The engine passes its own resolved stack and region. `calculateDiff` holds no
+* trusted pair and passes neither (see {@link stackClause}).
+*/
+function refuseMalformedResourceEntriesForDeploy(state, stackName, region) {
+	const unreadable = unreadableResourceEntries(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedDeployResourceEntriesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The text {@link refuseMalformedResourceEntriesForDeploy} raises. Like
+* {@link malformedResourcePropertiesRefusalMessage}, it must be true under
+* `--dry-run` too, since the dry-run return comes after the diff.
+*/
+function malformedDeployResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a row that is not an object reads as a resource cdkd does not manage, so the template's resource of that id is planned as a CREATE (a second copy of a live resource, or a name collision), and a row with no resource type is planned as a TYPE CHANGE, which replaces the live resource. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack without those rows and warns that it did. Inspect the record with: ` + inspectCommand(stackName, region);
+}
+/**
 * For `cdkd orphan`: refuse a record whose SURVIVING `resources` entries are
 * not readable resource records (go-to-k/cdkd#3350).
 *
@@ -25303,12 +25301,177 @@ function malformedOrphanResourceAttributesRefusalMessage(rawStackName, rawRegion
 	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} resource record(s) whose 'attributes' map cannot be read — ${named}${more} — because it is null or not an object. The record is malformed or truncated. 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses. The map is carried into the save VERBATIM, and a list is walked, so its rewrites are recorded into a container that is still not a map. It is the cache a later 'cdkd deploy' reads another resource's 'Fn::GetAtt' of this one from, so continuing would report success over the one map that read depends on.`, SURVIVOR_THIRD_WAY_OUT);
 }
 /**
+* Is ONE `orphans[]` record PREVIEWABLE — the narrow half of
+* {@link isReadableOrphanRecord}, for `cdkd diff` alone (go-to-k/cdkd#3500).
+*
+* An object, a string `logicalId`, and a `state` that is a readable resource
+* entry with a non-empty string `physicalId`: everything the adoption preview
+* dereferences, and nothing more. The `physicalId` half is NOT inherited from
+* {@link isReadableResourceEntry} — see {@link hasStringPhysicalId} for why that
+* one stops at `resourceType` and why a ROW cannot. It
+* deliberately does not ask about that entry's `properties`, because `cdkd diff`
+* has a LATER answer for that one — `computeStackDiff` runs the `properties`
+* repair a second time over the adopted records and names what it emptied, which
+* `docs/cli-diff.md` and `.claude/rules/state-malformed-properties.md` both
+* describe. Dropping such a row here instead would make that repair unreachable
+* and silently retire a documented report. A torn `attributes` map rides through
+* for the same reason and gets NO later answer: stated rather than solved, and
+* the same residual `cdkd diff` had before this predicate existed.
+*
+* It CANNOT see rows sharing a `logicalId` (go-to-k/cdkd#3643), a LIST-level
+* defect — never filter a list with it alone; take
+* {@link previewableOrphanRecords} / {@link unpreviewableOrphanRecords}.
+*
+* Every WRITER takes the full predicate: none of them has a second answer, and
+* a torn `properties` map reaching a save is go-to-k/cdkd#3344's defect.
+*/
+function isPreviewableOrphanRecord(record) {
+	if (!isReadableBag(record)) return false;
+	if (typeof record.logicalId !== "string") return false;
+	const entry = record.state;
+	return isReadableResourceEntry(entry) && hasStringPhysicalId(entry);
+}
+/**
+* Does this resource entry carry a NON-EMPTY string `physicalId`?
+*
+* Its own helper rather than a clause spelled in each row predicate, so the two
+* cannot drift on it, and deliberately NOT folded into
+* {@link isReadableResourceEntry}: that one answers for a `resources` ENTRY,
+* where stopping at `resourceType` is a recorded decision — a row with a type and
+* no physical id fails per-resource where it is used and is reported by that
+* command in its own terms.
+*
+* An `orphans` ROW has no such second report, which is why it asks for more
+* (go-to-k/cdkd#3641 review). The record names a resource cdkd deliberately LEFT
+* LIVE in AWS, so the physical id is the only handle on it: `cdkd destroy`'s
+* pre-confirmation listing is the operator's only notice before the record is
+* deleted, and it rendered an absent id as an EMPTY field in the row they
+* approve. `planOrphanAdoption` dereferences it eight times over — including
+* `knownPhysicalId` on the provider call and `claims().has(...)` for a
+* cross-stack collision — so a row without one decides an adoption from
+* `undefined`.
+*/
+function hasStringPhysicalId(entry) {
+	const physicalId = entry.physicalId;
+	return typeof physicalId === "string" && physicalId !== "";
+}
+/**
+* The `orphans[]` records {@link isPreviewableOrphanRecord} rejects, PLUS every
+* row sharing its string `logicalId` with another row (go-to-k/cdkd#3643),
+* named the way {@link unreadableOrphanRecords} names its own.
+*/
+function unpreviewableOrphanRecords(state) {
+	if (!Array.isArray(state.orphans)) return [];
+	const rows = state.orphans;
+	const shared = sharedOrphanLogicalIds(rows);
+	return rows.filter((record) => !isPreviewableOrphanRecord(record) || sharesLogicalId(record, shared)).map(orphanRowName);
+}
+/**
+* The rows `cdkd diff` KEEPS for the adoption preview: the complement of
+* {@link unpreviewableOrphanRecords}, homed beside it so the two cannot
+* disagree about a row (go-to-k/cdkd#3643). `[]` for a container that is not a
+* list, which {@link hasReadableOrphans} reports.
+*
+* Why not `orphans.filter(isPreviewableOrphanRecord)` at the call site, which is
+* what `cdkd diff` did: that predicate decides ONE record, and a shared
+* `logicalId` is a property of the LIST. Two rows carrying one id both pass it,
+* and `planOrphanAdoption` then keys its adoption map on that id, so the preview
+* shows ONE adoption for two rows — the collapse the writers now refuse.
+*/
+function previewableOrphanRecords(state) {
+	if (!Array.isArray(state.orphans)) return [];
+	const rows = state.orphans;
+	const shared = sharedOrphanLogicalIds(rows);
+	return rows.filter((record) => isPreviewableOrphanRecord(record) && !sharesLogicalId(record, shared));
+}
+/**
+* The string `logicalId`s that TWO OR MORE rows of `orphans` carry
+* (go-to-k/cdkd#3643) — `''` included, since an empty string is still a key.
+*
+* Such a record is MALFORMED, not merely unusual: no supported writer produces
+* one, because `orphansAfterRollback` merges by `logicalId` and keeps one row per
+* id. What a reader does with it is the loss the row predicate exists to refuse
+* for a MISSING id — `orphansAfterRollback` keeps only the LAST of the rows, and
+* the deploy's adoption pass writes `adopted[logicalId]` for each, so the first
+* row's resource stays live in AWS with nothing tracking it.
+*
+* Counted over EVERY row that is an object carrying a string id, not only the
+* rows the per-record predicate accepts: a torn row and a healthy one sharing an
+* id still say the record was edited or damaged, and keeping the healthy one
+* would have a read-only command preview, as the stack's only row of that id, a
+* row whose twin the writers refuse over. A `Map` rather than a plain object, so
+* an id spelled `__proto__` or `constructor` is counted rather than resolved
+* through the prototype.
+*/
+function sharedOrphanLogicalIds(rows) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const record of rows) {
+		if (!isReadableBag(record)) continue;
+		const id = record.logicalId;
+		if (typeof id !== "string") continue;
+		seen.set(id, (seen.get(id) ?? 0) + 1);
+	}
+	const shared = /* @__PURE__ */ new Set();
+	for (const [id, count] of seen) if (count > 1) shared.add(id);
+	return shared;
+}
+/** Does this row carry one of the {@link sharedOrphanLogicalIds}? */
+function sharesLogicalId(record, shared) {
+	if (shared.size === 0 || !isReadableBag(record)) return false;
+	const id = record.logicalId;
+	return typeof id === "string" && shared.has(id);
+}
+/**
+* How every `orphans` ROW helper names a row: its `logicalId`, or `''`
+* (rendered as the `UNRENDERABLE` stand-in) when it has no string one.
+*/
+function orphanRowName(record) {
+	const id = isReadableBag(record) ? record.logicalId : void 0;
+	return typeof id === "string" ? id : "";
+}
+/**
+* Is ONE `orphans[]` record usable by a reader (go-to-k/cdkd#3500)?
+*
+* Split out of {@link unreadableOrphanRecords} rather than written a second
+* time, so the five WRITE-capable readers that take a row's fields off the cast
+* and the `cdkd orphan` refusal that predates them cannot disagree about which
+* rows are usable. `cdkd diff` deliberately disagrees for one class — see
+* {@link isPreviewableOrphanRecord}, which is the narrower half it takes. The two shapes answer different questions and share this verdict:
+* this one decides ONE record, that one names every record a state fails on.
+*
+* A reader needs all of it to hold, because it reaches the record as a WHOLE:
+* the record is an object, its `logicalId` is a string (a row with none keys
+* `orphansAfterRollback`'s merge map on `undefined`, so several of them collapse
+* into one), its `state` is a readable resource entry carrying a NON-EMPTY string
+* `physicalId` ({@link hasStringPhysicalId} carries why that is asked here and
+* not for a `resources` entry), and that entry's `properties` and `attributes`
+* maps are readable.
+*
+* It CANNOT see the one LIST-level defect: two rows sharing a string `logicalId`
+* collapse in the same merge map, and each of them passes this test
+* (go-to-k/cdkd#3643). So never filter a list with it alone — take
+* {@link unreadableOrphanRecords} (or, for `cdkd diff`,
+* {@link previewableOrphanRecords}), which add that check.
+*/
+function isReadableOrphanRecord(record) {
+	if (!isPreviewableOrphanRecord(record)) return false;
+	const entry = record.state;
+	return isReadableBag(entry.properties) && hasReadableAttributes(entry);
+}
+/**
 * The `orphans[]` records a reader cannot use: a record that is not an object
-* or has no string `logicalId`, whose `state` is not a readable resource entry,
-* or whose `state` carries an unreadable `properties` or `attributes` map
+* or has no string `logicalId`, or whose `state` is not a readable resource entry,
+* carries no non-empty string `physicalId`, or carries an unreadable `properties`
+* or `attributes` map
 * (go-to-k/cdkd#3344). The `logicalId` half is go-to-k/cdkd#3500's row
-* predicate: rows with none all key one map entry, and `orphansAfterRollback`
-* collapses them into one.
+* predicate: rows MISSING one all key the same map entry, and
+* `orphansAfterRollback` collapses those into one. EVERY row whose string
+* `logicalId` another row also carries is named too — each of them, since
+* nothing says which is the live resource (go-to-k/cdkd#3643,
+* {@link sharedOrphanLogicalIds}): those collapse in the same map by the same
+* mechanism, and it is the check {@link isReadableOrphanRecord} cannot make.
+* Folded in HERE so every refusal, the read-only repair and `cdkd orphan`
+* inherit it and no caller re-spells it.
 *
 * Every `ResourceState` question the `resources` side answers in separate
 * predicates, asked in ONE here: a rollback-orphan record is reached only as a
@@ -25321,15 +25484,100 @@ function malformedOrphanResourceAttributesRefusalMessage(rawStackName, rawRegion
 */
 function unreadableOrphanRecords(state) {
 	if (!Array.isArray(state.orphans)) return [];
-	return state.orphans.filter((record) => {
-		if (!isReadableBag(record)) return true;
-		if (typeof record.logicalId !== "string") return true;
-		const entry = record.state;
-		return !isReadableResourceEntry(entry) || !isReadableBag(entry.properties) || !hasReadableAttributes(entry);
-	}).map((record) => {
-		const id = isReadableBag(record) ? record.logicalId : void 0;
-		return typeof id === "string" ? id : "";
-	});
+	const rows = state.orphans;
+	const shared = sharedOrphanLogicalIds(rows);
+	return rows.filter((record) => isUnusableOrphanRow(record, shared)).map(orphanRowName);
+}
+/**
+* The writers' per-row verdict with the list-level half applied: the ONE test
+* {@link unreadableOrphanRecords} names by and
+* {@link repairMalformedOrphanRecordsForReadOnly} drops by, so the rows a
+* dry run drops are exactly the rows the real run refuses over.
+*/
+function isUnusableOrphanRow(record, shared) {
+	return !isReadableOrphanRecord(record) || sharesLogicalId(record, shared);
+}
+/**
+* Refuse a readable `orphans` list holding a record no reader can use, on a
+* path that can WRITE state (go-to-k/cdkd#3500).
+*
+* The CONTAINER pair beside this one ({@link refuseMalformedOrphans} and its
+* destroy twin) answers "is the field a list"; this answers "is every row in it
+* usable", and a list can fail the second while passing the first. One
+* predicate for both questions would be wrong in the direction that loses
+* evidence: `cdkd diff` repairs the container and must DROP a row, which is not
+* the same verdict.
+*
+* Marked non-retryable for {@link refuseMalformedOrphans}'s reason: a retry
+* cannot change a persisted record, and a nested child's deploy runs inside a
+* `withRetry`.
+*
+* It takes NO `LockRecoveryContext`, matching its container twin
+* {@link refuseMalformedOrphans}: no caller on these paths holds one, and a
+* parameter every call site omits renders nothing. The message builder keeps its
+* own `recovery` parameter, and its arms are pinned by calling it directly —
+* `refuseMalformedOrphansForOrphan` is NOT that route, since it raises a
+* different text ({@link malformedOrphansForOrphanRefusalMessage}).
+*/
+function refuseMalformedOrphanRecords(state, stackName, region) {
+	const unreadable = unreadableOrphanRecords(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedOrphanRecordsRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The DESTROY twin of {@link refuseMalformedOrphanRecords}, carrying its own
+* text for the reason the container pair splits: a destroy neither walks the
+* record back into `resources` nor writes a reshaped one, so the writer text's
+* mechanism would be false here. What it does instead is REPORT the rows — the
+* operator's only notice that those resources stop being tracked — from fields
+* it never validates, and then remove the record.
+*/
+function refuseMalformedOrphanRecordsForDestroy(state, stackName, region) {
+	const unreadable = unreadableOrphanRecords(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedOrphanRecordsForDestroyRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The WRITER text {@link refuseMalformedOrphanRecords} raises.
+*
+* Its mechanism clause names THREE outcomes rather than one, because a reader
+* meets a different one per shape: a row MISSING its `logicalId` keys
+* `orphansAfterRollback`'s merge map on `undefined`, so rows missing it collapse
+* to one saved survivor (distinct NUMERIC ids do not — they stay distinct keys),
+* and rows SHARING a string one collapse the same way (go-to-k/cdkd#3643);
+* a row whose `state` is absent or null aborts wherever it is first
+* dereferenced; and a `state` that is a primitive or names no resource type
+* reads as `undefined` and is carried or reported as though it were a record.
+*/
+function malformedOrphanRecordsRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. This command can WRITE state, and what it would do with such a row is not one thing: 'cdkd rollback' merges by 'logicalId', so rows MISSING one, or SHARING one, key the same entry and only one of them survives into the record it saves, the others' resources left live in AWS with nothing tracking them; a row whose 'state' is absent or null aborts wherever it is first dereferenced, with an error naming neither the field nor the stack; and the quietest shape is neither — a 'state' that is a primitive, or an object naming no resource type, reads as 'undefined' and is carried or reported as if it were a record. It refuses rather than pick one of those outcomes.`, "Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
+}
+/** The DESTROY text {@link refuseMalformedOrphanRecordsForDestroy} raises. */
+function malformedOrphanRecordsForDestroyRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. This command DELETES state, and the record is the only evidence that those resources are live in AWS — so it refuses over any part of a row it cannot read rather than removing evidence it could not fully report. What the DAMAGE costs the report depends on which part is torn: the listing that tells you which resources stop being tracked prints the row's own 'logicalId', resource type and physical id, from fields nothing else validates, so it can abort before the confirmation naming nothing, or print a row with a field missing and let you approve the delete. A torn 'properties' or 'attributes' map the listing never reads is refused too, because what is discarded is the whole record. So are rows sharing one 'logicalId', though the listing would print each: no cdkd command writes such a record — the rollback save merges by id and every other save carries the list unchanged — so it was damaged or edited by hand, and deleting it would discard it before anyone decides which of those resources the stack still owns.`, "Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
+}
+/**
+* The READ-ONLY disposition for the same rows: DROP them and return their
+* names, for a command that never writes the record back — `cdkd scrub
+* --dry-run` today.
+*
+* Returns the dropped names rather than a boolean because its caller reports
+* them: `cdkd scrub --dry-run` warns with them by name, and the stack joins the
+* audited-record refusal's list. `cdkd diff` does NOT call this — it needs the
+* narrower {@link isPreviewableOrphanRecord} and keeps the survivors itself. An
+* empty return means nothing was dropped and the list is untouched.
+*/
+function repairMalformedOrphanRecordsForReadOnly(state) {
+	const unreadable = unreadableOrphanRecords(state);
+	if (unreadable.length === 0) return [];
+	const rows = state.orphans ?? [];
+	const shared = sharedOrphanLogicalIds(rows);
+	state.orphans = rows.filter((record) => !isUnusableOrphanRow(record, shared));
+	return unreadable;
 }
 /**
 * For `cdkd orphan`: refuse a record whose `orphans` list, or any record in
@@ -25353,6 +25601,87 @@ function refuseMalformedOrphansForOrphan(state, stackName, region, recovery) {
 	if (unreadable.length === 0) return;
 	throw new CdkdError(malformedOrphansForOrphanRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
 }
+/**
+* The `--fail` / exit-3 reason `cdkd diff` reports for an `orphans` row it KEEPS
+* in the preview and `cdkd deploy` REFUSES (go-to-k/cdkd#3641 maintainer review,
+* M1).
+*
+* The two predicates disagree on exactly one class — a row whose `properties` or
+* `attributes` map is torn — and that disagreement is deliberate: `cdkd diff`
+* keeps such a row so the second `properties` repair can name it. What was
+* missing is the OTHER half of keeping it: the deploy refuses the whole record
+* over that same row, so a preview that says nothing lets `cdkd diff --fail`
+* exit 0 and the deploy the operator runs next refuse. That is the contract
+* `cdkd diff` states for the adoption preview, and this PR is what made it
+* false. Precisely which shapes: a torn `attributes` map, and a torn `properties`
+* map on a row the adoption did NOT take — an ADOPTED torn-`properties` row was
+* already refused at deploy through `calculateDiff` before this lane
+* (go-to-k/cdkd#3641 item o5), and it is the one the sibling arm reports.
+*
+* Homed HERE rather than in `diff-recursive.ts` for the reason every text in
+* this module is: it renders untrusted logical ids, so it needs
+* {@link namedOrphanRows} — the same cap, the same `displayLogicalId`, the same
+* `UNRENDERABLE` stand-in. It NAMES the rows as well as counting them, unlike
+* {@link deployRefusesPropertiesReason}'s count-only line in that file. It keeps
+* the names even though {@link malformedOrphanRowsKeptWarning} now names them
+* too: this reason ships in the `--json` payload, where "see the warning above"
+* has no referent — the same argument that sibling's doc makes for its own
+* shape.
+*/
+function deployRefusesOrphanRowsReason(logicalIds) {
+	return `${logicalIds.length} rollback-orphan record(s) in 'orphans' — ${namedOrphanRows(logicalIds)} — carry a 'properties' or 'attributes' map that cannot be read. This preview KEEPS them, so any adoption shown for them is one 'cdkd deploy' will not perform: it refuses the record over the same rows, and the deploy this previews will not start.`;
+}
+/**
+* The WARNING `cdkd diff` prints for an `orphans` row it KEEPS and a writer
+* refuses (go-to-k/cdkd#3641 maintainer round 2, M1 continued).
+*
+* At every node the RUN REACHES with an adoption preview, which is narrower than
+* "every node" and the difference is not pedantry (round 4): a non-recursive run —
+* the default — returns before visiting any child, a state-only child being
+* DELETED is built with no `previewOrphanAdoption` so the whole row pass is
+* skipped, and any other caller omitting that option skips it too.
+*
+* The exit-3 reason beside this one is TOP-LEVEL only, which is
+* go-to-k/cdkd#3335's scope decision and right: the deploy skips an unchanged
+* nested-stack row, so a reason there would report a refusal over a deploy that
+* succeeds. What made that split SAFE for every other class is that each one
+* still warns at every node — and this class had no warning at all, because the
+* row is KEPT and {@link malformedOrphanRecordsWarning} speaks only for rows that
+* were DROPPED. So a changed nested child holding such a row printed nothing and
+* its deploy refused.
+*
+* It says what the row IS and what the deploy will do, and makes no claim about
+* what else happens to the row — which is where the first two spellings went
+* wrong (go-to-k/cdkd#3641 rounds 3 and 4). One said the map "is repaired and
+* named again over the records an adoption takes", false for every row that
+* survives the caller's subtraction; the next said nothing else repairs or
+* previews these rows, false for an ADOPTED row whose `properties` are healthy and
+* whose `attributes` are torn — the subtraction removes adopted torn-`properties`
+* names, not every adopted row, and `planOrphanAdoption` rebuilds that row's
+* attributes and previews the adopted resource. The row's disposition beyond
+* "kept" is the caller's business, not this sentence's.
+*
+* It says the deploy of THIS stack refuses, not that "the deploy this previews"
+* will not start (round 4 again): under `--recursive` this warning can name a row
+* in an UNCHANGED nested child, whose parent deploy skips that child and
+* succeeds. The stack the message already names is the one whose deploy refuses.
+*/
+function malformedOrphanRowsKeptWarning(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' — ${namedOrphanRows(logicalIds)} — whose 'properties' or 'attributes' map is not an object. This preview KEEPS them. 'cdkd deploy' of THIS stack does NOT: it refuses the whole record over these rows and will not start until they are repaired. See the stored values with: ` + inspectCommand(stackName, region);
+}
+/**
+* The `<ids> and N more` fragment every `orphans` ROW text shares — the three
+* refusals and the warning — so a fifth cannot spell the cap differently
+* (go-to-k/cdkd#3500). Derive the list with
+* `grep -n "namedOrphanRows(" src/state/malformed-resources-bag.ts`.
+*/
+function namedOrphanRows(logicalIds) {
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
+	return `${named}${rest > 0 ? ` and ${rest} more` : ""}`;
+}
 /** See {@link orphanRefusal}'s `dropCaveat`. */
 const ORPHANS_DROP_CAVEAT = "; it also discards the 'orphans' list, the only record of resources an earlier failed deploy left live in AWS";
 /**
@@ -25369,10 +25698,7 @@ function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logica
 	const region = absentIfEmpty(rawRegion);
 	const verbatim = "'cdkd orphan' carries it into the record it saves VERBATIM, without reading it, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses.";
 	if (logicalIds === void 0) return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} has no readable 'orphans' list — the record is malformed or truncated. ${verbatim} The next 'cdkd deploy' refuses the same record, so continuing would only report success over it and leave that refusal one command later.`, "'cdkd orphan' cannot address this list at all, and rewriting it to [] by hand discards the only record of resources an earlier failed deploy left live in AWS.", ORPHANS_DROP_CAVEAT);
-	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
-	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
-	const more = rest > 0 ? ` and ${rest} more` : "";
-	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${named}${more} — because the record has no string 'logicalId', its 'state' is not an object or names no resource type, or that state's 'properties' or 'attributes' map is not one. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
 }
 
 //#endregion
@@ -25427,6 +25753,21 @@ const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 */
 const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]) });
 /**
+* The PREFIX twin of {@link IN_PLACE_UPDATE_DERIVED_ATTRS}, for a type whose
+* derived attributes are an open family rather than a fixed list (issue
+* [#3631](https://github.com/go-to-k/cdkd/issues/3631)).
+*
+* A nested stack's `Outputs.<Key>` attributes are the child's outputs, and a
+* child-only change moves them while the parent's `AWS::CloudFormation::Stack`
+* row changes only `TemplateURL` / `Parameters`. The parent's diff runs BEFORE
+* the child deploys, so a reader of `Fn::GetAtt [Child, 'Outputs.<Key>']`
+* resolves against the PREVIOUS value and diffs NO_CHANGE. Which outputs move
+* is decided by the child's own deploy, so it is not knowable here: every
+* reader is promoted, and the deploy engine's re-resolve-and-skip drops the
+* ones whose output did not move.
+*/
+const IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES = Object.freeze({ "AWS::CloudFormation::Stack": Object.freeze(["Outputs."]) });
+/**
 * Diff calculator for comparing desired state (template) with current state
 */
 var DiffCalculator = class DiffCalculator {
@@ -25462,6 +25803,7 @@ var DiffCalculator = class DiffCalculator {
 	*/
 	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties) {
 		const changes = /* @__PURE__ */ new Map();
+		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0);
 		refuseMalformedResourceProperties(currentState, void 0, void 0);
 		const currentResources = currentState.resources;
 		const desiredResources = desiredTemplate.Resources;
@@ -25556,8 +25898,11 @@ var DiffCalculator = class DiffCalculator {
 			});
 			this.logger.debug(`DELETE: ${logicalId} (${currentResource.resourceType})`);
 		}
-		this.promoteReplacementDependents(changes, desiredTemplate);
-		this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs);
+		let round = 0;
+		do {
+			round++;
+			this.promoteReplacementDependents(changes, desiredTemplate);
+		} while (this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, currentResources, round));
 		const summary = this.getSummary(changes);
 		this.logger.debug(`Diff calculated: ${summary.create} CREATE, ${summary.update} UPDATE, ${summary.delete} DELETE, ${summary.noChange} NO_CHANGE`);
 		return changes;
@@ -25669,7 +26014,11 @@ var DiffCalculator = class DiffCalculator {
 	*      update side-effects even though it is not a template property — the
 	*      per-type {@link IN_PLACE_UPDATE_DERIVED_ATTRS} allow list (issue #985;
 	*      e.g. `AWS::EC2::LaunchTemplate.LatestVersionNumber`, which an
-	*      `autoscaling.AutoScalingGroup` reads for its `LaunchTemplate.Version`).
+	*      `autoscaling.AutoScalingGroup` reads for its `LaunchTemplate.Version`);
+	*      or
+	*   3. `Attr` starts with a derived-attribute PREFIX of `Up`'s type — the
+	*      {@link IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES} table (issue #3631; a
+	*      nested stack's `Outputs.<Key>`).
 	* (`Ref` resolves to the physical id, which an in-place update never moves, so
 	* Ref-only dependents are left NO_CHANGE; likewise a GetAtt of a computed
 	* attribute NOT in the allow list, e.g. a Lambda `Arn` on a Description edit.)
@@ -25678,14 +26027,25 @@ var DiffCalculator = class DiffCalculator {
 	* promoted resource against the in-flight state and skips the provider call
 	* when nothing actually changed.
 	*
-	* Single-hop by design (unlike {@link promoteReplacementDependents}, which is
-	* fully transitive via a worklist): `changedPropsByUpstream` is frozen at entry,
-	* so a chain `A(in-place) -> B(reads A's changed attr) -> C(reads B's now-changed
-	* attr)` promotes B but not C. Deep GetAtt-of-a-changed-attr chains are rare in
-	* practice; if one ever needs full transitivity, promote to a worklist that
-	* re-derives changed props as dependents are promoted.
-	*/
-	promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs) {
+	* One pass is single-hop: `changedPropsByUpstream` is frozen at entry, so a
+	* chain `A(in-place) -> B(reads A's changed attr) -> C(reads B's now-changed
+	* attr)` promotes B but not C. `calculateDiff` re-runs it to a fixpoint, and
+	* the pass after B's promotion sees B as an in-place UPDATE.
+	*
+	* A SPECULATIVE promotion — arm 3 in any round, and every arm after the first
+	* round, whose upstreams exist only because an earlier promotion guessed —
+	* skips a dependent that reads a MASKED attribute anywhere
+	* ({@link readsMaskedAttribute}). The engine resolves the dependent's whole
+	* bag and refuses a read of `***` BEFORE its no-change skip, so such a guess
+	* would fail a deploy that left the dependent alone before this pass could
+	* reach it (go-to-k/cdkd#3662). The first round's arms 1 and 2 keep their
+	* behaviour: a property they match really changed.
+	*
+	* @param round 1-based fixpoint round; see the speculative-promotion note.
+	* @returns whether any synthetic PropertyChange was added (the caller's
+	*          fixpoint signal).
+	*/
+	promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, currentResources, round) {
 		const changedPropsByUpstream = /* @__PURE__ */ new Map();
 		const inPlaceUpdateTypeByUpstream = /* @__PURE__ */ new Map();
 		for (const [logicalId, change] of changes) {
@@ -25695,7 +26055,8 @@ var DiffCalculator = class DiffCalculator {
 			const props = propertyChanges.map((pc) => pc.path).filter((p) => typeof p === "string");
 			if (props.length > 0) changedPropsByUpstream.set(logicalId, new Set(props));
 		}
-		if (changedPropsByUpstream.size === 0 && inPlaceUpdateTypeByUpstream.size === 0) return;
+		if (changedPropsByUpstream.size === 0 && inPlaceUpdateTypeByUpstream.size === 0) return false;
+		let added = false;
 		for (const [dependentId, perProp] of rawGetAttRefs) {
 			const resource = desiredTemplate.Resources[dependentId];
 			if (!resource || resource.Type === "AWS::CDK::Metadata") continue;
@@ -25704,22 +26065,29 @@ var DiffCalculator = class DiffCalculator {
 			if (change.changeType !== "NO_CHANGE" && change.changeType !== "UPDATE") continue;
 			const existingPaths = new Set((change.propertyChanges ?? []).map((pc) => pc.path));
 			const syntheticChanges = [];
+			const speculationAllowed = !DiffCalculator.readsMaskedAttribute(perProp, currentResources);
 			for (const [propKey, getAttRefs] of perProp) {
 				if (existingPaths.has(propKey)) continue;
 				let matched = false;
 				for (const [upstreamId, attrs] of getAttRefs) {
 					if (upstreamId === dependentId) continue;
+					if (round > 1 && !speculationAllowed) break;
 					const changedProps = changedPropsByUpstream.get(upstreamId);
 					if (changedProps && [...attrs].some((attr) => changedProps.has(attr))) {
 						matched = true;
 						break;
 					}
 					const upstreamType = inPlaceUpdateTypeByUpstream.get(upstreamId);
-					const derivedAttrs = upstreamType ? IN_PLACE_UPDATE_DERIVED_ATTRS[upstreamType] : void 0;
+					const derivedAttrs = upstreamType !== void 0 && Object.hasOwn(IN_PLACE_UPDATE_DERIVED_ATTRS, upstreamType) ? IN_PLACE_UPDATE_DERIVED_ATTRS[upstreamType] : void 0;
 					if (derivedAttrs && [...attrs].some((attr) => derivedAttrs.has(attr))) {
 						matched = true;
 						break;
 					}
+					const derivedPrefixes = upstreamType !== void 0 && Object.hasOwn(IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES, upstreamType) ? IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES[upstreamType] : void 0;
+					if (speculationAllowed && derivedPrefixes && [...attrs].some((attr) => derivedPrefixes.some((prefix) => attr.startsWith(prefix)))) {
+						matched = true;
+						break;
+					}
 				}
 				if (!matched) continue;
 				syntheticChanges.push({
@@ -25730,12 +26098,51 @@ var DiffCalculator = class DiffCalculator {
 				});
 			}
 			if (syntheticChanges.length === 0) continue;
+			added = true;
 			if (change.changeType === "NO_CHANGE") {
 				change.changeType = "UPDATE";
 				change.propertyChanges = syntheticChanges;
 				this.logger.debug(`UPDATE (in-place attr propagated): ${dependentId} reads a changed attribute of an updated resource`);
 			} else change.propertyChanges = [...change.propertyChanges ?? [], ...syntheticChanges];
 		}
+		return added;
+	}
+	/**
+	* Whether any `Fn::GetAtt` / `Fn::Sub` read of a dependent (its
+	* {@link extractGetAttRefs} map, every property and every upstream) lands on
+	* a PERSISTED attribute carrying the redaction mask. The attribute is found
+	* the way the resolver finds it: the flat key, else the dot-separated path
+	* walked through nested objects (a Cloud Control record's
+	* `Endpoint.Address`).
+	*
+	* What it cannot see, and the engine still refuses on a speculative
+	* promotion: a masked cross-stack read (`Fn::ImportValue` /
+	* `Fn::GetStackOutput`), whose producer record is another stack's, and a
+	* `Ref` whose state-key lookup lands on a masked property, since `Ref`
+	* reads are not extracted.
+	*/
+	static readsMaskedAttribute(perProp, currentResources) {
+		for (const getAttRefs of perProp.values()) for (const [upstreamId, attrs] of getAttRefs) {
+			const attributes = Object.hasOwn(currentResources, upstreamId) ? currentResources[upstreamId]?.attributes : void 0;
+			if (!attributes) continue;
+			for (const attr of attrs) if (carriesSecretMask(DiffCalculator.persistedAttribute(attributes, attr))) return true;
+		}
+		return false;
+	}
+	/**
+	* A persisted attribute by the resolver's lookup rule: the own flat key, else
+	* the dot-separated path through own keys of nested objects; `undefined`
+	* when neither exists.
+	*/
+	static persistedAttribute(attributes, attr) {
+		if (Object.hasOwn(attributes, attr)) return attributes[attr];
+		if (!attr.includes(".")) return void 0;
+		let cursor = attributes;
+		for (const part of attr.split(".")) {
+			if (cursor === null || typeof cursor !== "object" || !Object.hasOwn(cursor, part)) return;
+			cursor = cursor[part];
+		}
+		return cursor;
 	}
 	/**
 	* Extract `Fn::GetAtt` / `Fn::Sub`-`${X.Attr}` references from a property value
@@ -25765,6 +26172,10 @@ var DiffCalculator = class DiffCalculator {
 			if ("Fn::GetAtt" in obj) {
 				const ga = obj["Fn::GetAtt"];
 				if (Array.isArray(ga) && typeof ga[0] === "string" && typeof ga[1] === "string") add(ga[0], ga[1]);
+				else if (typeof ga === "string") {
+					const split = splitGetAttStringForm(ga);
+					if (split) add(split.logicalId, split.attributeName);
+				}
 				return;
 			}
 			if ("Fn::Sub" in obj) {
@@ -31104,12 +31515,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
+					const notedNameServers = this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
-					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
+					return notedNameServers;
 				}
+				const reresolvesNestedReference = resource.resourceType === NESTED_STACK_RESOURCE_TYPE$2 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue);
+				const notedFlatValue = reresolvesNestedReference ? flatValue : this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$2 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
-				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
+				if (reresolvesNestedReference) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				return notedFlatValue;
 			}
 			if (attributeName.includes(".")) {
 				const parts = attributeName.split(".");
@@ -31120,8 +31534,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
+					const notedCursor = this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
-					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
+					return notedCursor;
 				}
 			}
 		}
@@ -31180,6 +31595,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* A context supplying NEITHER field — the diff / no-op resolver, `cdkd
 	* scrub`, `cdkd import` — pays two undefined checks and gets its value back.
+	*
+	* ORDERING: call it BEFORE any log line that prints the value
+	* (go-to-k/cdkd#3659). Note 1 is what puts a `NoEcho` value into the bag
+	* `displayMasked` masks against, so a line logged first prints the plaintext
+	* at `--verbose`.
 	*/
 	noteAttributeSecrecy(logicalId, attributeName, value, context) {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
@@ -31314,8 +31734,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	}
 	/** Serve a value the #1852 heal just read from AWS, logging it like a cached read. */
 	serveHealedAttribute(logicalId, attributeName, value, context) {
+		const noted = this.noteAttributeSecrecy(logicalId, attributeName, value, context);
 		this.logger.debug(`Resolved Fn::GetAtt from a re-read of AWS (the state record lacked it): ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
-		return this.noteAttributeSecrecy(logicalId, attributeName, value, context);
+		return noted;
 	}
 	/**
 	* {@link constructGuardedAttribute}, healing a STALE state record first when
@@ -35270,6 +35691,15 @@ const CC_PROTECTION_PROPERTIES = {
 function ccProtectionProperty(resourceType) {
 	return CC_PROTECTION_PROPERTIES[resourceType];
 }
+/**
+* Every resource type registered in the CC protection registry. Consumed by
+* the cross-site consistency test that keeps this registry, the destroy
+* confirm-prompt count map, the `--remove-protection` help strings, and the
+* docs tables from drifting apart.
+*/
+function ccProtectionRegistryTypes() {
+	return Object.keys(CC_PROTECTION_PROPERTIES);
+}
 
 //#endregion
 //#region src/provisioning/unsupported-types.generated.ts
@@ -36326,7 +36756,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DAvRcbyS.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DR5gOGbi.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -41574,7 +42004,8 @@ var ProviderRegistry = class {
 					provisionedBy: "sdk"
 				};
 			}
-			if (isNonProvisionable(resourceType) || specificProvider.disableCcApiFallback === true) throw new Error(this.buildUnroutableSilentDropMessage(resourceType, actionableDrops));
+			const unroutable = this.ccRouteUnavailableReason(resourceType);
+			if (unroutable !== void 0) throw new Error(this.buildUnroutableSilentDropMessage(resourceType, actionableDrops, unroutable));
 			this.logger.debug(`Auto-routing ${resourceType} via Cloud Control (silent-drop properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
 			return {
 				provider: this.cloudControlProvider,
@@ -41599,19 +42030,29 @@ var ProviderRegistry = class {
 		throw new Error(`No provider available for resource type: ${resourceType}. This resource type is not supported by Cloud Control API and no SDK provider is registered.`);
 	}
 	/**
+	* Why the Cloud Control auto-route cannot serve `resourceType`, or
+	* `undefined` when it can. The ONE predicate both refusal sites
+	* (`getProviderFor` and `reportSilentDropDecisions`) and the accepted-drop
+	* warn read, so the warn that predicts what a flag-less deploy does cannot
+	* disagree with the refusal that deploy then hits (issue #2792).
+	*/
+	ccRouteUnavailableReason(resourceType) {
+		if (isNonProvisionable(resourceType)) return "ProvisioningType: NON_PROVISIONABLE — Cloud Control has no handlers for it";
+		if (this.providers.get(resourceType)?.disableCcApiFallback === true) return "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)";
+	}
+	/**
 	* Error message for a resource whose template uses SDK-provider-unhandled
 	* properties on a type where the Cloud Control auto-route (issue #614) is
 	* NOT viable — `ProvisioningType: NON_PROVISIONABLE` (no CC handlers) or a
-	* provider-level `disableCcApiFallback` opt-out. Includes each property's
+	* provider-level `disableCcApiFallback` opt-out; `reason` is
+	* {@link ccRouteUnavailableReason}'s answer. Includes each property's
 	* `unhandledByDesign` rationale so the user sees WHY it is unhandled, plus
 	* the `--allow-unsupported-properties` escape hatch (which forces the SDK
 	* path and accepts the drop — the provider may still reject the resource
 	* if the property is load-bearing, e.g. a non-Lustre FSx variant config).
 	*/
-	buildUnroutableSilentDropMessage(resourceType, drops) {
-		const details = drops.map((d) => `  - ${d.property}: ${d.rationale}`).join("\n");
-		const overrideHint = drops.map((d) => `${resourceType}:${d.property}`).join(",");
-		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${isNonProvisionable(resourceType) ? "ProvisioningType: NON_PROVISIONABLE — Cloud Control has no handlers for it" : "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)"}):\n${details}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${overrideHint} (the provider may still reject the resource if the property is required).`;
+	buildUnroutableSilentDropMessage(resourceType, drops, reason) {
+		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${reason}):\n${drops.map((d) => `  - ${d.property}: ${d.rationale}`).join("\n")}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${drops.map((d) => `${resourceType}:${d.property}`).join(",")} (the provider may still reject the resource if the property is required).`;
 	}
 	/**
 	* Legacy entry point that returns just the provider. Delegates to
@@ -41793,8 +42234,8 @@ var ProviderRegistry = class {
 			const overridden = stickyCc ? [] : findAcceptedSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
 			const autoRouted = drops.map(({ property }) => property).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`));
 			if (autoRouted.length > 0) {
-				const provider = this.providers.get(resourceType);
-				if (isNonProvisionable(resourceType) || provider?.disableCcApiFallback === true) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)))}`);
+				const unroutable = this.ccRouteUnavailableReason(resourceType);
+				if (unroutable !== void 0) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)), unroutable)}`);
 				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${autoRouted.join(", ")} — CC API will forward the full property map. Override via --prefer-sdk-route ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")}.)`;
 				if (provisionedBy === "cc-api") this.logger.debug(message);
 				else this.logger.info(message);
@@ -41808,9 +42249,11 @@ var ProviderRegistry = class {
 			}
 			if (overridden.length > 0) {
 				const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
-				const reroutable = overridden.filter((p) => createOnly?.has(p) !== true);
-				const needsRecreate = overridden.filter((p) => createOnly?.has(p) === true);
+				const unroutable = this.ccRouteUnavailableReason(resourceType);
+				const reroutable = unroutable === void 0 ? overridden.filter((p) => createOnly?.has(p) !== true) : [];
+				const needsRecreate = unroutable === void 0 ? overridden.filter((p) => createOnly?.has(p) === true) : [];
 				const remedies = [];
+				if (unroutable !== void 0) remedies.push(`This type cannot be routed via Cloud Control API (${unroutable}), so removing the override makes the deploy refuse at pre-flight instead of rerouting; cdkd has no route that applies ${overridden.length === 1 ? "it" : "them"} to this type.`);
 				if (reroutable.length > 0) remedies.push(`Remove the override for ${reroutable.join(", ")} to route this resource via Cloud Control API instead.`);
 				if (needsRecreate.length > 0) {
 					const one = needsRecreate.length === 1;
@@ -49760,7 +50203,9 @@ var DeployEngine = class DeployEngine {
 			this.healBaseline = currentState.resources ?? {};
 			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 			refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
+			refuseMalformedResourceEntriesForDeploy(currentState, stackName, this.stackRegion);
 			refuseMalformedOrphans(currentState, stackName, this.stackRegion);
+			refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -51807,5 +52252,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, formatError as $a, MIGRATE_TMP_PREFIX as $i, repairMalformedOutputsForReadOnly as $n, WorkGraph as $r, replayWarn as $t, createPreDeleteFinalSnapshot as A, runWithStackAwsClients as Aa, runDockerForeground as Ai, malformedOrphansRefusalMessage as An, scrubResourceRecord as Ar, isTerminationProtectionPropagationError as At, isStatefulRecreateTargetSync as B, LocalInvokeBuildError as Ba, getLegacyStateBucketName as Bi, refuseMalformedNestedChildOutputs as Bn, DEFAULT_STATE_PREFIX as Br, parameterTypeMayLoseSecretIdentity as Bt, namesAnyDeclaredParameter as C, renderAssemblyPathEscape as Ca, finchSecretArgvRefusal as Ci, hasReadableOutputs as Cn, maskSecretsInError as Cr, CloudControlProvider as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, AwsClients as Da, isMalformedEnvKey as Di, malformedExportSourceWarning as Dn, recordMaskOnlyValuesIn as Dr, deleteSkipReason as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, resolveBucketRegion as Ea, isDockerClientEnvKey as Ei, malformedExportNamesWarning as En, recordMaskOnlyValue as Er, deleteIndeterminateGuards as Et, extractDeploymentEventError as F, CrossAccountSecretRefusalError as Fa, AssetManifestLoader as Fi, malformedResourceEntriesWarning as Fn, buildForceUnlockCommand as Fr, coerceParameterTypedValue as Ft, toCfnInteger as G, PartialFailureError as Ga, resolveStateBucketWithDefault as Gi, refuseMalformedOutputsForDestroy as Gn, importableOutputKeys as Gr, resolveExplicitPhysicalId as Gt, WARM_THROUGHPUT_MEMBERS as H, LockError as Ha, resolveAutoAssetStorage as Hi, refuseMalformedOrphansForDestroy as Hn, hasReadableExportSet as Hr, isSettledInstanceState as Ht, makeSiblingClaimReader as I, DependencyError as Ia, getDockerImageBySourceHash as Ii, malformedResourcePropertiesWarning as In, buildLockContentionMessage as Ir, getAccountInfo as It, bold as J, ResourceUpdateNotSupportedError as Ja, stateBucketExistenceConfirmed as Ji, refuseMalformedResourceEntriesForOrphan as Jn, orphansAfterRollback as Jr, coerceCfnInteger as Jt, toFiniteNumber as K, ProvisioningError as Ka, resolveStateBucketWithDefaultAndSource as Ki, refuseMalformedResourceAttributesForOrphan as Kn, importableOutputs as Kr, assertRegionMatch as Kt, planOrphanAdoption as L, DeployCancelledError as La, Synthesizer as Li, malformedResourcesWarning as Ln, forceQuitRecoveryClause as Lr, isImpossibleEmptyStoredAttribute as Lt, refusesFinalSnapshot as M, AssetError as Ma, warnFinchArgvExposure as Mi, malformedOutputsRefusalMessage as Mn, S3StateBackend as Mr, carriesDynamicReference as Mt, unsupportedFinalSnapshotError as N, CdkdError as Na, escapeRegExp$1 as Ni, malformedOutputsWarning as Nn, rebuildClientForBucketRegion as Nr, carriesFetchableDynamicReference as Nt, buildFinalSnapshotIdentifier as O, getAwsClients as Oa, partitionSensitiveEnv as Oi, malformedLocalOutputsWarning as On, recoverMaskedOutput as Or, isWaitAbandonedError as Ot, makeCanonicalizePropertiesFn as P, ConfigError as Pa, stripControlChars as Pi, malformedRenderedContainersWarning as Pn, UNREPRODUCIBLE_LOCK_CLAUSE as Pr, cfnRefValueFromPhysicalId as Pt, red as Q, SynthesisError as Qa, CFN_TEMPLATE_URL_LIMIT as Qi, repairMalformedOrphansForReadOnly as Qn, stringifyValue as Qr, readConfigString as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, DynamicReferenceRegionAmbiguousError as Ra, synthesisStatusMessage as Ri, malformedStateRefusalMessage as Rn, formatLockExpiry as Rr, isNamelessDynamicReferenceError as Rt, computeParameterTaint as S, displayAssemblyPath as Sa, dockerSpawnEnvWithSensitive as Si, hasReadableOrphans as Sn, markSameGenerationBag as Sr, startInterruptWatch as St, resourcesNamingDeclaredParameter as T, clearBucketRegionCache as Ta, getDockerCmd as Ti, isReadableResourceEntry as Tn, pathCrossesDottedKey as Tr, UNSPECIFIED_SKIP_REASON as Tt, coerceWarmThroughput as U, MalformedProducerRecordRefusalError as Ua, resolveCaptureObservedState as Ui, refuseMalformedOrphansForOrphan as Un, hasReasonlessBaselineRefusal as Ur, WAFv2WebACLProvider as Ut, renderStatefulReason as V, LocalStartServiceError as Va, resolveApp as Vi, refuseMalformedOrphans as Vn, exportNamesCarriedFrom as Vr, refStateLookupFromResource as Vt, isWarmThroughputDecrease as W, NestedStackChildDirectDestroyError as Wa, resolveSkipPrefix as Wi, refuseMalformedOutputs as Wn, hasUnverifiableParameterRefusal as Wr, normalizeAwsTagsToCfn as Wt, gray as X, StackTerminationProtectionError as Xa, ssmResolvedValueType as Xi, refuseMalformedResourcesForDestroy as Xn, shouldRetainResource as Xr, configIntegerRefusal as Xt, cyan as Y, StackHasActiveImportsError as Ya, warnDeprecatedNoPrefixCliFlag as Yi, refuseMalformedResourcePropertiesForOrphan as Yn, orphansCarriedFrom as Yr, configBooleanRefusal as Yt, green as Z, StateError as Za, CFN_TEMPLATE_BODY_LIMIT as Zi, refuseMalformedState as Zn, AssetPublisher as Zr, configStringRefusal as Zt, bagHoldsSecretExpression as _, hasOwnKey as _a, resolveDockerContextDirectory as _i, INTRINSIC_KEYS as _n, dynamicReferenceTokens as _r, maskerOrIdentity as _t, DeploymentEventsStore as a, producerCoordinateKey as aa, BOOTSTRAP_MARKER_PREFIX as ai, withSharedDrainBudget as an, isMarkedNonRetryable as ao, findActionableSilentDrops as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, ownValue as ba, describeDockerExecFailure as bi, UNREADABLE_RESOURCES_MAP_ROW as bn, isSingleDynamicReferenceToken as br, interruptWatchListenerCount as bt, replayFailedOperations as c, expectedOwnerParam as ca, getBootstrapMarkerKey as ci, s3BucketDualStackDomainName as cn, isTransientServerError as co, withRetry as cr, IAMRoleProvider as ct, updatePartialMessage as d, derivePartitionAndUrlSuffix as da, readBootstrapMarkerBody as di, applyRoleArnIfSet as dn, retryClassificationText as do, STATE_SOURCED_BASELINE_RULES as dr, definedAttributes as dt, findLargeInlineResources as ea, buildAssetRedirectMap as ei, requireConfigArray as en, isCdkdError as eo, repairMalformedResourceEntriesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, AssemblyReader as fa, validateAssetBucketName as fi, AWS_CREDENTIAL_ENV_KEYS as fn, describeAwsFailure as fo, STATE_SOURCED_CROSS_GENERATION_RULES as fr, stringifyIfAssigned as ft, computeImplicitDeleteEdges as g, defineOwnKey as ga, buildDockerImage as gi, DiffCalculator as gn, createSecretMasker as gr, maskDeep as gt, IMPLICIT_DELETE_DEPENDENCIES as h, processStackMessages as ha, assertCdkLocalDockerContextContained as hi, envCredentialsAreAssumedRole as hn, carriesSecretMask as hr, createMaskedRetryLogger as ht, DeploymentEventsReader as i, injectiveKeyPrefix as ia, AssetModeResolver as ii, producerRegionsFromState as in, shellQuote as io, safeStackName as ir, secretBearing as it, isFinalSnapshotError as j, setAwsClients as ja, runDockerStreaming as ji, malformedOrphansWarning as jn, LockManager as jr, IntrinsicFunctionResolver as jt, ccRoutedFinalSnapshotError as k, resetAwsClients as ka, redactDockerArgvValues as ki, malformedOrphanRecordsWarning as kn, redactSecretsForState as kr, disableInstanceApiTermination as kt, replayRollback as l, PARTITION_TABLE as la, isCrossRegionRedirect as li, s3BucketRegionalDomainName as ln, markNonRetryable as lo, DagBuilder as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, globMatches as ma, buildDenyExternalAccessPolicy as mi, callerEnvCredentials as mn, __exportAll as mo, TEMPLATE_SOURCED_RULES as mr, wouldReturnToSdkProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as na, loadPublishableAssetManifest as ni, requireConfigString as nn, withErrorHandling as no, repairMalformedResourcesForReadOnly as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, producerRecordKey as oa, assertAssetBucketRegion as oi, s3BucketArn as on, isRetryableTransientError as oo, findSilentDropProperties as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, failedStageNote as pa, validateContainerRepoName as pi, applyCallerIdentityCredentials as pn, safeStringify$1 as po, STATE_SOURCED_READBACK_RULES as pr, ProviderRegistry as pt, formatResourceLine as q, ResourceTimeoutError as qa, resolveUseCdkBootstrapAssets as qi, refuseMalformedResourceEntries as qn, isReadableBag as qr, coerceCfnBoolean as qt, DeployEngine as r, injectiveKey as ra, rewriteTemplateAssetReferences as ri, classifyReplaySecretRegion as rn, pasteableCommand as ro, safeRegion as rr, isExportAliasCollision as rt, planRollback as s, decodeListingKey as sa, ensureAssetStorage as si, s3BucketDomainName as sn, isThrottlingError as so, describeTypeWithThrottleRetry as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, uploadCfnTemplate as ta, createAssetRedirectResolver as ti, requireConfigObject as tn, normalizeAwsError as to, repairMalformedResourcePropertiesForReadOnly as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, canonicalizeRegion as ua, parseBootstrapMarker as ui, s3BucketWebsiteUrl as un, markRedactedCause as uo, TemplateParser as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, hasPlainPrototype$1 as va, warnManifestExecutable as vi, STATE_RESOURCES_MALFORMED as vn, errorCauseChain as vr, beginCommandInterruptScope as vt, reachableDivergentParameters as w, resolveAssemblyPath as wa, formatDockerLoginError as wi, hasReadableResources as wn, maskSecretsInText as wr, slowCcOperationTimeoutMs as wt, bindingSkippedOutputs as x, absoluteAssemblyPathEscape as xa, describeDockerFailure as xi, displayLogicalId as xn, isUncertifiedBaselineMaskPosition as xr, isInterruptedWaitError as xt, keptWholeReasonText as y, nullPrototypeRecord as ya, describeDockerCapturedOutput as yi, UNREADABLE_ORPHANS_CONTAINER_ROW as yn, identityKeyFor as yr, endCommandInterruptScope as yt, isStatefulRecreateTargetForReplace as z, IntrinsicResolutionRefusalError as za, getDefaultStateBucketName as zi, refuseDivergentRecordRegionForDestroy as zn, CUSTOM_RESOURCE_RESPONSE_PREFIX as zr, isUnboundTemplateParameter as zt };
-//# sourceMappingURL=deploy-engine-yukC8N_f.js.map
+export { yellow as $, NestedStackChildDirectDestroyError as $a, resolveSkipPrefix as $i, refuseMalformedOutputsForDestroy as $n, hasReadableExportSet as $r, readConfigString as $t, createPreDeleteFinalSnapshot as A, absoluteAssemblyPathEscape as Aa, describeDockerFailure as Ai, malformedExportSourceWarning as An, identityKeyFor as Ar, disableInstanceApiTermination as At, isStatefulRecreateTargetSync as B, setAwsClients as Ba, runDockerStreaming as Bi, malformedResourceEntriesWarning as Bn, redactSecretsForState as Br, isUnboundTemplateParameter as Bt, namesAnyDeclaredParameter as C, globMatches as Ca, validateAssetBucketName as Ci, displayLogicalId as Cn, __exportAll as Co, STATE_SOURCED_CROSS_GENERATION_RULES as Cr, CloudControlProvider as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, hasPlainPrototype$1 as Da, resolveDockerContextDirectory as Di, isReadableOrphanRecord as Dn, createSecretMasker as Dr, deleteIndeterminateGuards as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, hasOwnKey as Ea, buildDockerImage as Ei, hasReadableResources as En, carriesSecretMask as Er, UNSPECIFIED_SKIP_REASON as Et, extractDeploymentEventError as F, resolveBucketRegion as Fa, isDockerClientEnvKey as Fi, malformedOrphansRefusalMessage as Fn, maskSecretsInText as Fr, cfnRefValueFromPhysicalId as Ft, toCfnInteger as G, DependencyError as Ga, getDockerImageBySourceHash as Gi, refuseDivergentRecordRegionForDestroy as Gn, UNREPRODUCIBLE_LOCK_CLAUSE as Gr, normalizeAwsTagsToCfn as Gt, WARM_THROUGHPUT_MEMBERS as H, CdkdError as Ha, escapeRegExp$1 as Hi, malformedResourcesWarning as Hn, LockManager as Hr, refStateLookupFromResource as Ht, makeSiblingClaimReader as I, AwsClients as Ia, isMalformedEnvKey as Ii, malformedOrphansWarning as In, pathCrossesDottedKey as Ir, coerceParameterTypedValue as It, bold as J, IntrinsicResolutionRefusalError as Ja, getDefaultStateBucketName as Ji, refuseMalformedOrphanRecordsForDestroy as Jn, forceQuitRecoveryClause as Jr, coerceCfnBoolean as Jt, toFiniteNumber as K, DeployCancelledError as Ka, Synthesizer as Ki, refuseMalformedNestedChildOutputs as Kn, buildForceUnlockCommand as Kr, resolveExplicitPhysicalId as Kt, planOrphanAdoption as L, getAwsClients as La, partitionSensitiveEnv as Li, malformedOutputsRefusalMessage as Ln, recordMaskOnlyValue as Lr, getAccountInfo as Lt, refusesFinalSnapshot as M, renderAssemblyPathEscape as Ma, finchSecretArgvRefusal as Mi, malformedOrphanRecordsRefusalMessage as Mn, isUncertifiedBaselineMaskPosition as Mr, IntrinsicFunctionResolver as Mt, unsupportedFinalSnapshotError as N, resolveAssemblyPath as Na, formatDockerLoginError as Ni, malformedOrphanRecordsWarning as Nn, markSameGenerationBag as Nr, carriesDynamicReference as Nt, buildFinalSnapshotIdentifier as O, nullPrototypeRecord as Oa, describeDockerCapturedOutput as Oi, isReadableResourceEntry as On, dynamicReferenceTokens as Or, deleteSkipReason as Ot, makeCanonicalizePropertiesFn as P, clearBucketRegionCache as Pa, getDockerCmd as Pi, malformedOrphanRowsKeptWarning as Pn, maskSecretsInError as Pr, carriesFetchableDynamicReference as Pt, red as Q, MalformedProducerRecordRefusalError as Qa, resolveCaptureObservedState as Qi, refuseMalformedOutputs as Qn, exportNamesCarriedFrom as Qr, configStringRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, resetAwsClients as Ra, redactDockerArgvValues as Ri, malformedOutputsWarning as Rn, recordMaskOnlyValuesIn as Rr, isImpossibleEmptyStoredAttribute as Rt, computeParameterTaint as S, failedStageNote as Sa, readBootstrapMarkerBody as Si, deployRefusesOrphanRowsReason as Sn, safeStringify$1 as So, STATE_SOURCED_BASELINE_RULES as Sr, startInterruptWatch as St, resourcesNamingDeclaredParameter as T, defineOwnKey as Ta, buildDenyExternalAccessPolicy as Ti, hasReadableOutputs as Tn, TEMPLATE_SOURCED_RULES as Tr, ccProtectionRegistryTypes as Tt, coerceWarmThroughput as U, ConfigError as Ua, stripControlChars as Ui, malformedStateRefusalMessage as Un, S3StateBackend as Ur, isSettledInstanceState as Ut, renderStatefulReason as V, AssetError as Va, warnFinchArgvExposure as Vi, malformedResourcePropertiesWarning as Vn, scrubResourceRecord as Vr, parameterTypeMayLoseSecretIdentity as Vt, isWarmThroughputDecrease as W, CrossAccountSecretRefusalError as Wa, AssetManifestLoader as Wi, previewableOrphanRecords as Wn, rebuildClientForBucketRegion as Wr, WAFv2WebACLProvider as Wt, gray as X, LocalStartServiceError as Xa, resolveApp as Xi, refuseMalformedOrphansForDestroy as Xn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Xr, configBooleanRefusal as Xt, cyan as Y, LocalInvokeBuildError as Ya, getLegacyStateBucketName as Yi, refuseMalformedOrphans as Yn, formatLockExpiry as Yr, coerceCfnInteger as Yt, green as Z, LockError as Za, resolveAutoAssetStorage as Zi, refuseMalformedOrphansForOrphan as Zn, DEFAULT_STATE_PREFIX as Zr, configIntegerRefusal as Zt, bagHoldsSecretExpression as _, expectedOwnerParam as _a, assertAssetBucketRegion as _i, DiffCalculator as _n, isTransientServerError as _o, findSilentDropProperties as _r, maskerOrIdentity as _t, DeploymentEventsStore as a, ssmResolvedValueType as aa, orphansAfterRollback as ai, producerRegionsFromState as an, StackTerminationProtectionError as ao, refuseMalformedState as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, derivePartitionAndUrlSuffix as ba, isCrossRegionRedirect as bi, UNREADABLE_ORPHANS_CONTAINER_ROW as bn, retryClassificationText as bo, DagBuilder as br, interruptWatchListenerCount as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as ca, AssetPublisher as ci, s3BucketDomainName as cn, formatError as co, repairMalformedOutputsForReadOnly as cr, IAMRoleProvider as ct, updatePartialMessage as d, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as da, buildAssetRedirectMap as di, s3BucketWebsiteUrl as dn, withErrorHandling as do, repairMalformedResourcesForReadOnly as dr, definedAttributes as dt, resolveStateBucketWithDefault as ea, hasReasonlessBaselineRefusal as ei, replayWarn as en, PartialFailureError as eo, refuseMalformedResourceAttributesForOrphan as er, collectDeclaredOutputNames as et, updatePartialReason as f, injectiveKey as fa, createAssetRedirectResolver as fi, applyRoleArnIfSet as fn, pasteableCommand as fo, safeRegion as fr, stringifyIfAssigned as ft, computeImplicitDeleteEdges as g, decodeListingKey as ga, BOOTSTRAP_MARKER_PREFIX as gi, envCredentialsAreAssumedRole as gn, isThrottlingError as go, findActionableSilentDrops as gr, maskDeep as gt, IMPLICIT_DELETE_DEPENDENCIES as h, producerRecordKey as ha, AssetModeResolver as hi, callerEnvCredentials as hn, isRetryableTransientError as ho, unreadableOrphanRecords as hr, createMaskedRetryLogger as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as ia, isReadableBag as ii, classifyReplaySecretRegion as in, StackHasActiveImportsError as io, refuseMalformedResourcesForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, displayAssemblyPath as ja, dockerSpawnEnvWithSensitive as ji, malformedLocalOutputsWarning as jn, isSingleDynamicReferenceToken as jr, isTerminationProtectionPropagationError as jt, ccRoutedFinalSnapshotError as k, ownValue as ka, describeDockerExecFailure as ki, malformedExportNamesWarning as kn, errorCauseChain as kr, isWaitAbandonedError as kt, replayRollback as l, findLargeInlineResources as la, stringifyValue as li, s3BucketDualStackDomainName as ln, isCdkdError as lo, repairMalformedResourceEntriesForReadOnly as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, producerCoordinateKey as ma, rewriteTemplateAssetReferences as mi, applyCallerIdentityCredentials as mn, isMarkedNonRetryable as mo, unpreviewableOrphanRecords as mr, wouldReturnToSdkProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as na, importableOutputKeys as ni, requireConfigObject as nn, ResourceTimeoutError as no, refuseMalformedResourceEntriesForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as oa, orphansCarriedFrom as oi, withSharedDrainBudget as on, StateError as oo, repairMalformedOrphanRecordsForReadOnly as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, injectiveKeyPrefix as pa, loadPublishableAssetManifest as pi, AWS_CREDENTIAL_ENV_KEYS as pn, shellQuote as po, safeStackName as pr, ProviderRegistry as pt, formatResourceLine as q, DynamicReferenceRegionAmbiguousError as qa, synthesisStatusMessage as qi, refuseMalformedOrphanRecords as qn, buildLockContentionMessage as qr, assertRegionMatch as qt, DeployEngine as r, stateBucketExistenceConfirmed as ra, importableOutputs as ri, requireConfigString as rn, ResourceUpdateNotSupportedError as ro, refuseMalformedResourcePropertiesForOrphan as rr, isExportAliasCollision as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sa, shouldRetainResource as si, s3BucketArn as sn, SynthesisError as so, repairMalformedOrphansForReadOnly as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as ta, hasUnverifiableParameterRefusal as ti, requireConfigArray as tn, ProvisioningError as to, refuseMalformedResourceEntries as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, uploadCfnTemplate as ua, WorkGraph as ui, s3BucketRegionalDomainName as un, normalizeAwsError as uo, repairMalformedResourcePropertiesForReadOnly as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, PARTITION_TABLE as va, ensureAssetStorage as vi, INTRINSIC_KEYS as vn, markNonRetryable as vo, describeTypeWithThrottleRetry as vr, beginCommandInterruptScope as vt, reachableDivergentParameters as w, processStackMessages as wa, validateContainerRepoName as wi, hasReadableOrphans as wn, STATE_SOURCED_READBACK_RULES as wr, slowCcOperationTimeoutMs as wt, bindingSkippedOutputs as x, AssemblyReader as xa, parseBootstrapMarker as xi, UNREADABLE_RESOURCES_MAP_ROW as xn, describeAwsFailure as xo, TemplateParser as xr, isInterruptedWaitError as xt, keptWholeReasonText as y, canonicalizeRegion as ya, getBootstrapMarkerKey as yi, STATE_RESOURCES_MALFORMED as yn, markRedactedCause as yo, withRetry as yr, endCommandInterruptScope as yt, isStatefulRecreateTargetForReplace as z, runWithStackAwsClients as za, runDockerForeground as zi, malformedRenderedContainersWarning as zn, recoverMaskedOutput as zr, isNamelessDynamicReferenceError as zt };
+//# sourceMappingURL=deploy-engine-BwDlgFRs.js.map