@go-to-k/cdkd 0.291.17 → 0.291.19

package/dist/{deploy-engine-xxVOQPPr.js → deploy-engine-OgrMdBRR.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
+import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-Bt0RGDfb.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-DMRkEtU2.js";
+import { t as getCdkdVersion } from "./version-2QIPw29e.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -35,10 +35,9 @@ import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } fro
 import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBalancingV2Client } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
-import { isAbsolute as isAbsolute$1, relative, resolve as resolve$1, sep } from "path";
+import { isAbsolute as isAbsolute$1, resolve as resolve$1 } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
 import { inspect } from "node:util";
-import { realpathSync as realpathSync$1 } from "fs";
 import { hostname } from "os";
 import graphlib from "graphlib";
 import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from "@aws-sdk/client-rds";
@@ -3365,7 +3364,9 @@ function assemblyPathEscape(base, bound, candidate) {
 * Modifier Letters block (U+02BA reads as `"`, U+02BC as `'`) plus the ones
 * outside it (U+0374, U+0559, U+07F4-U+07F5, U+A78B-U+A78C, and the halfwidth
 * sound marks U+FF9E-U+FF9F). Not all of `\p{Lm}`: U+30FC is in it, and it is
-* an ordinary character of a Japanese directory name.
+* an ordinary character of a Japanese directory name. `classify` tests
+* {@link DEFAULT_IGNORABLE} first, so that carve-out is a backstop here, kept
+* so the class matches cdk-local's `displayUntrustedValue`.
 */
 const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
 /**
@@ -3375,6 +3376,14 @@ const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Poin
 */
 const COMBINING_MARK = /^\p{M}$/u;
 /**
+* A default-ignorable code point, which draws as NOTHING. Tested before the
+* mark rule, because some are combining marks (U+034F, U+17B4, U+180B, the
+* variation selectors U+FE00-U+FE0F and U+E0100-U+E01EF): after a letter they
+* would otherwise pass as bare, and `/home/me/.ss\u034fh` would print exactly
+* like `.ssh` while naming a different path (go-to-k/cdkd#3656).
+*/
+const DEFAULT_IGNORABLE = /^\p{Default_Ignorable_Code_Point}$/u;
+/**
 * The ASCII a bare path may carry besides letters and digits. Everything else —
 * any whitespace, any quote, any other symbol — takes the boundary, which
 * costs a legitimate path nothing but a pair of quotes.
@@ -3394,6 +3403,10 @@ const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
 function classify(chars) {
 	let afterLetter = false;
 	return chars.map((ch) => {
+		if (DEFAULT_IGNORABLE.test(ch)) {
+			afterLetter = false;
+			return "escaped";
+		}
 		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
 		afterLetter = VISIBLE_LETTER.test(ch);
 		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
@@ -3944,7 +3957,7 @@ var AssemblyReader = class {
 	getStack(assemblyDir, manifest, stackName) {
 		const { stacks, failedStages } = this.readAssembly(assemblyDir, manifest);
 		const stack = stacks.find((s) => s.stackName === stackName);
-		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. ` + (stacks.length > 0 ? `Available: ${stacks.map((s) => displayIdent(s.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })).join(", ")}` : "The assembly has no stacks") + failedStageNote([stackName], failedStages));
+		if (!stack) throw new SynthesisError(`Stack ${displayStackName(stackName)} not found in assembly. ` + (stacks.length > 0 ? `Available: ${stacks.map((s) => displayIdent(s.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })).join(", ")}` : "The assembly has no stacks") + failedStageNote([stackName], failedStages));
 		return stack;
 	}
 	/**
@@ -3964,7 +3977,7 @@ var AssemblyReader = class {
 			const props = artifact.properties;
 			if (props?.file) {
 				const resolved = resolveAssemblyPath(assemblyDir, props.file);
-				if (!resolved.contained) throw new SynthesisError(`Asset manifest artifact '${displaySafe(artifactId)}' has file=${displayAssemblyPath(props.file)} which ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				if (!resolved.contained) throw new SynthesisError(`Asset manifest artifact ${displayStackName(artifactId)} has file=${displayAssemblyPath(props.file)} which ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
 				map.set(artifactId, resolved.path);
 			}
 		}
@@ -3977,16 +3990,16 @@ var AssemblyReader = class {
 		const props = artifact.properties;
 		const stackName = props?.stackName || artifactId;
 		const templateFile = props?.templateFile;
-		if (!templateFile) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has no templateFile property`);
+		if (!templateFile) throw new SynthesisError(`Stack ${displayStackName(stackName)} has no templateFile property`);
 		const resolvedTemplate = resolveAssemblyPath(assemblyDir, templateFile);
-		if (!resolvedTemplate.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has templateFile=${displayAssemblyPath(templateFile)} which ${renderAssemblyPathEscape(resolvedTemplate, assemblyDir)}`);
+		if (!resolvedTemplate.contained) throw new SynthesisError(`Stack ${displayStackName(stackName)} has templateFile=${displayAssemblyPath(templateFile)} which ${renderAssemblyPathEscape(resolvedTemplate, assemblyDir)}`);
 		const templatePath = resolvedTemplate.path;
 		let template;
 		try {
 			const content = readFileSync(templatePath, "utf-8");
 			template = JSON.parse(content);
 		} catch (error) {
-			throw new SynthesisError(`Failed to read template for stack '${displaySafe(stackName)}': ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
+			throw new SynthesisError(`Failed to read template for stack ${displayStackName(stackName)}: ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
 		this.logger.debug(`Stack: ${displaySafe(stackName)}, Resources: ${Object.keys(template.Resources ?? {}).length}`);
 		let assetManifestPath;
@@ -4005,7 +4018,7 @@ var AssemblyReader = class {
 				if (depName !== stackName) dependencyNames.push(depName);
 			}
 		}
-		if (dependencyNames.length > 0) this.logger.debug(`Stack '${displaySafe(stackName)}' depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
+		if (dependencyNames.length > 0) this.logger.debug(`Stack ${displayStackName(stackName)} depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
 		if (artifact.environment) env = parseEnvironment(artifact.environment);
 		const nestedTemplates = nullPrototypeRecord();
@@ -4013,9 +4026,9 @@ var AssemblyReader = class {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 			const assetPath = resource.Metadata?.["aws:asset:path"];
 			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack ${displayStackName(stackName)} nested-stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 			const resolvedNested = resolveAssemblyPath(assemblyDir, assetPath);
-			if (!resolvedNested.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
+			if (!resolvedNested.contained) throw new SynthesisError(`Stack ${displayStackName(stackName)} nested-stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
 			nestedTemplates[logicalId] = resolvedNested.path;
 		}
 		return {
@@ -4107,6 +4120,109 @@ var ContextStore = class {
 	}
 };
 
+//#endregion
+//#region src/utils/ambient-client-defaults.ts
+/**
+* Client config for an SDK client built OUTSIDE `AwsClients` (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)).
+*
+* `awsClientDefaults()` alone carries the ambient ENVIRONMENT — `AWS_PROFILE`,
+* a published `--role-arn` role, the proxy handler, a stack scope's region — but
+* not an explicit `AwsClientConfig.credentials` object, which has no
+* environment path at all. A LIBRARY caller that installs
+* `new AwsClients({ credentials })` (`AwsClients` / `setAwsClients` are public
+* exports) therefore had every client a provider, context provider,
+* asset publisher or the cross-account STS hop built for itself signing with
+* the default credential chain: a different identity from the one it
+* configured. {@link ambientClientDefaults} closes that for every site at once
+* by reading the ACTIVE clients' {@link AwsClients.credentialConfig}.
+*
+* BOUND: a site that caches its client (every SDK provider's lazy
+* `getClient()`) captures the identity active at its FIRST call. cdkd builds a
+* provider registry per stack inside that stack's scope, so this is the stack's
+* identity; a library caller that reuses one registry across `setAwsClients`
+* switches keeps the first identity's clients.
+*
+* SPREAD IT FIRST, exactly where `awsClientDefaults()` was spread:
+*
+* `new GlueClient({ ...ambientClientDefaults(), ...(region && { region }) })`
+*
+* The site's own keys still win, so a site that names its own `region` or its
+* own `credentials` keeps them. `scripts/check-aws-client-defaults.ts` accepts
+* this helper as the defaults spread (it calls `awsClientDefaults` afresh per
+* call, so each client still gets its own routing agent), and
+* `tests/unit/utils/ambient-client-defaults-fence.test.ts` refuses a new
+* `awsClientDefaults()`-only construction under `src/**`.
+*
+* Its own module rather than a member of `aws-clients.ts` so that a test which
+* `vi.mock`s `aws-clients.js` with a `getAwsClients` double still reaches this
+* code and degrades, instead of losing the export. It is deliberately OUTSIDE
+* the literal-`.ts` closure `scripts/audit-provider-coverage.ts` resolves
+* (nothing in that closure imports it), and neither module it imports imports
+* it back, so there is no cycle.
+*/
+/**
+* The ACTIVE clients' credential configuration: the stack scope's
+* `AwsClients` inside `runWithStackAwsClients`, else the process-global one.
+*
+* `{}` when those clients carry none (every CLI run passes no explicit
+* `credentials`, and `--profile` alone yields `{ profile }`), and also for a
+* test double that has no `credentialConfig` getter — degrading to the plain
+* `awsClientDefaults()` answer rather than throwing.
+*
+* Read through `getAwsClients()`, which creates an unconfigured global on first
+* use when nothing installed one. That is side-effect free here: its service
+* clients are lazy, no production call passes `getAwsClients(config)` (so no
+* later configuration is shadowed), and `setAwsClients` replaces it.
+*/
+function ambientCredentialConfig() {
+	return getAwsClients()?.credentialConfig ?? {};
+}
+/**
+* `awsClientDefaults(...)` plus `credentialConfig`, in `AwsClients.clientOptions`'
+* spread order: the defaults FIRST, so an explicit `credentials` outranks a
+* published `--role-arn` role, then `profile`, then `credentials`.
+*
+* Takes the configuration as an argument for the callers that must key a cache
+* on the SAME reading they build from ({@link credentialFingerprint}); every
+* other site calls {@link ambientClientDefaults}.
+*/
+function clientDefaultsFor(credentialConfig) {
+	return {
+		...awsClientDefaults({ profile: credentialConfig.profile }),
+		...credentialConfig.profile && { profile: credentialConfig.profile },
+		...credentialConfig.credentials && { credentials: { ...credentialConfig.credentials } }
+	};
+}
+/**
+* The config every SDK client built outside `AwsClients` spreads first: the
+* proxy / role / scope-region defaults plus the ACTIVE clients' profile and
+* explicit credentials.
+*/
+function ambientClientDefaults() {
+	return clientDefaultsFor(ambientCredentialConfig());
+}
+/**
+* A cache-key component naming WHICH identity a credential configuration
+* selects, for a cache that holds a client (or credentials) built from it.
+*
+* `profile` plus the explicit credentials' ACCESS KEY ID — never the secret
+* key or the session token. The access key id is an identifier rather than a
+* secret (`expected-bucket-owner.ts` already keys its account cache on it), and
+* STS issues a distinct one per session, so two different explicit bags are
+* told apart. The one collision is two bags sharing an access key id with
+* different secrets, at most one of which can be valid.
+*
+* What it does NOT carry, because it is PROCESS-WIDE rather than per
+* configuration: a published `--role-arn` role (set once, refused a second
+* time), the proxy, and `AWS_PROFILE` / the environment chain. Two readings
+* with equal fingerprints within one process therefore resolve to the same
+* identity. Do not log it.
+*/
+function credentialFingerprint(credentialConfig) {
+	return JSON.stringify([credentialConfig.profile ?? null, credentialConfig.credentials?.accessKeyId ?? null]);
+}
+
 //#endregion
 //#region src/synthesis/context-providers/az-provider.ts
 /**
@@ -4125,7 +4241,7 @@ var AZContextProvider = class {
 		const region = props["region"] || this.awsConfig?.region;
 		this.logger.debug(`Fetching availability zones for region: ${region}`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4158,7 +4274,7 @@ var SSMContextProvider = class {
 		if (!parameterName) throw new Error("SSM context provider requires parameterName property");
 		this.logger.debug(`Reading SSM parameter: ${parameterName} (region: ${region})`);
 		const client = new SSMClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4200,7 +4316,7 @@ var HostedZoneContextProvider = class {
 		if (!domainName) throw new Error("Hosted zone context provider requires domainName property");
 		this.logger.debug(`Looking up hosted zone: ${domainName} (private: ${privateZone})`);
 		const client = new Route53Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4254,7 +4370,7 @@ var VpcContextProvider = class {
 		const returnVpnGateways = props["returnVpnGateways"];
 		this.logger.debug(`Looking up VPC (region: ${region}, filter: ${JSON.stringify(filter)})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4420,7 +4536,7 @@ var CcApiContextProvider = class {
 		if (!typeName) throw new Error("CC API context provider requires typeName property");
 		this.logger.debug(`CC API lookup: ${typeName}${exactIdentifier ? ` (id: ${exactIdentifier})` : ""} (region: ${region})`);
 		const client = new CloudControlClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4547,7 +4663,7 @@ var AmiContextProvider = class {
 		const filters = props["filters"];
 		this.logger.debug(`Looking up AMI (region: ${region})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4590,7 +4706,7 @@ var SecurityGroupContextProvider = class {
 		const vpcId = props["vpcId"];
 		this.logger.debug(`Looking up security group (id: ${securityGroupId}, name: ${securityGroupName}, region: ${region})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4644,7 +4760,7 @@ var LoadBalancerContextProvider = class {
 		const loadBalancerType = props["loadBalancerType"];
 		this.logger.debug(`Looking up load balancer (arn: ${loadBalancerArn}, region: ${region})`);
 		const client = new ElasticLoadBalancingV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4686,7 +4802,7 @@ var LoadBalancerListenerContextProvider = class {
 		const listenerProtocol = props["listenerProtocol"];
 		this.logger.debug(`Looking up load balancer listener (arn: ${listenerArn}, lb: ${loadBalancerArn}, region: ${region})`);
 		const client = new ElasticLoadBalancingV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4730,7 +4846,7 @@ var KeyContextProvider = class {
 		if (!aliasName) throw new Error("Key context provider requires aliasName property");
 		this.logger.debug(`Looking up KMS key by alias: ${aliasName} (region: ${region})`);
 		const client = new KMSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -5115,6 +5231,10 @@ function canonicalizeRegion(region) {
 * the COMMERCIAL suffix, so `parseEcrRegistryHost` (`src/utils/ecr-uri.ts`)
 * rejected it under the strict host check issue #1758 added and the image was
 * classified `public` — anonymous pull, no `docker login`, opaque failure.
+* `parseEcrRegistryHost` is stricter than this fallback (issue #3670): a
+* region whose PREFIX no partition row knows (`nz-north-1`) is refused there,
+* and reported by `looksLikeEcrHostWithForeignSuffix`, until its partition's
+* `regionRegex` is added to `AWS_REGION_ID` in `src/utils/ecr-uri.ts`.
 *
 * The region is CANONICALIZED through {@link canonicalizeRegion} before the
 * prefix tests (issue [#1795](https://github.com/go-to-k/cdkd/issues/1795)),
@@ -6630,7 +6750,7 @@ async function expandMacrosAttempt(template, opts, logger) {
 		const parameters = buildParameterValues(template, logger);
 		ownsClient = opts.cfnClient === void 0;
 		cfn = opts.cfnClient ?? new CloudFormationClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region
 		});
 		let templateInput;
@@ -7378,12 +7498,12 @@ var Synthesizer = class {
 		else if (accountId) stateBucket = `cdkd-state-${accountId}`;
 		else {
 			const oversize = stacksWithMacros.find((s) => JSON.stringify(s.template).length > 51200);
-			if (oversize) throw new SynthesisError(`Stack '${displaySafe(oversize.stackName)}' uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
+			if (oversize) throw new SynthesisError(`Stack ${displayStackName(oversize.stackName)} uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
 			stateBucket = void 0;
 		}
 		for (const stack of stacksWithMacros) {
 			const macros = enumerateMacros(stack.template);
-			this.logger.info(`[macros] Expanding CloudFormation macros for stack '${displaySafe(stack.stackName)}' via CFn round-trip (transforms: ${macros.map((m) => displaySafe(m)).join(", ")}; may take 30-60s)...`);
+			this.logger.info(`[macros] Expanding CloudFormation macros for stack ${displayStackName(stack.stackName)} via CFn round-trip (transforms: ${macros.map((m) => displaySafe(m)).join(", ")}; may take 30-60s)...`);
 			const before = Date.now();
 			const expanded = await expandMacros(stack.template, {
 				region,
@@ -7536,14 +7656,14 @@ function resolveFileAssetSourcePath(manifestDir, asset, opts) {
 		const absolute = resolve$1(asset.source.path);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
 		if (escape !== void 0) warnAbsoluteAssetPath({
-			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			subject: `File asset ${displayAssemblyPath(asset.displayName)}`,
 			field: "source.path",
 			absolute,
 			escape,
 			sink
 		});
 		else if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource({
-			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			subject: `File asset ${displayAssemblyPath(asset.displayName)}`,
 			field: "source.path",
 			outdir: absolute,
 			sink
@@ -7553,14 +7673,14 @@ function resolveFileAssetSourcePath(manifestDir, asset, opts) {
 	const resolved = resolveAssemblyPath(manifestDir, asset.source.path, { containWithin: assetOutdir });
 	if (!resolved.contained && namesTheSameDirectory(assetOutdir, resolved.path)) {
 		warnWholeAssemblyAsSource({
-			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			subject: `File asset ${displayAssemblyPath(asset.displayName)}`,
 			field: "source.path",
 			outdir: resolved.path,
 			sink
 		});
 		return resolved.path;
 	}
-	if (!resolved.contained) throw new Error(`File asset '${displaySafe(asset.displayName)}' has source.path=${displayAssemblyPath(asset.source.path)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
+	if (!resolved.contained) throw new Error(`File asset ${displayAssemblyPath(asset.displayName)} has source.path=${displayAssemblyPath(asset.source.path)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
 	return resolved.path;
 }
 /**
@@ -7596,7 +7716,7 @@ var AssetManifestLoader = class {
 	*/
 	async loadManifest(cdkOutputDir, stackName) {
 		const resolved = resolveAssemblyPath(cdkOutputDir, `${stackName}.assets.json`);
-		if (!resolved.contained) throw new Error(`Asset manifest for stack '${displaySafe(stackName)}' ${renderAssemblyPathEscape(resolved, cdkOutputDir)}`);
+		if (!resolved.contained) throw new Error(`Asset manifest for stack ${displayStackName(stackName)} ${renderAssemblyPathEscape(resolved, cdkOutputDir)}`);
 		const manifestPath = resolved.path;
 		try {
 			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
@@ -7761,7 +7881,7 @@ var FileAssetPublisher = class {
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
 			this.logger.debug(`Publishing file asset ${asset.displayName || assetHash} → s3://${bucketName}/${objectKey}`);
 			const client = new S3Client({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -9559,65 +9679,7 @@ function resolveDockerContextDirectory(opts) {
 }
 /** One spelling of the warning subject, so the two arms cannot drift. */
 function dockerSubject(assetId) {
-	return assetId === void 0 ? "A Docker asset" : `Docker asset '${displaySafe(assetId)}'`;
-}
-/**
-* Refuse a Docker asset whose build context the bundled `cdk-local` engine
-* would take from outside the assembly (issue
-* [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
-*
-* Since cdk-local 0.149.3 the engine's own `buildDockerImage` refuses the same
-* escapes and opens the path it judged (go-to-k/cdkd#3597). This copy stays in
-* FRONT of it because the engine's refusal quotes the assembly-chosen value in
-* a boundary the value can close (go-to-k/cdk-local#758), while this one
-* renders it through `displayAssemblyPath`; go-to-k/cdkd#3652 removes it once
-* that ships. It judges the path the engine's `${cdkOutDir}/${source.directory}`
-* spelling names, before the engine runs, through the same
-* {@link resolveDockerContextDirectory} cdkd's own build uses.
-*
-* An ABSOLUTE value is judged by the engine's spelling, not honoured: the
-* concatenation folds it UNDER the manifest directory, so its leading
-* separators are stripped and the remainder takes the relative arm. That
-* keeps a symlink inside the assembly from becoming an escape through an
-* absolute spelling, and keeps the honour-and-warn arm, which describes a
-* build this engine never performs, out of these paths.
-*/
-function assertCdkLocalDockerContextContained(opts) {
-	const { manifestDir, source, assetOutdir, wrapError } = opts;
-	const directory = source.directory;
-	if (!directory) return;
-	const asEngineJoinsIt = isAbsolute$1(directory) ? directory.replace(/^[/\\]+/, "") : directory;
-	resolveDockerContextDirectory({
-		manifestDir,
-		directory: asEngineJoinsIt,
-		wrapError,
-		assetOutdir,
-		sink: source.executable && source.executable.length > 0 ? "run this asset's source.executable with that directory as its working directory" : "send that directory to docker build as the context of an image cdkd then runs locally"
-	});
-	const engineSpelled = `${manifestDir}/${asEngineJoinsIt}`;
-	const physical = tryRealpathNative(engineSpelled);
-	if (physical === void 0) return;
-	const bound = tryRealpathNative(assetOutdir) ?? resolve$1(assetOutdir);
-	const rel = relative(bound, physical);
-	if (rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute$1(rel)) return;
-	throw wrapError(`asset source.directory=${displayAssemblyPath(directory)} which ` + renderAssemblyPathEscape({
-		contained: false,
-		escape: "symlink",
-		path: engineSpelled,
-		realPath: physical
-	}, assetOutdir, "build it"));
-}
-/**
-* `realpath(3)`, or `undefined` when the path does not resolve. `.native` is
-* load-bearing: the JavaScript `realpathSync` folds `..` lexically first,
-* which is the very reading the check above exists to avoid.
-*/
-function tryRealpathNative(p) {
-	try {
-		return realpathSync$1.native(p);
-	} catch {
-		return;
-	}
+	return assetId === void 0 ? "A Docker asset" : `Docker asset ${displayIdent(assetId)}`;
 }
 /**
 * Build a Docker image from a CDK asset source. Returns the local image
@@ -9781,7 +9843,7 @@ var DockerAssetPublisher = class {
 			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
 			this.logger.debug(`Publishing Docker image ${asset.displayName || assetHash} → ${ecrUri}`);
 			const client = new ECRClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -9820,7 +9882,7 @@ var DockerAssetPublisher = class {
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
 			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
 			const client = new ECRClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -11363,7 +11425,7 @@ var AssetPublisher = class {
 			if (!accountId) {
 				const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 				const stsClient = new STSClient({
-					...awsClientDefaults(),
+					...ambientClientDefaults(),
 					region
 				});
 				accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -24507,9 +24569,9 @@ function inspectCommand(stackName, region) {
 * entries FIRST ({@link repairMalformedResourceEntriesForReadOnly}), so the
 * row is reported once, as unreadable, rather than warned about as a preview
 * and then dropped. The object test stays here rather than
-* {@link isReadableResourceEntry} because the deploy path takes this
-* predicate WITHOUT the entry one, and narrowing it would let a typeless
-* object with a torn map reach the comparison unrefused. Likewise a `resources` bag that is not readable at all
+* {@link isReadableResourceEntry} so this verdict does not depend on the entry
+* guard running first: narrowing it would let a typeless object with a torn
+* map through any caller that takes this predicate alone. Likewise a `resources` bag that is not readable at all
 * yields `[]` here rather than ids invented from a string's characters — that
 * class is {@link hasReadableResources}'s to report. What a caller must not do
 * is take only this one.
@@ -25167,13 +25229,10 @@ function malformedResourceEntriesWarning(rawStackName, rawRegion, logicalIds) {
 * `logicalId` is not a string arrives as `''` and renders as the
 * `UNRENDERABLE` stand-in.
 */
-function malformedOrphanRecordsWarning(rawStackName, rawRegion, logicalIds) {
+function malformedOrphanRecordsWarning(rawStackName, rawRegion, logicalIds, alsoRejectsTornMaps) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
-	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
-	const more = rest > 0 ? ` and ${rest} more` : "";
-	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${named}${more} — because they are not objects, or carry no resource type. Continuing WITHOUT them: they are not previewed for adoption. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. See the stored values with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${namedOrphanRows(logicalIds)} — because they are not objects, have no string 'logicalId' or share it with another row, or their 'state' is not an object, names no resource type${alsoRejectsTornMaps ? ", has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object" : ` or has no non-empty string 'physicalId'`}. Continuing WITHOUT them: ${alsoRejectsTornMaps ? `they are excluded from the secret scan, so nothing this run does can certify them` : "they are not previewed for adoption, and 'cdkd deploy' refuses the record over them rather than dropping them as this command does"}. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. See the stored values with: ` + inspectCommand(stackName, region);
 }
 /**
 * The half the refusal and the warning share: what is wrong and which entries.
@@ -25212,6 +25271,46 @@ function malformedResourceEntriesRefusalMessage(rawStackName, rawRegion, logical
 	return `${namedEntriesClause(stackName, region, logicalIds)} This command can WRITE state, so it refuses rather than skipping them: saving over the record would report a clean run for entries nothing could read, and would leave the next command to fail on them with no more to go on. Nothing was locked, read from AWS or written FOR THIS STACK. Inspect it with: ` + inspectCommand(stackName, region);
 }
 /**
+* For `cdkd deploy`: refuse a record whose `resources` map holds a ROW that is
+* not a readable resource record (go-to-k/cdkd#3314). TWO call sites, one
+* verdict. `DeployEngine`'s state load is the one a deploy hits: two walks run
+* between the load and the diff (the CLI's prefix-migration gate and the
+* observed-state auto-refresh) and each died on a `null` row with a bare
+* `TypeError`. `DiffCalculator.calculateDiff` also calls it, beside
+* {@link refuseMalformedResourceProperties}, because that is where the verdict
+* is made. Any other caller of the diff that forgets gets the refusal.
+*
+* The harm is the diff's verdict, not a save. The diff looks up each template
+* resource by logical id, so a `null` (or any non-object) row reads as "not in
+* state" and is planned as a CREATE. That either collides with the live
+* resource's name or creates a SECOND copy and orphans the first. A row with no
+* `resourceType` compares unequal to the template's type, so it is planned as a
+* TYPE CHANGE, which is a replacement.
+*
+* A third entry point on the ENTRY class rather than a call to
+* {@link refuseMalformedResourceEntries}, whose text is false here. That text
+* says "Nothing was locked", but the deploy holds its lock at both sites. Same
+* predicate, so the verdict cannot diverge.
+*
+* The engine passes its own resolved stack and region. `calculateDiff` holds no
+* trusted pair and passes neither (see {@link stackClause}).
+*/
+function refuseMalformedResourceEntriesForDeploy(state, stackName, region) {
+	const unreadable = unreadableResourceEntries(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedDeployResourceEntriesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The text {@link refuseMalformedResourceEntriesForDeploy} raises. Like
+* {@link malformedResourcePropertiesRefusalMessage}, it must be true under
+* `--dry-run` too, since the dry-run return comes after the diff.
+*/
+function malformedDeployResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a row that is not an object reads as a resource cdkd does not manage, so the template's resource of that id is planned as a CREATE (a second copy of a live resource, or a name collision), and a row with no resource type is planned as a TYPE CHANGE, which replaces the live resource. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack without those rows and warns that it did. Inspect the record with: ` + inspectCommand(stackName, region);
+}
+/**
 * For `cdkd orphan`: refuse a record whose SURVIVING `resources` entries are
 * not readable resource records (go-to-k/cdkd#3350).
 *
@@ -25305,12 +25404,177 @@ function malformedOrphanResourceAttributesRefusalMessage(rawStackName, rawRegion
 	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} resource record(s) whose 'attributes' map cannot be read — ${named}${more} — because it is null or not an object. The record is malformed or truncated. 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses. The map is carried into the save VERBATIM, and a list is walked, so its rewrites are recorded into a container that is still not a map. It is the cache a later 'cdkd deploy' reads another resource's 'Fn::GetAtt' of this one from, so continuing would report success over the one map that read depends on.`, SURVIVOR_THIRD_WAY_OUT);
 }
 /**
+* Is ONE `orphans[]` record PREVIEWABLE — the narrow half of
+* {@link isReadableOrphanRecord}, for `cdkd diff` alone (go-to-k/cdkd#3500).
+*
+* An object, a string `logicalId`, and a `state` that is a readable resource
+* entry with a non-empty string `physicalId`: everything the adoption preview
+* dereferences, and nothing more. The `physicalId` half is NOT inherited from
+* {@link isReadableResourceEntry} — see {@link hasStringPhysicalId} for why that
+* one stops at `resourceType` and why a ROW cannot. It
+* deliberately does not ask about that entry's `properties`, because `cdkd diff`
+* has a LATER answer for that one — `computeStackDiff` runs the `properties`
+* repair a second time over the adopted records and names what it emptied, which
+* `docs/cli-diff.md` and `.claude/rules/state-malformed-properties.md` both
+* describe. Dropping such a row here instead would make that repair unreachable
+* and silently retire a documented report. A torn `attributes` map rides through
+* for the same reason and gets NO later answer: stated rather than solved, and
+* the same residual `cdkd diff` had before this predicate existed.
+*
+* It CANNOT see rows sharing a `logicalId` (go-to-k/cdkd#3643), a LIST-level
+* defect — never filter a list with it alone; take
+* {@link previewableOrphanRecords} / {@link unpreviewableOrphanRecords}.
+*
+* Every WRITER takes the full predicate: none of them has a second answer, and
+* a torn `properties` map reaching a save is go-to-k/cdkd#3344's defect.
+*/
+function isPreviewableOrphanRecord(record) {
+	if (!isReadableBag(record)) return false;
+	if (typeof record.logicalId !== "string") return false;
+	const entry = record.state;
+	return isReadableResourceEntry(entry) && hasStringPhysicalId(entry);
+}
+/**
+* Does this resource entry carry a NON-EMPTY string `physicalId`?
+*
+* Its own helper rather than a clause spelled in each row predicate, so the two
+* cannot drift on it, and deliberately NOT folded into
+* {@link isReadableResourceEntry}: that one answers for a `resources` ENTRY,
+* where stopping at `resourceType` is a recorded decision — a row with a type and
+* no physical id fails per-resource where it is used and is reported by that
+* command in its own terms.
+*
+* An `orphans` ROW has no such second report, which is why it asks for more
+* (go-to-k/cdkd#3641 review). The record names a resource cdkd deliberately LEFT
+* LIVE in AWS, so the physical id is the only handle on it: `cdkd destroy`'s
+* pre-confirmation listing is the operator's only notice before the record is
+* deleted, and it rendered an absent id as an EMPTY field in the row they
+* approve. `planOrphanAdoption` dereferences it eight times over — including
+* `knownPhysicalId` on the provider call and `claims().has(...)` for a
+* cross-stack collision — so a row without one decides an adoption from
+* `undefined`.
+*/
+function hasStringPhysicalId(entry) {
+	const physicalId = entry.physicalId;
+	return typeof physicalId === "string" && physicalId !== "";
+}
+/**
+* The `orphans[]` records {@link isPreviewableOrphanRecord} rejects, PLUS every
+* row sharing its string `logicalId` with another row (go-to-k/cdkd#3643),
+* named the way {@link unreadableOrphanRecords} names its own.
+*/
+function unpreviewableOrphanRecords(state) {
+	if (!Array.isArray(state.orphans)) return [];
+	const rows = state.orphans;
+	const shared = sharedOrphanLogicalIds(rows);
+	return rows.filter((record) => !isPreviewableOrphanRecord(record) || sharesLogicalId(record, shared)).map(orphanRowName);
+}
+/**
+* The rows `cdkd diff` KEEPS for the adoption preview: the complement of
+* {@link unpreviewableOrphanRecords}, homed beside it so the two cannot
+* disagree about a row (go-to-k/cdkd#3643). `[]` for a container that is not a
+* list, which {@link hasReadableOrphans} reports.
+*
+* Why not `orphans.filter(isPreviewableOrphanRecord)` at the call site, which is
+* what `cdkd diff` did: that predicate decides ONE record, and a shared
+* `logicalId` is a property of the LIST. Two rows carrying one id both pass it,
+* and `planOrphanAdoption` then keys its adoption map on that id, so the preview
+* shows ONE adoption for two rows — the collapse the writers now refuse.
+*/
+function previewableOrphanRecords(state) {
+	if (!Array.isArray(state.orphans)) return [];
+	const rows = state.orphans;
+	const shared = sharedOrphanLogicalIds(rows);
+	return rows.filter((record) => isPreviewableOrphanRecord(record) && !sharesLogicalId(record, shared));
+}
+/**
+* The string `logicalId`s that TWO OR MORE rows of `orphans` carry
+* (go-to-k/cdkd#3643) — `''` included, since an empty string is still a key.
+*
+* Such a record is MALFORMED, not merely unusual: no supported writer produces
+* one, because `orphansAfterRollback` merges by `logicalId` and keeps one row per
+* id. What a reader does with it is the loss the row predicate exists to refuse
+* for a MISSING id — `orphansAfterRollback` keeps only the LAST of the rows, and
+* the deploy's adoption pass writes `adopted[logicalId]` for each, so the first
+* row's resource stays live in AWS with nothing tracking it.
+*
+* Counted over EVERY row that is an object carrying a string id, not only the
+* rows the per-record predicate accepts: a torn row and a healthy one sharing an
+* id still say the record was edited or damaged, and keeping the healthy one
+* would have a read-only command preview, as the stack's only row of that id, a
+* row whose twin the writers refuse over. A `Map` rather than a plain object, so
+* an id spelled `__proto__` or `constructor` is counted rather than resolved
+* through the prototype.
+*/
+function sharedOrphanLogicalIds(rows) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const record of rows) {
+		if (!isReadableBag(record)) continue;
+		const id = record.logicalId;
+		if (typeof id !== "string") continue;
+		seen.set(id, (seen.get(id) ?? 0) + 1);
+	}
+	const shared = /* @__PURE__ */ new Set();
+	for (const [id, count] of seen) if (count > 1) shared.add(id);
+	return shared;
+}
+/** Does this row carry one of the {@link sharedOrphanLogicalIds}? */
+function sharesLogicalId(record, shared) {
+	if (shared.size === 0 || !isReadableBag(record)) return false;
+	const id = record.logicalId;
+	return typeof id === "string" && shared.has(id);
+}
+/**
+* How every `orphans` ROW helper names a row: its `logicalId`, or `''`
+* (rendered as the `UNRENDERABLE` stand-in) when it has no string one.
+*/
+function orphanRowName(record) {
+	const id = isReadableBag(record) ? record.logicalId : void 0;
+	return typeof id === "string" ? id : "";
+}
+/**
+* Is ONE `orphans[]` record usable by a reader (go-to-k/cdkd#3500)?
+*
+* Split out of {@link unreadableOrphanRecords} rather than written a second
+* time, so the five WRITE-capable readers that take a row's fields off the cast
+* and the `cdkd orphan` refusal that predates them cannot disagree about which
+* rows are usable. `cdkd diff` deliberately disagrees for one class — see
+* {@link isPreviewableOrphanRecord}, which is the narrower half it takes. The two shapes answer different questions and share this verdict:
+* this one decides ONE record, that one names every record a state fails on.
+*
+* A reader needs all of it to hold, because it reaches the record as a WHOLE:
+* the record is an object, its `logicalId` is a string (a row with none keys
+* `orphansAfterRollback`'s merge map on `undefined`, so several of them collapse
+* into one), its `state` is a readable resource entry carrying a NON-EMPTY string
+* `physicalId` ({@link hasStringPhysicalId} carries why that is asked here and
+* not for a `resources` entry), and that entry's `properties` and `attributes`
+* maps are readable.
+*
+* It CANNOT see the one LIST-level defect: two rows sharing a string `logicalId`
+* collapse in the same merge map, and each of them passes this test
+* (go-to-k/cdkd#3643). So never filter a list with it alone — take
+* {@link unreadableOrphanRecords} (or, for `cdkd diff`,
+* {@link previewableOrphanRecords}), which add that check.
+*/
+function isReadableOrphanRecord(record) {
+	if (!isPreviewableOrphanRecord(record)) return false;
+	const entry = record.state;
+	return isReadableBag(entry.properties) && hasReadableAttributes(entry);
+}
+/**
 * The `orphans[]` records a reader cannot use: a record that is not an object
-* or has no string `logicalId`, whose `state` is not a readable resource entry,
-* or whose `state` carries an unreadable `properties` or `attributes` map
+* or has no string `logicalId`, or whose `state` is not a readable resource entry,
+* carries no non-empty string `physicalId`, or carries an unreadable `properties`
+* or `attributes` map
 * (go-to-k/cdkd#3344). The `logicalId` half is go-to-k/cdkd#3500's row
-* predicate: rows with none all key one map entry, and `orphansAfterRollback`
-* collapses them into one.
+* predicate: rows MISSING one all key the same map entry, and
+* `orphansAfterRollback` collapses those into one. EVERY row whose string
+* `logicalId` another row also carries is named too — each of them, since
+* nothing says which is the live resource (go-to-k/cdkd#3643,
+* {@link sharedOrphanLogicalIds}): those collapse in the same map by the same
+* mechanism, and it is the check {@link isReadableOrphanRecord} cannot make.
+* Folded in HERE so every refusal, the read-only repair and `cdkd orphan`
+* inherit it and no caller re-spells it.
 *
 * Every `ResourceState` question the `resources` side answers in separate
 * predicates, asked in ONE here: a rollback-orphan record is reached only as a
@@ -25323,15 +25587,100 @@ function malformedOrphanResourceAttributesRefusalMessage(rawStackName, rawRegion
 */
 function unreadableOrphanRecords(state) {
 	if (!Array.isArray(state.orphans)) return [];
-	return state.orphans.filter((record) => {
-		if (!isReadableBag(record)) return true;
-		if (typeof record.logicalId !== "string") return true;
-		const entry = record.state;
-		return !isReadableResourceEntry(entry) || !isReadableBag(entry.properties) || !hasReadableAttributes(entry);
-	}).map((record) => {
-		const id = isReadableBag(record) ? record.logicalId : void 0;
-		return typeof id === "string" ? id : "";
-	});
+	const rows = state.orphans;
+	const shared = sharedOrphanLogicalIds(rows);
+	return rows.filter((record) => isUnusableOrphanRow(record, shared)).map(orphanRowName);
+}
+/**
+* The writers' per-row verdict with the list-level half applied: the ONE test
+* {@link unreadableOrphanRecords} names by and
+* {@link repairMalformedOrphanRecordsForReadOnly} drops by, so the rows a
+* dry run drops are exactly the rows the real run refuses over.
+*/
+function isUnusableOrphanRow(record, shared) {
+	return !isReadableOrphanRecord(record) || sharesLogicalId(record, shared);
+}
+/**
+* Refuse a readable `orphans` list holding a record no reader can use, on a
+* path that can WRITE state (go-to-k/cdkd#3500).
+*
+* The CONTAINER pair beside this one ({@link refuseMalformedOrphans} and its
+* destroy twin) answers "is the field a list"; this answers "is every row in it
+* usable", and a list can fail the second while passing the first. One
+* predicate for both questions would be wrong in the direction that loses
+* evidence: `cdkd diff` repairs the container and must DROP a row, which is not
+* the same verdict.
+*
+* Marked non-retryable for {@link refuseMalformedOrphans}'s reason: a retry
+* cannot change a persisted record, and a nested child's deploy runs inside a
+* `withRetry`.
+*
+* It takes NO `LockRecoveryContext`, matching its container twin
+* {@link refuseMalformedOrphans}: no caller on these paths holds one, and a
+* parameter every call site omits renders nothing. The message builder keeps its
+* own `recovery` parameter, and its arms are pinned by calling it directly —
+* `refuseMalformedOrphansForOrphan` is NOT that route, since it raises a
+* different text ({@link malformedOrphansForOrphanRefusalMessage}).
+*/
+function refuseMalformedOrphanRecords(state, stackName, region) {
+	const unreadable = unreadableOrphanRecords(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedOrphanRecordsRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The DESTROY twin of {@link refuseMalformedOrphanRecords}, carrying its own
+* text for the reason the container pair splits: a destroy neither walks the
+* record back into `resources` nor writes a reshaped one, so the writer text's
+* mechanism would be false here. What it does instead is REPORT the rows — the
+* operator's only notice that those resources stop being tracked — from fields
+* it never validates, and then remove the record.
+*/
+function refuseMalformedOrphanRecordsForDestroy(state, stackName, region) {
+	const unreadable = unreadableOrphanRecords(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedOrphanRecordsForDestroyRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The WRITER text {@link refuseMalformedOrphanRecords} raises.
+*
+* Its mechanism clause names THREE outcomes rather than one, because a reader
+* meets a different one per shape: a row MISSING its `logicalId` keys
+* `orphansAfterRollback`'s merge map on `undefined`, so rows missing it collapse
+* to one saved survivor (distinct NUMERIC ids do not — they stay distinct keys),
+* and rows SHARING a string one collapse the same way (go-to-k/cdkd#3643);
+* a row whose `state` is absent or null aborts wherever it is first
+* dereferenced; and a `state` that is a primitive or names no resource type
+* reads as `undefined` and is carried or reported as though it were a record.
+*/
+function malformedOrphanRecordsRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. This command can WRITE state, and what it would do with such a row is not one thing: 'cdkd rollback' merges by 'logicalId', so rows MISSING one, or SHARING one, key the same entry and only one of them survives into the record it saves, the others' resources left live in AWS with nothing tracking them; a row whose 'state' is absent or null aborts wherever it is first dereferenced, with an error naming neither the field nor the stack; and the quietest shape is neither — a 'state' that is a primitive, or an object naming no resource type, reads as 'undefined' and is carried or reported as if it were a record. It refuses rather than pick one of those outcomes.`, "Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
+}
+/** The DESTROY text {@link refuseMalformedOrphanRecordsForDestroy} raises. */
+function malformedOrphanRecordsForDestroyRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. This command DELETES state, and the record is the only evidence that those resources are live in AWS — so it refuses over any part of a row it cannot read rather than removing evidence it could not fully report. What the DAMAGE costs the report depends on which part is torn: the listing that tells you which resources stop being tracked prints the row's own 'logicalId', resource type and physical id, from fields nothing else validates, so it can abort before the confirmation naming nothing, or print a row with a field missing and let you approve the delete. A torn 'properties' or 'attributes' map the listing never reads is refused too, because what is discarded is the whole record. So are rows sharing one 'logicalId', though the listing would print each: no cdkd command writes such a record — the rollback save merges by id and every other save carries the list unchanged — so it was damaged or edited by hand, and deleting it would discard it before anyone decides which of those resources the stack still owns.`, "Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
+}
+/**
+* The READ-ONLY disposition for the same rows: DROP them and return their
+* names, for a command that never writes the record back — `cdkd scrub
+* --dry-run` today.
+*
+* Returns the dropped names rather than a boolean because its caller reports
+* them: `cdkd scrub --dry-run` warns with them by name, and the stack joins the
+* audited-record refusal's list. `cdkd diff` does NOT call this — it needs the
+* narrower {@link isPreviewableOrphanRecord} and keeps the survivors itself. An
+* empty return means nothing was dropped and the list is untouched.
+*/
+function repairMalformedOrphanRecordsForReadOnly(state) {
+	const unreadable = unreadableOrphanRecords(state);
+	if (unreadable.length === 0) return [];
+	const rows = state.orphans ?? [];
+	const shared = sharedOrphanLogicalIds(rows);
+	state.orphans = rows.filter((record) => !isUnusableOrphanRow(record, shared));
+	return unreadable;
 }
 /**
 * For `cdkd orphan`: refuse a record whose `orphans` list, or any record in
@@ -25355,6 +25704,87 @@ function refuseMalformedOrphansForOrphan(state, stackName, region, recovery) {
 	if (unreadable.length === 0) return;
 	throw new CdkdError(malformedOrphansForOrphanRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
 }
+/**
+* The `--fail` / exit-3 reason `cdkd diff` reports for an `orphans` row it KEEPS
+* in the preview and `cdkd deploy` REFUSES (go-to-k/cdkd#3641 maintainer review,
+* M1).
+*
+* The two predicates disagree on exactly one class — a row whose `properties` or
+* `attributes` map is torn — and that disagreement is deliberate: `cdkd diff`
+* keeps such a row so the second `properties` repair can name it. What was
+* missing is the OTHER half of keeping it: the deploy refuses the whole record
+* over that same row, so a preview that says nothing lets `cdkd diff --fail`
+* exit 0 and the deploy the operator runs next refuse. That is the contract
+* `cdkd diff` states for the adoption preview, and this PR is what made it
+* false. Precisely which shapes: a torn `attributes` map, and a torn `properties`
+* map on a row the adoption did NOT take — an ADOPTED torn-`properties` row was
+* already refused at deploy through `calculateDiff` before this lane
+* (go-to-k/cdkd#3641 item o5), and it is the one the sibling arm reports.
+*
+* Homed HERE rather than in `diff-recursive.ts` for the reason every text in
+* this module is: it renders untrusted logical ids, so it needs
+* {@link namedOrphanRows} — the same cap, the same `displayLogicalId`, the same
+* `UNRENDERABLE` stand-in. It NAMES the rows as well as counting them, unlike
+* {@link deployRefusesPropertiesReason}'s count-only line in that file. It keeps
+* the names even though {@link malformedOrphanRowsKeptWarning} now names them
+* too: this reason ships in the `--json` payload, where "see the warning above"
+* has no referent — the same argument that sibling's doc makes for its own
+* shape.
+*/
+function deployRefusesOrphanRowsReason(logicalIds) {
+	return `${logicalIds.length} rollback-orphan record(s) in 'orphans' — ${namedOrphanRows(logicalIds)} — carry a 'properties' or 'attributes' map that cannot be read. This preview KEEPS them, so any adoption shown for them is one 'cdkd deploy' will not perform: it refuses the record over the same rows, and the deploy this previews will not start.`;
+}
+/**
+* The WARNING `cdkd diff` prints for an `orphans` row it KEEPS and a writer
+* refuses (go-to-k/cdkd#3641 maintainer round 2, M1 continued).
+*
+* At every node the RUN REACHES with an adoption preview, which is narrower than
+* "every node" and the difference is not pedantry (round 4): a non-recursive run —
+* the default — returns before visiting any child, a state-only child being
+* DELETED is built with no `previewOrphanAdoption` so the whole row pass is
+* skipped, and any other caller omitting that option skips it too.
+*
+* The exit-3 reason beside this one is TOP-LEVEL only, which is
+* go-to-k/cdkd#3335's scope decision and right: the deploy skips an unchanged
+* nested-stack row, so a reason there would report a refusal over a deploy that
+* succeeds. What made that split SAFE for every other class is that each one
+* still warns at every node — and this class had no warning at all, because the
+* row is KEPT and {@link malformedOrphanRecordsWarning} speaks only for rows that
+* were DROPPED. So a changed nested child holding such a row printed nothing and
+* its deploy refused.
+*
+* It says what the row IS and what the deploy will do, and makes no claim about
+* what else happens to the row — which is where the first two spellings went
+* wrong (go-to-k/cdkd#3641 rounds 3 and 4). One said the map "is repaired and
+* named again over the records an adoption takes", false for every row that
+* survives the caller's subtraction; the next said nothing else repairs or
+* previews these rows, false for an ADOPTED row whose `properties` are healthy and
+* whose `attributes` are torn — the subtraction removes adopted torn-`properties`
+* names, not every adopted row, and `planOrphanAdoption` rebuilds that row's
+* attributes and previews the adopted resource. The row's disposition beyond
+* "kept" is the caller's business, not this sentence's.
+*
+* It says the deploy of THIS stack refuses, not that "the deploy this previews"
+* will not start (round 4 again): under `--recursive` this warning can name a row
+* in an UNCHANGED nested child, whose parent deploy skips that child and
+* succeeds. The stack the message already names is the one whose deploy refuses.
+*/
+function malformedOrphanRowsKeptWarning(rawStackName, rawRegion, logicalIds) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' — ${namedOrphanRows(logicalIds)} — whose 'properties' or 'attributes' map is not an object. This preview KEEPS them. 'cdkd deploy' of THIS stack does NOT: it refuses the whole record over these rows and will not start until they are repaired. See the stored values with: ` + inspectCommand(stackName, region);
+}
+/**
+* The `<ids> and N more` fragment every `orphans` ROW text shares — the three
+* refusals and the warning — so a fifth cannot spell the cap differently
+* (go-to-k/cdkd#3500). Derive the list with
+* `grep -n "namedOrphanRows(" src/state/malformed-resources-bag.ts`.
+*/
+function namedOrphanRows(logicalIds) {
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
+	return `${named}${rest > 0 ? ` and ${rest} more` : ""}`;
+}
 /** See {@link orphanRefusal}'s `dropCaveat`. */
 const ORPHANS_DROP_CAVEAT = "; it also discards the 'orphans' list, the only record of resources an earlier failed deploy left live in AWS";
 /**
@@ -25371,10 +25801,7 @@ function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logica
 	const region = absentIfEmpty(rawRegion);
 	const verbatim = "'cdkd orphan' carries it into the record it saves VERBATIM, without reading it, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses.";
 	if (logicalIds === void 0) return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} has no readable 'orphans' list — the record is malformed or truncated. ${verbatim} The next 'cdkd deploy' refuses the same record, so continuing would only report success over it and leave that refusal one command later.`, "'cdkd orphan' cannot address this list at all, and rewriting it to [] by hand discards the only record of resources an earlier failed deploy left live in AWS.", ORPHANS_DROP_CAVEAT);
-	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
-	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
-	const more = rest > 0 ? ` and ${rest} more` : "";
-	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${named}${more} — because the record has no string 'logicalId', its 'state' is not an object or names no resource type, or that state's 'properties' or 'attributes' map is not one. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
 }
 
 //#endregion
@@ -25429,6 +25856,21 @@ const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 */
 const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]) });
 /**
+* The PREFIX twin of {@link IN_PLACE_UPDATE_DERIVED_ATTRS}, for a type whose
+* derived attributes are an open family rather than a fixed list (issue
+* [#3631](https://github.com/go-to-k/cdkd/issues/3631)).
+*
+* A nested stack's `Outputs.<Key>` attributes are the child's outputs, and a
+* child-only change moves them while the parent's `AWS::CloudFormation::Stack`
+* row changes only `TemplateURL` / `Parameters`. The parent's diff runs BEFORE
+* the child deploys, so a reader of `Fn::GetAtt [Child, 'Outputs.<Key>']`
+* resolves against the PREVIOUS value and diffs NO_CHANGE. Which outputs move
+* is decided by the child's own deploy, so it is not knowable here: every
+* reader is promoted, and the deploy engine's re-resolve-and-skip drops the
+* ones whose output did not move.
+*/
+const IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES = Object.freeze({ "AWS::CloudFormation::Stack": Object.freeze(["Outputs."]) });
+/**
 * Diff calculator for comparing desired state (template) with current state
 */
 var DiffCalculator = class DiffCalculator {
@@ -25464,6 +25906,7 @@ var DiffCalculator = class DiffCalculator {
 	*/
 	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties) {
 		const changes = /* @__PURE__ */ new Map();
+		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0);
 		refuseMalformedResourceProperties(currentState, void 0, void 0);
 		const currentResources = currentState.resources;
 		const desiredResources = desiredTemplate.Resources;
@@ -25558,8 +26001,11 @@ var DiffCalculator = class DiffCalculator {
 			});
 			this.logger.debug(`DELETE: ${logicalId} (${currentResource.resourceType})`);
 		}
-		this.promoteReplacementDependents(changes, desiredTemplate);
-		this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs);
+		let round = 0;
+		do {
+			round++;
+			this.promoteReplacementDependents(changes, desiredTemplate);
+		} while (this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, currentResources, round));
 		const summary = this.getSummary(changes);
 		this.logger.debug(`Diff calculated: ${summary.create} CREATE, ${summary.update} UPDATE, ${summary.delete} DELETE, ${summary.noChange} NO_CHANGE`);
 		return changes;
@@ -25671,7 +26117,11 @@ var DiffCalculator = class DiffCalculator {
 	*      update side-effects even though it is not a template property — the
 	*      per-type {@link IN_PLACE_UPDATE_DERIVED_ATTRS} allow list (issue #985;
 	*      e.g. `AWS::EC2::LaunchTemplate.LatestVersionNumber`, which an
-	*      `autoscaling.AutoScalingGroup` reads for its `LaunchTemplate.Version`).
+	*      `autoscaling.AutoScalingGroup` reads for its `LaunchTemplate.Version`);
+	*      or
+	*   3. `Attr` starts with a derived-attribute PREFIX of `Up`'s type — the
+	*      {@link IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES} table (issue #3631; a
+	*      nested stack's `Outputs.<Key>`).
 	* (`Ref` resolves to the physical id, which an in-place update never moves, so
 	* Ref-only dependents are left NO_CHANGE; likewise a GetAtt of a computed
 	* attribute NOT in the allow list, e.g. a Lambda `Arn` on a Description edit.)
@@ -25680,14 +26130,25 @@ var DiffCalculator = class DiffCalculator {
 	* promoted resource against the in-flight state and skips the provider call
 	* when nothing actually changed.
 	*
-	* Single-hop by design (unlike {@link promoteReplacementDependents}, which is
-	* fully transitive via a worklist): `changedPropsByUpstream` is frozen at entry,
-	* so a chain `A(in-place) -> B(reads A's changed attr) -> C(reads B's now-changed
-	* attr)` promotes B but not C. Deep GetAtt-of-a-changed-attr chains are rare in
-	* practice; if one ever needs full transitivity, promote to a worklist that
-	* re-derives changed props as dependents are promoted.
-	*/
-	promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs) {
+	* One pass is single-hop: `changedPropsByUpstream` is frozen at entry, so a
+	* chain `A(in-place) -> B(reads A's changed attr) -> C(reads B's now-changed
+	* attr)` promotes B but not C. `calculateDiff` re-runs it to a fixpoint, and
+	* the pass after B's promotion sees B as an in-place UPDATE.
+	*
+	* A SPECULATIVE promotion — arm 3 in any round, and every arm after the first
+	* round, whose upstreams exist only because an earlier promotion guessed —
+	* skips a dependent that reads a MASKED attribute anywhere
+	* ({@link readsMaskedAttribute}). The engine resolves the dependent's whole
+	* bag and refuses a read of `***` BEFORE its no-change skip, so such a guess
+	* would fail a deploy that left the dependent alone before this pass could
+	* reach it (go-to-k/cdkd#3662). The first round's arms 1 and 2 keep their
+	* behaviour: a property they match really changed.
+	*
+	* @param round 1-based fixpoint round; see the speculative-promotion note.
+	* @returns whether any synthetic PropertyChange was added (the caller's
+	*          fixpoint signal).
+	*/
+	promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, currentResources, round) {
 		const changedPropsByUpstream = /* @__PURE__ */ new Map();
 		const inPlaceUpdateTypeByUpstream = /* @__PURE__ */ new Map();
 		for (const [logicalId, change] of changes) {
@@ -25697,7 +26158,8 @@ var DiffCalculator = class DiffCalculator {
 			const props = propertyChanges.map((pc) => pc.path).filter((p) => typeof p === "string");
 			if (props.length > 0) changedPropsByUpstream.set(logicalId, new Set(props));
 		}
-		if (changedPropsByUpstream.size === 0 && inPlaceUpdateTypeByUpstream.size === 0) return;
+		if (changedPropsByUpstream.size === 0 && inPlaceUpdateTypeByUpstream.size === 0) return false;
+		let added = false;
 		for (const [dependentId, perProp] of rawGetAttRefs) {
 			const resource = desiredTemplate.Resources[dependentId];
 			if (!resource || resource.Type === "AWS::CDK::Metadata") continue;
@@ -25706,22 +26168,29 @@ var DiffCalculator = class DiffCalculator {
 			if (change.changeType !== "NO_CHANGE" && change.changeType !== "UPDATE") continue;
 			const existingPaths = new Set((change.propertyChanges ?? []).map((pc) => pc.path));
 			const syntheticChanges = [];
+			const speculationAllowed = !DiffCalculator.readsMaskedAttribute(perProp, currentResources);
 			for (const [propKey, getAttRefs] of perProp) {
 				if (existingPaths.has(propKey)) continue;
 				let matched = false;
 				for (const [upstreamId, attrs] of getAttRefs) {
 					if (upstreamId === dependentId) continue;
+					if (round > 1 && !speculationAllowed) break;
 					const changedProps = changedPropsByUpstream.get(upstreamId);
 					if (changedProps && [...attrs].some((attr) => changedProps.has(attr))) {
 						matched = true;
 						break;
 					}
 					const upstreamType = inPlaceUpdateTypeByUpstream.get(upstreamId);
-					const derivedAttrs = upstreamType ? IN_PLACE_UPDATE_DERIVED_ATTRS[upstreamType] : void 0;
+					const derivedAttrs = upstreamType !== void 0 && Object.hasOwn(IN_PLACE_UPDATE_DERIVED_ATTRS, upstreamType) ? IN_PLACE_UPDATE_DERIVED_ATTRS[upstreamType] : void 0;
 					if (derivedAttrs && [...attrs].some((attr) => derivedAttrs.has(attr))) {
 						matched = true;
 						break;
 					}
+					const derivedPrefixes = upstreamType !== void 0 && Object.hasOwn(IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES, upstreamType) ? IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES[upstreamType] : void 0;
+					if (speculationAllowed && derivedPrefixes && [...attrs].some((attr) => derivedPrefixes.some((prefix) => attr.startsWith(prefix)))) {
+						matched = true;
+						break;
+					}
 				}
 				if (!matched) continue;
 				syntheticChanges.push({
@@ -25732,12 +26201,51 @@ var DiffCalculator = class DiffCalculator {
 				});
 			}
 			if (syntheticChanges.length === 0) continue;
+			added = true;
 			if (change.changeType === "NO_CHANGE") {
 				change.changeType = "UPDATE";
 				change.propertyChanges = syntheticChanges;
 				this.logger.debug(`UPDATE (in-place attr propagated): ${dependentId} reads a changed attribute of an updated resource`);
 			} else change.propertyChanges = [...change.propertyChanges ?? [], ...syntheticChanges];
 		}
+		return added;
+	}
+	/**
+	* Whether any `Fn::GetAtt` / `Fn::Sub` read of a dependent (its
+	* {@link extractGetAttRefs} map, every property and every upstream) lands on
+	* a PERSISTED attribute carrying the redaction mask. The attribute is found
+	* the way the resolver finds it: the flat key, else the dot-separated path
+	* walked through nested objects (a Cloud Control record's
+	* `Endpoint.Address`).
+	*
+	* What it cannot see, and the engine still refuses on a speculative
+	* promotion: a masked cross-stack read (`Fn::ImportValue` /
+	* `Fn::GetStackOutput`), whose producer record is another stack's, and a
+	* `Ref` whose state-key lookup lands on a masked property, since `Ref`
+	* reads are not extracted.
+	*/
+	static readsMaskedAttribute(perProp, currentResources) {
+		for (const getAttRefs of perProp.values()) for (const [upstreamId, attrs] of getAttRefs) {
+			const attributes = Object.hasOwn(currentResources, upstreamId) ? currentResources[upstreamId]?.attributes : void 0;
+			if (!attributes) continue;
+			for (const attr of attrs) if (carriesSecretMask(DiffCalculator.persistedAttribute(attributes, attr))) return true;
+		}
+		return false;
+	}
+	/**
+	* A persisted attribute by the resolver's lookup rule: the own flat key, else
+	* the dot-separated path through own keys of nested objects; `undefined`
+	* when neither exists.
+	*/
+	static persistedAttribute(attributes, attr) {
+		if (Object.hasOwn(attributes, attr)) return attributes[attr];
+		if (!attr.includes(".")) return void 0;
+		let cursor = attributes;
+		for (const part of attr.split(".")) {
+			if (cursor === null || typeof cursor !== "object" || !Object.hasOwn(cursor, part)) return;
+			cursor = cursor[part];
+		}
+		return cursor;
 	}
 	/**
 	* Extract `Fn::GetAtt` / `Fn::Sub`-`${X.Attr}` references from a property value
@@ -25767,6 +26275,10 @@ var DiffCalculator = class DiffCalculator {
 			if ("Fn::GetAtt" in obj) {
 				const ga = obj["Fn::GetAtt"];
 				if (Array.isArray(ga) && typeof ga[0] === "string" && typeof ga[1] === "string") add(ga[0], ga[1]);
+				else if (typeof ga === "string") {
+					const split = splitGetAttStringForm(ga);
+					if (split) add(split.logicalId, split.attributeName);
+				}
 				return;
 			}
 			if ("Fn::Sub" in obj) {
@@ -26148,7 +26660,8 @@ function applyCallerIdentityCredentials(env) {
 //#endregion
 //#region src/utils/role-arn.ts
 /**
-* Process-lifetime cache of assumed credentials keyed by RoleArn.
+* Process-lifetime cache of assumed credentials keyed by RoleArn AND the
+* SOURCE identity the `sts:AssumeRole` hop runs as.
 *
 * Storing the in-flight `Promise` (rather than the resolved value) collapses
 * concurrent first-time callers into a single `sts:AssumeRole` request. After
@@ -26156,10 +26669,19 @@ function applyCallerIdentityCredentials(env) {
 * stack that references the same producer N times via `Fn::GetStackOutput`
 * only pays the STS hop once.
 *
-* The cache is keyed by RoleArn alone (not RoleArn + region) because STS
-* credentials are global — assumed credentials work against any region's
-* service endpoint. The downstream S3 client built from these credentials
-* picks its own region via `GetBucketLocation`.
+* Not keyed by region, because STS credentials are global — assumed
+* credentials work against any region's service endpoint. The downstream S3
+* client built from these credentials picks its own region via
+* `GetBucketLocation`.
+*
+* KEYED BY THE SOURCE IDENTITY TOO (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)): the hop runs as the
+* ACTIVE `AwsClients`' credential configuration, and a library caller can
+* install (`setAwsClients`) two different explicit credentials in one process,
+* as can cdkd's own per-stack scopes. Keyed by RoleArn alone, the second would be handed
+* credentials the FIRST identity obtained — a role the second one may not even
+* be trusted to assume. The source half is `credentialFingerprint`'s (profile +
+* access key id, never secret material).
 *
 * **Expiration handling**: on every cache hit, the cached credentials'
 * `expiration` is compared against `Date.now()` with a 60-second safety
@@ -26219,7 +26741,7 @@ function parseIamRoleArn(roleArn) {
 * the consumer account's normal credentials). Threading the credentials
 * through a fresh `S3Client` via this helper keeps the scope narrow.
 *
-* **Why cache per-RoleArn for the process lifetime.** A multi-resource
+* **Why cache per RoleArn (and source identity) for the process lifetime.** A multi-resource
 * stack typically references `Fn::GetStackOutput` from many template sites
 * (every IAM policy / Lambda env / ALB listener that pulls a shared VPC ID
 * from a platform stack). Assuming the role once per deploy is sufficient;
@@ -26242,17 +26764,19 @@ function parseIamRoleArn(roleArn) {
 * uniformly), but the next caller after rejection gets a clean slate.
 */
 async function assumeRoleForCrossAccountStateRead(roleArn) {
-	const cached = crossAccountCredentialsCache.get(roleArn);
+	const sourceConfig = ambientCredentialConfig();
+	const cacheKey = JSON.stringify([credentialFingerprint(sourceConfig), roleArn]);
+	const cached = crossAccountCredentialsCache.get(cacheKey);
 	if (cached) {
 		const cachedCreds = await cached;
 		if (!cachedCreds.expiration || Date.now() < cachedCreds.expiration.getTime() - CRED_EXPIRY_SAFETY_MS) return cachedCreds;
-		crossAccountCredentialsCache.delete(roleArn);
+		crossAccountCredentialsCache.delete(cacheKey);
 	}
 	const promise = (async () => {
 		const logger = getLogger().child("role-arn");
 		const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
 		logger.debug(`Assuming role for cross-account state read: ${displayRoleArn}`);
-		const sts = new STSClient({ ...awsClientDefaults() });
+		const sts = new STSClient({ ...clientDefaultsFor(sourceConfig) });
 		try {
 			let response;
 			try {
@@ -26279,10 +26803,10 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 			sts.destroy();
 		}
 	})().catch((err) => {
-		if (crossAccountCredentialsCache.get(roleArn) === promise) crossAccountCredentialsCache.delete(roleArn);
+		if (crossAccountCredentialsCache.get(cacheKey) === promise) crossAccountCredentialsCache.delete(cacheKey);
 		throw err;
 	});
-	crossAccountCredentialsCache.set(roleArn, promise);
+	crossAccountCredentialsCache.set(cacheKey, promise);
 	return promise;
 }
 /**
@@ -28179,7 +28703,7 @@ var WAFv2WebACLProvider = class {
 	])]]);
 	getClient() {
 		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.wafv2Client;
@@ -29603,6 +30127,18 @@ async function allSettledKeepingFirstRejection(promises, onAbandoned) {
 	}
 }
 /**
+* The key for the resolver's per-region SDK client caches ({@link
+* IntrinsicFunctionResolver}'s `cfnClients`, `regionScopedClients` and
+* `serviceDiscoveryClients`): the region PLUS the credential fingerprint of the
+* configuration the cached client was built from (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)). Encoded through
+* {@link injectiveKey}, so no region or profile spelling can forge another
+* pair's key.
+*/
+function clientCacheKey(region, credentialConfig) {
+	return injectiveKey(region, credentialFingerprint(credentialConfig));
+}
+/**
 * Is `region` safe to build an AWS SDK client from?
 *
 * This is a SECURITY gate, not an AWS region registry, and the distinction
@@ -30084,15 +30620,22 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* foreign region per resolver, versus the ambient clients which are already
 	* created and destroyed per stack by `deploy.ts`.
 	*
-	* KEYED BY REGION ALONE, which means an entry also pins the CREDENTIAL
-	* configuration of whichever ambient instance was current at the first
-	* mismatch for that region. That is sound today because the credential half
-	* is process-wide rather than per-stack: `--profile` comes from one CLI
-	* option and `--role-arn` lands in `process.env`, so every ambient instance
-	* a run installs carries the same one. Widen the key to include
-	* {@link AwsClients.credentialConfig} the moment that stops being true —
-	* per-stack credentials would otherwise let one stack's lookups run under
-	* another's identity, which is a worse bug than the one this cache serves.
+	* KEYED BY REGION AND CREDENTIAL FINGERPRINT ({@link clientCacheKey}, issue
+	* [#3588](https://github.com/go-to-k/cdkd/issues/3588)). An entry pins the
+	* credential configuration of the ambient instance it was derived from, and
+	* that half is process-wide only for the CLI (one `--profile`, one
+	* `--role-arn`): a LIBRARY caller can drive one resolver across two
+	* `setAwsClients` installs (or cdkd's per-stack scopes) with different
+	* explicit credentials, and keyed by region alone the second's lookups ran under the first's
+	* identity. {@link cfnClients} and {@link serviceDiscoveryClients} share the
+	* key for the same reason, and the two CloudFormation fallback memos
+	* ({@link cfnExportsPromises}, {@link cfnStackOutputsCache}) carry the
+	* fingerprint too.
+	*
+	* THE CLIENT HALF IS CLOSED, NOT THE WHOLE CLASS: {@link cachedDynamicReferences}
+	* (keyed by the expression alone) and the PROCESS-GLOBAL account identity
+	* behind `getAccountInfo` still assume one identity per resolver and per
+	* process respectively — a value one identity read is served to the next.
 	*/
 	regionScopedClients = /* @__PURE__ */ new Map();
 	/**
@@ -30159,9 +30702,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	/**
 	* Per-region CloudFormation clients for the cross-stack fallback
 	* lookups (issue #1697). Keyed by region because `Fn::GetStackOutput`
-	* may target a region different from the consumer's deploy region.
+	* may target a region different from the consumer's deploy region, and by
+	* the credential fingerprint for {@link regionScopedClients}' reason.
 	*/
-	cfnClients = {};
+	cfnClients = /* @__PURE__ */ new Map();
 	/**
 	* Memoized full `ListExports` listing for the `Fn::ImportValue`
 	* fallback (issue #1697 review). Without it, EVERY cdkd-miss import
@@ -30173,14 +30717,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* deploys. FAILED fetches are not cached (the rejection handler
 	* clears the slot) so a transient throttle does not poison the rest
 	* of the deploy's lookups.
+	*
+	* Keyed by the credential fingerprint (issue #3588): a listing is an answer
+	* one identity was allowed to read, so it is never handed to another.
 	*/
-	cfnExportsPromise;
+	cfnExportsPromises = /* @__PURE__ */ new Map();
 	/**
 	* Memoized per-(region, stack) `DescribeStacks` outputs for the
 	* `Fn::GetStackOutput` fallback (issue #1697 review) — a stack
 	* referencing the same CFn producer N times pays one call. Successful
 	* lookups (including the definitive "stack does not exist" miss) are
-	* cached; lookup FAILURES are evicted so they are retried.
+	* cached; lookup FAILURES are evicted so they are retried. Keyed by the
+	* credential fingerprint as well, for {@link cfnExportsPromises}' reason.
 	*/
 	cfnStackOutputsCache = /* @__PURE__ */ new Map();
 	/**
@@ -30412,11 +30960,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
 		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${displaySafe(stripControlChars(loggedTarget)).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
-		const cached = this.regionScopedClients.get(target);
+		const cacheKey = clientCacheKey(target, ambient.credentialConfig ?? {});
+		const cached = this.regionScopedClients.get(cacheKey);
 		if (cached) return cached;
 		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
 		const scoped = ambient.withRegion(target);
-		this.regionScopedClients.set(target, scoped);
+		this.regionScopedClients.set(cacheKey, scoped);
 		this.logger.debug(`Using region-scoped AWS clients for ${displaySafe(loggedTarget)}`);
 		return scoped;
 	}
@@ -30447,21 +30996,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `getAccountInfo`'s in-flight promise and reach here one at a time, which
 	* the case says out loud. A REJECTED import is evicted
 	* so a transient failure does not poison the rest of the deploy, mirroring
-	* `cfnExportsPromise`. Lifetime is the resolver's own, like
+	* `cfnExportsPromises`. Lifetime is the resolver's own, like
 	* {@link regionScopedClients} and {@link cfnClients}: at most one per region
 	* per resolver, versus the one-per-CALL this replaces.
 	*/
 	async serviceDiscoveryClient() {
 		const scoped = this.clientsForRegion(this.explicitRegion);
 		const region = scoped.configuredRegion;
-		const key = region ?? "";
+		const credentialConfig = scoped.credentialConfig ?? {};
+		const key = clientCacheKey(region ?? "", credentialConfig);
 		const cached = this.serviceDiscoveryClients.get(key);
 		if (cached) return cached;
 		const building = (async () => {
 			const { ServiceDiscoveryClient } = await import("@aws-sdk/client-servicediscovery");
 			return new ServiceDiscoveryClient({
-				...awsClientDefaults({ profile: scoped.credentialConfig?.profile }),
-				...scoped.credentialConfig ?? {},
+				...clientDefaultsFor(credentialConfig),
 				...region ? { region } : {}
 			});
 		})();
@@ -31106,12 +31655,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
+					const notedNameServers = this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
-					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
+					return notedNameServers;
 				}
+				const reresolvesNestedReference = resource.resourceType === NESTED_STACK_RESOURCE_TYPE$2 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue);
+				const notedFlatValue = reresolvesNestedReference ? flatValue : this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$2 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
-				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
+				if (reresolvesNestedReference) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				return notedFlatValue;
 			}
 			if (attributeName.includes(".")) {
 				const parts = attributeName.split(".");
@@ -31122,8 +31674,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
+					const notedCursor = this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
-					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
+					return notedCursor;
 				}
 			}
 		}
@@ -31182,6 +31735,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* A context supplying NEITHER field — the diff / no-op resolver, `cdkd
 	* scrub`, `cdkd import` — pays two undefined checks and gets its value back.
+	*
+	* ORDERING: call it BEFORE any log line that prints the value
+	* (go-to-k/cdkd#3659). Note 1 is what puts a `NoEcho` value into the bag
+	* `displayMasked` masks against, so a line logged first prints the plaintext
+	* at `--verbose`.
 	*/
 	noteAttributeSecrecy(logicalId, attributeName, value, context) {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
@@ -31316,8 +31874,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	}
 	/** Serve a value the #1852 heal just read from AWS, logging it like a cached read. */
 	serveHealedAttribute(logicalId, attributeName, value, context) {
+		const noted = this.noteAttributeSecrecy(logicalId, attributeName, value, context);
 		this.logger.debug(`Resolved Fn::GetAtt from a re-read of AWS (the state record lacked it): ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
-		return this.noteAttributeSecrecy(logicalId, attributeName, value, context);
+		return noted;
 	}
 	/**
 	* {@link constructGuardedAttribute}, healing a STALE state record first when
@@ -32857,12 +33416,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the same not-found error anyway.
 	*/
 	async lookupCfnExport(exportName, context) {
-		let listing = this.cfnExportsPromise;
+		const listingKey = credentialFingerprint(ambientCredentialConfig());
+		let listing = this.cfnExportsPromises.get(listingKey);
 		if (!listing) {
-			listing = this.fetchAllCfnExports();
-			this.cfnExportsPromise = listing;
-			listing.catch(() => {
-				if (this.cfnExportsPromise === listing) this.cfnExportsPromise = void 0;
+			const fetched = this.fetchAllCfnExports();
+			listing = fetched;
+			this.cfnExportsPromises.set(listingKey, fetched);
+			fetched.catch(() => {
+				if (this.cfnExportsPromises.get(listingKey) === fetched) this.cfnExportsPromises.delete(listingKey);
 			});
 		}
 		try {
@@ -32932,7 +33493,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* contract as {@link lookupCfnExport}.
 	*/
 	async lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
-		const cacheKey = injectiveKey(region, stackName);
+		const cacheKey = injectiveKey(region, stackName, credentialFingerprint(ambientCredentialConfig()));
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
 			fetch = this.fetchCfnStackOutputs(stackName, region);
@@ -32983,19 +33544,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Not routed through {@link clientsForRegion}: the region here is always
 	* the one the caller named, never the ambient's, and a test double without
 	* `credentialConfig` degrades to the default chain rather than throwing.
-	* Keyed by region alone for the reason {@link regionScopedClients} gives:
-	* the credential half is process-wide.
+	* Keyed by region AND credential fingerprint for the reason
+	* {@link regionScopedClients} gives (issue #3588).
 	*/
 	getCfnClient(region) {
-		let client = this.cfnClients[region];
+		const credentialConfig = ambientCredentialConfig();
+		const key = clientCacheKey(region, credentialConfig);
+		let client = this.cfnClients.get(key);
 		if (!client) {
-			const credentialConfig = getAwsClients().credentialConfig ?? {};
 			client = new CloudFormationClient({
-				...awsClientDefaults({ profile: credentialConfig.profile }),
-				...credentialConfig,
+				...clientDefaultsFor(credentialConfig),
 				region
 			});
-			this.cfnClients[region] = client;
+			this.cfnClients.set(key, client);
 		}
 		return client;
 	}
@@ -35272,6 +35833,15 @@ const CC_PROTECTION_PROPERTIES = {
 function ccProtectionProperty(resourceType) {
 	return CC_PROTECTION_PROPERTIES[resourceType];
 }
+/**
+* Every resource type registered in the CC protection registry. Consumed by
+* the cross-site consistency test that keeps this registry, the destroy
+* confirm-prompt count map, the `--remove-protection` help strings, and the
+* docs tables from drifting apart.
+*/
+function ccProtectionRegistryTypes() {
+	return Object.keys(CC_PROTECTION_PROPERTIES);
+}
 
 //#endregion
 //#region src/provisioning/unsupported-types.generated.ts
@@ -36328,7 +36898,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CHM7_WdJ.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dpki2-Xd.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -36878,7 +37448,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::RDS::DBCluster":
 				try {
-					const cluster = (await new RDSClient({ ...awsClientDefaults() }).send(new DescribeDBClustersCommand({ DBClusterIdentifier: physicalId }))).DBClusters?.[0];
+					const cluster = (await new RDSClient({ ...ambientClientDefaults() }).send(new DescribeDBClustersCommand({ DBClusterIdentifier: physicalId }))).DBClusters?.[0];
 					if (cluster) {
 						if (cluster.Endpoint) enriched["Endpoint.Address"] = cluster.Endpoint;
 						if (cluster.Port !== void 0) enriched["Endpoint.Port"] = String(cluster.Port);
@@ -36893,7 +37463,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::RDS::DBInstance":
 				try {
-					const inst = (await new RDSClient({ ...awsClientDefaults() }).send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: physicalId }))).DBInstances?.[0];
+					const inst = (await new RDSClient({ ...ambientClientDefaults() }).send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: physicalId }))).DBInstances?.[0];
 					if (inst) {
 						if (inst.Endpoint?.Address) enriched["Endpoint.Address"] = inst.Endpoint.Address;
 						if (inst.Endpoint?.Port !== void 0) enriched["Endpoint.Port"] = String(inst.Endpoint.Port);
@@ -37047,7 +37617,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::ElastiCache::ReplicationGroup":
 				try {
-					const rg = (await new ElastiCacheClient({ ...awsClientDefaults() }).send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: physicalId }))).ReplicationGroups?.[0];
+					const rg = (await new ElastiCacheClient({ ...ambientClientDefaults() }).send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: physicalId }))).ReplicationGroups?.[0];
 					if (rg) {
 						const primaryNode = rg.NodeGroups?.[0];
 						if (primaryNode?.PrimaryEndpoint?.Address) enriched["PrimaryEndPoint.Address"] = primaryNode.PrimaryEndpoint.Address;
@@ -37069,7 +37639,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::Redshift::Cluster":
 				try {
-					const cluster = (await new RedshiftClient({ ...awsClientDefaults() }).send(new DescribeClustersCommand({ ClusterIdentifier: physicalId }))).Clusters?.[0];
+					const cluster = (await new RedshiftClient({ ...ambientClientDefaults() }).send(new DescribeClustersCommand({ ClusterIdentifier: physicalId }))).Clusters?.[0];
 					if (cluster?.Endpoint) {
 						if (cluster.Endpoint.Address) enriched["Endpoint.Address"] = cluster.Endpoint.Address;
 						if (cluster.Endpoint.Port !== void 0) enriched["Endpoint.Port"] = String(cluster.Endpoint.Port);
@@ -37081,7 +37651,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::OpenSearchService::Domain":
 				try {
-					const domain = (await new OpenSearchClient({ ...awsClientDefaults() }).send(new DescribeDomainCommand({ DomainName: physicalId }))).DomainStatus;
+					const domain = (await new OpenSearchClient({ ...ambientClientDefaults() }).send(new DescribeDomainCommand({ DomainName: physicalId }))).DomainStatus;
 					if (domain) {
 						const endpoint = domain.Endpoint ?? domain.Endpoints?.["vpc"];
 						if (endpoint) enriched["DomainEndpoint"] = endpoint;
@@ -41576,7 +42146,8 @@ var ProviderRegistry = class {
 					provisionedBy: "sdk"
 				};
 			}
-			if (isNonProvisionable(resourceType) || specificProvider.disableCcApiFallback === true) throw new Error(this.buildUnroutableSilentDropMessage(resourceType, actionableDrops));
+			const unroutable = this.ccRouteUnavailableReason(resourceType);
+			if (unroutable !== void 0) throw new Error(this.buildUnroutableSilentDropMessage(resourceType, actionableDrops, unroutable));
 			this.logger.debug(`Auto-routing ${resourceType} via Cloud Control (silent-drop properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
 			return {
 				provider: this.cloudControlProvider,
@@ -41601,19 +42172,29 @@ var ProviderRegistry = class {
 		throw new Error(`No provider available for resource type: ${resourceType}. This resource type is not supported by Cloud Control API and no SDK provider is registered.`);
 	}
 	/**
+	* Why the Cloud Control auto-route cannot serve `resourceType`, or
+	* `undefined` when it can. The ONE predicate both refusal sites
+	* (`getProviderFor` and `reportSilentDropDecisions`) and the accepted-drop
+	* warn read, so the warn that predicts what a flag-less deploy does cannot
+	* disagree with the refusal that deploy then hits (issue #2792).
+	*/
+	ccRouteUnavailableReason(resourceType) {
+		if (isNonProvisionable(resourceType)) return "ProvisioningType: NON_PROVISIONABLE — Cloud Control has no handlers for it";
+		if (this.providers.get(resourceType)?.disableCcApiFallback === true) return "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)";
+	}
+	/**
 	* Error message for a resource whose template uses SDK-provider-unhandled
 	* properties on a type where the Cloud Control auto-route (issue #614) is
 	* NOT viable — `ProvisioningType: NON_PROVISIONABLE` (no CC handlers) or a
-	* provider-level `disableCcApiFallback` opt-out. Includes each property's
+	* provider-level `disableCcApiFallback` opt-out; `reason` is
+	* {@link ccRouteUnavailableReason}'s answer. Includes each property's
 	* `unhandledByDesign` rationale so the user sees WHY it is unhandled, plus
 	* the `--allow-unsupported-properties` escape hatch (which forces the SDK
 	* path and accepts the drop — the provider may still reject the resource
 	* if the property is load-bearing, e.g. a non-Lustre FSx variant config).
 	*/
-	buildUnroutableSilentDropMessage(resourceType, drops) {
-		const details = drops.map((d) => `  - ${d.property}: ${d.rationale}`).join("\n");
-		const overrideHint = drops.map((d) => `${resourceType}:${d.property}`).join(",");
-		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${isNonProvisionable(resourceType) ? "ProvisioningType: NON_PROVISIONABLE — Cloud Control has no handlers for it" : "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)"}):\n${details}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${overrideHint} (the provider may still reject the resource if the property is required).`;
+	buildUnroutableSilentDropMessage(resourceType, drops, reason) {
+		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${reason}):\n${drops.map((d) => `  - ${d.property}: ${d.rationale}`).join("\n")}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${drops.map((d) => `${resourceType}:${d.property}`).join(",")} (the provider may still reject the resource if the property is required).`;
 	}
 	/**
 	* Legacy entry point that returns just the provider. Delegates to
@@ -41795,8 +42376,8 @@ var ProviderRegistry = class {
 			const overridden = stickyCc ? [] : findAcceptedSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
 			const autoRouted = drops.map(({ property }) => property).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`));
 			if (autoRouted.length > 0) {
-				const provider = this.providers.get(resourceType);
-				if (isNonProvisionable(resourceType) || provider?.disableCcApiFallback === true) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)))}`);
+				const unroutable = this.ccRouteUnavailableReason(resourceType);
+				if (unroutable !== void 0) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)), unroutable)}`);
 				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${autoRouted.join(", ")} — CC API will forward the full property map. Override via --prefer-sdk-route ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")}.)`;
 				if (provisionedBy === "cc-api") this.logger.debug(message);
 				else this.logger.info(message);
@@ -41810,9 +42391,11 @@ var ProviderRegistry = class {
 			}
 			if (overridden.length > 0) {
 				const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
-				const reroutable = overridden.filter((p) => createOnly?.has(p) !== true);
-				const needsRecreate = overridden.filter((p) => createOnly?.has(p) === true);
+				const unroutable = this.ccRouteUnavailableReason(resourceType);
+				const reroutable = unroutable === void 0 ? overridden.filter((p) => createOnly?.has(p) !== true) : [];
+				const needsRecreate = unroutable === void 0 ? overridden.filter((p) => createOnly?.has(p) === true) : [];
 				const remedies = [];
+				if (unroutable !== void 0) remedies.push(`This type cannot be routed via Cloud Control API (${unroutable}), so removing the override makes the deploy refuse at pre-flight instead of rerouting; cdkd has no route that applies ${overridden.length === 1 ? "it" : "them"} to this type.`);
 				if (reroutable.length > 0) remedies.push(`Remove the override for ${reroutable.join(", ")} to route this resource via Cloud Control API instead.`);
 				if (needsRecreate.length > 0) {
 					const one = needsRecreate.length === 1;
@@ -44305,8 +44888,11 @@ async function planOrphanAdoption(params) {
 	const claims = async () => siblingClaims ??= await params.readSiblingClaims();
 	for (const record of params.records) {
 		const { logicalId, state } = record;
+		const shownId = displayIdent(logicalId);
+		const shownType = displayIdent(state.resourceType);
+		const shownPhysicalId = displaySafe(state.physicalId);
 		if (params.managedLogicalIds.has(logicalId)) {
-			params.logger.debug(`orphan ${logicalId}: already present in state.resources — dropping the stale record`);
+			params.logger.debug(`orphan ${shownId}: already present in state.resources — dropping the stale record`);
 			continue;
 		}
 		let provider;
@@ -44314,12 +44900,12 @@ async function planOrphanAdoption(params) {
 			provider = params.getProvider(state.resourceType, state.provisionedBy);
 		} catch (error) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback, but this build cannot route that type (${error instanceof Error ? error.message : String(error)}) — cdkd is not adopting it.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback, but this build cannot route that type (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — cdkd is not adopting it.`);
 			continue;
 		}
 		if (!provider.import) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) was left in AWS by an earlier rollback as ${state.physicalId}, but its provider cannot verify it — cdkd is not adopting it.`);
+			outcome.notices.push(`${shownId} (${shownType}) was left in AWS by an earlier rollback as ${shownPhysicalId}, but its provider cannot verify it — cdkd is not adopting it.`);
 			continue;
 		}
 		let found;
@@ -44333,32 +44919,32 @@ async function planOrphanAdoption(params) {
 				knownPhysicalId: state.physicalId
 			});
 		} catch (error) {
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is recorded as left in AWS as ${state.physicalId}, but cdkd could not confirm it exists (${error instanceof Error ? error.message : String(error)}) — keeping the record and not adopting it this run.`);
+			outcome.notices.push(`${shownId} (${shownType}) is recorded as left in AWS as ${shownPhysicalId}, but cdkd could not confirm it exists (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — keeping the record and not adopting it this run.`);
 			outcome.remaining.push(record);
 			continue;
 		}
 		if (found !== null && found.physicalId !== state.physicalId) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}): cdkd asked about ${state.physicalId} and its provider answered for ${found.physicalId} — not adopting.`);
+			outcome.notices.push(`${shownId} (${shownType}): cdkd asked about ${shownPhysicalId} and its provider answered for ${displaySafe(found.physicalId)} — not adopting.`);
 			continue;
 		}
 		if (found === null) {
-			params.logger.debug(`orphan ${logicalId}: ${state.physicalId} no longer exists in AWS — dropping the record`);
+			params.logger.debug(`orphan ${shownId}: ${shownPhysicalId} no longer exists in AWS — dropping the record`);
 			continue;
 		}
 		if (params.nameProperties(state.resourceType).length === 0 || ADOPTION_REFUSED_TYPES.has(state.resourceType)) {
 			outcome.remaining.push(record);
 			const why = ADOPTION_REFUSED_TYPES.has(state.resourceType) ? "a new deploy of it mints a new resource rather than colliding, and cdkd cannot update one in place — so adopting it would end in a replacement that destroys what DeletionPolicy: Retain preserved" : "cdkd does not derive that resource's physical name, so a new deploy mints a new resource instead of colliding";
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback. cdkd does not re-adopt this type: ${why}. Delete it yourself when you no longer need it.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback. cdkd does not re-adopt this type: ${why}. Delete it yourself when you no longer need it.`);
 			continue;
 		}
 		if (!templateStillDeclares(params.template, record, params.nameProperties(state.resourceType))) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback. This deploy does not create it under that name, so cdkd is leaving it alone.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback. This deploy does not create it under that name, so cdkd is leaving it alone.`);
 			continue;
 		}
 		if ((await claims()).has(state.physicalId)) {
-			outcome.refusals.push(`${logicalId}: ${state.physicalId} is already recorded by another cdkd stack. cdkd will not adopt a resource another stack manages.`);
+			outcome.refusals.push(`${shownId}: ${shownPhysicalId} is already recorded by another cdkd stack. cdkd will not adopt a resource another stack manages.`);
 			outcome.remaining.push(record);
 			continue;
 		}
@@ -44411,7 +44997,7 @@ function makeSiblingClaimReader(params) {
 		try {
 			refs = await stateBackend.listStacks();
 		} catch (error) {
-			logger.debug(`orphan adoption: could not list sibling stacks — ${error instanceof Error ? error.message : String(error)}`);
+			logger.debug(`orphan adoption: could not list sibling stacks — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
 			return claimed;
 		}
 		for (const ref of refs) {
@@ -44421,7 +45007,7 @@ function makeSiblingClaimReader(params) {
 				const sibling = await stateBackend.getState(ref.stackName, ref.region);
 				for (const record of Object.values(sibling?.state.resources ?? {})) claimed.add(record.physicalId);
 			} catch (error) {
-				logger.debug(`orphan adoption: skipping unreadable state for ${ref.stackName} — ${error instanceof Error ? error.message : String(error)}`);
+				logger.debug(`orphan adoption: skipping unreadable state for ${displayStackName(ref.stackName)} — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
 			}
 		}
 		return claimed;
@@ -49762,7 +50348,9 @@ var DeployEngine = class DeployEngine {
 			this.healBaseline = currentState.resources ?? {};
 			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 			refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
+			refuseMalformedResourceEntriesForDeploy(currentState, stackName, this.stackRegion);
 			refuseMalformedOrphans(currentState, stackName, this.stackRegion);
+			refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -50342,7 +50930,7 @@ var DeployEngine = class DeployEngine {
 		if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.join("\n  ")}`);
 		for (const [logicalId, record] of Object.entries(plan.adopted)) {
 			currentState.resources[logicalId] = record;
-			this.logger.info(`Adopting ${logicalId} (${record.resourceType}) left in AWS by an earlier rollback as ${record.physicalId}`);
+			this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(record.physicalId)}`);
 		}
 		if (records.length > 0) currentState.orphans = plan.remaining;
 		return plan;
@@ -51809,5 +52397,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, isCdkdError as $a, findLargeInlineResources as $i, repairMalformedOutputsForReadOnly as $n, WorkGraph as $r, replayWarn as $t, createPreDeleteFinalSnapshot as A, setAwsClients as Aa, runDockerStreaming as Ai, malformedOrphansRefusalMessage as An, scrubResourceRecord as Ar, isTerminationProtectionPropagationError as At, isStatefulRecreateTargetSync as B, LocalStartServiceError as Ba, resolveApp as Bi, refuseMalformedNestedChildOutputs as Bn, DEFAULT_STATE_PREFIX as Br, parameterTypeMayLoseSecretIdentity as Bt, namesAnyDeclaredParameter as C, resolveAssemblyPath as Ca, formatDockerLoginError as Ci, hasReadableOutputs as Cn, maskSecretsInError as Cr, CloudControlProvider as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, getAwsClients as Da, partitionSensitiveEnv as Di, malformedExportSourceWarning as Dn, recordMaskOnlyValuesIn as Dr, deleteSkipReason as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, AwsClients as Ea, isMalformedEnvKey as Ei, malformedExportNamesWarning as En, recordMaskOnlyValue as Er, deleteIndeterminateGuards as Et, extractDeploymentEventError as F, DependencyError as Fa, getDockerImageBySourceHash as Fi, malformedResourceEntriesWarning as Fn, buildForceUnlockCommand as Fr, coerceParameterTypedValue as Ft, toCfnInteger as G, ProvisioningError as Ga, resolveStateBucketWithDefaultAndSource as Gi, refuseMalformedOutputsForDestroy as Gn, importableOutputKeys as Gr, resolveExplicitPhysicalId as Gt, WARM_THROUGHPUT_MEMBERS as H, MalformedProducerRecordRefusalError as Ha, resolveCaptureObservedState as Hi, refuseMalformedOrphansForDestroy as Hn, hasReadableExportSet as Hr, isSettledInstanceState as Ht, makeSiblingClaimReader as I, DeployCancelledError as Ia, Synthesizer as Ii, malformedResourcePropertiesWarning as In, buildLockContentionMessage as Ir, getAccountInfo as It, bold as J, StackHasActiveImportsError as Ja, warnDeprecatedNoPrefixCliFlag as Ji, refuseMalformedResourceEntriesForOrphan as Jn, orphansAfterRollback as Jr, coerceCfnInteger as Jt, toFiniteNumber as K, ResourceTimeoutError as Ka, resolveUseCdkBootstrapAssets as Ki, refuseMalformedResourceAttributesForOrphan as Kn, importableOutputs as Kr, assertRegionMatch as Kt, planOrphanAdoption as L, DynamicReferenceRegionAmbiguousError as La, synthesisStatusMessage as Li, malformedResourcesWarning as Ln, forceQuitRecoveryClause as Lr, isImpossibleEmptyStoredAttribute as Lt, refusesFinalSnapshot as M, CdkdError as Ma, escapeRegExp$1 as Mi, malformedOutputsRefusalMessage as Mn, S3StateBackend as Mr, carriesDynamicReference as Mt, unsupportedFinalSnapshotError as N, ConfigError as Na, stripControlChars as Ni, malformedOutputsWarning as Nn, rebuildClientForBucketRegion as Nr, carriesFetchableDynamicReference as Nt, buildFinalSnapshotIdentifier as O, resetAwsClients as Oa, redactDockerArgvValues as Oi, malformedLocalOutputsWarning as On, recoverMaskedOutput as Or, isWaitAbandonedError as Ot, makeCanonicalizePropertiesFn as P, CrossAccountSecretRefusalError as Pa, AssetManifestLoader as Pi, malformedRenderedContainersWarning as Pn, UNREPRODUCIBLE_LOCK_CLAUSE as Pr, cfnRefValueFromPhysicalId as Pt, red as Q, formatError as Qa, MIGRATE_TMP_PREFIX as Qi, repairMalformedOrphansForReadOnly as Qn, stringifyValue as Qr, readConfigString as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, IntrinsicResolutionRefusalError as Ra, getDefaultStateBucketName as Ri, malformedStateRefusalMessage as Rn, formatLockExpiry as Rr, isNamelessDynamicReferenceError as Rt, computeParameterTaint as S, renderAssemblyPathEscape as Sa, finchSecretArgvRefusal as Si, hasReadableOrphans as Sn, markSameGenerationBag as Sr, startInterruptWatch as St, resourcesNamingDeclaredParameter as T, resolveBucketRegion as Ta, isDockerClientEnvKey as Ti, isReadableResourceEntry as Tn, pathCrossesDottedKey as Tr, UNSPECIFIED_SKIP_REASON as Tt, coerceWarmThroughput as U, NestedStackChildDirectDestroyError as Ua, resolveSkipPrefix as Ui, refuseMalformedOrphansForOrphan as Un, hasReasonlessBaselineRefusal as Ur, WAFv2WebACLProvider as Ut, renderStatefulReason as V, LockError as Va, resolveAutoAssetStorage as Vi, refuseMalformedOrphans as Vn, exportNamesCarriedFrom as Vr, refStateLookupFromResource as Vt, isWarmThroughputDecrease as W, PartialFailureError as Wa, resolveStateBucketWithDefault as Wi, refuseMalformedOutputs as Wn, hasUnverifiableParameterRefusal as Wr, normalizeAwsTagsToCfn as Wt, gray as X, StateError as Xa, CFN_TEMPLATE_BODY_LIMIT as Xi, refuseMalformedResourcesForDestroy as Xn, shouldRetainResource as Xr, configIntegerRefusal as Xt, cyan as Y, StackTerminationProtectionError as Ya, ssmResolvedValueType as Yi, refuseMalformedResourcePropertiesForOrphan as Yn, orphansCarriedFrom as Yr, configBooleanRefusal as Yt, green as Z, SynthesisError as Za, CFN_TEMPLATE_URL_LIMIT as Zi, refuseMalformedState as Zn, AssetPublisher as Zr, configStringRefusal as Zt, bagHoldsSecretExpression as _, hasPlainPrototype$1 as _a, resolveDockerContextDirectory as _i, INTRINSIC_KEYS as _n, dynamicReferenceTokens as _r, maskerOrIdentity as _t, DeploymentEventsStore as a, producerRecordKey as aa, BOOTSTRAP_MARKER_PREFIX as ai, withSharedDrainBudget as an, isRetryableTransientError as ao, findActionableSilentDrops as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, absoluteAssemblyPathEscape as ba, describeDockerFailure as bi, UNREADABLE_RESOURCES_MAP_ROW as bn, isSingleDynamicReferenceToken as br, interruptWatchListenerCount as bt, replayFailedOperations as c, PARTITION_TABLE as ca, getBootstrapMarkerKey as ci, s3BucketDualStackDomainName as cn, markNonRetryable as co, withRetry as cr, IAMRoleProvider as ct, updatePartialMessage as d, AssemblyReader as da, readBootstrapMarkerBody as di, applyRoleArnIfSet as dn, describeAwsFailure as do, STATE_SOURCED_BASELINE_RULES as dr, definedAttributes as dt, uploadCfnTemplate as ea, buildAssetRedirectMap as ei, requireConfigArray as en, normalizeAwsError as eo, repairMalformedResourceEntriesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, failedStageNote as fa, validateAssetBucketName as fi, AWS_CREDENTIAL_ENV_KEYS as fn, safeStringify$1 as fo, STATE_SOURCED_CROSS_GENERATION_RULES as fr, stringifyIfAssigned as ft, computeImplicitDeleteEdges as g, hasOwnKey as ga, buildDockerImage as gi, DiffCalculator as gn, createSecretMasker as gr, maskDeep as gt, IMPLICIT_DELETE_DEPENDENCIES as h, defineOwnKey as ha, assertCdkLocalDockerContextContained as hi, envCredentialsAreAssumedRole as hn, carriesSecretMask as hr, createMaskedRetryLogger as ht, DeploymentEventsReader as i, producerCoordinateKey as ia, AssetModeResolver as ii, producerRegionsFromState as in, isMarkedNonRetryable as io, safeStackName as ir, secretBearing as it, isFinalSnapshotError as j, AssetError as ja, warnFinchArgvExposure as ji, malformedOrphansWarning as jn, LockManager as jr, IntrinsicFunctionResolver as jt, ccRoutedFinalSnapshotError as k, runWithStackAwsClients as ka, runDockerForeground as ki, malformedOrphanRecordsWarning as kn, redactSecretsForState as kr, disableInstanceApiTermination as kt, replayRollback as l, canonicalizeRegion as la, isCrossRegionRedirect as li, s3BucketRegionalDomainName as ln, markRedactedCause as lo, DagBuilder as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, processStackMessages as ma, buildDenyExternalAccessPolicy as mi, callerEnvCredentials as mn, TEMPLATE_SOURCED_RULES as mr, wouldReturnToSdkProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, injectiveKey as na, loadPublishableAssetManifest as ni, requireConfigString as nn, pasteableCommand as no, repairMalformedResourcesForReadOnly as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, decodeListingKey as oa, assertAssetBucketRegion as oi, s3BucketArn as on, isThrottlingError as oo, findSilentDropProperties as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, globMatches as pa, validateContainerRepoName as pi, applyCallerIdentityCredentials as pn, __exportAll as po, STATE_SOURCED_READBACK_RULES as pr, ProviderRegistry as pt, formatResourceLine as q, ResourceUpdateNotSupportedError as qa, stateBucketExistenceConfirmed as qi, refuseMalformedResourceEntries as qn, isReadableBag as qr, coerceCfnBoolean as qt, DeployEngine as r, injectiveKeyPrefix as ra, rewriteTemplateAssetReferences as ri, classifyReplaySecretRegion as rn, shellQuote as ro, safeRegion as rr, isExportAliasCollision as rt, planRollback as s, expectedOwnerParam as sa, ensureAssetStorage as si, s3BucketDomainName as sn, isTransientServerError as so, describeTypeWithThrottleRetry as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ta, createAssetRedirectResolver as ti, requireConfigObject as tn, withErrorHandling as to, repairMalformedResourcePropertiesForReadOnly as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, derivePartitionAndUrlSuffix as ua, parseBootstrapMarker as ui, s3BucketWebsiteUrl as un, retryClassificationText as uo, TemplateParser as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, nullPrototypeRecord as va, describeDockerCapturedOutput as vi, STATE_RESOURCES_MALFORMED as vn, errorCauseChain as vr, beginCommandInterruptScope as vt, reachableDivergentParameters as w, clearBucketRegionCache as wa, getDockerCmd as wi, hasReadableResources as wn, maskSecretsInText as wr, slowCcOperationTimeoutMs as wt, bindingSkippedOutputs as x, displayAssemblyPath as xa, dockerSpawnEnvWithSensitive as xi, displayLogicalId as xn, isUncertifiedBaselineMaskPosition as xr, isInterruptedWaitError as xt, keptWholeReasonText as y, ownValue as ya, describeDockerExecFailure as yi, UNREADABLE_ORPHANS_CONTAINER_ROW as yn, identityKeyFor as yr, endCommandInterruptScope as yt, isStatefulRecreateTargetForReplace as z, LocalInvokeBuildError as za, getLegacyStateBucketName as zi, refuseDivergentRecordRegionForDestroy as zn, CUSTOM_RESOURCE_RESPONSE_PREFIX as zr, isUnboundTemplateParameter as zt };
-//# sourceMappingURL=deploy-engine-xxVOQPPr.js.map
+export { yellow as $, MalformedProducerRecordRefusalError as $a, resolveSkipPrefix as $i, refuseMalformedOutputsForDestroy as $n, hasReadableExportSet as $r, readConfigString as $t, createPreDeleteFinalSnapshot as A, ownValue as Aa, describeDockerFailure as Ai, malformedExportSourceWarning as An, identityKeyFor as Ar, disableInstanceApiTermination as At, isStatefulRecreateTargetSync as B, runWithStackAwsClients as Ba, runDockerStreaming as Bi, malformedResourceEntriesWarning as Bn, redactSecretsForState as Br, isUnboundTemplateParameter as Bt, namesAnyDeclaredParameter as C, failedStageNote as Ca, validateAssetBucketName as Ci, displayLogicalId as Cn, safeStringify$1 as Co, STATE_SOURCED_CROSS_GENERATION_RULES as Cr, CloudControlProvider as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, hasOwnKey as Da, resolveDockerContextDirectory as Di, isReadableOrphanRecord as Dn, createSecretMasker as Dr, deleteIndeterminateGuards as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, defineOwnKey as Ea, buildDockerImage as Ei, hasReadableResources as En, carriesSecretMask as Er, UNSPECIFIED_SKIP_REASON as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fa, isDockerClientEnvKey as Fi, malformedOrphansRefusalMessage as Fn, maskSecretsInText as Fr, cfnRefValueFromPhysicalId as Ft, toCfnInteger as G, CrossAccountSecretRefusalError as Ga, getDockerImageBySourceHash as Gi, refuseDivergentRecordRegionForDestroy as Gn, UNREPRODUCIBLE_LOCK_CLAUSE as Gr, normalizeAwsTagsToCfn as Gt, WARM_THROUGHPUT_MEMBERS as H, AssetError as Ha, escapeRegExp$1 as Hi, malformedResourcesWarning as Hn, LockManager as Hr, refStateLookupFromResource as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ia, isMalformedEnvKey as Ii, malformedOrphansWarning as In, pathCrossesDottedKey as Ir, coerceParameterTypedValue as It, bold as J, DynamicReferenceRegionAmbiguousError as Ja, getDefaultStateBucketName as Ji, refuseMalformedOrphanRecordsForDestroy as Jn, forceQuitRecoveryClause as Jr, coerceCfnBoolean as Jt, toFiniteNumber as K, DependencyError as Ka, Synthesizer as Ki, refuseMalformedNestedChildOutputs as Kn, buildForceUnlockCommand as Kr, resolveExplicitPhysicalId as Kt, planOrphanAdoption as L, AwsClients as La, partitionSensitiveEnv as Li, malformedOutputsRefusalMessage as Ln, recordMaskOnlyValue as Lr, getAccountInfo as Lt, refusesFinalSnapshot as M, displayAssemblyPath as Ma, finchSecretArgvRefusal as Mi, malformedOrphanRecordsRefusalMessage as Mn, isUncertifiedBaselineMaskPosition as Mr, IntrinsicFunctionResolver as Mt, unsupportedFinalSnapshotError as N, renderAssemblyPathEscape as Na, formatDockerLoginError as Ni, malformedOrphanRecordsWarning as Nn, markSameGenerationBag as Nr, carriesDynamicReference as Nt, buildFinalSnapshotIdentifier as O, hasPlainPrototype$1 as Oa, describeDockerCapturedOutput as Oi, isReadableResourceEntry as On, dynamicReferenceTokens as Or, deleteSkipReason as Ot, makeCanonicalizePropertiesFn as P, resolveAssemblyPath as Pa, getDockerCmd as Pi, malformedOrphanRowsKeptWarning as Pn, maskSecretsInError as Pr, carriesFetchableDynamicReference as Pt, red as Q, LockError as Qa, resolveCaptureObservedState as Qi, refuseMalformedOutputs as Qn, exportNamesCarriedFrom as Qr, configStringRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ra, redactDockerArgvValues as Ri, malformedOutputsWarning as Rn, recordMaskOnlyValuesIn as Rr, isImpossibleEmptyStoredAttribute as Rt, computeParameterTaint as S, AssemblyReader as Sa, readBootstrapMarkerBody as Si, deployRefusesOrphanRowsReason as Sn, describeAwsFailure as So, STATE_SOURCED_BASELINE_RULES as Sr, startInterruptWatch as St, resourcesNamingDeclaredParameter as T, processStackMessages as Ta, buildDenyExternalAccessPolicy as Ti, hasReadableOutputs as Tn, TEMPLATE_SOURCED_RULES as Tr, ccProtectionRegistryTypes as Tt, coerceWarmThroughput as U, CdkdError as Ua, stripControlChars as Ui, malformedStateRefusalMessage as Un, S3StateBackend as Ur, isSettledInstanceState as Ut, renderStatefulReason as V, setAwsClients as Va, warnFinchArgvExposure as Vi, malformedResourcePropertiesWarning as Vn, scrubResourceRecord as Vr, parameterTypeMayLoseSecretIdentity as Vt, isWarmThroughputDecrease as W, ConfigError as Wa, AssetManifestLoader as Wi, previewableOrphanRecords as Wn, rebuildClientForBucketRegion as Wr, WAFv2WebACLProvider as Wt, gray as X, LocalInvokeBuildError as Xa, resolveApp as Xi, refuseMalformedOrphansForDestroy as Xn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Xr, configBooleanRefusal as Xt, cyan as Y, IntrinsicResolutionRefusalError as Ya, getLegacyStateBucketName as Yi, refuseMalformedOrphans as Yn, formatLockExpiry as Yr, coerceCfnInteger as Yt, green as Z, LocalStartServiceError as Za, resolveAutoAssetStorage as Zi, refuseMalformedOrphansForOrphan as Zn, DEFAULT_STATE_PREFIX as Zr, configIntegerRefusal as Zt, bagHoldsSecretExpression as _, expectedOwnerParam as _a, assertAssetBucketRegion as _i, DiffCalculator as _n, isThrottlingError as _o, findSilentDropProperties as _r, maskerOrIdentity as _t, DeploymentEventsStore as a, ssmResolvedValueType as aa, orphansAfterRollback as ai, producerRegionsFromState as an, StackHasActiveImportsError as ao, refuseMalformedState as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, derivePartitionAndUrlSuffix as ba, isCrossRegionRedirect as bi, UNREADABLE_ORPHANS_CONTAINER_ROW as bn, markRedactedCause as bo, DagBuilder as br, interruptWatchListenerCount as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as ca, AssetPublisher as ci, s3BucketDomainName as cn, SynthesisError as co, repairMalformedOutputsForReadOnly as cr, IAMRoleProvider as ct, updatePartialMessage as d, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as da, buildAssetRedirectMap as di, s3BucketWebsiteUrl as dn, normalizeAwsError as do, repairMalformedResourcesForReadOnly as dr, definedAttributes as dt, resolveStateBucketWithDefault as ea, hasReasonlessBaselineRefusal as ei, replayWarn as en, NestedStackChildDirectDestroyError as eo, refuseMalformedResourceAttributesForOrphan as er, collectDeclaredOutputNames as et, updatePartialReason as f, injectiveKey as fa, createAssetRedirectResolver as fi, applyRoleArnIfSet as fn, withErrorHandling as fo, safeRegion as fr, stringifyIfAssigned as ft, computeImplicitDeleteEdges as g, decodeListingKey as ga, BOOTSTRAP_MARKER_PREFIX as gi, envCredentialsAreAssumedRole as gn, isRetryableTransientError as go, findActionableSilentDrops as gr, maskDeep as gt, IMPLICIT_DELETE_DEPENDENCIES as h, producerRecordKey as ha, AssetModeResolver as hi, callerEnvCredentials as hn, isMarkedNonRetryable as ho, unreadableOrphanRecords as hr, createMaskedRetryLogger as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as ia, isReadableBag as ii, classifyReplaySecretRegion as in, ResourceUpdateNotSupportedError as io, refuseMalformedResourcesForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, absoluteAssemblyPathEscape as ja, dockerSpawnEnvWithSensitive as ji, malformedLocalOutputsWarning as jn, isSingleDynamicReferenceToken as jr, isTerminationProtectionPropagationError as jt, ccRoutedFinalSnapshotError as k, nullPrototypeRecord as ka, describeDockerExecFailure as ki, malformedExportNamesWarning as kn, errorCauseChain as kr, isWaitAbandonedError as kt, replayRollback as l, findLargeInlineResources as la, stringifyValue as li, s3BucketDualStackDomainName as ln, formatError as lo, repairMalformedResourceEntriesForReadOnly as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, producerCoordinateKey as ma, rewriteTemplateAssetReferences as mi, applyCallerIdentityCredentials as mn, shellQuote as mo, unpreviewableOrphanRecords as mr, wouldReturnToSdkProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as na, importableOutputKeys as ni, requireConfigObject as nn, ProvisioningError as no, refuseMalformedResourceEntriesForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as oa, orphansCarriedFrom as oi, withSharedDrainBudget as on, StackTerminationProtectionError as oo, repairMalformedOrphanRecordsForReadOnly as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, injectiveKeyPrefix as pa, loadPublishableAssetManifest as pi, AWS_CREDENTIAL_ENV_KEYS as pn, pasteableCommand as po, safeStackName as pr, ProviderRegistry as pt, formatResourceLine as q, DeployCancelledError as qa, synthesisStatusMessage as qi, refuseMalformedOrphanRecords as qn, buildLockContentionMessage as qr, assertRegionMatch as qt, DeployEngine as r, stateBucketExistenceConfirmed as ra, importableOutputs as ri, requireConfigString as rn, ResourceTimeoutError as ro, refuseMalformedResourcePropertiesForOrphan as rr, isExportAliasCollision as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sa, shouldRetainResource as si, s3BucketArn as sn, StateError as so, repairMalformedOrphansForReadOnly as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as ta, hasUnverifiableParameterRefusal as ti, requireConfigArray as tn, PartialFailureError as to, refuseMalformedResourceEntries as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, uploadCfnTemplate as ua, WorkGraph as ui, s3BucketRegionalDomainName as un, isCdkdError as uo, repairMalformedResourcePropertiesForReadOnly as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, PARTITION_TABLE as va, ensureAssetStorage as vi, INTRINSIC_KEYS as vn, isTransientServerError as vo, describeTypeWithThrottleRetry as vr, beginCommandInterruptScope as vt, reachableDivergentParameters as w, globMatches as wa, validateContainerRepoName as wi, hasReadableOrphans as wn, __exportAll as wo, STATE_SOURCED_READBACK_RULES as wr, slowCcOperationTimeoutMs as wt, bindingSkippedOutputs as x, ambientClientDefaults as xa, parseBootstrapMarker as xi, UNREADABLE_RESOURCES_MAP_ROW as xn, retryClassificationText as xo, TemplateParser as xr, isInterruptedWaitError as xt, keptWholeReasonText as y, canonicalizeRegion as ya, getBootstrapMarkerKey as yi, STATE_RESOURCES_MALFORMED as yn, markNonRetryable as yo, withRetry as yr, endCommandInterruptScope as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as za, runDockerForeground as zi, malformedRenderedContainersWarning as zn, recoverMaskedOutput as zr, isNamelessDynamicReferenceError as zt };
+//# sourceMappingURL=deploy-engine-OgrMdBRR.js.map