@go-to-k/cdkd 0.135.0 → 0.136.0

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { _ as withSkipPrefix, a as runDockerStreaming, c as getLogger, d as getLiveRenderer, f as PATTERN_B_NAME_PROPERTIES, g as generateResourceNameWithFallback, h as generateResourceName, i as runDockerForeground, n as formatDockerLoginError, p as PATTERN_B_RESOURCE_TYPES, r as getDockerCmd, u as runStackBuffered, v as withStackName } from "./docker-cmd-EtWSTAje.js";
-import { A as AssetPublisher, B as resolveStateBucketWithDefault, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as getDefaultStateBucketName, G as resolveBucketRegion, H as warnDeprecatedNoPrefixCliFlag, I as getLegacyStateBucketName, L as resolveApp, M as WorkGraph, N as buildDockerImage, O as S3StateBackend, P as Synthesizer, Q as LocalStartServiceError, R as resolveCaptureObservedState, S as IntrinsicFunctionResolver, T as DagBuilder, U as AssemblyReader, V as resolveStateBucketWithDefaultAndSource, X as LocalInvokeBuildError, Z as LocalMigrateError, _ as normalizeAwsTagsToCfn, a as withRetry, at as RouteDiscoveryError, b as CloudControlProvider, c as cyan, d as red, et as MissingCdkCliError, f as yellow, ft as normalizeAwsError, g as matchesCdkPath, h as CDK_PATH_TAG, i as withResourceDeadline, it as ResourceUpdateNotSupportedError, j as stringifyValue, k as shouldRetainResource, l as gray, m as collectInlinePolicyNamesManagedBySiblings, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as ProvisioningError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as StackHasActiveImportsError, p as IAMRoleProvider, pt as withErrorHandling, q as CdkdError, r as DeployEngine, rt as ResourceTimeoutError, s as bold, st as StackTerminationProtectionError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as PartialFailureError, u as green, v as resolveExplicitPhysicalId, w as DiffCalculator, x as assertRegionMatch, y as ProviderRegistry, z as resolveSkipPrefix } from "./deploy-engine-CX1x5ug1.js";
+import { A as AssetPublisher, B as resolveStateBucketWithDefault, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as getDefaultStateBucketName, G as MIGRATE_TMP_PREFIX, H as warnDeprecatedNoPrefixCliFlag, I as getLegacyStateBucketName, J as AssemblyReader, K as findLargeInlineResources, L as resolveApp, M as WorkGraph, N as buildDockerImage, O as S3StateBackend, P as Synthesizer, Q as CdkdError, R as resolveCaptureObservedState, S as IntrinsicFunctionResolver, T as DagBuilder, U as CFN_TEMPLATE_BODY_LIMIT, V as resolveStateBucketWithDefaultAndSource, W as CFN_TEMPLATE_URL_LIMIT, X as resolveBucketRegion, _ as normalizeAwsTagsToCfn, _t as normalizeAwsError, a as withRetry, at as MissingCdkCliError, b as CloudControlProvider, c as cyan, ct as ResourceTimeoutError, d as red, dt as StackHasActiveImportsError, f as yellow, ft as StackTerminationProtectionError, g as matchesCdkPath, h as CDK_PATH_TAG, i as withResourceDeadline, j as stringifyValue, k as shouldRetainResource, l as gray, lt as ResourceUpdateNotSupportedError, m as collectInlinePolicyNamesManagedBySiblings, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LocalMigrateError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as PartialFailureError, p as IAMRoleProvider, q as uploadCfnTemplate, r as DeployEngine, rt as LocalStartServiceError, s as bold, st as ProvisioningError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LocalInvokeBuildError, u as green, ut as RouteDiscoveryError, v as resolveExplicitPhysicalId, vt as withErrorHandling, w as DiffCalculator, x as assertRegionMatch, y as ProviderRegistry, z as resolveSkipPrefix } from "./deploy-engine-DZYchTh6.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-BF03Alpe.js";
 import { createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagUserCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, ListQueuesCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
@@ -30866,7 +30866,9 @@ async function deployCommand(stacks, options) {
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
-			...Object.keys(context).length > 0 && { context }
+			...Object.keys(context).length > 0 && { context },
+			stateBucket,
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 		});
 		logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
@@ -31124,7 +31126,9 @@ async function diffCommand(stacks, options) {
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
-			...Object.keys(context).length > 0 && { context }
+			...Object.keys(context).length > 0 && { context },
+			stateBucket,
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 		});
 		logger.info(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
@@ -32477,7 +32481,9 @@ async function destroyCommand(stackArgs, options) {
 			appStacks = (await synthesizer.synthesize({
 				app: appCmd,
 				output: options.output || "cdk.out",
-				...Object.keys(context).length > 0 && { context }
+				...Object.keys(context).length > 0 && { context },
+				stateBucket,
+				...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 			})).stacks.map((s) => ({
 				stackName: s.stackName,
 				displayName: s.displayName,
@@ -33101,7 +33107,9 @@ async function orphanCommand(pathArgs, options) {
 		const resolved = resolveConstructPaths(pathArgs, (await synthesizer.synthesize({
 			app: appCmd,
 			output: options.output || "cdk.out",
-			...Object.keys(context).length > 0 && { context }
+			...Object.keys(context).length > 0 && { context },
+			stateBucket,
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 		})).stacks);
 		const stackInfo = resolved.stack;
 		const orphanLogicalIds = resolved.logicalIds;
@@ -34775,143 +34783,6 @@ const STABLE_TERMINAL_STATUSES = new Set([
 	"IMPORT_ROLLBACK_COMPLETE"
 ]);
 
-//#endregion
-//#region src/cli/upload-cfn-template.ts
-/**
-* CloudFormation `TemplateBody` hard limit (51,200 bytes). Templates larger
-* than this cannot be submitted inline and must be uploaded to S3 and
-* referenced via `TemplateURL` instead — see {@link uploadCfnTemplate}.
-*/
-const CFN_TEMPLATE_BODY_LIMIT = 51200;
-/**
-* CloudFormation `TemplateURL` hard limit (1 MB / 1,048,576 bytes).
-* Templates larger than this are structurally unsubmittable through any
-* CloudFormation API — no S3 indirection helps. The caller surfaces a
-* pre-flight error pointing the user at template-splitting (nested stacks)
-* or shrinking inline asset payloads (`lambda.Code.fromAsset`).
-*/
-const CFN_TEMPLATE_URL_LIMIT = 1048576;
-/**
-* Shared S3 key prefix for transient CFn templates uploaded by `cdkd import
-* --migrate-from-cloudformation` and `cdkd export`. Kept distinct from
-* cdkd's `cdkd/` state prefix so `state list` / `state info` never conflate
-* transient migration artifacts with persisted stack state. The prefix is
-* intentionally human-grep-able — leftovers (if cleanup fails) point
-* straight at the offending stack name.
-*
-* Re-used by both commands so operator-facing audit trails (CloudTrail
-* records of the migrate-tmp uploads) stay consistent across the two
-* flows.
-*/
-const MIGRATE_TMP_PREFIX = "cdkd-migrate-tmp";
-/**
-* Upload a CFn template body to the cdkd state bucket and return both a
-* virtual-hosted-style HTTPS URL CloudFormation can fetch via
-* `TemplateURL` and a `cleanup` callback that deletes the object (and
-* destroys the S3 client).
-*
-* The state bucket's actual region is resolved via `GetBucketLocation`
-* (cached per-process) so the upload client and the URL match the
-* bucket's region — the calling CLI's profile region is irrelevant here.
-*
-* Cleanup is the caller's responsibility: invoke `cleanup` in a `finally`
-* around the CFn call. CloudFormation copies the template into its own
-* internal storage during the synchronous `CreateChangeSet` /
-* `UpdateStack` API call, so the S3 object is no longer needed after that
-* call returns (success or failure).
-*
-* Shared between `cdkd import --migrate-from-cloudformation` (via
-* `retire-cfn-stack.ts`) and `cdkd export` (via `commands/export.ts`) so
-* the upload + cleanup contract is single-sourced.
-*/
-async function uploadCfnTemplate(args) {
-	const { bucket, body, stackName, format, s3ClientOpts } = args;
-	const region = await resolveBucketRegion(bucket, {
-		...s3ClientOpts?.profile && { profile: s3ClientOpts.profile },
-		...s3ClientOpts?.credentials && { credentials: s3ClientOpts.credentials }
-	});
-	const s3 = new S3Client({
-		region,
-		...s3ClientOpts?.profile && { profile: s3ClientOpts.profile },
-		...s3ClientOpts?.credentials && { credentials: s3ClientOpts.credentials }
-	});
-	const ext = format === "yaml" ? "yaml" : "json";
-	const contentType = format === "yaml" ? "application/x-yaml" : "application/json";
-	const key = `${MIGRATE_TMP_PREFIX}/${stackName}/${Date.now()}.${ext}`;
-	try {
-		await s3.send(new PutObjectCommand({
-			Bucket: bucket,
-			Key: key,
-			Body: body,
-			ContentType: contentType
-		}));
-	} catch (err) {
-		s3.destroy();
-		throw err;
-	}
-	const url = `https://${bucket}.s3.${region}.amazonaws.com/${key}`;
-	const cleanup = async () => {
-		try {
-			await s3.send(new DeleteObjectCommand({
-				Bucket: bucket,
-				Key: key
-			}));
-		} finally {
-			s3.destroy();
-		}
-	};
-	return {
-		url,
-		cleanup
-	};
-}
-/**
-* Threshold (in bytes) above which a single resource's serialized
-* `Properties` block is considered an "inline payload" worth surfacing as
-* a contributor to a template that exceeds the 1 MB CFn `TemplateURL`
-* ceiling. 4 KB matches the typical inline `Code.ZipFile` Lambda payload
-* that pushes a multi-resource CDK app over the wire-format limit.
-*/
-const LARGE_INLINE_RESOURCE_THRESHOLD = 4096;
-/**
-* Walk a CFn template and surface every resource whose serialized
-* `Properties` block exceeds {@link LARGE_INLINE_RESOURCE_THRESHOLD}.
-* Used to build the actionable "offending resources" list in the
-* pre-flight error when a template exceeds the 1 MB `TemplateURL`
-* ceiling — typical culprits are inline `Code.ZipFile` Lambdas, inline
-* StepFunctions definitions, or large `AWS::CloudFormation::Stack`
-* bodies.
-*
-* Returns entries sorted by `approxBytes` descending so the user sees
-* the biggest contributor first. A non-CFn-template input (no
-* `Resources` object) returns an empty array.
-*/
-function findLargeInlineResources(template, threshold = LARGE_INLINE_RESOURCE_THRESHOLD) {
-	const result = [];
-	const resources = template["Resources"];
-	if (!resources || typeof resources !== "object" || Array.isArray(resources)) return result;
-	for (const [logicalId, resource] of Object.entries(resources)) {
-		if (!resource || typeof resource !== "object" || Array.isArray(resource)) continue;
-		const r = resource;
-		const resourceType = typeof r["Type"] === "string" ? r["Type"] : "<unknown>";
-		const properties = r["Properties"];
-		if (properties === void 0 || properties === null) continue;
-		let approxBytes;
-		try {
-			approxBytes = JSON.stringify(properties).length;
-		} catch {
-			continue;
-		}
-		if (approxBytes >= threshold) result.push({
-			logicalId,
-			resourceType,
-			approxBytes
-		});
-	}
-	result.sort((a, b) => b.approxBytes - a.approxBytes);
-	return result;
-}
-
 //#endregion
 //#region src/cli/yaml-cfn.ts
 /**
@@ -35498,7 +35369,9 @@ async function importCommand(stackArg, options) {
 		const result = await synthesizer.synthesize({
 			app: appCmd,
 			output: options.output || "cdk.out",
-			...Object.keys(context).length > 0 && { context }
+			...Object.keys(context).length > 0 && { context },
+			stateBucket,
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 		});
 		let stackInfo;
 		if (stackArg) {
@@ -42012,29 +41885,50 @@ function selectIntegrationResponse(entries, matchTarget, fallbackStatusCode = 20
 		try {
 			if (new RegExp(`^${entry.SelectionPattern}$`).test(matchTarget)) return {
 				entry,
-				statusCode: parseStatus$1(entry.StatusCode, fallbackStatusCode)
+				statusCode: parseStatus(entry.StatusCode, fallbackStatusCode)
 			};
 		} catch {}
 	}
 	const entry = defaultEntry ?? null;
 	return {
 		entry,
-		statusCode: entry !== null ? parseStatus$1(entry.StatusCode, fallbackStatusCode) : fallbackStatusCode
+		statusCode: entry !== null ? parseStatus(entry.StatusCode, fallbackStatusCode) : fallbackStatusCode
 	};
 }
-function parseStatus$1(raw, fallback) {
+/**
+* Parse an `IntegrationResponse.StatusCode` value into an HTTP status
+* code, returning `undefined` when the value is malformed or outside
+* the valid `[100, 600)` range.
+*
+* Issue (#507) items 6 + 7 + PR #515 item 4: this is the single source
+* of truth for "is `raw` a usable HTTP status code?" — `parseStatus`
+* in `rest-v1-integrations.ts` and this module's `parseStatus(raw, fallback)`
+* both delegate here so future shape-tightening (e.g. accepting `0x10`
+* the way `Number("0x10") === 16` does) lands in one place.
+*
+* Validation rules:
+*   - non-string non-number → undefined
+*   - empty / whitespace-only string → undefined
+*   - NaN / non-integer → undefined
+*   - integer outside `[100, 600)` (HTTP valid range) → undefined
+*   - hex literal `"0x10"` → Number coerces to 16 but below 100 → undefined
+*/
+function tryParseStatus(raw) {
 	if (typeof raw === "number") {
 		if (Number.isInteger(raw) && raw >= 100 && raw < 600) return raw;
-		return fallback;
+		return;
 	}
-	if (typeof raw !== "string") return fallback;
+	if (typeof raw !== "string") return void 0;
 	const trimmed = raw.trim();
-	if (trimmed === "") return fallback;
+	if (trimmed === "") return void 0;
 	const parsed = Number(trimmed);
-	if (!Number.isInteger(parsed)) return fallback;
-	if (parsed < 100 || parsed >= 600) return fallback;
+	if (!Number.isInteger(parsed)) return void 0;
+	if (parsed < 100 || parsed >= 600) return void 0;
 	return parsed;
 }
+function parseStatus(raw, fallback) {
+	return tryParseStatus(raw) ?? fallback;
+}
 /**
 * Evaluate `IntegrationResponse.ResponseParameters` — header literals
 * mapped onto the HTTP response. Returns `{name: value}` for every entry
@@ -42140,7 +42034,7 @@ function dispatchMockIntegration(config, req) {
 		return vtlFailure("request", err, config.requestTemplate);
 	}
 	let entry = null;
-	if (pickedStatus !== void 0) entry = config.responses.find((e) => parseStatus(e.StatusCode) === pickedStatus) ?? defaultResponseEntry(config.responses);
+	if (pickedStatus !== void 0) entry = config.responses.find((e) => tryParseStatus(e.StatusCode) === pickedStatus) ?? defaultResponseEntry(config.responses);
 	else entry = defaultResponseEntry(config.responses);
 	if (!entry) return {
 		statusCode: pickedStatus ?? 200,
@@ -42164,7 +42058,7 @@ function dispatchMockIntegration(config, req) {
 	Object.assign(headers, evaluateResponseParameters(entry.ResponseParameters, { onUnsupported: (_k, _v, reason) => logger.warn(`MOCK response: ${reason}`) }));
 	if (body === "" && headers["content-type"] === contentType) delete headers["content-type"];
 	return {
-		statusCode: parseStatus(entry.StatusCode) ?? 200,
+		statusCode: tryParseStatus(entry.StatusCode) ?? 200,
 		headers,
 		body
 	};
@@ -42469,19 +42363,6 @@ function extractStatusCodeFromRendered(rendered) {
 function defaultResponseEntry(entries) {
 	return entries.find((e) => e.SelectionPattern === void 0 || e.SelectionPattern === "") ?? null;
 }
-function parseStatus(raw) {
-	if (typeof raw === "number") {
-		if (Number.isInteger(raw) && raw >= 100 && raw < 600) return raw;
-		return;
-	}
-	if (typeof raw !== "string") return void 0;
-	const trimmed = raw.trim();
-	if (trimmed === "") return void 0;
-	const n = Number(trimmed);
-	if (!Number.isInteger(n)) return void 0;
-	if (n < 100 || n >= 600) return void 0;
-	return n;
-}
 /**
 * Heuristic: is the given HTTP `Content-Type` header value likely to
 * carry text content that VTL ResponseTemplates can safely render
@@ -43789,6 +43670,38 @@ function matchHeaderList(headerList, allowed) {
 	return true;
 }
 
+//#endregion
+//#region src/local/authorizer-context.ts
+/**
+* Build the per-kind context shape for the authorizer pipeline. Returns
+* an empty object only when nothing in the result is surfaceable (e.g.
+* a Lambda authorizer with no `principalId` and no `context`); callers
+* decide whether to skip surfacing in that case.
+*
+* For Lambda kinds: callers may need to wrap the returned shape in a
+* `lambda` namespace for HTTP API v2 (`{ lambda: shape }`); the wrap
+* is consumer-specific so it's NOT done here. The shape returned is
+* the always-flat REST v1 form.
+*/
+function buildAuthorizerContextShape(authorizer, result) {
+	if (authorizer.kind === "lambda-token" || authorizer.kind === "lambda-request") {
+		const ctx = {};
+		if (result.principalId !== void 0) ctx["principalId"] = result.principalId;
+		if (result.context) Object.assign(ctx, result.context);
+		return ctx;
+	}
+	if (authorizer.kind === "iam") {
+		const ctx = {};
+		if (result.principalId !== void 0) ctx["principalId"] = result.principalId;
+		return ctx;
+	}
+	if (authorizer.kind === "cognito") return { claims: { ...result.context ?? {} } };
+	return { jwt: {
+		claims: { ...result.context ?? {} },
+		scopes: []
+	} };
+}
+
 //#endregion
 //#region src/local/authorizer-resolver.ts
 /**
@@ -46300,22 +46213,7 @@ function buildServiceIntegrationContextVars(req, route) {
 */
 function buildAuthorizerContextForServiceIntegration(authorizer, result) {
 	if (!authorizer || !result) return void 0;
-	if (authorizer.kind === "lambda-token" || authorizer.kind === "lambda-request") {
-		const ctx = {};
-		if (result.principalId !== void 0) ctx["principalId"] = result.principalId;
-		if (result.context) Object.assign(ctx, result.context);
-		return ctx;
-	}
-	if (authorizer.kind === "iam") {
-		const ctx = {};
-		if (result.principalId !== void 0) ctx["principalId"] = result.principalId;
-		return ctx;
-	}
-	if (authorizer.kind === "cognito") return { claims: { ...result.context ?? {} } };
-	return { jwt: {
-		claims: { ...result.context ?? {} },
-		scopes: []
-	} };
+	return buildAuthorizerContextShape(authorizer, result);
 }
 /**
 * Write the 501 Not Implemented response surfaced for routes the
@@ -46967,7 +46865,9 @@ async function localStartApiCommand(target, options) {
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
-			...Object.keys(context).length > 0 && { context }
+			...Object.keys(context).length > 0 && { context },
+			...options.stateBucket && { stateBucket: options.stateBucket },
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 		};
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const targetStacks = pickTargetStacks(stacks, options.stack);
@@ -48895,7 +48795,9 @@ async function localRunTaskCommand(target, options) {
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
-			...Object.keys(context).length > 0 && { context }
+			...Object.keys(context).length > 0 && { context },
+			...options.stateBucket && { stateBucket: options.stateBucket },
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 		};
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const imageContext = await buildEcsImageResolutionContext$1(target, stacks, options);
@@ -49528,8 +49430,10 @@ const defaultWaitForExitImpl = async (containerId) => {
 * test-overridable function so unit tests do not need a real container.
 */
 let waitForExitImpl = defaultWaitForExitImpl;
+const defaultSleepImpl = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+let sleepImpl = defaultSleepImpl;
 function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
+	return sleepImpl(ms);
 }
 
 //#endregion
@@ -49574,7 +49478,9 @@ async function localStartServiceCommand(target, options) {
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
-			...Object.keys(context).length > 0 && { context }
+			...Object.keys(context).length > 0 && { context },
+			...options.stateBucket && { stateBucket: options.stateBucket },
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 		};
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const imageContext = await buildEcsImageResolutionContext(target, stacks, options);
@@ -49895,7 +49801,9 @@ async function localInvokeCommand(target, options) {
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
-			...Object.keys(context).length > 0 && { context }
+			...Object.keys(context).length > 0 && { context },
+			...options.stateBucket && { stateBucket: options.stateBucket },
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 		};
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const lambda = resolveLambdaTarget(target, stacks);
@@ -50803,7 +50711,9 @@ async function exportCommand(stackArg, options) {
 			const result = await synthesizer.synthesize({
 				app: appCmd,
 				output: options.output || "cdk.out",
-				...Object.keys(context).length > 0 && { context }
+				...Object.keys(context).length > 0 && { context },
+				stateBucket,
+				...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
 			});
 			let stackInfo;
 			if (stackArg) {
@@ -52972,7 +52882,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.135.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.136.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());