@go-to-k/cdkd 0.248.0 → 0.249.0

package/dist/ec2-termination-protection-q-WGWgxa.js

@@ -1,683 +0,0 @@
-import { n as getLogger } from "./logger-BzO-joNR.js";
-import { ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
-
-//#region src/utils/error-handler.ts
-/**
-* Base error class for cdkd
-*/
-var CdkdError = class CdkdError extends Error {
-	code;
-	cause;
-	constructor(message, code, cause) {
-		super(message);
-		this.code = code;
-		this.cause = cause;
-		this.name = "CdkdError";
-		Object.setPrototypeOf(this, CdkdError.prototype);
-	}
-};
-/**
-* State management errors
-*/
-var StateError = class StateError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "STATE_ERROR", cause);
-		this.name = "StateError";
-		Object.setPrototypeOf(this, StateError.prototype);
-	}
-};
-/**
-* Lock acquisition errors
-*/
-var LockError = class LockError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "LOCK_ERROR", cause);
-		this.name = "LockError";
-		Object.setPrototypeOf(this, LockError.prototype);
-	}
-};
-/**
-* Synthesis errors
-*/
-var SynthesisError = class SynthesisError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "SYNTHESIS_ERROR", cause);
-		this.name = "SynthesisError";
-		Object.setPrototypeOf(this, SynthesisError.prototype);
-	}
-};
-/**
-* Asset errors
-*/
-var AssetError = class AssetError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "ASSET_ERROR", cause);
-		this.name = "AssetError";
-		Object.setPrototypeOf(this, AssetError.prototype);
-	}
-};
-/**
-* Local-invoke `docker build` failures.
-*
-* Surfaces the stderr captured from `docker build` so the user can
-* re-run the same command directly to debug Dockerfile syntax errors
-* or missing build context. Used by `src/local/docker-image-builder.ts`
-* (PR 5) for container Lambdas; the parallel `AssetError` covers the
-* `cdkd publish-assets` / `cdkd deploy` build path. Kept distinct from
-* `AssetError` so `cdkd local invoke` failures don't show up under the
-* "asset" error class.
-*/
-var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
-		this.name = "LocalInvokeBuildError";
-		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
-	}
-};
-/**
-* Resource provisioning errors
-*/
-var ProvisioningError = class ProvisioningError extends CdkdError {
-	resourceType;
-	logicalId;
-	physicalId;
-	constructor(message, resourceType, logicalId, physicalId, cause) {
-		super(message, "PROVISIONING_ERROR", cause);
-		this.resourceType = resourceType;
-		this.logicalId = logicalId;
-		this.physicalId = physicalId;
-		this.name = "ProvisioningError";
-		Object.setPrototypeOf(this, ProvisioningError.prototype);
-	}
-};
-/**
-* Resource provisioning timeout errors (per-resource wall-clock deadline).
-*
-* Thrown by `withResourceDeadline` when a single CREATE / UPDATE / DELETE
-* operation exceeds the user-configured `--resource-timeout`. The deploy
-* engine catches this, wraps it in {@link ProvisioningError}, and lets the
-* existing failure path (interrupt siblings → pre-rollback save → rollback
-* unless `--no-rollback`) take over.
-*
-* The message intentionally names the resource, type, region, elapsed time
-* and operation, plus how to override the default. Long-running providers
-* (e.g. Custom Resource: 1h polling cap) self-report their needed budget
-* via `getMinResourceTimeoutMs()`, so the user only needs a per-type
-* override (`--resource-timeout TYPE=DURATION`) when they want to bump a
-* specific non-self-reporting type or shorten a self-reported one.
-*/
-var ResourceTimeoutError = class ResourceTimeoutError extends CdkdError {
-	logicalId;
-	resourceType;
-	region;
-	elapsedMs;
-	operation;
-	timeoutMs;
-	constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
-		const elapsedLabel = formatDuration(elapsedMs);
-		const timeoutLabel = formatDuration(timeoutMs);
-		super(`Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).\nThis may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
-slow ENI provisioning. Re-run with --resource-timeout ${resourceType}=<DURATION>\nto bump the budget for this resource type only, or --verbose to see the
-underlying provider activity.`, "RESOURCE_TIMEOUT");
-		this.logicalId = logicalId;
-		this.resourceType = resourceType;
-		this.region = region;
-		this.elapsedMs = elapsedMs;
-		this.operation = operation;
-		this.timeoutMs = timeoutMs;
-		this.name = "ResourceTimeoutError";
-		Object.setPrototypeOf(this, ResourceTimeoutError.prototype);
-	}
-};
-/**
-* Format a duration in milliseconds as a short human-readable label
-* (`30m`, `1h30m`, `45s`). Used by {@link ResourceTimeoutError} so the
-* error message stays compact.
-*/
-function formatDuration(ms) {
-	if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
-	const totalMinutes = Math.round(ms / 6e4);
-	if (totalMinutes < 60) return `${totalMinutes}m`;
-	const hours = Math.floor(totalMinutes / 60);
-	const minutes = totalMinutes % 60;
-	return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
-}
-/**
-* Dependency resolution errors
-*/
-var DependencyError = class DependencyError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "DEPENDENCY_ERROR", cause);
-		this.name = "DependencyError";
-		Object.setPrototypeOf(this, DependencyError.prototype);
-	}
-};
-/**
-* Configuration errors
-*/
-var ConfigError = class ConfigError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "CONFIG_ERROR", cause);
-		this.name = "ConfigError";
-		Object.setPrototypeOf(this, ConfigError.prototype);
-	}
-};
-/**
-* Signals a partial-failure outcome that should map to exit code 2 (not 1).
-*
-* Used by `cdkd destroy` and `cdkd state destroy` when one or more
-* per-resource deletes failed but the overall command finished its work
-* (state.json is preserved, the rest of the stack was deleted, and the
-* user can re-run to clean up the remaining resources).
-*
-* Exit code conventions:
-*   - 0: command completed successfully, no resources left in error state.
-*   - 1: command-level failure (auth error, bad arguments, synth crash,
-*        unhandled exception). Default for any thrown error.
-*   - 2: partial failure — work completed but some resources are still in
-*        an error state. Re-running typically resolves it. Documented in
-*        README's "Exit codes" section.
-*
-* `handleError` recognizes this class via `instanceof` and uses its
-* `exitCode` instead of the default 1.
-*/
-var PartialFailureError = class PartialFailureError extends CdkdError {
-	exitCode = 2;
-	constructor(message, cause) {
-		super(message, "PARTIAL_FAILURE", cause);
-		this.name = "PartialFailureError";
-		Object.setPrototypeOf(this, PartialFailureError.prototype);
-	}
-};
-/**
-* Signals that a provider cannot perform an in-place `update` for a
-* resource type — most commonly because the AWS resource is structurally
-* immutable (`AWS::Lambda::LayerVersion`, `AWS::S3Tables::TableBucket` once
-* created, certain `AWS::EC2::*` sub-resources) or because the provider
-* surfaces a sub-resource attachment whose only mutation pattern is
-* delete + add (Lambda permission statements, IAM policy attachments).
-*
-* Surfaced through `cdkd drift --revert`, which calls
-* `provider.update(logicalId, physicalId, type, stateProps, awsProps)` to
-* push cdkd state values back into AWS for every drifted resource. When a
-* provider throws this error, the drift command collects it as a
-* per-resource outcome distinct from a generic AWS update failure: the
-* fix is to re-deploy with `--replace` (or recreate the resource), not to
-* retry the update.
-*
-* Carries the same `exitCode = 2` as {@link PartialFailureError} so a
-* drift run that hits one immutable resource is reported as partial-
-* success rather than fatal — the rest of the drifted resources still
-* had their `update` invoked, and the user has a clear next step printed
-* for the unsupported one.
-*/
-var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError extends CdkdError {
-	exitCode = 2;
-	resourceType;
-	logicalId;
-	/**
-	* Human-readable hint printed alongside the error. The default is
-	* "use cdkd deploy with --replace, or change the resource definition
-	* to create a new version" — providers are encouraged to override
-	* with a more specific suggestion when one is available (e.g.
-	* Lambda::Permission's "delete + add a new statement").
-	*/
-	suggestion;
-	constructor(resourceType, logicalId, suggestion, cause) {
-		super(`${resourceType} (${logicalId}) cannot be updated in place: ${suggestion ? suggestion : "use cdkd deploy with --replace, or change the resource definition to create a new version"}.`, "RESOURCE_UPDATE_NOT_SUPPORTED", cause);
-		this.resourceType = resourceType;
-		this.logicalId = logicalId;
-		this.suggestion = suggestion;
-		this.name = "ResourceUpdateNotSupportedError";
-		Object.setPrototypeOf(this, ResourceUpdateNotSupportedError.prototype);
-	}
-};
-/**
-* Signals a refusal to destroy a stack whose CDK manifest has
-* `terminationProtection: true`.
-*
-* Surfaced from `cdkd destroy <stack>` / `cdkd destroy --all` BEFORE
-* any lock acquisition or per-resource delete. In multi-stack runs
-* (e.g. `--all`) this counts as a per-stack failure and the rest of
-* the targets continue — the aggregated count is wrapped in
-* {@link PartialFailureError} so the command exits with code 2.
-*
-* The bypass workflow is documented in the message: edit the CDK code
-* (`new Stack(app, '...', { terminationProtection: false })`),
-* redeploy, then retry the destroy. A future `--remove-protection`
-* flag (separate scope) will provide an explicit one-shot bypass.
-*
-* Note: `cdkd state destroy` (state-only, no synth) does NOT honor
-* `terminationProtection` — the flag is a CDK property not persisted
-* in cdkd's state.json. Use `cdkd destroy` when synth is available.
-*/
-var StackTerminationProtectionError = class StackTerminationProtectionError extends CdkdError {
-	stackName;
-	constructor(stackName, cause) {
-		super(`Stack '${stackName}' has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry 'cdkd destroy ${stackName}'.`, "STACK_TERMINATION_PROTECTION", cause);
-		this.stackName = stackName;
-		this.name = "StackTerminationProtectionError";
-		Object.setPrototypeOf(this, StackTerminationProtectionError.prototype);
-	}
-};
-/**
-* `cdkd destroy <child>` refused because the named stack is a nested
-* child of another stack. Mirrors CloudFormation's `you can't directly
-* destroy a nested stack` semantic — destroying the child without
-* touching the parent would leave the parent's `AWS::CloudFormation::Stack`
-* record pointing at non-existent resources, and the parent's next
-* deploy would silently try to re-create them.
-*
-* Detected by reading the loaded state's v6 `parentStack` field — only
-* state files written by `NestedStackProvider.create` (or by the
-* recursive `cdkd import --migrate-from-cloudformation` walk) carry
-* this field; top-level stacks have `parentStack: undefined` and pass
-* the guard unchanged.
-*
-* Fires from `cdkd destroy` AFTER state load but BEFORE lock
-* acquisition or any per-resource delete, so the refusal is cheap.
-* Surfaced as a per-stack failure (wrapped in {@link PartialFailureError},
-* exit code 2) in multi-stack runs — siblings continue.
-*
-* Bypass paths (both intentional escape hatches):
-*
-*  1. `cdkd destroy <parent>` — the normal cascading-destroy path; the
-*     parent's reverse-DAG walks into the child via
-*     `NestedStackProvider.delete` and removes both layers atomically.
-*  2. `cdkd state destroy <child>` — state-only destroy with no parent
-*     coupling check. The state-driven entry point intentionally
-*     bypasses this guard for the same reason `cdkd state destroy`
-*     bypasses `terminationProtection`: it's the "I know what I'm
-*     doing" path for cleaning up state when synth is unavailable or
-*     the user accepts leaving the parent's reference dangling.
-*/
-var NestedStackChildDirectDestroyError = class NestedStackChildDirectDestroyError extends CdkdError {
-	stackName;
-	parentStack;
-	parentLogicalId;
-	constructor(stackName, parentStack, parentLogicalId, cause) {
-		const logicalIdSuffix = parentLogicalId ? ` (parent's logical id: ${parentLogicalId})` : "";
-		super(`Stack '${stackName}' is a nested child of '${parentStack}'${logicalIdSuffix}; directly destroying a nested stack is not supported. Either run 'cdkd destroy ${parentStack}' to cascade-delete this child along with its parent, or run 'cdkd state destroy ${stackName}' if you intentionally want to leave the parent's reference dangling (the state-only escape hatch).`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
-		this.stackName = stackName;
-		this.parentStack = parentStack;
-		if (parentLogicalId !== void 0) this.parentLogicalId = parentLogicalId;
-		this.name = "NestedStackChildDirectDestroyError";
-		Object.setPrototypeOf(this, NestedStackChildDirectDestroyError.prototype);
-	}
-};
-/**
-* `cdkd destroy <producer>` refused because at least one consumer stack
-* still records an `Fn::ImportValue` reference to one of the producer's
-* outputs. This matches CloudFormation's strong-reference semantics —
-* CFn rejects `DeleteStack` for an exporter while an importer exists.
-*
-* cdkd has no `--force` escape hatch for this (intentionally, mirroring
-* CFn). The error message lists every offending consumer and points the
-* user at the two valid resolution paths:
-*
-*  1. Destroy the consumer first: `cdkd destroy <consumer>`
-*  2. Remove the `Fn::ImportValue` from the consumer's template and
-*     redeploy, then retry the producer destroy.
-*
-* Weak-reference consumers (`Fn::GetStackOutput`, cdkd-specific) never
-* trigger this error by design — the producer stays deletable
-* independently of consumers when the user intentionally chose a weak
-* reference at template-authoring time.
-*
-* Exit code 2 (same as `PartialFailureError`) so multi-stack `cdkd
-* destroy --all` runs that partially succeed still surface as
-* non-zero without being indistinguishable from a fatal cdkd error.
-*/
-var StackHasActiveImportsError = class StackHasActiveImportsError extends CdkdError {
-	exitCode = 2;
-	producerStack;
-	producerRegion;
-	consumers;
-	constructor(producerStack, producerRegion, consumers, cause) {
-		const lines = consumers.map((c) => `  - ${c.consumerStack} (${c.consumerRegion}): imports export '${c.exportName}'`);
-		super(`Cannot destroy stack '${producerStack}' (${producerRegion}): the following stacks still import its outputs via Fn::ImportValue:\n${lines.join("\n")}\n\nThis matches CloudFormation's strong-reference semantics — exports are\nprotected as long as a consumer references them.\n\nTo proceed:\n  1. Destroy the consumer first: cdkd destroy <consumer-stack>\n  2. Or remove the Fn::ImportValue from the consumer's template\n     (e.g. inline the value, or refactor) and re-deploy the consumer,\n     then retry this destroy.\n\nNote: cdkd's Fn::GetStackOutput intrinsic is a weak alternative that\ndoes NOT protect the producer — use it when you intentionally want\nthe producer to be deletable independently of consumers.`, "STACK_HAS_ACTIVE_IMPORTS", cause);
-		this.producerStack = producerStack;
-		this.producerRegion = producerRegion;
-		this.consumers = consumers;
-		this.name = "StackHasActiveImportsError";
-		Object.setPrototypeOf(this, StackHasActiveImportsError.prototype);
-	}
-};
-/**
-* Signals a `cdkd local start-service` orchestration failure (Phase 2
-* of #262 — `AWS::ECS::Service` emulator). Distinct from
-* `LocalRunTaskError` because the service runner has its own lifecycle
-* (long-running replica pool, restart-on-exit), so a failure inside it
-* carries different operator semantics than a one-shot task failure.
-*/
-var LocalStartServiceError = class LocalStartServiceError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "LOCAL_START_SERVICE_ERROR", cause);
-		this.name = "LocalStartServiceError";
-		Object.setPrototypeOf(this, LocalStartServiceError.prototype);
-	}
-};
-/**
-* Signals that the upstream `cdk` CLI is not available on PATH (or at
-* the override path passed via `--cdk-bin`). Surfaced from `cdkd migrate`
-* (#465 PR A) before any other work runs.
-*
-* The message includes the install hint `npm install -g aws-cdk@latest`
-* so users on a fresh machine see exactly how to recover.
-*/
-var MissingCdkCliError = class MissingCdkCliError extends CdkdError {
-	constructor(detail, cause) {
-		super(`${detail ?? "upstream 'cdk' CLI not found on PATH"}. 'cdkd migrate' shells out to the upstream aws-cdk CLI for L1 codegen — install it with 'npm install -g aws-cdk@latest' (or pass --cdk-bin <path>).`, "MISSING_CDK_CLI", cause);
-		this.name = "MissingCdkCliError";
-		Object.setPrototypeOf(this, MissingCdkCliError.prototype);
-	}
-};
-/**
-* Generic local-migrate orchestration failure (#465 PR A). Used by
-* `cdkd migrate` for pre-flight rejections (Custom Resource / nested
-* stack / non-terminal CFn stack state), output-dir collisions, and
-* `cdk migrate` subprocess failures whose underlying stderr is folded
-* into the error message. Exit code 2 (partial-failure family) because
-* some pre-flight failures leave the user with a partially-populated
-* output directory that's still useful for debugging.
-*/
-var LocalMigrateError = class LocalMigrateError extends CdkdError {
-	exitCode = 2;
-	constructor(message, cause) {
-		super(message, "LOCAL_MIGRATE_ERROR", cause);
-		this.name = "LocalMigrateError";
-		Object.setPrototypeOf(this, LocalMigrateError.prototype);
-	}
-};
-/**
-* CloudFormation macro / `Fn::Transform` expansion failure (#463).
-*
-* cdkd hands templates that declare `Transform: [...]` (or carry
-* `Fn::Transform: {...}` snippets) to CloudFormation server-side via a
-* transient `CreateChangeSet --change-set-type CREATE` against a
-* `cdkd-macro-expand-<id>` stack name. This error wraps every failure
-* mode of that round-trip:
-*
-*   - `CreateChangeSet` rejection (bad template, missing macro IAM
-*     permission, custom macro not found in the account).
-*   - Changeset settles in `FAILED` (`StatusReason` from CFn is
-*     surfaced verbatim — typically a custom macro Lambda error).
-*   - Waiter timeout (the macro Lambda is stuck or oversized).
-*   - `GetTemplate --template-stage Processed` returns no body (would
-*     indicate a CFn-side regression — fail loud rather than silently
-*     proceed with the un-expanded template).
-*   - Multi-stage detection: the expanded template still contains
-*     macros, which cdkd v1 does not support (the design intentionally
-*     rejects this so a second round-trip is not silently triggered).
-*
-* The error surfaces at exit code 2 (partial-failure family) — the
-* cleanup `finally` in the expander always runs `DeleteChangeSet` +
-* `DeleteStack` regardless of this error firing, so a failed
-* expansion never leaves a transient CFn stack behind in a routine
-* case. The user can re-run `cdkd deploy` once the upstream cause is
-* fixed.
-*/
-var MacroExpansionError = class MacroExpansionError extends CdkdError {
-	exitCode = 2;
-	constructor(message, cause) {
-		super(message, "MACRO_EXPANSION_ERROR", cause);
-		this.name = "MacroExpansionError";
-		Object.setPrototypeOf(this, MacroExpansionError.prototype);
-	}
-};
-/**
-* Check if error is a cdkd error
-*/
-function isCdkdError(error) {
-	return error instanceof CdkdError;
-}
-/**
-* Format error for display
-*/
-function formatError(error) {
-	if (isCdkdError(error)) {
-		let message = `${error.name}: ${error.message}`;
-		if (error.cause) message += `\nCaused by: ${error.cause.message}`;
-		return message;
-	}
-	if (error instanceof Error) return `${error.name}: ${error.message}`;
-	return String(error);
-}
-/**
-* Global error handler
-*
-* Default exit code is 1 (general error). `PartialFailureError`
-* overrides it to 2 so callers can distinguish "command crashed /
-* unauthorized / bad arguments" from "command completed but some
-* resources are still in an error state, re-run to clean up".
-*
-* A {@link CdkdError} subclass may set `silent = true` to suppress the
-* default `logger.error` line — used by `cdkd drift` where the command
-* has already printed a richer report and only needs the exit code.
-*/
-function handleError(error) {
-	const logger = getLogger();
-	if (!(error instanceof CdkdError && error.silent)) logger.error(formatError(error));
-	if (error instanceof Error && error.stack) logger.debug("Stack trace:", error.stack);
-	const customExitCode = error instanceof CdkdError ? error.exitCode : void 0;
-	const exitCode = typeof customExitCode === "number" ? customExitCode : 1;
-	process.exit(exitCode);
-}
-/**
-* Wrap async function with error handling
-*
-* Note: Uses `any[]` for args to support Commander.js action handlers
-* which can have various parameter types
-*/
-function withErrorHandling(fn) {
-	return async (...args) => {
-		try {
-			await fn(...args);
-		} catch (error) {
-			handleError(error);
-		}
-	};
-}
-/**
-* Convert AWS SDK v3's synthetic `Unknown` / `UnknownError` exception into
-* an actionable `Error` keyed off `$metadata.httpStatusCode`.
-*
-* Background — why this helper exists:
-*   AWS SDK v3 produces a synthetic `name: 'Unknown'`, `message:
-*   'UnknownError'` exception when the protocol parser hits a HEAD response
-*   with an empty body. The most common trigger is `HeadBucket` against a
-*   bucket in a different region than the client (S3 returns 301
-*   PermanentRedirect with `x-amz-bucket-region` set, but the redirect
-*   middleware doesn't recover from the empty body). Surfacing the literal
-*   string `UnknownError` to users is uninformative.
-*
-* Behavior:
-*   - Non-AWS-SDK errors (anything where `name` is not `Unknown` and
-*     `message` is not `UnknownError`) pass through unchanged.
-*   - AWS SDK Unknown errors are mapped by HTTP status:
-*     - 301 → `Bucket '<name>' is in a different region…` (auto-resolved
-*       elsewhere; if this surfaces, it's a bug worth reporting).
-*     - 403 → `Access denied to bucket '<name>'.`
-*     - 404 → `Bucket '<name>' does not exist.`
-*     - other / unknown → `S3 error during <operation> on '<bucket>' (HTTP
-*       <status>).`
-*/
-function normalizeAwsError(err, context = {}) {
-	if (!(err instanceof Error)) return new Error(String(err));
-	if (!(err.name === "Unknown" || err.message === "UnknownError")) return err;
-	const status = err.$metadata?.httpStatusCode;
-	const bucket = context.bucket ?? "<unknown bucket>";
-	const operation = context.operation ?? "operation";
-	switch (status) {
-		case 301: {
-			const responseHeaders = err.$response?.headers;
-			const region = responseHeaders?.["x-amz-bucket-region"] ?? responseHeaders?.["X-Amz-Bucket-Region"];
-			const where = region ? ` (in ${region})` : "";
-			return /* @__PURE__ */ new Error(`Bucket '${bucket}'${where} is in a different region than the client. cdkd resolves this automatically; if you see this message, please report it.`);
-		}
-		case 403: return /* @__PURE__ */ new Error(`Access denied to bucket '${bucket}'. Verify credentials and bucket policy.`);
-		case 404: return /* @__PURE__ */ new Error(`Bucket '${bucket}' does not exist.`);
-		default: {
-			const statusStr = status !== void 0 ? `HTTP ${status}` : "unknown HTTP status";
-			return /* @__PURE__ */ new Error(`S3 error during ${operation} on '${bucket}' (${statusStr}). See CloudTrail for details.`);
-		}
-	}
-}
-
-//#endregion
-//#region src/provisioning/region-check.ts
-/**
-* Verify that the AWS client's region matches the region the resource is
-* expected to live in before treating a `NotFound` error as idempotent
-* delete success.
-*
-* Why: a destroy run with the wrong region would otherwise receive
-* `*NotFound` for every resource and silently strip them all from state,
-* leaving the actual AWS resources orphaned in the real region. The
-* silent-failure incident that motivated this check was a Lambda in
-* `us-west-2` removed from state by a destroy that ran with a `us-east-1`
-* client.
-*
-* Behavior:
-* - If `expectedRegion` is unset, this is a no-op (back-compat: existing
-*   idempotent semantics preserved for callers that have not been
-*   threaded with state region).
-* - If `clientRegion` matches `expectedRegion`, returns silently.
-* - Otherwise throws `ProvisioningError` so the caller surfaces the
-*   mismatch instead of swallowing the NotFound.
-*
-* @param clientRegion Region resolved from the AWS SDK client config
-*   (typically `await client.config.region()`).
-* @param expectedRegion Region recorded in stack state, or undefined if
-*   the caller has no expected region.
-* @param resourceType CloudFormation resource type, used in the error
-*   message and on the thrown ProvisioningError.
-* @param logicalId Logical ID of the resource, used in the error message
-*   and on the thrown ProvisioningError.
-* @param physicalId Optional physical ID, used in the error message and
-*   on the thrown ProvisioningError.
-*/
-function assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, physicalId) {
-	if (!expectedRegion) return;
-	if (!clientRegion) throw new ProvisioningError(`Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region is unknown but stack state expects ${expectedRegion}. The resource may exist in ${expectedRegion} and would be silently removed from state if this NotFound were trusted.`, resourceType, logicalId, physicalId);
-	if (clientRegion !== expectedRegion) throw new ProvisioningError(`Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region ${clientRegion} does not match stack state region ${expectedRegion}. The resource likely still exists in ${expectedRegion}; rerun the destroy with the correct region (e.g. --region ${expectedRegion}).`, resourceType, logicalId, physicalId);
-}
-
-//#endregion
-//#region src/provisioning/import-helpers.ts
-/**
-* Read an explicit name field from template properties. Returns `undefined`
-* when the property is missing or not a string — callers fall back to
-* tag-based lookup in that case.
-*/
-function readNameProperty(input, propertyName) {
-	const value = input.properties?.[propertyName];
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-/**
-* Resolve the physical id when the template provides an explicit name OR the
-* caller passed `--resource`/`--resource-mapping`. Returns `undefined` when
-* neither shortcut applies — caller must then fall back to tag-based lookup.
-*
-* Does NOT verify the resource exists: callers should follow up with a
-* service-specific `Head*`/`Get*`/`Describe*` to fail fast if the named
-* resource is missing.
-*/
-function resolveExplicitPhysicalId(input, nameProperty) {
-	if (input.knownPhysicalId) return input.knownPhysicalId;
-	if (nameProperty) {
-		const name = readNameProperty(input, nameProperty);
-		if (name) return name;
-	}
-}
-/**
-* The standard tag CDK puts on every deployed resource — its construct path
-* within the app, e.g. `MyStack/MyConstruct/MyBucket`. Used as the lookup key
-* when no explicit name is in the template.
-*/
-const CDK_PATH_TAG = "aws:cdk:path";
-/**
-* Match an AWS resource's tag set against the CDK path the template carries.
-* Returns true if the resource was deployed by the same CDK construct.
-*/
-function matchesCdkPath(tags, cdkPath) {
-	if (!tags || !cdkPath) return false;
-	for (const t of tags) if (t.Key === "aws:cdk:path" && t.Value === cdkPath) return true;
-	return false;
-}
-/**
-* Re-shape an AWS tag list (any of the common shapes — array of `{Key, Value}`,
-* map keyed by tag name, or v2-style array of `{TagKey, TagValue}`) into the
-* canonical CFn shape (`Array<{Key, Value}>`) that cdkd state holds, with
-* `aws:`-prefixed entries filtered out.
-*
-* AWS reserves the `aws:` tag prefix; CDK injects `aws:cdk:path` (and
-* sometimes `aws:cdk:metadata`) on every resource it deploys. Those tags are
-* NOT in cdkd state's `Tags` (they come from CDK template `Metadata`, not
-* `Properties.Tags`), so leaving them in the AWS-current snapshot would fire
-* false-positive drift on every CDK-deployed resource.
-*
-* Returns an empty array `[]` when AWS reports no user tags. Callers decide
-* whether to surface `Tags: []` (most providers — matches the typical
-* CFn behavior of always emitting Tags in templates) or omit the key
-* entirely (when the corresponding `create()` only sets Tags when the user
-* explicitly passes them — see each provider's docstring).
-*/
-function normalizeAwsTagsToCfn(tags) {
-	if (!tags) return [];
-	const out = [];
-	if (Array.isArray(tags)) for (const t of tags) {
-		const obj = t;
-		const k = (typeof obj["Key"] === "string" ? obj["Key"] : void 0) ?? (typeof obj["TagKey"] === "string" ? obj["TagKey"] : void 0) ?? (typeof obj["key"] === "string" ? obj["key"] : void 0);
-		const v = (typeof obj["Value"] === "string" ? obj["Value"] : void 0) ?? (typeof obj["TagValue"] === "string" ? obj["TagValue"] : void 0) ?? (typeof obj["value"] === "string" ? obj["value"] : void 0);
-		if (typeof k !== "string" || k.length === 0) continue;
-		if (k.startsWith("aws:")) continue;
-		out.push({
-			Key: k,
-			Value: typeof v === "string" ? v : ""
-		});
-	}
-	else for (const [k, v] of Object.entries(tags)) {
-		if (!k || k.startsWith("aws:")) continue;
-		out.push({
-			Key: k,
-			Value: typeof v === "string" ? v : ""
-		});
-	}
-	out.sort((a, b) => a.Key < b.Key ? -1 : a.Key > b.Key ? 1 : 0);
-	return out;
-}
-
-//#endregion
-//#region src/provisioning/ec2-termination-protection.ts
-/**
-* Flip `DisableApiTermination` off on an instance. Idempotent — EC2 accepts the
-* call when the attribute is already false. Non-fatal: a NotFound (already
-* gone) or any other error is swallowed at debug so the actual delete still
-* proceeds (it will surface the real failure if the instance truly cannot be
-* deleted).
-*/
-async function disableInstanceApiTermination(client, instanceId, logger) {
-	try {
-		await client.send(new ModifyInstanceAttributeCommand({
-			InstanceId: instanceId,
-			DisableApiTermination: { Value: false }
-		}));
-		logger.debug(`Disabled DisableApiTermination on EC2 Instance ${instanceId} before deletion`);
-	} catch (flipError) {
-		logger.debug(`Could not disable DisableApiTermination on ${instanceId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
-	}
-}
-/**
-* Does this error message indicate the terminate / delete raced the
-* `DisableApiTermination` flip-off propagation (so re-flipping + retrying is
-* the right move)? Matches both the SDK `TerminateInstances` 400 and the Cloud
-* Control `DeleteResource` wrapper of the same underlying EC2 error.
-*/
-function isTerminationProtectionPropagationError(message) {
-	return /may not be terminated|disableApiTermination/i.test(message);
-}
-
-//#endregion
-export { withErrorHandling as A, StackHasActiveImportsError as C, formatError as D, SynthesisError as E, isCdkdError as O, ResourceUpdateNotSupportedError as S, StateError as T, MissingCdkCliError as _, normalizeAwsTagsToCfn as a, ProvisioningError as b, AssetError as c, DependencyError as d, LocalInvokeBuildError as f, MacroExpansionError as g, LockError as h, matchesCdkPath as i, normalizeAwsError as k, CdkdError as l, LocalStartServiceError as m, isTerminationProtectionPropagationError as n, resolveExplicitPhysicalId as o, LocalMigrateError as p, CDK_PATH_TAG as r, assertRegionMatch as s, disableInstanceApiTermination as t, ConfigError as u, NestedStackChildDirectDestroyError as v, StackTerminationProtectionError as w, ResourceTimeoutError as x, PartialFailureError as y };
-//# sourceMappingURL=ec2-termination-protection-q-WGWgxa.js.map