@go-to-k/cdkd 0.285.5 → 0.285.6

package/dist/{program-Def0C7JX.js → program-cjSJf49d.js}

@@ -1,8 +1,8 @@
-import { $ as DEFAULT_STATE_PREFIX, $n as warnDeprecatedNoPrefixCliFlag, $t as maskSecretsInError, A as bold, An as buildDenyExternalAccessPolicy, Ar as NestedStackChildDirectDestroyError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as getDockerImageBySourceHash, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as ensureAssetStorage, Cr as DeployCancelledError, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as readBootstrapMarkerBody, Dr as LocalStartServiceError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as parseBootstrapMarker, Er as LocalMigrateError, Et as configStringRefusal, F as yellow, Fn as getDockerCmd, Fr as StackHasActiveImportsError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as resolveApp, Gr as isThrottlingError, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as synthesisStatusMessage, Hr as withErrorHandling, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as partitionSensitiveEnv, Ir as StackTerminationProtectionError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveSkipPrefix, Jr as markRedactedCause, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as resolveAutoAssetStorage, Kr as isTransientServerError, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as runDockerForeground, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDockerImage, Mr as ProvisioningError, Mt as classifyReplaySecretRegion, N as green, Nn as dockerSpawnEnvWithSensitive, Nr as ResourceTimeoutError, Nt as producerRegionsFromState, O as renderStatefulReason, On as validateAssetBucketName, Ot as replayWarn, P as red, Pn as formatDockerLoginError, Pr as ResourceUpdateNotSupportedError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as stateBucketExistenceConfirmed, Qt as isSingleDynamicReferenceToken, R as exportAliasCollisionScrubWarning, Rn as runDockerStreaming, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as assertAssetBucketRegion, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as isCrossRegionRedirect, Tr as LocalInvokeBuildError$1, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as getDefaultStateBucketName, Ur as isMarkedNonRetryable, Ut as withRetry, V as stateKeySecretExposure, Vn as Synthesizer, Vr as normalizeAwsError, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as getLegacyStateBucketName, Wr as isRetryableTransientError, Wt as DagBuilder, X as maskDeep, Xn as resolveStateBucketWithDefaultAndSource, Xt as dynamicReferenceTokens, Y as createMaskedRetryLogger, Yn as resolveStateBucketWithDefault, Yr as retryClassificationText, Yt as createSecretMasker, Z as maskerOrIdentity, Zn as resolveUseCdkBootstrapAssets, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as rewriteTemplateAssetReferences, _r as setAwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as S3StateBackend, ar as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as AssetModeResolver, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as importableOutputKeys, cr as canonicalizeRegion, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as AssetPublisher, dr as processStackMessages, dt as isTerminationProtectionPropagationError, en as maskSecretsInText, er as CFN_TEMPLATE_BODY_LIMIT, et as beginCommandInterruptScope, f as withResourceDeadline, fn as stringifyValue, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as loadPublishableAssetManifest, gr as resetAwsClients, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as createAssetRedirectResolver, hr as getAwsClients, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as displaySafe, ir as uploadCfnTemplate, it as startInterruptWatch, j as cyan, jn as describeAwsFailure, jr as PartialFailureError, jt as requireConfigString, k as formatResourceLine, kn as validateContainerRepoName, kr as MissingCdkCliError, kt as requireConfigArray, l as replayRollback, ln as importableOutputs, lr as derivePartitionAndUrlSuffix, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildAssetRedirectMap, mr as AwsClients, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as scrubResourceRecord, nr as MIGRATE_TMP_PREFIX, nt as interruptWatchListenerCount, o as planFailedOps, on as rebuildClientForBucketRegion, or as expectedOwnerParam, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as WorkGraph, pr as resolveBucketRegion, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveCaptureObservedState, qr as markNonRetryable, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as LockManager, rr as findLargeInlineResources, rt as isInterruptedWaitError, s as planRollback, sn as exportNamesCarriedFrom, sr as PARTITION_TABLE, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as redactSecretsForState, tr as CFN_TEMPLATE_URL_LIMIT, tt as endCommandInterruptScope, u as updatePartialMessage, un as shouldRetainResource, ur as AssemblyReader, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as escapeRegExp, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as getBootstrapMarkerKey, wr as DynamicReferenceRegionAmbiguousError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as BOOTSTRAP_MARKER_PREFIX, xr as CrossAccountSecretRefusalError, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as stripControlChars, yr as CdkdError, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as AssetManifestLoader, zt as applyRoleArnIfSet } from "./deploy-engine-CSBoL-Az.js";
-import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-Dz3Le2Pw.js";
+import { $ as DEFAULT_STATE_PREFIX, $n as warnDeprecatedNoPrefixCliFlag, $t as maskSecretsInError, A as bold, An as buildDenyExternalAccessPolicy, Ar as NestedStackChildDirectDestroyError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as getDockerImageBySourceHash, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as ensureAssetStorage, Cr as DeployCancelledError, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as readBootstrapMarkerBody, Dr as LocalStartServiceError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as parseBootstrapMarker, Er as LocalMigrateError, Et as configStringRefusal, F as yellow, Fn as getDockerCmd, Fr as StackHasActiveImportsError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as resolveApp, Gr as isThrottlingError, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as synthesisStatusMessage, Hr as withErrorHandling, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as partitionSensitiveEnv, Ir as StackTerminationProtectionError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveSkipPrefix, Jr as markRedactedCause, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as resolveAutoAssetStorage, Kr as isTransientServerError, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as runDockerForeground, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDockerImage, Mr as ProvisioningError, Mt as classifyReplaySecretRegion, N as green, Nn as dockerSpawnEnvWithSensitive, Nr as ResourceTimeoutError, Nt as producerRegionsFromState, O as renderStatefulReason, On as validateAssetBucketName, Ot as replayWarn, P as red, Pn as formatDockerLoginError, Pr as ResourceUpdateNotSupportedError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as stateBucketExistenceConfirmed, Qt as isSingleDynamicReferenceToken, R as exportAliasCollisionScrubWarning, Rn as runDockerStreaming, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as assertAssetBucketRegion, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as isCrossRegionRedirect, Tr as LocalInvokeBuildError$1, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as getDefaultStateBucketName, Ur as isMarkedNonRetryable, Ut as withRetry, V as stateKeySecretExposure, Vn as Synthesizer, Vr as normalizeAwsError, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as getLegacyStateBucketName, Wr as isRetryableTransientError, Wt as DagBuilder, X as maskDeep, Xn as resolveStateBucketWithDefaultAndSource, Xt as dynamicReferenceTokens, Y as createMaskedRetryLogger, Yn as resolveStateBucketWithDefault, Yr as retryClassificationText, Yt as createSecretMasker, Z as maskerOrIdentity, Zn as resolveUseCdkBootstrapAssets, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as rewriteTemplateAssetReferences, _r as setAwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as S3StateBackend, ar as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as AssetModeResolver, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as importableOutputKeys, cr as canonicalizeRegion, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as AssetPublisher, dr as processStackMessages, dt as isTerminationProtectionPropagationError, en as maskSecretsInText, er as CFN_TEMPLATE_BODY_LIMIT, et as beginCommandInterruptScope, f as withResourceDeadline, fn as stringifyValue, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as loadPublishableAssetManifest, gr as resetAwsClients, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as createAssetRedirectResolver, hr as getAwsClients, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as displaySafe, ir as uploadCfnTemplate, it as startInterruptWatch, j as cyan, jn as describeAwsFailure, jr as PartialFailureError, jt as requireConfigString, k as formatResourceLine, kn as validateContainerRepoName, kr as MissingCdkCliError, kt as requireConfigArray, l as replayRollback, ln as importableOutputs, lr as derivePartitionAndUrlSuffix, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildAssetRedirectMap, mr as AwsClients, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as scrubResourceRecord, nr as MIGRATE_TMP_PREFIX, nt as interruptWatchListenerCount, o as planFailedOps, on as rebuildClientForBucketRegion, or as expectedOwnerParam, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as WorkGraph, pr as resolveBucketRegion, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveCaptureObservedState, qr as markNonRetryable, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as LockManager, rr as findLargeInlineResources, rt as isInterruptedWaitError, s as planRollback, sn as exportNamesCarriedFrom, sr as PARTITION_TABLE, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as redactSecretsForState, tr as CFN_TEMPLATE_URL_LIMIT, tt as endCommandInterruptScope, u as updatePartialMessage, un as shouldRetainResource, ur as AssemblyReader, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as escapeRegExp, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as getBootstrapMarkerKey, wr as DynamicReferenceRegionAmbiguousError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as BOOTSTRAP_MARKER_PREFIX, xr as CrossAccountSecretRefusalError, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as stripControlChars, yr as CdkdError, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as AssetManifestLoader, zt as applyRoleArnIfSet } from "./deploy-engine-BgpCWFvY.js";
+import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-DyTk5GeO.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-neBHYAq9.js";
-import { t as ASGProvider } from "./asg-provider-BBSPZtne.js";
+import { t as getCdkdVersion } from "./version-De6foYg3.js";
+import { t as ASGProvider } from "./asg-provider-DsyALMVT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1810,6 +1810,7 @@ function countDeployableResources(template) {
 async function synthCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	reserveStdoutForPayload();
 	warnIfDeprecatedRegion(options);
 	foldRegionOption(options);
 	await applyRoleArnIfSet({
@@ -1948,7 +1949,7 @@ function toLongRecord(stack, includeDeps) {
 async function listCommand(patterns, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	if (options.json) reserveStdoutForPayload();
+	reserveStdoutForPayload();
 	warnIfDeprecatedRegion(options);
 	foldRegionOption(options);
 	await applyRoleArnIfSet({
@@ -81137,8 +81138,15 @@ var DockerRunnerError = class DockerRunnerError extends Error {
 * Pull the image. No-op when `skipPull` is true.
 *
 * In verbose mode (`--verbose` / global log level `debug`), streams the
-* full `docker pull` progress to stdout so the user sees per-layer
-* downloads. In the default compact mode the call is silent (cached
+* full `docker pull` progress live so the user sees per-layer downloads.
+* NOT necessarily to stdout: on a command holding a payload reservation --
+* which `cdkd local invoke` and `cdkd local invoke-agentcore` both do, and
+* both reach this function -- the child's fd 1 is redirected to stderr by
+* `spawnForeground` (`src/utils/docker-cmd.ts`, issue
+* [#2410](https://github.com/go-to-k/cdkd/issues/2410)), so the progress
+* lands there instead. Do not build on the fd-1 assumption; that is the one
+* this file's own leak was made of. In the default compact mode the call is
+* silent (cached
 * images are the common case; a fresh pull still shows progress only
 * via `--verbose`). Errors are always surfaced: the captured stderr is
 * folded into the thrown `DockerRunnerError` message.
@@ -85844,6 +85852,7 @@ function parseTimeoutMs(raw) {
 async function localInvokeAgentCoreCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	reserveStdoutForPayload();
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	if (options.stackRegion !== void 0) {
@@ -85964,6 +85973,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 			emitA2aResult(a2a);
 		} else if (options.ws) {
 			const interactive = process.stdin.isTTY === true;
+			const promptOnStdout = interactive && process.stdout.isTTY === true;
 			if (watchActive) await runAgentCoreWatchLoop({
 				containerHost,
 				hostPort,
@@ -85979,7 +85989,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 					const wsResult = await invokeAgentCoreWs(containerHost, port, event, {
 						sessionId,
 						timeoutMs: options.timeout,
-						onMessage: wrapWsOnMessage((text) => process.stdout.write(text), interactive),
+						onMessage: wrapWsOnMessage((text) => process.stdout.write(text), promptOnStdout),
 						abortSignal,
 						...authorization && { authorization },
 						...frameSource && { frameSource }
@@ -86034,7 +86044,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 				const wsResult = await invokeAgentCoreWs(containerHost, hostPort, event, {
 					sessionId,
 					timeoutMs: options.timeout,
-					onMessage: wrapWsOnMessage((text) => process.stdout.write(text), interactive),
+					onMessage: wrapWsOnMessage((text) => process.stdout.write(text), promptOnStdout),
 					...authorization && { authorization },
 					...frameSource && { frameSource }
 				});
@@ -86857,17 +86867,22 @@ const WS_REPL_PROMPT = "> ";
 * `/ws` endpoint behaves the same. That's correct on the wire but visually
 * run-on in an interactive terminal — the user's next keystroke concatenates
 * onto the last frame's tail char and they have no signal that the REPL is
-* waiting for input. In interactive mode we append `\n` (unless already
+* waiting for input. When the prompt is on, we append `\n` (unless already
 * present) and then write a `> ` prompt, so each agent message is presented as
 * its own line and the next input prompt is visible.
 *
-* Non-interactive (piped / CI) is unchanged — the raw stdout shape is what
-* scripts rely on, and the WS-protocol-faithful pass-through stays.
+* The gate is `promptOnStdout` — stdin a TTY AND stdout a TTY — not stdin
+* alone (issue [#2410](https://github.com/go-to-k/cdkd/issues/2410)). Reading
+* follow-up frames from stdin is a stdin question and keeps its own check at
+* the call site; writing a prompt is a STDOUT question, and stdout is this
+* command's payload stream. With a REDIRECTED stdout the raw
+* WS-protocol-faithful pass-through is what a consumer parses, so a terminal
+* stdin no longer drags a `> ` into it.
 *
 * Exported so a unit test can drive the wrapping without the full WS pipeline.
 */
-function wrapWsOnMessage(sink, interactive) {
-	if (!interactive) return sink;
+function wrapWsOnMessage(sink, promptOnStdout) {
+	if (!promptOnStdout) return sink;
 	return (text) => {
 		sink(text.endsWith("\n") ? text : `${text}\n`);
 		sink("> ");
@@ -87071,6 +87086,7 @@ const CDKD_EMBED_CONFIG = {
 async function localInvokeCommand(target, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	reserveStdoutForPayload();
 	warnIfDeprecatedRegion(options);
 	if (options.region !== void 0) options.region = canonicalizeRegion(options.region);
 	if (options.stackRegion !== void 0) {
@@ -89022,4 +89038,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Def0C7JX.js.map
+//# sourceMappingURL=program-cjSJf49d.js.map