@go-to-k/cdkd 0.285.9 → 0.285.11

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Br as StateError, Bt as DiffCalculator, Cr as ConfigError, Fr as ProvisioningError, Gt as TemplateParser, Hr as formatError, K as ProviderRegistry, Sr as CdkdError, Tr as DependencyError, U as IAMRoleProvider, Un as Synthesizer, Ur as isCdkdError, Vr as SynthesisError, Wr as normalizeAwsError, Wt as DagBuilder, _r as AwsClients, at as CloudControlProvider, br as setAwsClients, gr as resolveBucketRegion, hr as clearBucketRegionCache, jr as LockError, on as LockManager, pn as AssetPublisher, pr as AssemblyReader, r as DeployEngine, sn as S3StateBackend, vr as getAwsClients, xr as AssetError, yr as resetAwsClients } from "./deploy-engine-BhBR2d3w.js";
+import { Br as StateError, Bt as DiffCalculator, Cr as ConfigError, Fr as ProvisioningError, Gt as TemplateParser, Hr as formatError, K as ProviderRegistry, Sr as CdkdError, Tr as DependencyError, U as IAMRoleProvider, Un as Synthesizer, Ur as isCdkdError, Vr as SynthesisError, Wr as normalizeAwsError, Wt as DagBuilder, _r as AwsClients, at as CloudControlProvider, br as setAwsClients, gr as resolveBucketRegion, hr as clearBucketRegionCache, jr as LockError, on as LockManager, pn as AssetPublisher, pr as AssemblyReader, r as DeployEngine, sn as S3StateBackend, vr as getAwsClients, xr as AssetError, yr as resetAwsClients } from "./deploy-engine-CJdl4I5l.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Dw-3y48G.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-B9vnKc3N.js → program-BeYoZQIP.js}

@@ -1,8 +1,8 @@
-import { $ as DEFAULT_STATE_PREFIX, $n as resolveUseCdkBootstrapAssets, $t as isSingleDynamicReferenceToken, A as bold, An as validateAssetBucketName, Ar as LocalStartServiceError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as runDockerStreaming, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as BOOTSTRAP_MARKER_PREFIX, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as isCrossRegionRedirect, Dr as DynamicReferenceRegionAmbiguousError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as getBootstrapMarkerKey, Er as DeployCancelledError, Et as configStringRefusal, F as yellow, Fn as dockerSpawnEnvWithSensitive, Fr as ProvisioningError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as getDefaultStateBucketName, Gr as withErrorHandling, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDockerImageBySourceHash, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as formatDockerLoginError, Ir as ResourceTimeoutError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveAutoAssetStorage, Jr as isThrottlingError, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as getLegacyStateBucketName, Kr as isMarkedNonRetryable, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as getDockerCmd, Lr as ResourceUpdateNotSupportedError, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDenyExternalAccessPolicy, Mr as MissingCdkCliError, Mt as classifyReplaySecretRegion, N as green, Nn as describeAwsFailure, Nr as NestedStackChildDirectDestroyError, Nt as producerRegionsFromState, O as renderStatefulReason, On as parseBootstrapMarker, Or as LocalInvokeBuildError$1, Ot as replayWarn, P as red, Pn as buildDockerImage, Pr as PartialFailureError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as resolveStateBucketWithDefaultAndSource, Qr as retryClassificationText, Qt as errorCauseChain, R as exportAliasCollisionScrubWarning, Rn as partitionSensitiveEnv, Rr as StackHasActiveImportsError, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as AssetModeResolver, Sr as CdkdError, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as ensureAssetStorage, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as Synthesizer, Ut as withRetry, V as stateKeySecretExposure, Vn as AssetManifestLoader, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as synthesisStatusMessage, Wr as normalizeAwsError, Wt as DagBuilder, X as maskDeep, Xn as resolveSkipPrefix, Xr as markNonRetryable, Xt as createSecretMasker, Y as createMaskedRetryLogger, Yn as resolveCaptureObservedState, Yr as isTransientServerError, Yt as carriesSecretMask, Z as maskerOrIdentity, Zn as resolveStateBucketWithDefault, Zr as markRedactedCause, Zt as dynamicReferenceTokens, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as createAssetRedirectResolver, _r as AwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as scrubResourceRecord, ar as findLargeInlineResources, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as escapeRegExp, br as setAwsClients, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as rebuildClientForBucketRegion, cr as displaySafe, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as importableOutputs, dr as canonicalizeRegion, dt as isTerminationProtectionPropagationError, en as maskSecretsInError, er as stateBucketExistenceConfirmed, et as beginCommandInterruptScope, f as withResourceDeadline, fn as shouldRetainResource, fr as derivePartitionAndUrlSuffix, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as buildAssetRedirectMap, gr as resolveBucketRegion, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as WorkGraph, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as redactSecretsForState, ir as MIGRATE_TMP_PREFIX, it as startInterruptWatch, j as cyan, jn as validateContainerRepoName, jt as requireConfigString, k as formatResourceLine, kn as readBootstrapMarkerBody, kr as LocalMigrateError, kt as requireConfigArray, l as replayRollback, ln as exportNamesCarriedFrom, lr as expectedOwnerParam, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as stringifyValue, mr as processStackMessages, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as recordMaskOnlyValue, nr as CFN_TEMPLATE_BODY_LIMIT, nt as interruptWatchListenerCount, o as planFailedOps, on as LockManager, or as uploadCfnTemplate, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as AssetPublisher, pr as AssemblyReader, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveApp, qr as isRetryableTransientError, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as recoverMaskedOutput, rr as CFN_TEMPLATE_URL_LIMIT, rt as isInterruptedWaitError, s as planRollback, sn as S3StateBackend, sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as maskSecretsInText, tr as warnDeprecatedNoPrefixCliFlag, tt as endCommandInterruptScope, u as updatePartialMessage, un as importableOutputKeys, ur as PARTITION_TABLE, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as loadPublishableAssetManifest, vr as getAwsClients, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as assertAssetBucketRegion, wr as CrossAccountSecretRefusalError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as stripControlChars, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as rewriteTemplateAssetReferences, yr as resetAwsClients, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as runDockerForeground, zr as StackTerminationProtectionError, zt as applyRoleArnIfSet } from "./deploy-engine-BhBR2d3w.js";
+import { $ as DEFAULT_STATE_PREFIX, $n as resolveUseCdkBootstrapAssets, $t as isSingleDynamicReferenceToken, A as bold, An as validateAssetBucketName, Ar as LocalStartServiceError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as runDockerStreaming, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as BOOTSTRAP_MARKER_PREFIX, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as isCrossRegionRedirect, Dr as DynamicReferenceRegionAmbiguousError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as getBootstrapMarkerKey, Er as DeployCancelledError, Et as configStringRefusal, F as yellow, Fn as dockerSpawnEnvWithSensitive, Fr as ProvisioningError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as getDefaultStateBucketName, Gr as withErrorHandling, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDockerImageBySourceHash, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as formatDockerLoginError, Ir as ResourceTimeoutError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveAutoAssetStorage, Jr as isThrottlingError, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as getLegacyStateBucketName, Kr as isMarkedNonRetryable, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as getDockerCmd, Lr as ResourceUpdateNotSupportedError, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDenyExternalAccessPolicy, Mr as MissingCdkCliError, Mt as classifyReplaySecretRegion, N as green, Nn as describeAwsFailure, Nr as NestedStackChildDirectDestroyError, Nt as producerRegionsFromState, O as renderStatefulReason, On as parseBootstrapMarker, Or as LocalInvokeBuildError$1, Ot as replayWarn, P as red, Pn as buildDockerImage, Pr as PartialFailureError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as resolveStateBucketWithDefaultAndSource, Qr as retryClassificationText, Qt as errorCauseChain, R as exportAliasCollisionScrubWarning, Rn as partitionSensitiveEnv, Rr as StackHasActiveImportsError, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as AssetModeResolver, Sr as CdkdError, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as ensureAssetStorage, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as Synthesizer, Ut as withRetry, V as stateKeySecretExposure, Vn as AssetManifestLoader, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as synthesisStatusMessage, Wr as normalizeAwsError, Wt as DagBuilder, X as maskDeep, Xn as resolveSkipPrefix, Xr as markNonRetryable, Xt as createSecretMasker, Y as createMaskedRetryLogger, Yn as resolveCaptureObservedState, Yr as isTransientServerError, Yt as carriesSecretMask, Z as maskerOrIdentity, Zn as resolveStateBucketWithDefault, Zr as markRedactedCause, Zt as dynamicReferenceTokens, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as createAssetRedirectResolver, _r as AwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as scrubResourceRecord, ar as findLargeInlineResources, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as escapeRegExp, br as setAwsClients, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as rebuildClientForBucketRegion, cr as displaySafe, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as importableOutputs, dr as canonicalizeRegion, dt as isTerminationProtectionPropagationError, en as maskSecretsInError, er as stateBucketExistenceConfirmed, et as beginCommandInterruptScope, f as withResourceDeadline, fn as shouldRetainResource, fr as derivePartitionAndUrlSuffix, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as buildAssetRedirectMap, gr as resolveBucketRegion, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as WorkGraph, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as redactSecretsForState, ir as MIGRATE_TMP_PREFIX, it as startInterruptWatch, j as cyan, jn as validateContainerRepoName, jt as requireConfigString, k as formatResourceLine, kn as readBootstrapMarkerBody, kr as LocalMigrateError, kt as requireConfigArray, l as replayRollback, ln as exportNamesCarriedFrom, lr as expectedOwnerParam, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as stringifyValue, mr as processStackMessages, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as recordMaskOnlyValue, nr as CFN_TEMPLATE_BODY_LIMIT, nt as interruptWatchListenerCount, o as planFailedOps, on as LockManager, or as uploadCfnTemplate, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as AssetPublisher, pr as AssemblyReader, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveApp, qr as isRetryableTransientError, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as recoverMaskedOutput, rr as CFN_TEMPLATE_URL_LIMIT, rt as isInterruptedWaitError, s as planRollback, sn as S3StateBackend, sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as maskSecretsInText, tr as warnDeprecatedNoPrefixCliFlag, tt as endCommandInterruptScope, u as updatePartialMessage, un as importableOutputKeys, ur as PARTITION_TABLE, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as loadPublishableAssetManifest, vr as getAwsClients, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as assertAssetBucketRegion, wr as CrossAccountSecretRefusalError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as stripControlChars, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as rewriteTemplateAssetReferences, yr as resetAwsClients, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as runDockerForeground, zr as StackTerminationProtectionError, zt as applyRoleArnIfSet } from "./deploy-engine-CJdl4I5l.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BWsyP2sq.js";
-import { t as ASGProvider } from "./asg-provider-hNkWDuAJ.js";
+import { t as getCdkdVersion } from "./version-CHHsJMqE.js";
+import { t as ASGProvider } from "./asg-provider--XFrKRbw.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -42,6 +42,7 @@ import { Command, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import { writeFileSync as writeFileSync$1 } from "fs";
+import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
@@ -52,7 +53,7 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBCluster
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
-import { parse, print } from "graphql";
+import { parse as parse$1, print } from "graphql";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
@@ -69,7 +70,6 @@ import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand a
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23 } from "@aws-sdk/client-s3-control";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24 } from "@aws-sdk/client-s3tables";
-import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
 import { createServer } from "node:net";
@@ -1749,47 +1749,205 @@ function createBootstrapCommand() {
 //#endregion
 //#region src/utils/yaml.ts
 /**
-* Simple JSON to YAML converter (CDK CLI compatible output)
+* JSON to YAML rendering (CDK CLI compatible output)
 *
 * Used by `synth` (CloudFormation template) and `list` (long output) for
-* human-friendly YAML rendering. Matches the quoting style of CDK CLI:
-* single-quote JSON-like / multi-line strings, double-quote strings whose
-* literal content collides with YAML scalar keywords.
-*/
-function toYaml(obj, indent = 0) {
-	const prefix = "  ".repeat(indent);
-	if (obj === null || obj === void 0) return "null\n";
-	if (typeof obj === "boolean") return `${obj}\n`;
-	if (typeof obj === "number") return `"${obj}"\n`;
-	if (typeof obj === "string") {
-		if (obj.includes("\n")) return `'${obj.replace(/'/g, "''")}'\n`;
-		if (obj.startsWith("{") || obj.startsWith("[") || obj.startsWith("\"")) return `'${obj.replace(/'/g, "''")}'\n`;
-		if (obj.includes("#") || obj === "" || obj === "true" || obj === "false" || obj === "null") return `"${obj}"\n`;
-		return `${obj}\n`;
-	}
-	if (Array.isArray(obj)) {
-		if (obj.length === 0) return "[]\n";
-		let result = "\n";
-		for (const item of obj) {
-			const value = toYaml(item, indent + 1).trimStart();
-			result += `${prefix}- ${value}`;
-		}
+* human-friendly YAML rendering.
+*
+* Issue [#2421](https://github.com/go-to-k/cdkd/issues/2421): this was a
+* hand-rolled emitter whose "needs quoting" predicate covered four cases (an
+* embedded newline, a leading `{` / `[` / `"`, and the literals containing
+* `#` / empty / `true` / `false` / `null`). Every other YAML indicator was
+* emitted bare, so `AllowedOrigins: ['*']` rendered as `- *` — an alias node,
+* which a parser rejects with `BAD_ALIAS`. `cdkd synth` writes this output to
+* stdout, so `cdkd synth | yq` failed on the repo's own minimal fixture.
+*
+* The fix is a change of INSTRUMENT rather than a wider predicate: quoting a
+* YAML scalar correctly is a solved problem with an unbounded number of
+* spellings to get wrong one at a time, and the `yaml` package is already a
+* runtime dependency — the same library the AWS CDK CLI does this job with
+* (`@aws-cdk/toolkit-lib/lib/util/yaml-cfn.ts`: `yaml.stringify(obj, {
+* schema: 'yaml-1.1' })` at fold width 0). So "CDK CLI compatible" is now
+* produced by the library CDK CLI uses rather than approximated. The SCHEMA
+* differs from CDK CLI's deliberately; `EMIT_OPTIONS` below carries the
+* measurement and the reason, including the one input class whose rendering
+* that choice does change.
+*
+* Measured consequence on `tests/integration/basic` (2026-09-03): of 182
+* lines, only the defect and its mirror move — `- *` becomes `- "*"`, numbers
+* stop being emitted as strings (`ExpirationInDays: 90`, not `"90"`), numeric
+* STRINGS start being quoted (`schemaVersion: "2.2"`), and the document no
+* longer opens with a blank line. Indentation, key order and sequence style
+* are byte-identical to the hand-rolled output.
+*
+* One further contract change, recorded because it is silent rather than
+* because it is reachable: an `undefined` OBJECT VALUE is now OMITTED
+* (`{ a: undefined, b: 1 }` renders `b: 1`) where the hand-rolled emitter
+* wrote `a: null`. That matches what `JSON.stringify` does, so the YAML and
+* `--json` spellings of `cdkd list` agree, and neither consumer can produce
+* one today — `synth` passes assembly JSON, and `list`'s record is built with
+* `??` defaults.
+*
+* NOT the same job as `src/cli/yaml-cfn.ts`, which emits CFn intrinsics as
+* shorthand tags (`!Ref`) for `cdkd export` / `import`. `cdk synth` prints
+* the long form (`Fn::GetAtt`), and so does this.
+*/
+/**
+* The emit options, and the READERS the output has to survive.
+*
+* The correctness here comes from `READER_SCHEMAS` — the oracle below quotes
+* anything EITHER reader would hand back changed — and NOT from the emitting
+* schema. That split matters, because neither schema resolves a superset of
+* the other:
+*
+* - 1.2 core added `0o` octal, for which 1.1 has no resolver, so `'0o17'`
+*   emitted bare under 1.1 would come back as the number 15 from a default
+*   reader — the finding that produced this oracle, and the reason the list
+*   is a list. It is currently INERT, because emitting under `core` means the
+*   library has already applied core's own resolvers: measured, dropping
+*   `'core'` from this list reds nothing while dropping `'yaml-1.1'` reds. It
+*   stays because the emit schema has already moved once in this file's
+*   history, and this list is what would keep the guarantee standing if it
+*   moves again;
+* - 1.1 resolves `yes` / `no` / `on` / `off` and timestamps, which 1.2 leaves
+*   alone, so those must be quoted for `yq`'s sake even though a 1.2 reader
+*   would not have re-typed them.
+*
+* Emitting under `core` rather than the CDK CLI's `yaml-1.1` is therefore a
+* deliberate choice and not a drift from parity, because 1.1 carries one tag
+* that DEFEATS the oracle: `<<` is the MERGE key, and its tag's `stringify`
+* returns the literal `<<` while ignoring the node's style, so the
+* `QUOTE_DOUBLE` the oracle sets on that key is silently discarded and
+* `{'<<': 'v'}` still emits `<<: v` — which a 1.1 reader rejects with `Merge
+* sources must be maps`. Under `core` there is no merge tag, the forced
+* quotes survive, and the output is `"<<": v`.
+*
+* Parity is preserved in fact rather than by the option name, and it was
+* MEASURED rather than argued (2026-09-03): with the oracle in place, both
+* this repo's real templates — `tests/integration/basic` and
+* `tests/integration/local-invoke` — render BYTE-IDENTICALLY under the two
+* schemas, as does every probe tried except `<<` itself. What changes is only
+* which layer does the quoting: under `core` the library emits `yes` bare and
+* the oracle quotes it; under 1.1 the library quoted it directly.
+*
+* This was found by a review round, after a first cut had `yaml-1.1` here and
+* a test suite that could not see the difference — the four-position
+* round-trip loop parses under 1.2, where `<<:` is an ordinary key, and the
+* 1.1 arm covered only the map-VALUE position. Both now run all four
+* positions under both readers.
+*/
+const EMIT_OPTIONS = {
+	schema: "core",
+	lineWidth: 0,
+	aliasDuplicateObjects: false
+};
+const READER_SCHEMAS = ["yaml-1.1", "core"];
+/**
+* The oracle PARSES, and a parse can warn as well as throw — so the probe
+* reads have to be silenced or the probe becomes an output side effect.
+*
+* Measured: a date-shaped map KEY emits bare under `core`, and probing it
+* under the 1.1 reader resolves it to a `Date`, at which point `yaml` calls
+* `process.emitWarning` (`Keys with collection values will be stringified`).
+* That reached the real stderr — 254 bytes on a GREEN unit run, against this
+* repo's "a green run must print nothing" rule, and on `cdkd synth` for any
+* template carrying such a key. The oracle only ever reads the parsed VALUE,
+* so it has no use for the diagnostics.
+*
+* `silent` is NOT diagnostics-only, though, and the difference is recorded
+* here because it changes what the `catch`es below mean. `parse` re-throws
+* `doc.errors[0]` only when the level is not `silent` (`yaml`'s
+* `public-api.js`), so under it a `DUPLICATE_KEY` / `TAB_AS_INDENT` /
+* `BLOCK_AS_IMPLICIT_KEY` document RETURNS a partially-composed value instead
+* of throwing. The oracle's answer is unaffected — it degrades "threw" into
+* "came back different", which is the same `false` — and that was measured
+* rather than argued: over a 91,033-string corpus in review, 0 verdicts flip,
+* and of the 487 strings whose emission fails a loud parse, none has a silent
+* parse returning the ORIGINAL value, which is the only shape that could
+* produce a wrong `true`.
+*
+* What still throws under `silent` is a `toJS`-time error, because that runs
+* AFTER the error check — which is exactly the `<<` merge failure the key
+* oracle depends on. Verified: `parse('<<: v', { schema: 'yaml-1.1',
+* logLevel: 'silent' })` still raises `Merge sources must be maps`.
+*/
+const READER_OPTIONS = { logLevel: "silent" };
+/**
+* Templates repeat their scalars heavily (`AWS::S3::Bucket`, a region, a
+* logical id), and each miss costs one emit plus one parse per reader. Keyed
+* by the exact string, and the wrapped predicates are pure functions of it.
+*/
+function memoize(fn) {
+	const cache = /* @__PURE__ */ new Map();
+	return (value) => {
+		const hit = cache.get(value);
+		if (hit !== void 0) return hit;
+		const result = fn(value);
+		cache.set(value, result);
 		return result;
-	}
-	if (typeof obj === "object") {
-		const entries = Object.entries(obj);
-		if (entries.length === 0) return "{}\n";
-		let result = "\n";
-		for (const [key, value] of entries) {
-			const safeKey = key.includes(" ") ? `"${key}"` : key;
-			const isContainer = typeof value === "object" && value !== null;
-			const isEmptyContainer = isContainer && (Array.isArray(value) ? value.length === 0 : Object.keys(value).length === 0);
-			if (isContainer && !isEmptyContainer) result += `${prefix}${safeKey}:${toYaml(value, indent + 1)}`;
-			else result += `${prefix}${safeKey}: ${toYaml(value, indent + 1).trimStart()}`;
+	};
+}
+/**
+* Would this string, emitted plain, come back as the same string from EVERY
+* reader above?
+*
+* The library answers it, for both resolvers, rather than a predicate spelled
+* out here. The defect being fixed WAS a hand-written must-quote list missing
+* entries, and a second list with two more entries on it is the same artifact
+* with the same failure mode; asking whether the value survives the trip has
+* no spellings to miss.
+*
+* There are two of these because position decides the question. A string can
+* be special as a KEY while ordinary as a value: `<<` is the merge key under
+* 1.1, so `{'<<': 'v'}` emitted plain makes a 1.1 reader fail with `Merge
+* sources must be maps`, while a bare `<<` in value position is just a
+* string.
+*/
+const valueRoundTripsPlain = memoize((value) => {
+	const emitted = stringify(value, EMIT_OPTIONS);
+	return READER_SCHEMAS.every((schema) => {
+		try {
+			return parse(emitted, {
+				schema,
+				...READER_OPTIONS
+			}) === value;
+		} catch {
+			return false;
 		}
-		return result;
-	}
-	return `${stringifyValue(obj)}\n`;
+	});
+});
+const keyRoundTripsPlain = memoize((key) => {
+	const probe = "cdkd-probe";
+	const emitted = stringify({ [key]: probe }, EMIT_OPTIONS);
+	return READER_SCHEMAS.every((schema) => {
+		let back;
+		try {
+			back = parse(emitted, {
+				schema,
+				...READER_OPTIONS
+			});
+		} catch {
+			return false;
+		}
+		if (back === null || typeof back !== "object" || Array.isArray(back)) return false;
+		const record = back;
+		const keys = Object.keys(record);
+		return keys.length === 1 && keys[0] === key && record[key] === probe;
+	});
+});
+function toYaml(obj) {
+	const doc = new Document(obj, EMIT_OPTIONS);
+	visit(doc, {
+		Scalar(key, node) {
+			if (key === "key") return;
+			if (typeof node.value === "string" && !valueRoundTripsPlain(node.value)) node.type = Scalar.QUOTE_DOUBLE;
+		},
+		Pair(_, pair) {
+			const { key } = pair;
+			if (isScalar(key) && typeof key.value === "string" && !keyRoundTripsPlain(key.value)) key.type = Scalar.QUOTE_DOUBLE;
+		}
+	});
+	return doc.toString(EMIT_OPTIONS);
 }
 
 //#endregion
@@ -2010,8 +2168,7 @@ function emitStructured(payload, asJson) {
 		process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
 		return;
 	}
-	const yaml = toYaml(payload).replace(/^\n/, "");
-	process.stdout.write(yaml);
+	process.stdout.write(toYaml(payload));
 }
 /**
 * Create list command
@@ -46518,7 +46675,7 @@ var AppSyncProvider = class {
 	*/
 	canonicalizeSdl(sdl, source) {
 		try {
-			return print(parse(sdl));
+			return print(parse$1(sdl));
 		} catch (err) {
 			this.logger.debug(`Failed to parse ${source} SDL via graphql-js (falling back to raw): ${err instanceof Error ? err.message : String(err)}`);
 			return sdl;
@@ -62816,7 +62973,7 @@ function parseCfnTemplate(text) {
 		throw new Error(`Template is not valid JSON. Cause: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	else try {
-		parsed = parse$1(body, { customTags: CUSTOM_TAGS });
+		parsed = parse(body, { customTags: CUSTOM_TAGS });
 	} catch (err) {
 		throw new Error(`Template is not valid YAML. Cause: ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -75996,10 +76153,6 @@ async function eventsPruneCommand(stackName, options) {
 		const totalRuns = (await reader.listRuns(stackName, targetRegion)).length;
 		const scope = options.all ? `ALL ${totalRuns} run(s)` : options.keep !== void 0 && olderThanMs !== void 0 ? `runs beyond the newest ${options.keep} AND older than ${options.olderThan}` : options.keep !== void 0 ? `runs beyond the newest ${options.keep}` : olderThanMs !== void 0 ? `runs older than ${options.olderThan}` : `runs beyond the newest ${20}`;
 		if (options.yes !== true) {
-			if (!process.stdin.isTTY) {
-				logger.info(gray(`Refusing to prune deployment-event history for ${stackName} (${targetRegion}) without confirmation on a non-interactive terminal. Re-run with --yes to proceed.`));
-				return;
-			}
 			if (!await confirmPrompt$2(`Prune deployment-event history for ${cyan(stackName)} ${gray(`(${targetRegion})`)}: ${scope}?`)) {
 				logger.info(gray("Aborted; nothing was deleted."));
 				return;
@@ -76019,18 +76172,16 @@ async function eventsPruneCommand(stackName, options) {
 		awsClients.destroy();
 	}
 }
-/** Minimal `(y/N)` confirmation prompt. */
+/**
+* Minimal `(y/N)` prune confirmation, delegating to the shared guarded helper.
+*
+* Exported for unit testing, matching the nine siblings issue #2275 folded —
+* `tests/unit/cli/non-interactive-confirm-guards.test.ts` drives each command's
+* wrapper directly, which is how the refusal wording and the never-settling
+* hang fence are checked per site.
+*/
 async function confirmPrompt$2(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd events prune confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the prune, or run the command from a real terminal. Nothing has been deleted." });
 }
 /** Human-readable run listing (newest first). */
 function printRunList(stackName, region, runs) {
@@ -89364,7 +89515,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version(getCdkdVersion());
+	program.name("cdkd").description("Drop-in CDK CLI for existing CDK apps - up to 15x faster deploys via direct AWS SDK calls instead of CloudFormation").version(getCdkdVersion());
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;
@@ -89393,4 +89544,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-B9vnKc3N.js.map
+//# sourceMappingURL=program-BeYoZQIP.js.map