@go-to-k/cdkd 0.286.4 → 0.287.0

package/dist/index.d.ts

@@ -626,11 +626,14 @@ interface ProviderRoutingDecision {
   ccRouteReason?: {
     properties: string[];
   };
+  sdkMigration?: true;
 }
 interface GetProviderForInput {
   resourceType: string;
   properties?: Record<string, unknown> | undefined;
   provisionedBy?: ProvisionedBy | undefined;
+  previousProperties?: Record<string, unknown> | undefined;
+  forceCcApi?: boolean | undefined;
 }
 interface AutoRouteHit {
   logicalId: string;
@@ -678,6 +681,7 @@ declare class ProviderRegistry {
     properties: Record<string, unknown> | undefined;
     provisionedBy?: 'sdk' | 'cc-api' | undefined;
   }>): void;
+  private reportUnrecognizedProperties;
   findAutoRouteHits(resources: Iterable<{
     logicalId: string;
     resourceType: string;
@@ -1084,6 +1088,10 @@ interface DeployEngineOptions {
   };
   inheritedSecrets?: RecordedSecretValues;
   onCurrentStateLoaded?: (stackName: string, state: StackState | undefined) => Promise<void>;
+  pinCcApi?: {
+    stackName: string;
+    logicalIds: ReadonlySet<string>;
+  };
   recreateTargets?: {
     stackName: string;
     viaCcApi: ReadonlySet<string>;
@@ -1159,6 +1167,8 @@ declare class DeployEngine {
   private rollbackExecutorContext;
   private writeRollbackJournalSegment;
   private provisionResource;
+  private isPinnedToCcApi;
+  private recreateDirectionFor;
   private peekRoutingForLabel;
   private recordEvent;
   private maskSecretsInEvent;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAuGY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EAgBA;EAcA;EAYA;EAGA;;UAMe;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EAyBA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UAiFe;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC1fU,uBAAuB;KAi/JvB,gBAAgB;;;UC/gKX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAKf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UC3tC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCkEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UA0EA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cC9VrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAmPC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAsYvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UAwEX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCx0BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MAwDR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UCrrBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UCvSN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC9SO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cCuFE,gCAAgC;UACnC;UACA;UACA;mBAGS;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA2UJ;UAyHA;UA8LA;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAiCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAiDL,OAAO,OAAO,sBAAsB,QAAQ;;;;KCzqFxC;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;;UAUH;EACf;EACA,aAAa;EACb,gBAAgB;;UAQD;EACf;EACA;EACA;;cAuDW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EAWpC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UAmGpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EAqEJ,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UChMY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCHE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC3eZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UCnGe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAsExC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UAIM;UA4EA;UAwBA;UAQA;UAgDN;;;;UCvwCO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCjHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC3PK;EAEf;EASA;;cA2HW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UA4KW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EAmFR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cCj2CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAYlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA2BxC,YAAY,UAAU,kBAAkB;EA2BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC9XA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCzbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EAoBF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,2BACxB,QAAQ,YAAY;UAmRf;UAoJA;iBAkGO;UAsED;UAgCN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCv+BlD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC/5BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAwBG,WAAW,oBAAoB,OAAO,mBAAmB;EAYzD,YAAY,mBAAmB,yBAAyB;UAUhD;EAaR,WAAW;UAcH;UAWA;UAyCA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAQA;UAkBA;UAYA;UA+BN;UAMA;;;;UCreO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EA+C7E;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAoOW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAOA;UASA;UAWA;UAQA;UASA;UAkCA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAmCnE;UAqHA;UAwDA;UAcA;UAiGA;UAqDA;UAwBA;UA8BA;UAkDA;UA2BA;UAkCM;UAgDA;UAsGN;UAoGM;UAsuBA;UA2lBA;UA4EA;UA2BA;UA+BA;UAuCN;UA+BM;UA4CA;UAqSN;UAaA;UAmBA;UAwBA;UAyCM;UA0CA;UAyLA;UA6zDN;UA8BA;UAgCA;UAkCA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UAgBA;UAwCM;UAmSN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAuGY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EAgBA;EAcA;EAYA;EAGA;;UAMe;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UAiFe;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC3gBU,uBAAuB;KAm/JvB,gBAAgB;;;UCjhKX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAKf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UC3tC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCkEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UA0EA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cC9VrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAmPC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAsYvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UAwEX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCx0BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MAwDR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UCrrBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UCvSN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC9SO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cC4FE,gCAAgC;UACnC;UACA;UACA;mBAGS;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA2UJ;UAyHA;UA8LA;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAiCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAiDL,OAAO,OAAO,sBAAsB,QAAQ;;;;KCzqFxC;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;cA8MW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EAWpC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UA+GI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UC5fY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCHE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC3eZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UCnGe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAsExC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UAIM;UA4EA;UAwBA;UAQA;UAgDN;;;;UCvwCO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCjHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC3PK;EAEf;EASA;;cA2HW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UA4KW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EAmFR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cCj2CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAYlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA2BxC,YAAY,UAAU,kBAAkB;EA2BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC9XA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCzbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EAoBF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,2BACxB,QAAQ,YAAY;UAmRf;UAoJA;iBAkGO;UAsED;UAgCN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCv+BlD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC/5BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAwBG,WAAW,oBAAoB,OAAO,mBAAmB;EAYzD,YAAY,mBAAmB,yBAAyB;UAUhD;EAaR,WAAW;UAcH;UAWA;UAyCA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAQA;UAkBA;UAYA;UA+BN;UAMA;;;;UCreO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAmQW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAOA;UASA;UAWA;UAQA;UASA;UAkCA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAmCnE;UAqHA;UAwDA;UAcA;UAiGA;UAqDA;UAwBA;UA8BA;UAkDA;UA2BA;UAkCM;UAgDA;UAsGN;UA0GM;UAsuBA;UA2lBA;UA4EA;UA2BA;UA+BA;UAuCN;UA+BM;UA4CA;UAqUN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAyLA;UA23DN;UA8BA;UAgCA;UAkCA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UAuDA;UAiEM;UAoUN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $r as StateError, Ar as resolveBucketRegion, Cn as AssetPublisher, Dr as AssemblyReader, Fr as AssetError, Gr as LockError, Ir as CdkdError, J as IAMRoleProvider, Jr as ProvisioningError, Jt as TemplateParser, Lr as ConfigError, Mr as getAwsClients, Nr as resetAwsClients, Pr as setAwsClients, Ut as DiffCalculator, Z as ProviderRegistry, ct as CloudControlProvider, ei as SynthesisError, jr as AwsClients, kr as clearBucketRegionCache, ln as LockManager, ni as isCdkdError, qt as DagBuilder, r as DeployEngine, ri as normalizeAwsError, rr as Synthesizer, ti as formatError, un as S3StateBackend, zr as DependencyError } from "./deploy-engine-DylsbAdu.js";
+import { Ar as clearBucketRegionCache, Br as DependencyError, Fr as setAwsClients, Ir as AssetError, J as IAMRoleProvider, Jt as DagBuilder, Kr as LockError, Lr as CdkdError, Mr as AwsClients, Nr as getAwsClients, Or as AssemblyReader, Pr as resetAwsClients, Rr as ConfigError, Wt as DiffCalculator, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, dn as S3StateBackend, ei as StateError, ii as normalizeAwsError, ir as Synthesizer, jr as resolveBucketRegion, lt as CloudControlProvider, ni as formatError, r as DeployEngine, ri as isCdkdError, ti as SynthesisError, un as LockManager, wn as AssetPublisher } from "./deploy-engine-B377YKBI.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Dw-3y48G.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-dEYAo80R.js → program-D2Vykejc.js}

@@ -1,8 +1,8 @@
-import { $ as findSilentDropProperties, $n as escapeRegExp, $t as createSecretMasker, A as WARM_THROUGHPUT_MEMBERS, An as AssetModeResolver, Ar as resolveBucketRegion, At as readConfigString, B as yellow, Bn as buildDenyExternalAccessPolicy, Br as DeployCancelledError, Bt as s3BucketRegionalDomainName, C as unsupportedFinalSnapshotError, Cn as AssetPublisher, Cr as expectedOwnerParam, Ct as WAFv2WebACLProvider, D as isStatefulRecreateTargetForReplace, Dn as createAssetRedirectResolver, Dr as AssemblyReader, Dt as coerceCfnBoolean, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as buildAssetRedirectMap, Er as derivePartitionAndUrlSuffix, Et as assertRegionMatch, F as bold, Fn as isCrossRegionRedirect, Ft as classifyReplaySecretRegion, G as secretBearingStateKeyWarning, Gn as describeDockerFailure, Gt as describeTypeWithThrottleRetry, H as collectPublishedOutputNames, Hn as buildDockerImage, Hr as IntrinsicResolutionRefusalError, Ht as applyRoleArnIfSet, I as cyan, In as parseBootstrapMarker, Ir as CdkdError, It as producerRegionsFromState, J as IAMRoleProvider, Jn as getDockerCmd, Jr as ProvisioningError, Jt as TemplateParser, K as stateKeySecretExposure, Kn as dockerSpawnEnvWithSensitive, Kr as NestedStackChildDirectDestroyError, Kt as withRetry, L as gray, Ln as readBootstrapMarkerBody, Lt as s3BucketArn, M as isWarmThroughputDecrease, Mn as assertAssetBucketRegion, Mr as getAwsClients, Mt as requireConfigArray, N as toFiniteNumber, Nn as ensureAssetStorage, Nr as resetAwsClients, Nt as requireConfigObject, O as isStatefulRecreateTargetSync, On as loadPublishableAssetManifest, Or as processStackMessages, Ot as configBooleanRefusal, P as formatResourceLine, Pn as getBootstrapMarkerKey, Pr as setAwsClients, Pt as requireConfigString, Q as findActionableSilentDrops, Qn as runDockerStreaming, Qr as StackTerminationProtectionError, Qt as carriesSecretMask, R as green, Rn as validateAssetBucketName, Rr as CrossAccountSecretRefusalError, Rt as s3BucketDomainName, S as refusesFinalSnapshot, Sn as shouldRetainResource, Sr as displaySafe, St as refStateLookupFromResource, T as extractDeploymentEventError, Tn as WorkGraph, Tr as canonicalizeRegion, Tt as resolveExplicitPhysicalId, U as exportAliasCollisionScrubWarning, Un as describeDockerCapturedOutput, Ur as LocalInvokeBuildError$1, Ut as DiffCalculator, V as collectDeclaredOutputNames, Vn as describeAwsFailure, Vr as DynamicReferenceRegionAmbiguousError, Vt as s3BucketWebsiteUrl, W as isExportAliasCollision, Wn as describeDockerExecFailure, Wr as LocalStartServiceError, Wt as INTRINSIC_KEYS, X as clearOnUpdateRemoval, Xn as redactDockerArgvValues, Xr as ResourceUpdateNotSupportedError, Xt as STATE_SOURCED_READBACK_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as partitionSensitiveEnv, Yr as ResourceTimeoutError, Yt as STATE_SOURCED_CROSS_GENERATION_RULES, Z as ProviderRegistry, Zn as runDockerForeground, Zr as StackHasActiveImportsError, Zt as TEMPLATE_SOURCED_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as CUSTOM_RESOURCE_RESPONSE_PREFIX, _r as CFN_TEMPLATE_URL_LIMIT, _t as cfnRefValueFromPhysicalId, a as DeploymentEventsStore, ai as isMarkedNonRetryable, an as recordMaskOnlyValue, ar as getDefaultStateBucketName, at as interruptWatchListenerCount, b as createPreDeleteFinalSnapshot, bn as importableOutputKeys, br as uploadCfnTemplate, bt as isUnboundTemplateParameter, c as replayFailedOperations, ci as isTransientServerError, cn as scrubResourceRecord, cr as resolveAutoAssetStorage, ct as CloudControlProvider, d as updatePartialReason, di as retryClassificationText, dn as rebuildClientForBucketRegion, dr as resolveStateBucketWithDefault, dt as deleteIndeterminateGuards, en as dynamicReferenceTokens, er as stripControlChars, et as createMaskedRetryLogger, f as withResourceDeadline, fn as UNRENDERABLE, fr as resolveStateBucketWithDefaultAndSource, ft as deleteSkipReason, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as shellQuote, gr as CFN_TEMPLATE_BODY_LIMIT, gt as carriesDynamicReference, h as computeImplicitDeleteEdges, hn as forceQuitRecoveryClause, hr as warnDeprecatedNoPrefixCliFlag, ht as IntrinsicFunctionResolver, i as DeploymentEventsReader, ii as withErrorHandling, in as maskSecretsInText, ir as synthesisStatusMessage, it as endCommandInterruptScope, j as coerceWarmThroughput$1, jn as BOOTSTRAP_MARKER_PREFIX, jr as AwsClients, jt as replayWarn, k as renderStatefulReason, kn as rewriteTemplateAssetReferences, kt as configStringRefusal, l as replayRollback, li as markNonRetryable, ln as LockManager, lr as resolveCaptureObservedState, lt as slowCcOperationTimeoutMs, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildLockContentionMessage, mr as stateBucketExistenceConfirmed, mt as isTerminationProtectionPropagationError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as isSingleDynamicReferenceToken, nr as getDockerImageBySourceHash, nt as maskerOrIdentity, o as planFailedOps, oi as isRetryableTransientError, on as recoverMaskedOutput, or as getLegacyStateBucketName, ot as isInterruptedWaitError, p as maskingRetryLogger, pn as buildForceUnlockCommand, pr as resolveUseCdkBootstrapAssets, pt as disableInstanceApiTermination, q as getCurrentResourceSecrets, qn as formatDockerLoginError, qr as PartialFailureError, qt as DagBuilder, r as DeployEngine, ri as normalizeAwsError, rn as maskSecretsInError, rr as Synthesizer, rt as beginCommandInterruptScope, s as planRollback, si as isThrottlingError, sn as redactSecretsForState, sr as resolveApp, st as startInterruptWatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as errorCauseChain, tr as AssetManifestLoader, tt as maskDeep, u as updatePartialMessage, ui as markRedactedCause, un as S3StateBackend, ur as resolveSkipPrefix, ut as UNSPECIFIED_SKIP_REASON, v as buildFinalSnapshotIdentifier, vn as DEFAULT_STATE_PREFIX, vr as MIGRATE_TMP_PREFIX, vt as coerceParameterTypedValue, w as makeCanonicalizePropertiesFn, wn as stringifyValue, wr as PARTITION_TABLE, wt as normalizeAwsTagsToCfn, x as isFinalSnapshotError, xn as importableOutputs, xr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, xt as parameterTypeMayLoseSecretIdentity, y as ccRoutedFinalSnapshotError, yn as exportNamesCarriedFrom, yr as findLargeInlineResources, yt as getAccountInfo, z as red, zn as validateContainerRepoName, zt as s3BucketDualStackDomainName } from "./deploy-engine-DylsbAdu.js";
+import { $ as findActionableSilentDrops, $n as runDockerStreaming, $r as StackTerminationProtectionError, $t as carriesSecretMask, A as WARM_THROUGHPUT_MEMBERS, An as rewriteTemplateAssetReferences, At as configStringRefusal, B as yellow, Bn as validateContainerRepoName, Bt as s3BucketDualStackDomainName, C as unsupportedFinalSnapshotError, Cn as shouldRetainResource, Cr as displaySafe, Ct as refStateLookupFromResource, D as isStatefulRecreateTargetForReplace, Dn as buildAssetRedirectMap, Dr as derivePartitionAndUrlSuffix, Dt as assertRegionMatch, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as WorkGraph, Er as canonicalizeRegion, Et as resolveExplicitPhysicalId, F as bold, Fn as getBootstrapMarkerKey, Fr as setAwsClients, Ft as requireConfigString, G as secretBearingStateKeyWarning, Gn as describeDockerExecFailure, Gr as LocalStartServiceError, Gt as INTRINSIC_KEYS, H as collectPublishedOutputNames, Hn as describeAwsFailure, Hr as DynamicReferenceRegionAmbiguousError, Ht as s3BucketWebsiteUrl, I as cyan, In as isCrossRegionRedirect, It as classifyReplaySecretRegion, J as IAMRoleProvider, Jn as formatDockerLoginError, Jr as PartialFailureError, Jt as DagBuilder, K as stateKeySecretExposure, Kn as describeDockerFailure, Kt as describeTypeWithThrottleRetry, L as gray, Ln as parseBootstrapMarker, Lr as CdkdError, Lt as producerRegionsFromState, M as isWarmThroughputDecrease, Mn as BOOTSTRAP_MARKER_PREFIX, Mr as AwsClients, Mt as replayWarn, N as toFiniteNumber, Nn as assertAssetBucketRegion, Nr as getAwsClients, Nt as requireConfigArray, O as isStatefulRecreateTargetSync, On as createAssetRedirectResolver, Or as AssemblyReader, Ot as coerceCfnBoolean, P as formatResourceLine, Pn as ensureAssetStorage, Pr as resetAwsClients, Pt as requireConfigObject, Q as wouldReturnToSdkProvider, Qn as runDockerForeground, Qr as StackHasActiveImportsError, Qt as TEMPLATE_SOURCED_RULES, R as green, Rn as readBootstrapMarkerBody, Rt as s3BucketArn, S as refusesFinalSnapshot, Sn as importableOutputs, Sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, St as parameterTypeMayLoseSecretIdentity, T as extractDeploymentEventError, Tn as stringifyValue, Tr as PARTITION_TABLE, Tt as normalizeAwsTagsToCfn, U as exportAliasCollisionScrubWarning, Un as buildDockerImage, Ur as IntrinsicResolutionRefusalError, Ut as applyRoleArnIfSet, V as collectDeclaredOutputNames, Vn as buildDenyExternalAccessPolicy, Vr as DeployCancelledError, Vt as s3BucketRegionalDomainName, W as isExportAliasCollision, Wn as describeDockerCapturedOutput, Wr as LocalInvokeBuildError$1, Wt as DiffCalculator, X as clearOnUpdateRemoval, Xn as partitionSensitiveEnv, Xr as ResourceTimeoutError, Xt as STATE_SOURCED_CROSS_GENERATION_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as getDockerCmd, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, Zn as redactDockerArgvValues, Zr as ResourceUpdateNotSupportedError, Zt as STATE_SOURCED_READBACK_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shellQuote, _r as CFN_TEMPLATE_BODY_LIMIT, _t as carriesDynamicReference, a as DeploymentEventsStore, ai as withErrorHandling, an as maskSecretsInText, ar as synthesisStatusMessage, at as endCommandInterruptScope, b as createPreDeleteFinalSnapshot, bn as exportNamesCarriedFrom, br as findLargeInlineResources, bt as getAccountInfo, c as replayFailedOperations, ci as isThrottlingError, cn as redactSecretsForState, cr as resolveApp, ct as startInterruptWatch, d as updatePartialReason, di as markRedactedCause, dn as S3StateBackend, dr as resolveSkipPrefix, dt as UNSPECIFIED_SKIP_REASON, en as createSecretMasker, er as escapeRegExp, et as findSilentDropProperties, f as withResourceDeadline, fi as retryClassificationText, fn as rebuildClientForBucketRegion, fr as resolveStateBucketWithDefault, ft as deleteIndeterminateGuards, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as forceQuitRecoveryClause, gr as warnDeprecatedNoPrefixCliFlag, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hn as buildLockContentionMessage, hr as stateBucketExistenceConfirmed, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, ii as normalizeAwsError, in as maskSecretsInError, ir as Synthesizer, it as beginCommandInterruptScope, j as coerceWarmThroughput$1, jn as AssetModeResolver, jr as resolveBucketRegion, jt as readConfigString, k as renderStatefulReason, kn as loadPublishableAssetManifest, kr as processStackMessages, kt as configBooleanRefusal, l as replayRollback, li as isTransientServerError, ln as scrubResourceRecord, lr as resolveAutoAssetStorage, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildForceUnlockCommand, mr as resolveUseCdkBootstrapAssets, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as errorCauseChain, nr as AssetManifestLoader, nt as maskDeep, o as planFailedOps, oi as isMarkedNonRetryable, on as recordMaskOnlyValue, or as getDefaultStateBucketName, ot as interruptWatchListenerCount, p as maskingRetryLogger, pn as UNRENDERABLE, pr as resolveStateBucketWithDefaultAndSource, pt as deleteSkipReason, q as getCurrentResourceSecrets, qn as dockerSpawnEnvWithSensitive, qr as NestedStackChildDirectDestroyError, qt as withRetry, r as DeployEngine, rn as isSingleDynamicReferenceToken, rr as getDockerImageBySourceHash, rt as maskerOrIdentity, s as planRollback, si as isRetryableTransientError, sn as recoverMaskedOutput, sr as getLegacyStateBucketName, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as dynamicReferenceTokens, tr as stripControlChars, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as markNonRetryable, un as LockManager, ur as resolveCaptureObservedState, ut as slowCcOperationTimeoutMs, v as buildFinalSnapshotIdentifier, vn as CUSTOM_RESOURCE_RESPONSE_PREFIX, vr as CFN_TEMPLATE_URL_LIMIT, vt as cfnRefValueFromPhysicalId, w as makeCanonicalizePropertiesFn, wn as AssetPublisher, wr as expectedOwnerParam, wt as WAFv2WebACLProvider, x as isFinalSnapshotError, xn as importableOutputKeys, xr as uploadCfnTemplate, xt as isUnboundTemplateParameter, y as ccRoutedFinalSnapshotError, yn as DEFAULT_STATE_PREFIX, yr as MIGRATE_TMP_PREFIX, yt as coerceParameterTypedValue, z as red, zn as validateAssetBucketName, zr as CrossAccountSecretRefusalError, zt as s3BucketDomainName } from "./deploy-engine-B377YKBI.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CKOnsgg1.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-dBSdt3nB.js";
+import { t as getCdkdVersion } from "./version-Rs7TV7Gz.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-D10GWdiA.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -745,6 +745,32 @@ function parseRecreateViaSdkProviderToken(value, previous) {
 	if (!LOGICAL_ID_FORMAT.test(token)) throw new Error(`Invalid --recreate-via-sdk-provider value "${value}": expected a CloudFormation logical id (alphanumeric, starts with a letter, max 255 chars). One --recreate-via-sdk-provider flag per resource — repeat the flag for additional targets.`);
 	return [...previous ?? [], token];
 }
+/**
+* Issue [#2719] — `--pin-cc-api <logicalId>` keeps a named resource on the
+* Cloud Control route for this deploy, suppressing the `'sdk-coverage'`
+* sticky-exemption that would otherwise return it to its SDK provider.
+*
+* The lightweight counterpart to `--recreate-via-cc-api`: that one forces the
+* CC layer by DESTROYING and recreating the resource, which is not something a
+* user can do to a stateful resource just to decline a routing change. This
+* one changes only which provider runs the update.
+*
+* Deliberately per-deploy rather than a state field. A persisted pin would be
+* a v10 schema bump plus its migration integ, and nothing has yet shown a user
+* needing the pin to survive a deploy they did not pass it on -- the flip is
+* conditioned on the resource's own coverage, so the case it guards against is
+* "I disagree with this specific deploy's routing", not a standing preference.
+*
+* It does NOT override a `'cc-broken'` exemption: honoring it there would pin
+* the resource to a handler that cannot manage it, which is the bug those
+* entries exist to escape.
+*/
+function parsePinCcApiToken(value, previous) {
+	const token = value.trim();
+	if (!LOGICAL_ID_FORMAT.test(token)) throw new Error(`Invalid --pin-cc-api value "${value}": expected a CloudFormation logical id (alphanumeric, starts with a letter, max 255 chars). One --pin-cc-api flag per resource — repeat the flag for additional targets.`);
+	return [...previous ?? [], token];
+}
+const pinCcApiOption = new Option("--pin-cc-api <logicalId>", "Keep the named resource (by CloudFormation logical id) on the Cloud Control route in this deploy, declining the automatic return to the SDK Provider that a type-level sdk-coverage exemption would otherwise apply to a resource recorded as provisionedBy: cc-api. Repeatable — pass the flag once per resource. Has no effect on a resource already on the SDK path, and does not override an exemption admitted because Cloud Control cannot manage the type.").argParser(parsePinCcApiToken);
 const recreateViaSdkProviderOption = new Option("--recreate-via-sdk-provider <logicalId>", "Destroy + recreate the named resource (by CloudFormation logical id) via cdkd's SDK Provider in this deploy, so a resource currently sticky on provisionedBy: cc-api flips back to provisionedBy: sdk. Used after a #609 backfill release adds SDK coverage for a type the user originally needed CC for (e.g. Lambda LoggingConfig). Repeatable — pass the flag once per resource. Per-resource opt-in. Stateful resource types refuse unless --force-stateful-recreation is ALSO passed.").argParser(parseRecreateViaSdkProviderToken);
 /**
 * Issue [#615] — `--force-stateful-recreation` (boolean) confirms a
@@ -874,6 +900,7 @@ const deployOptions = [
 	allowUnsupportedPropertiesOption,
 	recreateViaCcApiOption,
 	recreateViaSdkProviderOption,
+	pinCcApiOption,
 	forceStatefulRecreationOption,
 	replaceOption,
 	useCdkBootstrapAssetsOption,
@@ -3145,6 +3172,32 @@ async function promptRecreateConfirm(input) {
 	}
 }
 
+//#endregion
+//#region src/cli/commands/pin-cc-api-reachability.ts
+function analyzePinCcApiReachability(pinnedLogicalIds, stacks) {
+	const idSets = stacks.map((s) => ({
+		stackName: s.stackName,
+		ids: new Set(s.logicalIds)
+	}));
+	const unmatched = [];
+	const partial = [];
+	for (const logicalId of [...new Set(pinnedLogicalIds)]) {
+		const appliesTo = idSets.filter((t) => t.ids.has(logicalId)).map((t) => t.stackName);
+		const absentFrom = idSets.filter((t) => !t.ids.has(logicalId)).map((t) => t.stackName);
+		if (appliesTo.length === 0) unmatched.push(logicalId);
+		else if (absentFrom.length > 0) partial.push({
+			logicalId,
+			appliesTo,
+			absentFrom
+		});
+	}
+	return {
+		unmatched,
+		partial,
+		errorMessage: unmatched.length === 0 ? "" : `--pin-cc-api named ${unmatched.length} logical id(s) present in no stack of this run:\n` + unmatched.map((id) => `  - ${id}`).join("\n") + `\n  Stacks in this run: ${idSets.map((t) => t.stackName).join(", ")}\n  Fix: pass the CFn-emitted logical id, not the CDK display path (\`cdkd synth\`, then read \`.Resources | keys\`). A resource inside a NESTED child stack cannot be pinned from its parent's deploy — name it in a deploy of that child.`
+	};
+}
+
 //#endregion
 //#region src/cli/commands/confirm-prompt.ts
 /**
@@ -62736,6 +62789,10 @@ async function deployCommand(stacks, options) {
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
 					...migrationGate && { onCurrentStateLoaded: migrationGate },
+					...options.pinCcApi?.length && { pinCcApi: {
+						stackName: stackInfo.stackName,
+						logicalIds: new Set(options.pinCcApi)
+					} },
 					...recreateTargets && (recreateTargets.viaCcApi.size > 0 || recreateTargets.viaSdkProvider.size > 0) && { recreateTargets },
 					...options.replace && { replace: true },
 					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
@@ -62813,6 +62870,18 @@ async function deployCommand(stacks, options) {
 				setAwsClients(awsClients);
 			}
 		};
+		if (options.pinCcApi?.length && options.recreateViaSdkProvider?.length) {
+			const both = options.pinCcApi.filter((id) => (options.recreateViaSdkProvider ?? []).includes(id));
+			if (both.length > 0) throw new CdkdError(`--pin-cc-api and --recreate-via-sdk-provider both named: ${both.join(", ")}. They are opposite requests — the first keeps the resource on Cloud Control, the second destroys and recreates it via the SDK provider. Pass one.`, "PIN_CC_API_INVALID");
+		}
+		if (options.pinCcApi?.length) {
+			const reach = analyzePinCcApiReachability(options.pinCcApi, targetStacks.map((st) => ({
+				stackName: st.stackName,
+				logicalIds: Object.keys(st.template.Resources ?? {})
+			})));
+			if (reach.unmatched.length > 0) throw new CdkdError(reach.errorMessage, "PIN_CC_API_INVALID");
+			for (const partial of reach.partial) logger.info(`--pin-cc-api ${partial.logicalId}: applies to ${partial.appliesTo.join(", ")}; not declared by ${partial.absentFrom.join(", ")}`);
+		}
 		await workGraph.execute({
 			"asset-build": options.imageBuildConcurrency,
 			"asset-publish": options.assetPublishConcurrency,
@@ -64181,6 +64250,13 @@ function isStackNotFoundError(err) {
 
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
+/**
+* The one spelling of the routing token for a resource leaving Cloud Control
+* (issue #2719). A literal, because `collectCcApiRoutes` writes it and
+* `annotateRouting` special-cases it, and the integ fixture greps for it --
+* three places that must agree on a string.
+*/
+const SDK_MIGRATION_TOKEN = "returning to SDK provider";
 const logger = getLogger().child("DiffRecursive");
 /** Every `Ref` target reachable from a value, collected in one walk. */
 function collectRefTargets(value, refs) {
@@ -64637,7 +64713,15 @@ function collectCcApiRoutes(template, state) {
 			hits.set(logicalId, drops.map((d) => d.property));
 			continue;
 		}
-		if (state.resources[logicalId]?.provisionedBy === "cc-api") hits.set(logicalId, ["sticky"]);
+		const record = state.resources[logicalId];
+		if (record?.provisionedBy === "cc-api") {
+			const leaving = wouldReturnToSdkProvider({
+				resourceType: resource.Type,
+				desiredProperties: resource.Properties ?? {},
+				previousProperties: record.properties
+			});
+			hits.set(logicalId, [leaving ? SDK_MIGRATION_TOKEN : "sticky"]);
+		}
 	}
 	return hits;
 }
@@ -64783,6 +64867,7 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 	const annotateRouting = (logicalId) => {
 		const props = ccApiRoutes?.get(logicalId);
 		if (!props || props.length === 0) return "";
+		if (props.length === 1 && props[0] === "returning to SDK provider") return ` [${SDK_MIGRATION_TOKEN}]`;
 		return ` [via CC API: ${props.join(", ")}]`;
 	};
 	for (const [logicalId, change] of changes.entries()) switch (change.changeType) {
@@ -66493,6 +66578,108 @@ function isRegionAmbiguousRefusal(err) {
 	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof DynamicReferenceRegionAmbiguousError);
 }
 /**
+* A secrets map with its OWN identity whose entries ARE `target`'s (issue
+* #2531): every read and write goes to `target`; nothing is stored here.
+*
+* The outputs pass resolves each `Export.Name` through one of these rather
+* than through the pass map itself. The resolver records the uncollapsed
+* `expression -> plaintext` PAIR beside each entry, keyed by the map INSTANCE
+* (`recordResolvedPair`), and a second write of one expression with a
+* different plaintext marks that pair conflicting — so a name's resolution
+* recording straight into the pass map could conflict the pair a literal
+* Output embedding the same token needs. Pairs recorded through this view
+* hang off THIS instance and are discarded with it (a name never positions a
+* leaf); the entries are the pass map's, live, in both directions.
+*
+* Live sharing rather than a private map with a copy: the resolver records
+* as it goes and `Fn::Join` resolves its parts concurrently, so a part that
+* rejects while a secret part is still pending ends the name's block before
+* that part records — a copy at the end of the block misses the late entry,
+* and a private map SEEDED from the pass map is a snapshot that a LATER
+* name's resolution would not see the late entry through either. Every
+* reader in the block (the cross-region pin, the cross-stack pre-pass, the
+* resolver, the masking of their messages) needs exactly what the pass map
+* holds at the moment it reads, which is what a view gives. (The deploy
+* engine's sibling block keeps its end-of-block copy and so still has the
+* late-entry hole — issue #2563.)
+*
+* TWO RESIDUALS of discarding what the view recorded, both bounded to the
+* choice of EXPRESSION and neither reaching a plaintext:
+*
+* - The pairs. A value leaf re-using the token records its own pair at the
+*   seam, which is what positions it — PROVIDED its own resolution succeeds.
+*   A value whose read through the PRIMARY resolver fails after the name's
+*   succeeded (that call sits in the value loop's best-effort catch) has no
+*   pair of its own and no name-recorded one to fall back on, so its leaf
+*   drops to the value scan (the #2485 shape, a sibling's spelling for a
+*   same-plaintext pair); the entry the name recorded is still a needle, so
+*   the plaintext is scrubbed either way — whole, at any length, when the
+*   leaf IS the plaintext (`redactSecretsForState`'s whole-value arm is
+*   unbounded and this pass hands it the raw pass map), and by the substring
+*   arm at `MIN_NEEDLE_LENGTH` or longer when the plaintext is EMBEDDED in a
+*   larger leaf; a shorter embedded one is the #2516 residual, which has
+*   nothing to do with the name loop. A failed read through the cross-region PIN
+*   is not a fallback at all: `unresolvableForeignScrubSecretError` refuses
+*   the whole scrub (`SCRUB_CROSS_REGION_SECRET_UNRESOLVED`), name loop or
+*   value loop.
+* - The cross-stack associations the pre-pass records
+*   (`recordCrossStackExpression`), keyed by instance the same way. They are
+*   recorded only for a plaintext ALREADY in the map (the resolver gates on
+*   `recordedSecretValues.has(...)`), so losing one degrades the expression a
+*   later leaf is positioned by, never whether the plaintext is found. No
+*   case pins this arm on its own.
+*
+* Every member of `Map.prototype` that reads or writes entries is overridden,
+* and a unit fence (`scrub-shared-entries-secrets.test.ts`) asserts that set
+* against the runtime's `Map.prototype` so a future addition (the stage-3
+* `getOrInsert` / `getOrInsertComputed`) cannot land on the permanently empty
+* backing store unnoticed — a needle inserted there would never reach the
+* pass map. `structuredClone` reads the internal slots the same way and is
+* equally unreachable from this file; a clone of a view would be an empty
+* `Map`.
+*/
+var SharedEntriesSecrets = class extends Map {
+	target;
+	constructor(target) {
+		super();
+		this.target = target;
+	}
+	get size() {
+		return this.target.size;
+	}
+	get(plaintext) {
+		return this.target.get(plaintext);
+	}
+	has(plaintext) {
+		return this.target.has(plaintext);
+	}
+	set(plaintext, expression) {
+		this.target.set(plaintext, expression);
+		return this;
+	}
+	delete(plaintext) {
+		return this.target.delete(plaintext);
+	}
+	clear() {
+		this.target.clear();
+	}
+	keys() {
+		return this.target.keys();
+	}
+	values() {
+		return this.target.values();
+	}
+	entries() {
+		return this.target.entries();
+	}
+	forEach(callback, thisArg) {
+		this.target.forEach((value, key) => callback.call(thisArg, value, key, this));
+	}
+	[Symbol.iterator]() {
+		return this.target[Symbol.iterator]();
+	}
+};
+/**
 * Build the CROSS-STACK pre-pass for ONE stack's scrub (issue
 * [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
 *
@@ -66890,21 +67077,28 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const declaredExportName = output.Export?.Name;
 			let exportName = declaredExportName;
 			if (declaredExportName !== void 0 && typeof declaredExportName !== "string") {
+				const nameSecrets = new SharedEntriesSecrets(outputSecrets);
+				let nameFailed = false;
+				let nameError;
 				const nameSource = await pinCrossRegionSecrets(declaredExportName, stack.stackName, {
 					stackRegion: region,
 					producerRegions,
 					resolvers,
-					recordedSecretValues: outputSecrets,
+					recordedSecretValues: nameSecrets,
 					origin: `Export.Name of output '${name}'`
 				});
-				const nameContext = resolverContext(outputSecrets);
+				const nameContext = resolverContext(nameSecrets);
 				await resolveCrossStackReads(nameSource, nameContext, `Export.Name of output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 				try {
 					exportName = await resolver.resolve(nameSource, nameContext);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err)) throw err;
+					nameFailed = true;
+					nameError = err;
+				}
+				if (nameFailed) {
 					outputsSourceUntrusted = true;
-					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(nameError instanceof Error ? nameError.message : String(nameError), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 				}
 			}
 			if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
@@ -89323,4 +89517,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-dEYAo80R.js.map
+//# sourceMappingURL=program-D2Vykejc.js.map