@go-to-k/cdkd 0.290.1 → 0.290.2

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $r as DependencyError, Cn as S3StateBackend, Gr as AwsClients, Jr as setAwsClients, Kr as getAwsClients, Rn as AssetPublisher, Sn as LockManager, Ur as clearBucketRegionCache, Vr as AssemblyReader, Wr as resolveBucketRegion, Xr as CdkdError, Yr as AssetError, Zr as ConfigError, Zt as DiffCalculator, _i as normalizeAwsError, ai as LockError, ci as ProvisioningError, et as IAMRoleProvider, gi as isCdkdError, hi as formatError, in as TemplateParser, mi as SynthesisError, pi as StateError, pt as CloudControlProvider, qr as resetAwsClients, r as DeployEngine, rn as DagBuilder, rt as ProviderRegistry, vr as Synthesizer } from "./deploy-engine-aYUEGRRl.js";
+import { $r as DependencyError, Cn as S3StateBackend, Gr as AwsClients, Jr as setAwsClients, Kr as getAwsClients, Rn as AssetPublisher, Sn as LockManager, Ur as clearBucketRegionCache, Vr as AssemblyReader, Wr as resolveBucketRegion, Xr as CdkdError, Yr as AssetError, Zr as ConfigError, Zt as DiffCalculator, _i as normalizeAwsError, ai as LockError, ci as ProvisioningError, et as IAMRoleProvider, gi as isCdkdError, hi as formatError, in as TemplateParser, mi as SynthesisError, pi as StateError, pt as CloudControlProvider, qr as resetAwsClients, r as DeployEngine, rn as DagBuilder, rt as ProviderRegistry, vr as Synthesizer } from "./deploy-engine-Nn9j2GPK.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-DTEUzYP_.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CnTfNj2k.js → program-z-ESK5sd.js}

@@ -1,8 +1,8 @@
-import { $ as getCurrentResourceSecrets, $n as validateAssetBucketName, $t as findActionableSilentDrops, A as planOrphanAdoption, An as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ar as warnDeprecatedNoPrefixCliFlag, At as resolveExplicitPhysicalId, B as bold, Bn as WorkGraph, Br as derivePartitionAndUrlSuffix, Bt as requireConfigObject, C as createPreDeleteFinalSnapshot, Ci as markNonRetryable, Cn as S3StateBackend, Cr as resolveAutoAssetStorage, Ct as coerceParameterTypedValue, D as makeCanonicalizePropertiesFn, Dn as forceQuitRecoveryClause, Dr as resolveStateBucketWithDefaultAndSource, Dt as refStateLookupFromResource, E as unsupportedFinalSnapshotError, En as buildLockContentionMessage, Er as resolveStateBucketWithDefault, Et as parameterTypeMayLoseSecretIdentity, F as WARM_THROUGHPUT_MEMBERS, Fn as orphansAfterRollback, Fr as uploadCfnTemplate, Ft as configIntegerRefusal, G as yellow, Gn as AssetModeResolver, Gr as AwsClients, Gt as s3BucketArn, H as gray, Hn as createAssetRedirectResolver, Hr as processStackMessages, Ht as classifyReplaySecretRegion, I as coerceWarmThroughput$1, In as orphansCarriedFrom, Ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, It as configStringRefusal, J as exportAliasCollisionScrubWarning, Jn as ensureAssetStorage, Jr as setAwsClients, Jt as s3BucketRegionalDomainName, K as collectDeclaredOutputNames, Kn as BOOTSTRAP_MARKER_PREFIX, Kr as getAwsClients, Kt as s3BucketDomainName, L as isWarmThroughputDecrease, Ln as shouldRetainResource, Lr as expectedOwnerParam, Lt as readConfigString, M as isStatefulRecreateTargetForReplace, Mn as exportNamesCarriedFrom, Mr as CFN_TEMPLATE_URL_LIMIT, Mt as coerceCfnBoolean, N as isStatefulRecreateTargetSync, Nn as importableOutputKeys, Nr as MIGRATE_TMP_PREFIX, Nt as coerceCfnInteger, O as extractDeploymentEventError, On as formatLockExpiry, Or as resolveUseCdkBootstrapAssets, Ot as WAFv2WebACLProvider, P as renderStatefulReason, Pn as importableOutputs, Pr as findLargeInlineResources, Pt as configBooleanRefusal, Q as secretSafeKeyDisplay, Qn as readBootstrapMarkerBody, Qr as CrossAccountSecretRefusalError, Qt as INTRINSIC_KEYS, R as toFiniteNumber, Rn as AssetPublisher, Rr as PARTITION_TABLE, Rt as replayWarn, S as ccRoutedFinalSnapshotError, Si as isTransientServerError, Sn as LockManager, Sr as resolveApp, St as cfnRefValueFromPhysicalId, T as refusesFinalSnapshot, Ti as retryClassificationText, Tn as buildForceUnlockCommand, Tr as resolveSkipPrefix, Tt as isUnboundTemplateParameter, U as green, Un as loadPublishableAssetManifest, Ut as producerRegionsFromState, V as cyan, Vn as buildAssetRedirectMap, Vr as AssemblyReader, Vt as requireConfigString, W as red, Wn as rewriteTemplateAssetReferences, Wr as resolveBucketRegion, Wt as withSharedDrainBudget, X as secretBearing, Xn as isCrossRegionRedirect, Xr as CdkdError, Xt as applyRoleArnIfSet, Y as isExportAliasCollision, Yn as getBootstrapMarkerKey, Yt as s3BucketWebsiteUrl, Z as secretBearingStateKeyWarning, Zn as parseBootstrapMarker, Zt as DiffCalculator, _ as isSecretBearingReferenceString, _i as normalizeAwsError, _n as maskSecretsInText, _r as getDockerImageBySourceHash, _t as deleteSkipReason, a as DeploymentEventsStore, an as STATE_SOURCED_BASELINE_RULES, ar as describeDockerExecFailure, at as createMaskedRetryLogger, b as PRE_DELETE_SNAPSHOT_TYPES, bi as isRetryableTransientError, bn as redactSecretsForState, br as getDefaultStateBucketName, bt as IntrinsicFunctionResolver, c as replayFailedOperations, ci as ProvisioningError, cn as TEMPLATE_SOURCED_RULES, cr as formatDockerLoginError, ct as beginCommandInterruptScope, d as updatePartialReason, di as StackHasActiveImportsError, dn as dynamicReferenceTokens, dr as redactDockerArgvValues, dt as isInterruptedWaitError, ei as DeployCancelledError, en as findSilentDropProperties, er as validateContainerRepoName, et as IAMRoleProvider, f as withResourceDeadline, fi as StackTerminationProtectionError, fn as errorCauseChain, fr as runDockerForeground, ft as startInterruptWatch, g as bagHoldsSecretExpression, gn as maskSecretsInError, gr as AssetManifestLoader, gt as deleteIndeterminateGuards, h as computeImplicitDeleteEdges, hn as markSameGenerationBag, hr as stripControlChars, ht as UNSPECIFIED_SKIP_REASON, i as DeploymentEventsReader, ii as LocalStartServiceError, in as TemplateParser, ir as describeDockerCapturedOutput, it as wouldReturnToSdkProvider, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as DEFAULT_STATE_PREFIX, jr as CFN_TEMPLATE_BODY_LIMIT, jt as assertRegionMatch, k as makeSiblingClaimReader, kn as shellQuote, kr as stateBucketExistenceConfirmed, kt as normalizeAwsTagsToCfn, l as replayRollback, li as ResourceTimeoutError, ln as carriesSecretMask, lr as getDockerCmd, lt as endCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mn as isSingleDynamicReferenceToken, mr as escapeRegExp, mt as slowCcOperationTimeoutMs, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as IntrinsicResolutionRefusalError, nn as withRetry, nr as describeAwsFailure, nt as clearOnUpdateRemoval, o as planFailedOps, oi as NestedStackChildDirectDestroyError, on as STATE_SOURCED_CROSS_GENERATION_RULES, or as describeDockerFailure, ot as maskDeep, p as maskingRetryLogger, pn as identityKeyFor, pr as runDockerStreaming, pt as CloudControlProvider, q as collectPublishedOutputNames, qn as assertAssetBucketRegion, qr as resetAwsClients, qt as s3BucketDualStackDomainName, r as DeployEngine, ri as LocalInvokeBuildError$1, rn as DagBuilder, rr as buildDockerImage, rt as ProviderRegistry, s as planRollback, si as PartialFailureError, sn as STATE_SOURCED_READBACK_RULES, sr as dockerSpawnEnvWithSensitive, st as maskerOrIdentity, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as DynamicReferenceRegionAmbiguousError, tn as describeTypeWithThrottleRetry, tr as buildDenyExternalAccessPolicy, tt as collectInlinePolicyNamesManagedBySiblings, u as updatePartialMessage, ui as ResourceUpdateNotSupportedError, un as createSecretMasker, ur as partitionSensitiveEnv, ut as interruptWatchListenerCount, v as bindingSkippedOutputs, vi as withErrorHandling, vn as recordMaskOnlyValue, vr as Synthesizer, vt as disableInstanceApiTermination, w as isFinalSnapshotError, wi as markRedactedCause, wn as rebuildClientForBucketRegion, wr as resolveCaptureObservedState, wt as getAccountInfo, x as buildFinalSnapshotIdentifier, xi as isThrottlingError, xn as scrubResourceRecord, xr as getLegacyStateBucketName, xt as carriesDynamicReference, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yi as isMarkedNonRetryable, yn as recoverMaskedOutput, yr as synthesisStatusMessage, yt as isTerminationProtectionPropagationError, z as formatResourceLine, zn as stringifyValue, zr as canonicalizeRegion, zt as requireConfigArray } from "./deploy-engine-aYUEGRRl.js";
+import { $ as getCurrentResourceSecrets, $n as validateAssetBucketName, $t as findActionableSilentDrops, A as planOrphanAdoption, An as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ar as warnDeprecatedNoPrefixCliFlag, At as resolveExplicitPhysicalId, B as bold, Bn as WorkGraph, Br as derivePartitionAndUrlSuffix, Bt as requireConfigObject, C as createPreDeleteFinalSnapshot, Ci as markNonRetryable, Cn as S3StateBackend, Cr as resolveAutoAssetStorage, Ct as coerceParameterTypedValue, D as makeCanonicalizePropertiesFn, Dn as forceQuitRecoveryClause, Dr as resolveStateBucketWithDefaultAndSource, Dt as refStateLookupFromResource, E as unsupportedFinalSnapshotError, En as buildLockContentionMessage, Er as resolveStateBucketWithDefault, Et as parameterTypeMayLoseSecretIdentity, F as WARM_THROUGHPUT_MEMBERS, Fn as orphansAfterRollback, Fr as uploadCfnTemplate, Ft as configIntegerRefusal, G as yellow, Gn as AssetModeResolver, Gr as AwsClients, Gt as s3BucketArn, H as gray, Hn as createAssetRedirectResolver, Hr as processStackMessages, Ht as classifyReplaySecretRegion, I as coerceWarmThroughput$1, In as orphansCarriedFrom, Ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, It as configStringRefusal, J as exportAliasCollisionScrubWarning, Jn as ensureAssetStorage, Jr as setAwsClients, Jt as s3BucketRegionalDomainName, K as collectDeclaredOutputNames, Kn as BOOTSTRAP_MARKER_PREFIX, Kr as getAwsClients, Kt as s3BucketDomainName, L as isWarmThroughputDecrease, Ln as shouldRetainResource, Lr as expectedOwnerParam, Lt as readConfigString, M as isStatefulRecreateTargetForReplace, Mn as exportNamesCarriedFrom, Mr as CFN_TEMPLATE_URL_LIMIT, Mt as coerceCfnBoolean, N as isStatefulRecreateTargetSync, Nn as importableOutputKeys, Nr as MIGRATE_TMP_PREFIX, Nt as coerceCfnInteger, O as extractDeploymentEventError, On as formatLockExpiry, Or as resolveUseCdkBootstrapAssets, Ot as WAFv2WebACLProvider, P as renderStatefulReason, Pn as importableOutputs, Pr as findLargeInlineResources, Pt as configBooleanRefusal, Q as secretSafeKeyDisplay, Qn as readBootstrapMarkerBody, Qr as CrossAccountSecretRefusalError, Qt as INTRINSIC_KEYS, R as toFiniteNumber, Rn as AssetPublisher, Rr as PARTITION_TABLE, Rt as replayWarn, S as ccRoutedFinalSnapshotError, Si as isTransientServerError, Sn as LockManager, Sr as resolveApp, St as cfnRefValueFromPhysicalId, T as refusesFinalSnapshot, Ti as retryClassificationText, Tn as buildForceUnlockCommand, Tr as resolveSkipPrefix, Tt as isUnboundTemplateParameter, U as green, Un as loadPublishableAssetManifest, Ut as producerRegionsFromState, V as cyan, Vn as buildAssetRedirectMap, Vr as AssemblyReader, Vt as requireConfigString, W as red, Wn as rewriteTemplateAssetReferences, Wr as resolveBucketRegion, Wt as withSharedDrainBudget, X as secretBearing, Xn as isCrossRegionRedirect, Xr as CdkdError, Xt as applyRoleArnIfSet, Y as isExportAliasCollision, Yn as getBootstrapMarkerKey, Yt as s3BucketWebsiteUrl, Z as secretBearingStateKeyWarning, Zn as parseBootstrapMarker, Zt as DiffCalculator, _ as isSecretBearingReferenceString, _i as normalizeAwsError, _n as maskSecretsInText, _r as getDockerImageBySourceHash, _t as deleteSkipReason, a as DeploymentEventsStore, an as STATE_SOURCED_BASELINE_RULES, ar as describeDockerExecFailure, at as createMaskedRetryLogger, b as PRE_DELETE_SNAPSHOT_TYPES, bi as isRetryableTransientError, bn as redactSecretsForState, br as getDefaultStateBucketName, bt as IntrinsicFunctionResolver, c as replayFailedOperations, ci as ProvisioningError, cn as TEMPLATE_SOURCED_RULES, cr as formatDockerLoginError, ct as beginCommandInterruptScope, d as updatePartialReason, di as StackHasActiveImportsError, dn as dynamicReferenceTokens, dr as redactDockerArgvValues, dt as isInterruptedWaitError, ei as DeployCancelledError, en as findSilentDropProperties, er as validateContainerRepoName, et as IAMRoleProvider, f as withResourceDeadline, fi as StackTerminationProtectionError, fn as errorCauseChain, fr as runDockerForeground, ft as startInterruptWatch, g as bagHoldsSecretExpression, gn as maskSecretsInError, gr as AssetManifestLoader, gt as deleteIndeterminateGuards, h as computeImplicitDeleteEdges, hn as markSameGenerationBag, hr as stripControlChars, ht as UNSPECIFIED_SKIP_REASON, i as DeploymentEventsReader, ii as LocalStartServiceError, in as TemplateParser, ir as describeDockerCapturedOutput, it as wouldReturnToSdkProvider, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as DEFAULT_STATE_PREFIX, jr as CFN_TEMPLATE_BODY_LIMIT, jt as assertRegionMatch, k as makeSiblingClaimReader, kn as shellQuote, kr as stateBucketExistenceConfirmed, kt as normalizeAwsTagsToCfn, l as replayRollback, li as ResourceTimeoutError, ln as carriesSecretMask, lr as getDockerCmd, lt as endCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mn as isSingleDynamicReferenceToken, mr as escapeRegExp, mt as slowCcOperationTimeoutMs, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as IntrinsicResolutionRefusalError, nn as withRetry, nr as describeAwsFailure, nt as clearOnUpdateRemoval, o as planFailedOps, oi as NestedStackChildDirectDestroyError, on as STATE_SOURCED_CROSS_GENERATION_RULES, or as describeDockerFailure, ot as maskDeep, p as maskingRetryLogger, pn as identityKeyFor, pr as runDockerStreaming, pt as CloudControlProvider, q as collectPublishedOutputNames, qn as assertAssetBucketRegion, qr as resetAwsClients, qt as s3BucketDualStackDomainName, r as DeployEngine, ri as LocalInvokeBuildError$1, rn as DagBuilder, rr as buildDockerImage, rt as ProviderRegistry, s as planRollback, si as PartialFailureError, sn as STATE_SOURCED_READBACK_RULES, sr as dockerSpawnEnvWithSensitive, st as maskerOrIdentity, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as DynamicReferenceRegionAmbiguousError, tn as describeTypeWithThrottleRetry, tr as buildDenyExternalAccessPolicy, tt as collectInlinePolicyNamesManagedBySiblings, u as updatePartialMessage, ui as ResourceUpdateNotSupportedError, un as createSecretMasker, ur as partitionSensitiveEnv, ut as interruptWatchListenerCount, v as bindingSkippedOutputs, vi as withErrorHandling, vn as recordMaskOnlyValue, vr as Synthesizer, vt as disableInstanceApiTermination, w as isFinalSnapshotError, wi as markRedactedCause, wn as rebuildClientForBucketRegion, wr as resolveCaptureObservedState, wt as getAccountInfo, x as buildFinalSnapshotIdentifier, xi as isThrottlingError, xn as scrubResourceRecord, xr as getLegacyStateBucketName, xt as carriesDynamicReference, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yi as isMarkedNonRetryable, yn as recoverMaskedOutput, yr as synthesisStatusMessage, yt as isTerminationProtectionPropagationError, z as formatResourceLine, zn as stringifyValue, zr as canonicalizeRegion, zt as requireConfigArray } from "./deploy-engine-Nn9j2GPK.js";
 import { _ as withSkipPrefix, b as displaySafe, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as truncateCodePoints, y as UNRENDERABLE } from "./logger-DTEUzYP_.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DTli1mA9.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-e05iqtU_.js";
+import { t as getCdkdVersion } from "./version-7XwrjRzX.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-BsC_XndT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -26,9 +26,9 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateCacheClus
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
-import { basename, dirname, isAbsolute, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
@@ -83846,7 +83846,7 @@ function resolveAssetCodePath$1(stack, logicalId, resource) {
 * **Order is preserved**: `Properties.Layers` is iterated left-to-right
 * and the resulting `ResolvedLambdaLayer[]` carries the same order. The
 * caller (`local-invoke.ts`'s `materializeLambdaLayers` and
-* `local-start-api.ts`'s server-boot pre-merge) `cpSync`-merges every
+* `local-start-api.ts`'s server-boot pre-merge) merges every
 * entry into one host tmpdir in template order to honor AWS's
 * "last-layer-wins" file-collision semantics — Docker rejects multiple
 * bind mounts at the same target so cdkd cannot rely on overlay
@@ -84117,6 +84117,110 @@ function notFoundError$1(target, stack, resources) {
 	return new LocalInvokeResolutionError(msg.trimEnd());
 }
 
+//#endregion
+//#region src/local/layer-tree-copy.ts
+/**
+* Merge one Lambda Layer's asset tree into the directory that will be
+* bind-mounted at `/opt`, with AWS's "last layer wins" semantic and with
+* symlinks kept VERBATIM (issue #3106).
+*
+* Why this is a hand-written walk and not `cpSync`. The merge used to be
+* `cpSync(src, dest, { recursive: true, force: true })`, and every
+* `cpSync`-shaped repair of it was measured wrong in some direction:
+*
+*   - Without `verbatimSymlinks: true` (the default), `cpSync` rewrites a
+*     RELATIVE link target to the ABSOLUTE path of the source on the host —
+*     `bin/rel-link -> real.sh` arrives as `-> <cdk.out>/asset.<hash>/bin/
+*     real.sh`, which is dangling inside the container, where only `dest`
+*     is mounted. Measured on Node 22.12 / 24.21.
+*   - WITH `verbatimSymlinks: true`, Node's C++ `cpSync` (every release
+*     after 22.12) throws `EEXIST` when a later layer carries a symlink at a
+*     path an earlier layer already placed one — `nodejs/node_modules/.bin/
+*     <tool>` in two layers built from the same dependency is the ordinary
+*     case. Measured by the go-to-k/cdkd#3118 review on 22.23 / 24.15 /
+*     24.21; the JS implementation on 22.12 does not throw, which is why
+*     the floor alone did not show it.
+*   - A `cpSync` + `readdirSync({ recursive: true })` pair was worse:
+*     the recursive readdir DESCENDS INTO directory symlinks on every Node
+*     after 22.12 (not on 22.12), so a cyclic link (`sub/up -> ..`, or a
+*     pnpm-style `node_modules`) hung the merge, and an absolute link to a
+*     host directory made the walk delete and write INSIDE that host
+*     directory. And `cpSync`'s `force` writes THROUGH a destination that
+*     is already a directory symlink, so a later layer's real directory
+*     landed in the earlier layer's link target — on the host, when the
+*     link was absolute. Same review, same versions.
+*
+* So the walk is explicit and recurses only on a real directory (`d_type`,
+* via `Dirent.isDirectory()`, which reports a directory symlink as a
+* symlink on 22.12 and 24.21 alike). Per entry, "last layer wins" is applied
+* the same way for every kind: whatever sits at the destination path that is
+* not of the same kind is removed first — a link, a file, or a whole
+* directory an earlier layer placed — then the entry lands. A symlink is
+* recreated with the SOURCE's own target string and never resolved, so an
+* absolute link stays absolute and a dangling one stays dangling, exactly as
+* AWS extracts the layer ZIP into `/opt`; nothing is ever written through a
+* link. A file is copied with `cpSync` (single file, `force`), which is what
+* preserves the mode bits, so a layer's `bin/<script>` keeps its `+x` — the
+* property the `local-invoke-layers` fixture executes through.
+*
+* The ROOT may itself be a symlink (an asset dir handed over through a link
+* passes `resolveAssetCodePath`'s `statSync`). `readdirSync` follows a root
+* link by itself, so the `realpathSync` is not what makes that case work,
+* and it does not move where a dangling or looping root fails either (the
+* first `readdirSync` raises the same `ENOENT` / `ELOOP` naming the asset
+* path); it only keeps every path the walk joins real.
+*
+* Bound, stated rather than handled: a FIFO or a socket inside a layer
+* makes the single-file `cpSync` throw (`ERR_FS_CP_FIFO_PIPE` /
+* `ERR_FS_CP_SOCKET`, immediately, never blocking) where the old recursive
+* copy skipped it in silence on some releases. CDK's own asset staging
+* cannot stage such an entry, so no real layer carries one.
+*
+* Both layer merges (`cdkd local invoke` and `cdkd local start-api`) call
+* this; keep them on the one helper rather than re-spelling copy options.
+*/
+function copyLayerTreeLastWins(src, dest) {
+	mkdirSync(dest, { recursive: true });
+	copyDirLastWins(realpathSync(src), dest);
+}
+function copyDirLastWins(fromDir, toDir) {
+	for (const entry of readdirSync(fromDir, { withFileTypes: true })) {
+		const from = join(fromDir, entry.name);
+		const to = join(toDir, entry.name);
+		if (entry.isSymbolicLink()) {
+			removeUnless(to, "symlink");
+			symlinkSync(readlinkSync(from), to);
+		} else if (entry.isDirectory()) {
+			removeUnless(to, "directory");
+			mkdirSync(to, { recursive: true });
+			copyDirLastWins(from, to);
+		} else {
+			removeUnless(to, "file");
+			cpSync(from, to, { force: true });
+		}
+	}
+}
+/**
+* Clear the destination path unless what is there is already of `kind`. A
+* directory is kept so a later layer MERGES into it; a file is kept because
+* `cpSync` overwrites it in place; a symlink is always replaced (its target
+* string comes from the later layer).
+*/
+function removeUnless(to, kind) {
+	let st;
+	try {
+		st = lstatSync(to);
+	} catch {
+		return;
+	}
+	if (kind === "directory" && st.isDirectory()) return;
+	if (kind === "file" && st.isFile()) return;
+	rmSync(to, {
+		recursive: true,
+		force: true
+	});
+}
+
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 function detectEcsImageResolutionNeeds(stack) {
@@ -87533,12 +87637,12 @@ async function resolveLocalBuildPlan$1(lambda) {
 *     when the entry is a same-stack asset. Literal-ARN entries always
 *     pre-materialize first.
 *   - 2+ layers → copy each into a fresh tmpdir IN ORDER (later
-*     layers overwrite earlier files via `cpSync({force: true})`),
+*     layers overwrite earlier files via `copyLayerTreeLastWins`),
 *     bind-mount the tmpdir at `/opt`. Records the tmpdir in
 *     `layerTmpDirs` so `shutdown(...)` removes it.
 *
 * Issue #448: literal-ARN entries (`{kind: 'arn', ...}`) are downloaded
-* + unzipped via `lambda:GetLayerVersion` BEFORE the cpSync-merge
+* + unzipped via `lambda:GetLayerVersion` BEFORE the merge
 * branches run. Every per-ARN tmpdir is also recorded in `layerTmpDirs`
 * so the same shutdown path cleans it up — even for the single-layer
 * fast path that bind-mounts the dir directly.
@@ -87568,10 +87672,15 @@ async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
 	}
 	if (flat.length === 1) return flat[0].assetPath;
 	const dir = mkdtempSync(path.join(tmpdir(), "cdkd-local-start-api-layers-"));
-	for (const layer of flat) cpSync(layer.assetPath, dir, {
-		recursive: true,
-		force: true
-	});
+	try {
+		for (const layer of flat) copyLayerTreeLastWins(layer.assetPath, dir);
+	} catch (error) {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
 	layerTmpDirs.add(dir);
 	return dir;
 }
@@ -91522,7 +91631,7 @@ async function resolveZipImagePlan(lambda, options) {
 *   - Stage 2: the resulting `{logicalId, assetPath}[]` list (in
 *     template order — ARN entries surface their `arn` as the
 *     `logicalId` for log lines) is handed to the existing
-*     `materializeLambdaLayers` `cpSync`-merge path. AWS's "last layer
+*     `materializeLambdaLayers` merge path. AWS's "last layer
 *     wins" file-collision semantic is preserved across both layer
 *     kinds because the merge step is unchanged.
 */
@@ -91590,7 +91699,7 @@ function resolveTmpfsForLambda(lambda) {
 *      than copying since CDK has already unzipped the asset.
 *   3. **Multiple layers**: copies each layer's contents into a fresh
 *      tmpdir IN ORDER (later layers overwrite earlier files via
-*      `cpSync({force: true})`), then bind-mounts the merged tmpdir at
+*      `copyLayerTreeLastWins`), then bind-mounts the merged tmpdir at
 *      `/opt`. Returns `{ mount, tmpDir: <path> }` so the caller can
 *      `rmSync` the tmpdir on cleanup.
 *
@@ -91607,10 +91716,15 @@ function materializeLambdaLayers(layers) {
 		readOnly: true
 	} };
 	const tmpDir = mkdtempSync(path.join(tmpdir(), "cdkd-local-invoke-layers-"));
-	for (const layer of layers) cpSync(layer.assetPath, tmpDir, {
-		recursive: true,
-		force: true
-	});
+	try {
+		for (const layer of layers) copyLayerTreeLastWins(layer.assetPath, tmpDir);
+	} catch (error) {
+		rmSync(tmpDir, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
 	return {
 		mount: {
 			hostPath: tmpDir,
@@ -92177,4 +92291,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CnTfNj2k.js.map
+//# sourceMappingURL=program-z-ESK5sd.js.map