@go-to-k/cdkd 0.290.28 → 0.290.30

package/dist/{program-C1iVGcxJ.js → program-qSSjqstP.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-CcFbq2q8.js";
-import { C as displayIdent, S as UNRENDERABLE, T as truncateCodePoints, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displaySafe, x as STACK_REF_MAX_CODE_POINTS } from "./logger-6LP1UiFA.js";
+import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-mI1Xv1oi.js";
+import { C as displayAwsMessage, E as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BjWM-UVj.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-B2-UuEte.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DiZsq-4k.js";
+import { t as getCdkdVersion } from "./version-C15BftsD.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-De5KONKr.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1089,6 +1089,21 @@ const deployOptions = [
 * -c / --context can be specified multiple times to pass context key=value pairs
 */
 const contextOptions = [new Option("-c, --context <key=value...>", "Set context values (can be specified multiple times)")];
+/**
+* ANCHORED AT THE START ONLY, and that is what makes the renders below a
+* display boundary rather than a formality (issue
+* [#3397](https://github.com/go-to-k/cdkd/issues/3397)).
+*
+* A value CLEARING this test is constrained in its first ~30 characters and in
+* nothing after `role/` — `arn:aws:iam::1:role/` followed by an ESC, a
+* newline, or 10 MB of anything is a PASS. So `normalizeStartApiAssumeRole`'s
+* mutual-exclusion error, which renders an ARN this regex already accepted,
+* needs sanitizing exactly as much as the three REFUSALS that render one it
+* rejected. Tightening the regex instead was considered and is the wrong tool:
+* `src/utils/role-arn.ts`'s `IAM_ROLE_ARN_RE` is the strict parse, it runs
+* later and on a different path, and a stricter argparse here would start
+* refusing role-name shapes the deploy path accepts.
+*/
 const IAM_ROLE_ARN_REGEX = /^arn:[^:]+:iam::\d+:role\//;
 /**
 * Argparse for the repeatable `--assume-role` flag.
@@ -1102,16 +1117,17 @@ const IAM_ROLE_ARN_REGEX = /^arn:[^:]+:iam::\d+:role\//;
 function parseAssumeRoleToken(raw, previous) {
 	const acc = previous ?? { perLambda: {} };
 	if (!acc.perLambda) acc.perLambda = {};
+	const shownRaw = displayIdent(raw, { maxCodePoints: 613 });
 	const eqIndex = raw.indexOf("=");
 	if (eqIndex === -1) {
-		if (!IAM_ROLE_ARN_REGEX.test(raw)) throw new Error(`Invalid --assume-role value "${raw}": expected an IAM role ARN like arn:aws:iam::123456789012:role/MyRole, or LogicalId=<arn>.`);
+		if (!IAM_ROLE_ARN_REGEX.test(raw)) throw new Error(`Invalid --assume-role value "${shownRaw}": expected an IAM role ARN like arn:aws:iam::123456789012:role/MyRole, or LogicalId=<arn>.`);
 		acc.globalArn = raw;
 		return acc;
 	}
 	const logicalId = raw.substring(0, eqIndex).trim();
 	const arn = raw.substring(eqIndex + 1).trim();
-	if (!/^[A-Za-z][A-Za-z0-9]*$/.test(logicalId)) throw new Error(`Invalid --assume-role value "${raw}": left-hand side "${logicalId}" must be a CloudFormation logical ID (alphanumeric, leading letter).`);
-	if (!IAM_ROLE_ARN_REGEX.test(arn)) throw new Error(`Invalid --assume-role value "${raw}": right-hand side "${arn}" must be an IAM role ARN like arn:aws:iam::123456789012:role/MyRole.`);
+	if (!/^[A-Za-z][A-Za-z0-9]*$/.test(logicalId)) throw new Error(`Invalid --assume-role value "${shownRaw}": left-hand side "${displayIdent(logicalId)}" must be a CloudFormation logical ID (alphanumeric, leading letter).`);
+	if (!IAM_ROLE_ARN_REGEX.test(arn)) throw new Error(`Invalid --assume-role value "${shownRaw}": right-hand side "${displayIdent(arn, { maxCodePoints: 613 })}" must be an IAM role ARN like arn:aws:iam::123456789012:role/MyRole.`);
 	acc.perLambda[logicalId] = arn;
 	return acc;
 }
@@ -1140,7 +1156,7 @@ function normalizeStartApiAssumeRole(raw, autoResolve) {
 		perLambda: {},
 		bareAutoResolve: true
 	} : void 0;
-	if (autoResolve && raw.globalArn) throw new Error(`--assume-role-auto auto-resolves EACH routed Lambda's own execution role, but --assume-role ${raw.globalArn} also names a single global default. These are mutually exclusive on the global slot. Either drop the global ARN to keep --assume-role-auto for every Lambda, or drop --assume-role-auto to keep the global default. Per-Lambda overrides (--assume-role <LogicalId>=<arn>) are compatible with either side.`);
+	if (autoResolve && raw.globalArn) throw new Error(`--assume-role-auto auto-resolves EACH routed Lambda's own execution role, but --assume-role ${displayIdent(raw.globalArn, { maxCodePoints: 613 })} also names a single global default. These are mutually exclusive on the global slot. Either drop the global ARN to keep --assume-role-auto for every Lambda, or drop --assume-role-auto to keep the global default. Per-Lambda overrides (--assume-role <LogicalId>=<arn>) are compatible with either side.`);
 	if (autoResolve) raw.bareAutoResolve = true;
 	return raw;
 }
@@ -12149,6 +12165,16 @@ function isSqsQueueUrl(value) {
 //#endregion
 //#region src/provisioning/providers/sns-topic-provider.ts
 /**
+* The value SNS enforces for a topic that never set `MaximumMessageSize`
+* (256 KiB, the standard maximum), and therefore what a template REMOVAL of
+* the member resets the attribute to — SNS refuses the `''` the other
+* `SetTopicAttributes` removals send (`MaximumMessageSize:  is not an integer
+* between 1024 and 1048576 bytes`, measured us-east-1 2026-09-18). A fresh
+* topic REPORTS no value at all, which `readCurrentState` folds to this value;
+* see there. Exported for the unit tests that pin both halves (issue #3413).
+*/
+const SNS_MAXIMUM_MESSAGE_SIZE_DEFAULT = "262144";
+/**
 * AWS SNS Topic Provider
 *
 * Implements resource provisioning for AWS::SNS::Topic using the SNS SDK.
@@ -12172,7 +12198,8 @@ var SNSTopicProvider = class {
 		"DataProtectionPolicy",
 		"DeliveryStatusLogging",
 		"Subscription",
-		"FifoThroughputScope"
+		"FifoThroughputScope",
+		"MaximumMessageSize"
 	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -12207,6 +12234,7 @@ var SNSTopicProvider = class {
 			if (properties["TracingConfig"]) topicAttributes["TracingConfig"] = properties["TracingConfig"];
 			if (properties["SignatureVersion"]) topicAttributes["SignatureVersion"] = stringifyValue(properties["SignatureVersion"]);
 			if (properties["FifoThroughputScope"]) topicAttributes["FifoThroughputScope"] = properties["FifoThroughputScope"];
+			if (properties["MaximumMessageSize"] != null) topicAttributes["MaximumMessageSize"] = stringifyValue(properties["MaximumMessageSize"]);
 			let tags;
 			if (properties["Tags"]) tags = properties["Tags"];
 			const createParams = {
@@ -12293,7 +12321,7 @@ var SNSTopicProvider = class {
 	}
 	async applyUpdate(logicalId, physicalId, properties, previousProperties, maskSecrets) {
 		this.logger.debug(`Updating SNS topic ${logicalId}: ${physicalId}`);
-		for (const attr of [
+		const mutableAttributes = [
 			{
 				name: "DisplayName",
 				prop: "DisplayName"
@@ -12327,13 +12355,19 @@ var SNSTopicProvider = class {
 				name: "DataProtectionPolicy",
 				prop: "DataProtectionPolicy",
 				serialize: true
+			},
+			{
+				name: "MaximumMessageSize",
+				prop: "MaximumMessageSize",
+				resetValue: SNS_MAXIMUM_MESSAGE_SIZE_DEFAULT
 			}
-		]) {
+		];
+		for (const attr of mutableAttributes) {
 			const newVal = properties[attr.prop];
 			const oldVal = previousProperties[attr.prop];
 			if (JSON.stringify(newVal) !== JSON.stringify(oldVal)) {
 				let value;
-				if (newVal === void 0 || newVal === null) value = "";
+				if (newVal === void 0 || newVal === null) value = attr.resetValue ?? "";
 				else if (attr.serialize && typeof newVal !== "string") value = JSON.stringify(newVal);
 				else value = stringifyValue(newVal);
 				await this.snsClient.send(new SetTopicAttributesCommand({
@@ -12568,6 +12602,9 @@ var SNSTopicProvider = class {
 			"SignatureVersion"
 		]) result[key] = attrs[key] ?? "";
 		if (attrs["FifoTopic"] === "true") result["FifoThroughputScope"] = attrs["FifoThroughputScope"] ?? "";
+		const liveMaxSize = attrs["MaximumMessageSize"] || "262144";
+		const maxSizeNumber = Number(liveMaxSize);
+		result["MaximumMessageSize"] = Number.isFinite(maxSizeNumber) ? maxSizeNumber : liveMaxSize;
 		for (const key of ["ArchivePolicy", "DataProtectionPolicy"]) {
 			const v = attrs[key];
 			if (v) try {
@@ -49644,10 +49681,14 @@ var AppSyncProvider = class {
 		}
 		const explicit = resolveExplicitPhysicalId(input, null);
 		if (explicit) try {
-			await this.getClient().send(new GetGraphqlApiCommand({ apiId: explicit }));
+			const response = await this.getClient().send(new GetGraphqlApiCommand({ apiId: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					ApiId: explicit,
+					Arn: response.graphqlApi?.arn,
+					GraphQLUrl: response.graphqlApi?.uris?.["GRAPHQL"]
+				})
 			};
 		} catch (err) {
 			if (err instanceof NotFoundException$4) return null;
@@ -72193,7 +72234,7 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 				entityId = user?.UserId;
 			}
 			if (entityArn !== void 0 && entityArn.toLowerCase() === arn.toLowerCase()) uniqueId = entityId;
-			else getLogger().debug(`Principal ${arn} resolved to ${entityArn ?? "no entity"} — same name in this account or under another IAM path; leaving the policy principal comparison untouched.`);
+			else getLogger().debug(`Principal ${displayIdent(arn, { maxCodePoints: 613 })} resolved to ${entityArn === void 0 ? "no entity" : displayIdent(entityArn, { maxCodePoints: 613 })} — same name in this account or under another IAM path; leaving the policy principal comparison untouched.`);
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			const name = error instanceof Error ? error.name : "";
@@ -72203,7 +72244,7 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 				warnedOnDenied = true;
 				getLogger().warn(`Cannot read IAM principals (${name || "access denied"}). A resource policy whose principal AWS rendered as a unique id (AROA…/AIDA…) may therefore report drift that is only a spelling difference; grant iam:GetRole / iam:GetUser to resolve it, or re-run with --verbose for the full error.`);
 			}
-			getLogger().debug(`Could not resolve the unique id of principal ${arn} (${message}); leaving the policy principal comparison untouched.`);
+			getLogger().debug(`Could not resolve the unique id of principal ${displayIdent(arn, { maxCodePoints: 613 })} (${displayAwsMessage(message)}); leaving the policy principal comparison untouched.`);
 			if (isThrottlingError(error)) return void 0;
 		}
 		cache.set(arn, uniqueId);
@@ -75867,6 +75908,43 @@ const COMPOSITE_ID_SPLITTERS = {
 			},
 			propertiesOverlay: { FunctionName: functionName }
 		};
+	},
+	"AWS::AppSync::ApiKey": (physicalId, properties) => {
+		const trimmed = physicalId.trim();
+		if (!trimmed) throw new Error("empty physical id for AWS::AppSync::ApiKey (expected 'apiId|apiKeyId', the key ARN, or a bare apiKeyId)");
+		const arnMatch = /^arn:[^:]+:appsync:[^:]*:[^:]*:apis\/([^/|]+)\/apikey\/([^/|]+)$/.exec(trimmed);
+		if (arnMatch) {
+			const [, apiId, apiKeyId] = arnMatch;
+			return {
+				resourceIdentifier: {
+					ApiId: apiId,
+					ApiKeyId: apiKeyId
+				},
+				propertiesOverlay: { ApiId: apiId }
+			};
+		}
+		if (trimmed.startsWith("arn:")) throw new Error(`'${physicalId}' looks like an ARN but is not an AppSync API key ARN (expected arn:<partition>:appsync:<region>:<account>:apis/<apiId>/apikey/<apiKeyId>)`);
+		const parts = trimmed.split("|");
+		if (parts.length > 2) throw new Error(`expected 'apiId|apiKeyId', the key ARN, or a bare apiKeyId, got ${parts.length} parts: '${physicalId}'`);
+		if (parts.length === 2) {
+			const [apiId, apiKeyId] = parts;
+			if (!apiId.trim() || !apiKeyId.trim()) throw new Error(`empty part in 'apiId|apiKeyId': '${physicalId}'`);
+			return {
+				resourceIdentifier: {
+					ApiId: apiId,
+					ApiKeyId: apiKeyId
+				},
+				propertiesOverlay: { ApiId: apiId }
+			};
+		}
+		const apiId = readStringProperty(properties, "ApiId", "AWS::AppSync::ApiKey");
+		return {
+			resourceIdentifier: {
+				ApiId: apiId,
+				ApiKeyId: trimmed
+			},
+			propertiesOverlay: { ApiId: apiId }
+		};
 	}
 };
 /**
@@ -76184,6 +76262,24 @@ function createIdentifierBackfillDeps(ec2Client) {
 * | `AWS::AppSync::Resolver` | `ResolverArn` | `attributes.ResolverArn` |
 * | `AWS::S3Tables::Table` | `TableARN` | `attributes.TableARN` |
 * | `AWS::EC2::SecurityGroupIngress` | `Id` | `attributes.Id` (issue #1761) |
+* | `AWS::AppSync::GraphQLApi` | `Arn` (2026-09-18) | `attributes.Arn` (issue #3414) |
+*
+* The GraphQLApi row is the one whose identifier AWS RE-DECLARED under cdkd:
+* the 2026-09-17 public bundle flipped it from `ApiId` to `Arn` (issue #3327
+* recorded the two published sources disagreeing at the time), and by
+* 2026-09-18 `describe-type` in us-east-1 answers `["/properties/Arn"]` with a
+* full handler set. cdkd's physicalId is the bare `apiId`, which is NOT the ARN
+* and cannot be turned into one without account + partition, so the entry
+* reads the `Arn` attribute `AppSyncProvider.create` records. Because the
+* flip is recent and the two sources disagreed, the entry ALSO declares
+* `physicalIdIsIdentifierFor: ['ApiId']`: a schema that reports the OLD
+* single field is not a schema change that needs a code edit — for a record
+* cdkd deployed, the physicalId already IS that value — so `resolveCompositeId`
+* takes the plain single-key path for it instead of refusing by name. The
+* bypass excludes an ARN-shaped physicalId (a `--migrate-from-cloudformation`
+* record stores CloudFormation's `PhysicalResourceId`, the ARN), which under
+* a pre-flip registry keeps the loud cross-check refusal rather than shipping
+* an ARN as `ApiId`.
 *
 * The SG-ingress row is measured the same way as the rest, and separately
 * against a real CloudFormation stack because the three strings that name one
@@ -76197,11 +76293,21 @@ function createIdentifierBackfillDeps(ec2Client) {
 * `sgr-02345615af6d2db0d`, with `Ref` and `Fn::GetAtt .Id` both returning that
 * same value.
 *
-* All four declare a `read` handler, so CFn genuinely does accept them for
-* IMPORT — unlike `AWS::Glue::Table`, the type issue #1659's title names, which
-* CFn rejects outright (see {@link typeIsImportUnsupported}).
+* All five declare a `read` handler. For four of them CFn genuinely does accept
+* the IMPORT — unlike `AWS::Glue::Table`, the type issue #1659's title names,
+* which CFn rejects outright (see {@link typeIsImportUnsupported}). The fifth,
+* `AWS::AppSync::GraphQLApi`, is measured REFUSED despite its read handler
+* (see {@link CFN_IMPORT_REFUSED_DESPITE_REGISTRY}), so its row below is
+* reachable only under `--skip-import-support-preflight`.
 */
 const COMPOSITE_PHYSICAL_ID_IDENTIFIERS = {
+	"AWS::AppSync::GraphQLApi": recordedArnIdentifier({
+		resourceType: "AWS::AppSync::GraphQLApi",
+		field: "Arn",
+		physicalIdShape: "<apiId>",
+		arnServiceSegment: "appsync",
+		physicalIdIsIdentifierFor: ["ApiId"]
+	}),
 	"AWS::AppSync::DataSource": recordedArnIdentifier({
 		resourceType: "AWS::AppSync::DataSource",
 		field: "DataSourceArn",
@@ -76617,7 +76723,7 @@ function maskedIdentifierAttributeReason(field, logicalId) {
 * and the remedy is the one that doc already gives.
 */
 function recordedArnIdentifier(options) {
-	const { resourceType, field, physicalIdShape, arnServiceSegment } = options;
+	const { resourceType, field, physicalIdShape, arnServiceSegment, physicalIdIsIdentifierFor } = options;
 	/**
 	* Is this value usable AS the type's CFn identifier?
 	*
@@ -76634,12 +76740,14 @@ function recordedArnIdentifier(options) {
 	};
 	return {
 		field,
+		...physicalIdIsIdentifierFor && { physicalIdIsIdentifierFor },
 		resolve: ({ logicalId, physicalId, attributes }) => {
 			const recorded = attributes[field];
 			if (typeof recorded === "string" && isUsableIdentifier(recorded)) return recorded.trim();
 			if (isUsableIdentifier(physicalId)) return physicalId.trim();
 			const recordedNote = typeof recorded === "string" && recorded.trim() ? `attributes.${field} is recorded as '${recorded.trim()}', which is not a ${arnServiceSegment} ARN` : `attributes.${field} is missing or empty`;
-			throw new Error(`cdkd's physical id for ${resourceType} is the composite '${physicalIdShape}', but CloudFormation IMPORT identifies the resource by its ${field}, which cdkd state does not record usably for '${logicalId}' (${recordedNote}). Re-deploy the stack once so cdkd records ${field}, then re-run cdkd export.`);
+			const shapeWord = physicalIdShape.includes("|") ? "the composite" : "the bare";
+			throw new Error(`cdkd's physical id for ${resourceType} is ${shapeWord} '${physicalIdShape}', but CloudFormation IMPORT identifies the resource by its ${field}, which cdkd state does not record usably for '${logicalId}' (${recordedNote}). Re-deploy the stack once so cdkd records ${field}, then re-run cdkd export.`);
 		}
 	};
 }
@@ -77517,6 +77625,15 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 		}
 		let resolved;
 		try {
+			const measuredRefusal = cfnRefusesImportDespiteRegistry(resourceType);
+			if (!options.skipImportSupportPreflight && measuredRefusal !== void 0) {
+				blocked.push({
+					logicalId,
+					resourceType,
+					reason: `AWS CloudFormation does not support ${resourceType} in IMPORT changesets, ${measuredRefusal}. Its registry schema passes cdkd's read-handler pre-flight, so without this list CreateChangeSet would reject the whole export with "ResourceTypes [${resourceType}] are not supported for Import" after the stack was locked. Remove the resource from the stack before exporting (it stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh. If AWS has since added IMPORT support for this type, re-run with --skip-import-support-preflight and please open a cdkd issue.`
+				});
+				continue;
+			}
 			const schemaInfo = await cachedTypeSchemaInfo(resourceType, cfnClient, identifierCache);
 			if (!options.skipImportSupportPreflight && typeIsImportUnsupported(schemaInfo)) {
 				blocked.push({
@@ -77622,7 +77739,8 @@ function groupBlockedReasons(blocked) {
 * IMPORT pre-flight and this resolution.
 */
 async function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry, backfillDeps) {
-	const compositeIdentifier = Object.hasOwn(COMPOSITE_PHYSICAL_ID_IDENTIFIERS, resourceType) ? COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType] : void 0;
+	const registered = Object.hasOwn(COMPOSITE_PHYSICAL_ID_IDENTIFIERS, resourceType) ? COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType] : void 0;
+	const compositeIdentifier = registered && entry.fields.length === 1 && registered.physicalIdIsIdentifierFor?.includes(entry.fields[0]) && !physicalId.trim().startsWith("arn:") ? void 0 : registered;
 	if (compositeIdentifier) {
 		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
 		const value = await resolveIdentifierValue(compositeIdentifier, {
@@ -77676,6 +77794,14 @@ async function cachedTypeSchemaInfo(resourceType, cfnClient, cache) {
 * legacy types) and a `handlers` block whose keys are only create / update /
 * delete (`AWS::EC2::NetworkAclEntry`).
 *
+* That list is a MEASUREMENT, not a contract, and AWS moves types off it:
+* `AWS::AppSync::ApiKey` was re-published `FULLY_MUTABLE` with a full handler
+* set by 2026-09-18 (issue #3414), so it now passes this pre-flight and is
+* resolved by its `COMPOSITE_ID_SPLITTERS` entry instead. The refusal reads
+* the LIVE response, so such a move needs no edit here — only the resolution
+* that the refusal used to shadow. `AWS::AppSync::GraphQLSchema` is still on
+* the list as of that date (no `handlers` block, `NON_PROVISIONABLE`).
+*
 * **Why the verdict needs TWO agreeing fields.** Reading "the `handlers` key is
 * missing" as a refusal on its own makes any partial or unusual response block
 * an export that works today — the one regression this pre-flight could cause,
@@ -77695,6 +77821,35 @@ function typeIsImportUnsupported(entry) {
 	return entry.importSupport === "unsupported";
 }
 /**
+* Types CloudFormation REFUSES in an IMPORT changeset although their registry
+* schema passes {@link typeIsImportUnsupported} — a `read` handler declared,
+* `ProvisioningType: FULLY_MUTABLE` — so the registry heuristic lets them
+* through and `CreateChangeSet` answers `ResourceTypes [<T>] are not
+* supported for Import` after the lock, the prompt and the template
+* preprocessing have already happened. The heuristic is NECESSARY (a type
+* with no read handler is never importable) but the 2026-09-18 measurement
+* showed it is not SUFFICIENT: AWS's supported-for-import list is a separate
+* fact the registry does not carry.
+*
+* Each entry is a dated measurement, and the map is the `blocked` message's
+* evidence. `--skip-import-support-preflight` bypasses this set together with
+* the heuristic, for the same reason it exists there: AWS may add support
+* without cdkd noticing, and the changeset is then the authority.
+*
+* | Type | measured |
+* |---|---|
+* | `AWS::AppSync::GraphQLApi` | us-east-1, 2026-09-18, the `export` integ fixture: registry `[read, create, update, delete, list]` / `FULLY_MUTABLE` / identifier `Arn`; `CreateChangeSet --change-set-type IMPORT` carrying the API (resolved to its ARN) rejected with `ResourceTypes [AWS::AppSync::GraphQLApi] are not supported for Import`. `AWS::AppSync::ApiKey` is NOT here: a standalone IMPORT changeset carrying one key with `{ApiId, ApiKeyId}` reached `CREATE_COMPLETE` the same day. (issue #3414) |
+*/
+const CFN_IMPORT_REFUSED_DESPITE_REGISTRY = /* @__PURE__ */ new Map([["AWS::AppSync::GraphQLApi", "measured in us-east-1 on 2026-09-18: the registry schema declares a read handler and FULLY_MUTABLE, yet CreateChangeSet --change-set-type IMPORT rejected the type"]]);
+/**
+* The dated measurement behind a {@link CFN_IMPORT_REFUSED_DESPITE_REGISTRY}
+* entry, or `undefined` when CloudFormation has not been measured refusing the
+* type. Exported for unit tests.
+*/
+function cfnRefusesImportDespiteRegistry(resourceType) {
+	return CFN_IMPORT_REFUSED_DESPITE_REGISTRY.get(resourceType);
+}
+/**
 * Fetch the primary identifier field names for a resource type, with a
 * hardcoded single-key fallback when DescribeType is unavailable.
 */
@@ -79227,7 +79382,7 @@ async function confirmPrompt$3(prompt) {
 	return confirmOrRefuse(prompt, { refusal: "The cdkd export confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal." });
 }
 function createExportCommand() {
-	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.", parseStackRegion).option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (AWS::ApiGatewayV2::Stage and AWS::IAM::Policy). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
+	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.", parseStackRegion).option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), AND cdkd's short list of types measured refused by CreateChangeSet despite their registry schema (AWS::AppSync::GraphQLApi), and let CreateChangeSet answer instead. Neither check is AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the check was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (AWS::ApiGatewayV2::Stage and AWS::IAM::Policy). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -81337,6 +81492,30 @@ function safeStack(value) {
 	return displayIdent(value, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
 }
 /**
+* `safe()` for an IAM ROLE ARN, the SECOND value class in this file whose
+* legitimate grammar runs past `displayIdent`'s 255-code-point default (issue
+* go-to-k/cdkd#3397 review).
+*
+* An AWS-legal role ARN reaches 613 code points — a 512-character path plus a
+* 64-character name — so `safe()` cut the one ARN this file renders at 255 and
+* appended `[cut: N more characters withheld]` INSIDE
+* `pass --role-arn to match`, the sentence whose only job is to say which role
+* to pass back. That is verbatim the failure `ROLE_ARN_MAX_CODE_POINTS`'s own
+* doc exists to prevent, and the display fence could not see it: it checks that
+* a sanitizer was CALLED, never which cap the call passed.
+*
+* A NAMED helper rather than a `maxCodePoints` argument at the site, for the
+* reason {@link safeStack} records about itself — a per-site spelling of
+* exactly this rule is what issue #3164 exists to stop, and a first cut of this
+* fix wrote one before the reference-count fence in
+* `tests/unit/cli/commands/rollback.test.ts` refused it. That refusal is the
+* fence working: it forces the question "which helper does this value belong
+* in" to be answered in code rather than in a diff.
+*/
+function safeRoleArn(value) {
+	return displayIdent(value, { maxCodePoints: 613 });
+}
+/**
 * Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
 * is threaded in because the classifier is pure (it cannot see CLI flags) and
 * the Snapshot label would otherwise promise a final snapshot the run is about
@@ -81456,7 +81635,7 @@ async function rollbackCommand(stackArg, options) {
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
 			const newestSegment = journal.segments[journal.segments.length - 1];
-			if (newestSegment.roleArn && !options.roleArn) logger.info(`Note: the failed deploy ran with --role-arn ${safe(newestSegment.roleArn)}; this rollback is running with ambient credentials (pass --role-arn to match).`);
+			if (newestSegment.roleArn && !options.roleArn) logger.info(`Note: the failed deploy ran with --role-arn ${safeRoleArn(newestSegment.roleArn)}; this rollback is running with ambient credentials (pass --role-arn to match).`);
 			logger.info(`\nRollback plan for '${safeStack(stackName)}' (${safe(region)}):`);
 			const planStateView = { ...stateResources };
 			for (let s = journal.segments.length - 1; s >= 0; s--) {
@@ -88434,11 +88613,11 @@ async function pullEcrImage(imageUri, options) {
 		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
 		if (cached && isCredentialFresh(cached)) {
 			assumed = cached;
-			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })}`);
+			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 613 })}`);
 		} else {
 			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, logger);
 			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
-			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
+			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 613 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
 		}
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
@@ -88469,7 +88648,7 @@ async function pullEcrImage(imageUri, options) {
 * mirrors the convention used by `src/utils/role-arn.ts`.
 */
 async function assumeRoleForEcr(roleArn, callerRegion, logger) {
-	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull...`);
+	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull...`);
 	const sts = new STSClient({
 		...awsClientDefaults(),
 		...callerRegion && { region: callerRegion }
@@ -88480,7 +88659,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 			RoleSessionName: `cdkd-local-ecr-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
+		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -88490,7 +88669,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
 		const reason = err instanceof Error ? err.message : String(err);
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
 	} finally {
 		sts.destroy();
 	}
@@ -90869,7 +91048,7 @@ async function assumeLambdaExecutionRole$1(roleArn, region) {
 			RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -92232,7 +92411,7 @@ async function resolvePlaceholderAccount(arn, region) {
 	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayIdent(arn, { maxCodePoints: 612 })}. Pass the ARN explicitly: --assume-task-role <arn>`);
+		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayIdent(arn, { maxCodePoints: 613 })}. Pass the ARN explicitly: --assume-task-role <arn>`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} finally {
 		sts.destroy();
@@ -92254,7 +92433,7 @@ async function assumeTaskRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-run-task-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -93736,7 +93915,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(err instanceof Error ? err.message : String(err))}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed: ${displaySafe(err instanceof Error ? err.message : String(err))}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -93793,7 +93972,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 */
 function assumeRoleFallbackWarning(args) {
 	const fallback = args.profile ? `--profile ${displayIdent(args.profile)}` : args.fallbackWithoutProfile;
-	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed for ${args.purpose}: ${displaySafe(args.error instanceof Error ? args.error.message : String(args.error))}. Falling back to ${fallback}.`;
+	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed for ${args.purpose}: ${displaySafe(args.error instanceof Error ? args.error.message : String(args.error))}. Falling back to ${fallback}.`;
 }
 /**
 * Resolve the role ARN to assume, honoring the three `--assume-role` forms.
@@ -93954,7 +94133,7 @@ async function assumeAgentCoreExecutionRole(roleArn, region) {
 			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-invoke-agentcore-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -94567,7 +94746,7 @@ async function localInvokeCommand(target, options) {
 				const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
 				if (arn) {
 					resolvedAssumeRoleArn = arn;
-					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${displayIdent(arn, { maxCodePoints: 612 })}`);
+					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${displayIdent(arn, { maxCodePoints: 613 })}`);
 				} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
 			}
 		} else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
@@ -95035,7 +95214,7 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 			assumeSucceeded = true;
 		} catch (err) {
 			const reason = err instanceof Error ? err.message : String(err);
-			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(reason)}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 613 })}) failed: ${displaySafe(reason)}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -95073,7 +95252,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-invoke-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 613 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -95194,7 +95373,7 @@ function materializeInlineCode(handler, source, fileExtension) {
 function suggestAssumeRoleFromState(state, logicalId) {
 	const logger = getLogger();
 	const roleArn = resolveExecutionRoleArnFromState(state, logicalId);
-	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${displayIdent(roleArn, { maxCodePoints: 612 })}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
+	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${displayIdent(roleArn, { maxCodePoints: 613 })}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
 }
 /**
 * Emit the "re-run with `--assume-role`" hint, if it applies.
@@ -95354,4 +95533,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-C1iVGcxJ.js.map
+//# sourceMappingURL=program-qSSjqstP.js.map