@go-to-k/cdkd 0.290.42 → 0.290.43

package/dist/index.d.ts

@@ -490,6 +490,7 @@ interface StackInfo {
   artifactId: string;
   template: CloudFormationTemplate;
   assetManifestPath?: string | undefined;
+  assetOutdir?: string | undefined;
   dependencyNames: string[];
   region?: string | undefined;
   account?: string | undefined;
@@ -500,7 +501,7 @@ interface StackInfo {
 export declare class AssemblyReader {
   private logger;
   readManifest(assemblyDir: string): AssemblyManifest;
-  getAllStacks(assemblyDir: string, manifest: AssemblyManifest): StackInfo[];
+  getAllStacks(assemblyDir: string, manifest: AssemblyManifest, assetOutdir?: string): StackInfo[];
   getStack(assemblyDir: string, manifest: AssemblyManifest, stackName: string): StackInfo;
   getTemplate(assemblyDir: string, manifest: AssemblyManifest, stackName: string): CloudFormationTemplate;
   private buildAssetManifestMap;
@@ -895,6 +896,7 @@ export declare class AssetPublisher {
     profile?: string;
     nodePrefix?: string;
     redirect?: AssetRedirectMap;
+    assetOutdir?: string;
   }): string[];
   executeNode(node: WorkNode): Promise<void>;
   publishFromManifest(manifestPath: string, options?: AssetPublisherOptions): Promise<void>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAYA;;UAsBe;EAUf;EAMA;EAQA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EA2DA;EAiEA;;UA0Ce;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Te;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KCzlCU,uBAAuB;KAwrOvB,gBAAgB;;;UC3tOX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UAmDC,sBAAsB;EAmBrC;EAmCA;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EAkBA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCnxC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;qBCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;wBAerB,aAAa;wBAUb,UAAU,QAAQ;;;qBC1WrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;qBAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;qBAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;qBA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;qBAySC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;qBAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;wBAsYvB,YAAY,iBAAiB,SAAS;wBAOtC,YAAY;UA0GX;EACf;EACA;;wBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCj6BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;qBAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA0DR;MA4BA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;wBAkCc,cAAc,SAAS,kBAAkB;wBAUzC,cAAc,SAAS;wBAOvB;;;UC1rBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;wBAgEoB,oBACpB,oBACA,OAAM,6BACL;wBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KCjHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;qBAsBA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EAuD/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAiB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EAmIR,UAAU,WAAW;;;;UCzUN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;qBAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KCvSO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;qBCsYE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;mBAqBA;mBAOA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EA4IR,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA8VJ;UAiIA;UA8LA;EA+GR,iBACJ,sBACA,qBACC,QAAQ;UAiDG;UAoRA;UAgHA;UA+CN;UAyCM;UAyCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCpvHJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;qBAsNW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAoOI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UC1oBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UC0ME;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;EAkBA;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCltBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UC7Fe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;qBAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA+BhD,SACJ,mBACA,iBACC;IACD,OAAO;IACP;IACA;IAaA;;EAkHI,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EAsFtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAwChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EA8D9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UA8DA;UA+DM;UA4EA;UAwBA;UAQA;UA6FN;;;;UC9gDO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCjHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;qBAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC1PK;EAEf;EASA;;qBA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;qBCj5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC1YA,YAAY,SAAS;UAQT;EAMf;;qBASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EAkJ9C,mBAAmB,OAAO;UAuDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UA2BA;UASA;UAwBA;UAwBA;;;;KC9dE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;qBAiCQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAgYf;UAoJA;iBAkGO;UAsED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;qBC7mClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC11BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UA8EA;UA0CN;UAsBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCzlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;qBAiSW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAcA;UAUA;UAaA;UAUA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAkEnE;UAuJA;UA2EA;UAiDA;UAiBA;UAyGA;iBA6GO;UAqQP;UAoFA;UA4EA;UA8BA;UAYM;UAmEN;UAsBA;UAUA;UA0IA;UAiDA;UAmCA;UAwBA;UA2BA;UAkCM;UAwGA;UA0GN;UAiDA;UA2IM;UAkgCA;UAqpBA;UA8FA;UAuDA;UAgCA;UA+BA;UAuCN;UAoCM;UA4CA;UAoVN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAgMA;UAgpEN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UAgFA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAYA;;UAsBe;EAUf;EAMA;EAQA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EA2DA;EAiEA;;UA0Ce;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Te;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KCzlCU,uBAAuB;KAwrOvB,gBAAgB;;;UC3tOX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UAmDC,sBAAsB;EAmBrC;EAmCA;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EAkBA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCnxC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;qBCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;wBAerB,aAAa;wBAUb,UAAU,QAAQ;;;qBC1WrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;qBAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;qBAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;qBA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;qBAySC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;qBAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;wBAsYvB,YAAY,iBAAiB,SAAS;wBAOtC,YAAY;UA0GX;EACf;EACA;;wBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCj6BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;qBAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA0DR;MA4BA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;wBAkCc,cAAc,SAAS,kBAAkB;wBAUzC,cAAc,SAAS;wBAOvB;;;UC1rBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;wBAgEoB,oBACpB,oBACA,OAAM,6BACL;wBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KCjHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC3Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAwBA;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;qBAsBA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aACE,qBACA,UAAU,kBAOV,uBACC;EA4EH,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAiB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAkCA;EA2JR,UAAU,WAAW;;;;UCpaN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;qBAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KCvSO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;qBCsYE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;mBAqBA;mBAOA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EA4IR,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA8VJ;UAiIA;UA8LA;EA+GR,iBACJ,sBACA,qBACC,QAAQ;UAiDG;UAoRA;UAgHA;UA+CN;UAyCM;UAyCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCpvHJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;qBAsNW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAoOI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UC1oBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UC0ME;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;EAkBA;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCltBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UC7Fe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;qBAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA+BhD,SACJ,mBACA,iBACC;IACD,OAAO;IACP;IACA;IAaA;;EAkHI,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EAsFtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAwChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EA8D9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UA8DA;UA+DM;UA4EA;UAwBA;UAQA;UA6FN;;;;UC9gDO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UC3GH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;qBAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;IAMX;;EA+FE,YAAY,MAAM,WAAW;EA8B7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC/QK;EAEf;EASA;;qBA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;qBCj5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC1YA,YAAY,SAAS;UAQT;EAMf;;qBASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EAkJ9C,mBAAmB,OAAO;UAuDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UA2BA;UASA;UAwBA;UAwBA;;;;KC9dE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;qBAiCQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAgYf;UAoJA;iBAkGO;UAsED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;qBC7mClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC11BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UA8EA;UA0CN;UAsBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCzlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;qBAiSW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAcA;UAUA;UAaA;UAUA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAkEnE;UAuJA;UA2EA;UAiDA;UAiBA;UAyGA;iBA6GO;UAqQP;UAoFA;UA4EA;UA8BA;UAYM;UAmEN;UAsBA;UAUA;UA0IA;UAiDA;UAmCA;UAwBA;UA2BA;UAkCM;UAwGA;UA0GN;UAiDA;UA2IM;UAkgCA;UAqpBA;UA8FA;UAuDA;UAgCA;UA+BA;UAuCN;UAoCM;UA4CA;UAoVN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAgMA;UAgpEN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UAgFA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $i as AssetError, Gi as AssemblyReader, Ji as resolveBucketRegion, Lr as AssetPublisher, Qi as setAwsClients, Qn as TemplateParser, Sa as normalizeAwsError, Xi as getAwsClients, Yi as AwsClients, Zi as resetAwsClients, Zn as DagBuilder, _r as S3StateBackend, ba as formatError, ct as IAMRoleProvider, dt as ProviderRegistry, ea as CdkdError, gi as Synthesizer, gr as LockManager, la as LockError, mn as DiffCalculator, pa as ProvisioningError, qi as clearBucketRegionCache, r as DeployEngine, ra as DependencyError, ta as ConfigError, va as StateError, xa as isCdkdError, xt as CloudControlProvider, ya as SynthesisError } from "./deploy-engine-C1dgx124.js";
+import { $i as getAwsClients, Ca as formatError, Ki as AssemblyReader, Lr as AssetPublisher, Qi as AwsClients, Qn as TemplateParser, Sa as SynthesisError, Ta as normalizeAwsError, Xi as clearBucketRegionCache, Zi as resolveBucketRegion, Zn as DagBuilder, _i as Synthesizer, _r as S3StateBackend, ct as IAMRoleProvider, dt as ProviderRegistry, ea as resetAwsClients, fa as LockError, ga as ProvisioningError, gr as LockManager, ia as ConfigError, mn as DiffCalculator, na as AssetError, oa as DependencyError, r as DeployEngine, ra as CdkdError, ta as setAwsClients, wa as isCdkdError, xa as StateError, xt as CloudControlProvider } from "./deploy-engine-Bw8VoyEi.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-D-2HeLmd.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-HtHlEaZm.js → program-Bh8a5wjj.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $n as STATE_SOURCED_BASELINE_RULES, $r as validateContainerRepoName, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as retryClassificationText, Ai as CFN_TEMPLATE_BODY_LIMIT, An as malformedResourcePropertiesWarning, Ar as hasUnverifiableParameterRefusal, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as decodeListingKey, Bn as refuseMalformedState, Br as buildAssetRedirectMap, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as withErrorHandling, Ci as resolveSkipPrefix, Cn as malformedExportSourceWarning, Cr as formatLockExpiry, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as isTransientServerError, Di as stateBucketExistenceConfirmed, Dn as malformedOutputsWarning, Dr as exportNamesCarriedFrom, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as isThrottlingError, Ei as resolveUseCdkBootstrapAssets, En as malformedOutputsRefusalMessage, Er as DEFAULT_STATE_PREFIX, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Fn as refuseMalformedOutputs, Fr as orphansCarriedFrom, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as AssemblyReader, Gn as safeRegion, Gr as BOOTSTRAP_MARKER_PREFIX, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as PARTITION_TABLE, Hn as repairMalformedResourceEntriesForReadOnly, Hr as loadPublishableAssetManifest, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as injectiveKey, In as refuseMalformedOutputsForDestroy, Ir as shouldRetainResource, It as isNamelessDynamicReferenceError, J as bold, Ji as resolveBucketRegion, Jn as findSilentDropProperties, Jr as getBootstrapMarkerKey, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as processStackMessages, Kn as safeStackName, Kr as assertAssetBucketRegion, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as injectiveKeyPrefix, Ln as refuseMalformedResourceEntries, Lr as AssetPublisher, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as safeStringify, Mi as MIGRATE_TMP_PREFIX, Mn as malformedStateRefusalMessage, Mr as importableOutputs, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Ni as findLargeInlineResources, Nn as refuseDivergentRecordRegionForDestroy, Nr as isReadableBag, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as markNonRetryable, Oi as warnDeprecatedNoPrefixCliFlag, On as malformedRenderedContainersWarning, Or as hasReadableExportSet, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as uploadCfnTemplate, Pn as refuseMalformedNestedChildOutputs, Pr as orphansAfterRollback, Pt as getAccountInfo, Q as red, Qi as setAwsClients, Qn as TemplateParser, Qr as validateAssetBucketName, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as producerCoordinateKey, Rn as refuseMalformedResourcePropertiesForOrphan, Rr as stringifyValue, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as normalizeAwsError, Si as resolveCaptureObservedState, Sn as malformedExportNamesWarning, Sr as forceQuitRecoveryClause, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as isRetryableTransientError, Ti as resolveStateBucketWithDefaultAndSource, Tn as malformedOrphanRecordsWarning, Tr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as canonicalizeRegion, Un as repairMalformedResourcePropertiesForReadOnly, Ur as rewriteTemplateAssetReferences, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as expectedOwnerParam, Vn as repairMalformedOutputsForReadOnly, Vr as createAssetRedirectResolver, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as derivePartitionAndUrlSuffix, Wn as repairMalformedResourcesForReadOnly, Wr as AssetModeResolver, Wt as assertRegionMatch, X as gray, Xi as getAwsClients, Xn as withRetry, Xr as parseBootstrapMarker, Xt as readConfigString, Y as cyan, Yi as AwsClients, Yn as describeTypeWithThrottleRetry, Yr as isCrossRegionRedirect, Yt as configStringRefusal, Z as green, Zi as resetAwsClients, Zn as DagBuilder, Zr as readBootstrapMarkerBody, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as StackTerminationProtectionError, _i as synthesisStatusMessage, _n as UNREADABLE_RESOURCES_MAP_ROW, _r as S3StateBackend, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as DynamicReferenceRegionAmbiguousError, ai as dockerSpawnEnvWithSensitive, an as s3BucketDomainName, ar as dynamicReferenceTokens, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, bi as resolveApp, bn as hasReadableResources, br as buildForceUnlockCommand, bt as startInterruptWatch, c as replayFailedOperations, ca as LocalStartServiceError, ci as partitionSensitiveEnv, cn as s3BucketWebsiteUrl, cr as isSingleDynamicReferenceToken, ct as IAMRoleProvider, d as updatePartialMessage, da as NestedStackChildDirectDestroyError, di as runDockerStreaming, dn as applyCallerIdentityCredentials, dr as maskSecretsInText, dt as ProviderRegistry, ea as CdkdError, ei as buildDenyExternalAccessPolicy, en as requireConfigString, er as STATE_SOURCED_CROSS_GENERATION_RULES, et as collectDeclaredOutputNames, f as updatePartialReason, fa as PartialFailureError, fi as escapeRegExp, fn as callerEnvCredentials, fr as recordMaskOnlyValue, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as StackHasActiveImportsError, gi as Synthesizer, gn as STATE_RESOURCES_MALFORMED, gr as LockManager, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as ResourceUpdateNotSupportedError, hi as getDockerImageBySourceHash, hn as INTRINSIC_KEYS, hr as scrubResourceRecord, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as DeployCancelledError, ii as describeDockerFailure, in as s3BucketArn, ir as createSecretMasker, it as secretBearing, j as isFinalSnapshotError, ja as describeAwsFailure, ji as CFN_TEMPLATE_URL_LIMIT, jn as malformedResourcesWarning, jr as importableOutputKeys, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as markRedactedCause, ki as ssmResolvedValueType, kn as malformedResourceEntriesWarning, kr as hasReasonlessBaselineRefusal, kt as IntrinsicFunctionResolver, l as replayRollback, li as redactDockerArgvValues, ln as applyRoleArnIfSet, lr as markSameGenerationBag, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as ResourceTimeoutError, mi as AssetManifestLoader, mn as DiffCalculator, mr as redactSecretsForState, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as CrossAccountSecretRefusalError, ni as describeDockerCapturedOutput, nn as producerRegionsFromState, nr as TEMPLATE_SOURCED_RULES, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as IntrinsicResolutionRefusalError, oi as formatDockerLoginError, on as s3BucketDualStackDomainName, or as errorCauseChain, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as ProvisioningError, pi as stripControlChars, pn as envCredentialsAreAssumedRole, pr as recoverMaskedOutput, pt as createMaskedRetryLogger, q as formatResourceLine, qn as findActionableSilentDrops, qr as ensureAssetStorage, qt as configBooleanRefusal, r as DeployEngine, ri as describeDockerExecFailure, rn as withSharedDrainBudget, rr as carriesSecretMask, rt as isExportAliasCollision, s as planRollback, sa as LocalInvokeBuildError$1, si as getDockerCmd, sn as s3BucketRegionalDomainName, sr as identityKeyFor, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as buildDockerImage, tn as classifyReplaySecretRegion, tr as STATE_SOURCED_READBACK_RULES, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as MalformedProducerRecordRefusalError, ui as runDockerForeground, un as AWS_CREDENTIAL_ENV_KEYS, ur as maskSecretsInError, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, vi as getDefaultStateBucketName, vn as displayLogicalId, vr as rebuildClientForBucketRegion, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as isMarkedNonRetryable, wi as resolveStateBucketWithDefault, wn as malformedLocalOutputsWarning, wr as shellQuote, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as resolveAutoAssetStorage, xn as isReadableResourceEntry, xr as buildLockContentionMessage, xt as CloudControlProvider, y as keptWholeReasonText, ya as SynthesisError, yi as getLegacyStateBucketName, yn as hasReadableOutputs, yr as UNREPRODUCIBLE_LOCK_CLAUSE, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as producerRecordKey, zn as refuseMalformedResourcesForDestroy, zr as WorkGraph, zt as refStateLookupFromResource } from "./deploy-engine-C1dgx124.js";
+import { $ as yellow, $i as getAwsClients, $n as STATE_SOURCED_BASELINE_RULES, $r as validateContainerRepoName, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as isTransientServerError, Ai as ssmResolvedValueType, An as malformedResourcePropertiesWarning, Ar as hasUnverifiableParameterRefusal, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as producerRecordKey, Bn as refuseMalformedState, Br as buildAssetRedirectMap, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as resolveCaptureObservedState, Cn as malformedExportSourceWarning, Cr as formatLockExpiry, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as isMarkedNonRetryable, Di as resolveUseCdkBootstrapAssets, Dn as malformedOutputsWarning, Dr as exportNamesCarriedFrom, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as withErrorHandling, Ei as resolveStateBucketWithDefaultAndSource, En as malformedOutputsRefusalMessage, Er as DEFAULT_STATE_PREFIX, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as safeStringify, Fi as uploadCfnTemplate, Fn as refuseMalformedOutputs, Fr as orphansCarriedFrom, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as derivePartitionAndUrlSuffix, Gn as safeRegion, Gr as BOOTSTRAP_MARKER_PREFIX, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as expectedOwnerParam, Hn as repairMalformedResourceEntriesForReadOnly, Hr as loadPublishableAssetManifest, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, In as refuseMalformedOutputsForDestroy, Ir as shouldRetainResource, It as isNamelessDynamicReferenceError, J as bold, Ji as renderAssemblyPathEscape, Jn as findSilentDropProperties, Jr as getBootstrapMarkerKey, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as AssemblyReader, Kn as safeStackName, Kr as assertAssetBucketRegion, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as injectiveKey, Ln as refuseMalformedResourceEntries, Lr as AssetPublisher, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as markRedactedCause, Mi as CFN_TEMPLATE_URL_LIMIT, Mn as malformedStateRefusalMessage, Mr as importableOutputs, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as retryClassificationText, Ni as MIGRATE_TMP_PREFIX, Nn as refuseDivergentRecordRegionForDestroy, Nr as isReadableBag, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as isRetryableTransientError, Oi as stateBucketExistenceConfirmed, On as malformedRenderedContainersWarning, Or as hasReadableExportSet, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as describeAwsFailure, Pi as findLargeInlineResources, Pn as refuseMalformedNestedChildOutputs, Pr as orphansAfterRollback, Pt as getAccountInfo, Q as red, Qi as AwsClients, Qn as TemplateParser, Qr as validateAssetBucketName, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as injectiveKeyPrefix, Rn as refuseMalformedResourcePropertiesForOrphan, Rr as stringifyValue, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as SynthesisError, Si as resolveAutoAssetStorage, Sn as malformedExportNamesWarning, Sr as forceQuitRecoveryClause, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as normalizeAwsError, Ti as resolveStateBucketWithDefault, Tn as malformedOrphanRecordsWarning, Tr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as PARTITION_TABLE, Un as repairMalformedResourcePropertiesForReadOnly, Ur as rewriteTemplateAssetReferences, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as decodeListingKey, Vn as repairMalformedOutputsForReadOnly, Vr as createAssetRedirectResolver, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as canonicalizeRegion, Wn as repairMalformedResourcesForReadOnly, Wr as AssetModeResolver, Wt as assertRegionMatch, X as gray, Xn as withRetry, Xr as parseBootstrapMarker, Xt as readConfigString, Y as cyan, Yi as resolveAssemblyPath, Yn as describeTypeWithThrottleRetry, Yr as isCrossRegionRedirect, Yt as configStringRefusal, Z as green, Zi as resolveBucketRegion, Zn as DagBuilder, Zr as readBootstrapMarkerBody, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as ResourceTimeoutError, _i as Synthesizer, _n as UNREADABLE_RESOURCES_MAP_ROW, _r as S3StateBackend, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as CrossAccountSecretRefusalError, ai as describeDockerFailure, an as s3BucketDomainName, ar as dynamicReferenceTokens, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as StackTerminationProtectionError, bi as getLegacyStateBucketName, bn as hasReadableResources, br as buildForceUnlockCommand, bt as startInterruptWatch, c as replayFailedOperations, ca as DynamicReferenceRegionAmbiguousError, ci as getDockerCmd, cn as s3BucketWebsiteUrl, cr as isSingleDynamicReferenceToken, ct as IAMRoleProvider, d as updatePartialMessage, da as LocalStartServiceError, di as runDockerForeground, dn as applyCallerIdentityCredentials, dr as maskSecretsInText, dt as ProviderRegistry, ea as resetAwsClients, ei as buildDenyExternalAccessPolicy, en as requireConfigString, er as STATE_SOURCED_CROSS_GENERATION_RULES, et as collectDeclaredOutputNames, f as updatePartialReason, fi as runDockerStreaming, fn as callerEnvCredentials, fr as recordMaskOnlyValue, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as ProvisioningError, gi as getDockerImageBySourceHash, gn as STATE_RESOURCES_MALFORMED, gr as LockManager, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as PartialFailureError, hi as AssetManifestLoader, hn as INTRINSIC_KEYS, hr as scrubResourceRecord, ht as maskerOrIdentity, i as DeploymentEventsReader, ii as describeDockerExecFailure, in as s3BucketArn, ir as createSecretMasker, it as secretBearing, j as isFinalSnapshotError, ja as markNonRetryable, ji as CFN_TEMPLATE_BODY_LIMIT, jn as malformedResourcesWarning, jr as importableOutputKeys, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as isThrottlingError, ki as warnDeprecatedNoPrefixCliFlag, kn as malformedResourceEntriesWarning, kr as hasReasonlessBaselineRefusal, kt as IntrinsicFunctionResolver, l as replayRollback, la as IntrinsicResolutionRefusalError, li as partitionSensitiveEnv, ln as applyRoleArnIfSet, lr as markSameGenerationBag, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as NestedStackChildDirectDestroyError, mi as stripControlChars, mn as DiffCalculator, mr as redactSecretsForState, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as resolveDockerContextDirectory, nn as producerRegionsFromState, nr as TEMPLATE_SOURCED_RULES, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oi as dockerSpawnEnvWithSensitive, on as s3BucketDualStackDomainName, or as errorCauseChain, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as MalformedProducerRecordRefusalError, pi as escapeRegExp, pn as envCredentialsAreAssumedRole, pr as recoverMaskedOutput, pt as createMaskedRetryLogger, q as formatResourceLine, qi as processStackMessages, qn as findActionableSilentDrops, qr as ensureAssetStorage, qt as configBooleanRefusal, r as DeployEngine, ra as CdkdError, ri as describeDockerCapturedOutput, rn as withSharedDrainBudget, rr as carriesSecretMask, rt as isExportAliasCollision, s as planRollback, sa as DeployCancelledError, si as formatDockerLoginError, sn as s3BucketRegionalDomainName, sr as identityKeyFor, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as setAwsClients, ti as buildDockerImage, tn as classifyReplaySecretRegion, tr as STATE_SOURCED_READBACK_RULES, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as LocalInvokeBuildError$1, ui as redactDockerArgvValues, un as AWS_CREDENTIAL_ENV_KEYS, ur as maskSecretsInError, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as ResourceUpdateNotSupportedError, vi as synthesisStatusMessage, vn as displayLogicalId, vr as rebuildClientForBucketRegion, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as resolveSkipPrefix, wn as malformedLocalOutputsWarning, wr as shellQuote, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as resolveApp, xn as isReadableResourceEntry, xr as buildLockContentionMessage, xt as CloudControlProvider, y as keptWholeReasonText, ya as StackHasActiveImportsError, yi as getDefaultStateBucketName, yn as hasReadableOutputs, yr as UNREPRODUCIBLE_LOCK_CLAUSE, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as producerCoordinateKey, zn as refuseMalformedResourcesForDestroy, zr as WorkGraph, zt as refStateLookupFromResource } from "./deploy-engine-Bw8VoyEi.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-D-2HeLmd.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-Divizw1k.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Cms9Daqn.js";
+import { t as getCdkdVersion } from "./version-ChfV4K6h.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-C9R-ND4b.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -34,7 +34,6 @@ import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
-import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import { isDeepStrictEqual, promisify } from "node:util";
 import graphlib from "graphlib";
@@ -42,7 +41,6 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBCluster
 import { Command, InvalidArgumentError, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
-import { writeFileSync as writeFileSync$1 } from "fs";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
@@ -2265,7 +2263,35 @@ function countDeployableResources(template) {
 	return Object.values(template.Resources ?? {}).filter((r) => r.Type !== "AWS::CDK::Metadata").length;
 }
 /**
-* Synth command implementation
+* Where `cdkd synth --verbose` writes one stack's template, refusing a path
+* that leaves `outputDir` (issue
+* [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
+* `stackName` is the assembly manifest's own `properties.stackName`, falling
+* back to the artifact id, so it is chosen by whoever wrote the assembly — and
+* this is the ONE place cdkd turns such a string into a path it WRITES. A
+* `../../../..`-bearing name would put attacker-chosen JSON outside the output
+* directory, clobbering whatever `<name>.template.json` it can reach.
+*
+* Exported for unit testing.
+*/
+function resolveVerboseTemplatePath(outputDir, stackName) {
+	const resolved = resolveAssemblyPath(outputDir, `${stackName}.template.json`);
+	if (!resolved.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' would write its template to a path that ${renderAssemblyPathEscape(resolved, outputDir, "write it")}`);
+	let linked = false;
+	try {
+		linked = lstatSync(resolved.path).isSymbolicLink();
+	} catch {}
+	if (linked) throw new SynthesisError(`Stack '${displaySafe(stackName)}' would write its template over a symbolic link at '${displaySafe(resolved.path)}'. cdkd writes a stack's template as a regular file beside the assembly; a symbolic link there redirects the write to wherever it points, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to write it.`);
+	return resolved.path;
+}
+/**
+* Synth command implementation.
+*
+* Exported for the wiring test that pins `--verbose` writing through
+* {@link resolveVerboseTemplatePath} rather than a bare `path.join`
+* (go-to-k/cdkd#3489): the guard has its own cases, but reverting the CALL
+* SITE left the suite green.
 */
 async function synthCommand(options) {
 	const logger = getLogger();
@@ -2311,9 +2337,9 @@ async function synthCommand(options) {
 		logger.info(`    - Outputs: ${outputCount}`);
 		logger.info(`    - Has assets: ${assemblyReader.hasAssets(stack) ? "Yes" : "No"}`);
 		if (options.verbose) {
-			const templatePath = join$1(options.output, `${stack.stackName}.template.json`);
-			writeFileSync$1(templatePath, JSON.stringify(stack.template, null, 2));
-			logger.debug(`    - Template written to: ${templatePath}`);
+			const templatePath = resolveVerboseTemplatePath(options.output, stack.stackName);
+			writeFileSync(templatePath, JSON.stringify(stack.template, null, 2));
+			logger.debug(`    - Template written to: ${displaySafe(templatePath)}`);
 		}
 	}
 	logger.info(`\nOutput: ${assemblyDir}`);
@@ -3444,7 +3470,7 @@ function templateIdentity(templatePath) {
 	const dir = path.dirname(templatePath);
 	let realDir;
 	try {
-		realDir = fs.realpathSync(dir);
+		realDir = fs.realpathSync.native(dir);
 	} catch {
 		realDir = path.resolve(dir);
 	}
@@ -3567,7 +3593,16 @@ function findNestedTemplateTreeDefect(nestedTemplates, ancestorTemplatePaths = [
 						logicalId: row.logicalId,
 						assetPath: row.assetPath
 					};
-					const defect = visit(row.logicalId, path.join(dir, row.assetPath));
+					const resolved = resolveAssemblyPath(dir, row.assetPath);
+					if (!resolved.contained) return {
+						kind: "escaping-path",
+						chain: [...chain],
+						logicalId: row.logicalId,
+						assetPath: row.assetPath,
+						escape: resolved,
+						dir
+					};
+					const defect = visit(row.logicalId, resolved.path);
 					if (defect) return defect;
 				}
 			} finally {
@@ -3626,6 +3661,7 @@ function renderNestedTemplateTreeDefect(defect, stackName, action) {
 	}
 	if (defect.kind === "too-large") return `The nested template tree under stack '${displaySafe(stackName)}' has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
 	if (defect.kind === "too-deep") return `The nested template tree under stack '${displaySafe(stackName)}' nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
+	if (defect.kind === "escaping-path") return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']='${displaySafe(defect.assetPath)}' which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
 	return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']='${displaySafe(defect.assetPath)}' which is absolute. ${provenance}`;
 }
 
@@ -64984,7 +65020,9 @@ var NestedStackProvider = class {
 		const result = Object.create(null);
 		for (const { logicalId: grandLogicalId, assetPath } of listNestedTemplateRows(childTemplate)) {
 			if (isAbsoluteCrossPlatform$1(assetPath)) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`));
-			result[grandLogicalId] = path.join(dir, assetPath);
+			const resolved = resolveAssemblyPath(dir, assetPath);
+			if (!resolved.contained) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`));
+			result[grandLogicalId] = resolved.path;
 		}
 		return result;
 	}
@@ -66097,7 +66135,8 @@ async function deployCommand(stacks, options) {
 							region: assetRegion,
 							...options.profile && { profile: options.profile },
 							nodePrefix: `${stack.stackName}:`,
-							...redirect && { redirect }
+							...redirect && { redirect },
+							...stack.assetOutdir !== void 0 && { assetOutdir: stack.assetOutdir }
 						});
 						for (const id of nodeIds) stackDeps.add(id);
 					}
@@ -67869,7 +67908,9 @@ function indexNestedChildTemplates(template, templatePath) {
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
 		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
-		result[logicalId] = path.join(dir, assetPath);
+		const resolved = resolveAssemblyPath(dir, assetPath);
+		if (!resolved.contained) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`);
+		result[logicalId] = resolved.path;
 	}
 	return result;
 }
@@ -78717,8 +78758,13 @@ function readNestedChildTemplateFile(templatePath, childLogicalId) {
 * non-CDK toolchain — `path.join(dir, '/abs/foo')` would silently bypass
 * the `dir` argument).
 *
+* Also refuses a path that RESOLVES outside `templateDir`, which the absolute
+* check cannot see — `path.join` folds `..`
+* ([#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
 * Sibling of `indexGrandchildTemplatePaths` in `import.ts`. Same rationale
-* for separate definitions as `readNestedChildTemplateFile` above.
+* for separate definitions as `readNestedChildTemplateFile` above. Exported
+* for unit testing.
 */
 function indexNestedTemplatePaths(template, templateDir) {
 	const result = {};
@@ -78730,8 +78776,10 @@ function indexNestedTemplatePaths(template, templateDir) {
 		if (r.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = r.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (path.isAbsolute(assetPath)) throw new Error(`cdkd export: nested-stack '${logicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates.`);
-		result[logicalId] = path.join(templateDir, assetPath);
+		if (path.isAbsolute(assetPath)) throw new Error(`cdkd export: nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates.`);
+		const resolved = resolveAssemblyPath(templateDir, assetPath);
+		if (!resolved.contained) throw new Error(`cdkd export: nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, templateDir)}`);
+		result[logicalId] = resolved.path;
 	}
 	return result;
 }
@@ -85781,7 +85829,8 @@ async function publishAssetsCommand(stacks, options) {
 						region: stack.region || baseRegion,
 						...options.profile && { profile: options.profile },
 						nodePrefix: `${stack.stackName}:`,
-						...redirect && { redirect }
+						...redirect && { redirect },
+						...stack.assetOutdir !== void 0 && { assetOutdir: stack.assetOutdir }
 					});
 				} catch (err) {
 					if (err.code === "ENOENT") {
@@ -87597,6 +87646,11 @@ function readNestedChildTemplate(templatePath, childLogicalId) {
 * does: an absolute path indicates the synth output was hand-modified or
 * generated by a non-CDK toolchain — `path.join(dir, '/abs/foo')` would
 * silently bypass our `dir` resolution and point outside cdk.out.
+*
+* Also refuses a path that RESOLVES outside `dir`, which the absolute check
+* cannot see — `path.join` folds `..`
+* ([#3489](https://github.com/go-to-k/cdkd/issues/3489)). Exported for unit
+* testing.
 */
 function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 	const dir = path.dirname(childTemplatePath);
@@ -87605,8 +87659,10 @@ function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 		if (resource.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (path.isAbsolute(assetPath)) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${grandLogicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates.`);
-		result[grandLogicalId] = path.join(dir, assetPath);
+		if (path.isAbsolute(assetPath)) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates.`);
+		const resolved = resolveAssemblyPath(dir, assetPath);
+		if (!resolved.contained) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`);
+		result[grandLogicalId] = resolved.path;
 	}
 	return result;
 }
@@ -88825,7 +88881,7 @@ function notFoundError$1(target, stack, resources) {
 */
 function copyLayerTreeLastWins(src, dest) {
 	mkdirSync(dest, { recursive: true });
-	copyDirLastWins(realpathSync(src), dest);
+	copyDirLastWins(realpathSync.native(src), dest);
 }
 function copyDirLastWins(fromDir, toDir) {
 	for (const entry of readdirSync(fromDir, { withFileTypes: true })) {
@@ -92591,7 +92647,7 @@ function materializeInlineCode$1(handler, source, fileExtension, tmpDirsOut) {
 	const modulePath = handler.substring(0, lastDot);
 	const dir = mkdtempSync(path.join(tmpdir(), "cdkd-local-start-api-"));
 	tmpDirsOut.add(dir);
-	const filePath = path.join(dir, `${modulePath}${fileExtension}`);
+	const filePath = resolveInlineCodeFilePath(dir, modulePath, fileExtension, handler);
 	mkdirSync(path.dirname(filePath), { recursive: true });
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
@@ -93781,8 +93837,9 @@ async function prepareOneImage(task, container, options) {
 			const tag = `cdkd-local-run-task-${(image.assetHash ?? "single").slice(0, 16)}`;
 			const actualTag = await buildDockerImage(asset, cdkOutDir, {
 				tag,
+				...task.stack.assetOutdir !== void 0 && { assetOutdir: task.stack.assetOutdir },
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${container.name}' (${asset.source.directory ?? (asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0)}): ${stderr}`)
+				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${displaySafe(container.name)}' (${asset.source.directory !== void 0 ? displaySafe(asset.source.directory) : asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0}): ${displaySafe(stderr)}`)
 			});
 			if (actualTag !== tag) {
 				const tagArgs = [
@@ -93793,7 +93850,7 @@ async function prepareOneImage(task, container, options) {
 				try {
 					await runDockerStreaming(tagArgs);
 				} catch (err) {
-					throw new LocalInvokeBuildError$1(`docker tag failed re-tagging '${actualTag}' → '${tag}' for ECS container '${container.name}': ${describeDockerFailure(err, tagArgs)}`);
+					throw new LocalInvokeBuildError$1(`docker tag failed re-tagging '${displaySafe(actualTag)}' → '${displaySafe(tag)}' for ECS container '${displaySafe(container.name)}': ${displaySafe(describeDockerFailure(err, tagArgs))}`);
 				}
 			}
 			return tag;
@@ -94711,13 +94768,16 @@ async function loadAgentCoreAssetContext(args) {
 	const { resolvedTarget, resolved, stacks, cdkOutDir, assetLoader, oldAssetHash } = args;
 	const newCandidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
 	if (!newCandidate) return void 0;
+	const cdkdRecord = stacks.find((s) => s.stackName === newCandidate.stackName);
+	const manifestDir = cdkdRecord?.assetManifestPath ? dirname(cdkdRecord.assetManifestPath) : cdkOutDir;
+	const assetOutdir = cdkdRecord?.assetOutdir ?? manifestDir;
 	if (resolved.codeArtifact) {
 		if (resolved.codeArtifact.s3Source) return void 0;
-		const manifest = await assetLoader.loadManifest(cdkOutDir, newCandidate.stackName);
+		const manifest = await assetLoader.loadManifest(manifestDir, newCandidate.stackName);
 		if (!manifest) return void 0;
 		const asset = assetLoader.getFileAssets(manifest).get(resolved.codeArtifact.codeAssetHash);
 		if (!asset) return void 0;
-		const sourceDir = assetLoader.getAssetSourcePath(cdkOutDir, asset);
+		const sourceDir = assetLoader.getAssetSourcePath(manifestDir, asset, assetOutdir);
 		return {
 			...oldAssetHash !== void 0 && { oldAssetHash },
 			newAssetHash: resolved.codeArtifact.codeAssetHash,
@@ -94726,13 +94786,13 @@ async function loadAgentCoreAssetContext(args) {
 		};
 	}
 	if (resolved.containerUri === void 0) return void 0;
-	const manifest = await assetLoader.loadManifest(cdkOutDir, newCandidate.stackName);
+	const manifest = await assetLoader.loadManifest(manifestDir, newCandidate.stackName);
 	if (!manifest) return void 0;
 	const dockerImageEntry = getDockerImageBySourceHash(manifest, resolved.containerUri);
 	if (!dockerImageEntry) return void 0;
 	const newDockerImage = dockerImageEntry.asset;
 	if (!newDockerImage.source.directory) return void 0;
-	const newAssetSourceDir = resolve(cdkOutDir, newDockerImage.source.directory);
+	const newAssetSourceDir = resolveDockerContextDirectory(manifestDir, newDockerImage.source.directory, (message) => new Error(message), assetOutdir);
 	return {
 		...oldAssetHash !== void 0 && { oldAssetHash },
 		newAssetHash: dockerImageEntry.hash,
@@ -94749,6 +94809,9 @@ async function loadAgentCoreAssetContext(args) {
 * "force rebuild", which is the conservative default.
 *
 * NOT exported from `cdk-local/internal`, so copied locally.
+*
+* @internal — exported so its manifest lookup can be fenced beside
+* {@link loadAgentCoreAssetContext}'s, which is its twin.
 */
 async function deriveOldAssetHash(args) {
 	const { resolvedTarget, resolved, stacks, cdkOutDir, assetLoader } = args;
@@ -94756,7 +94819,9 @@ async function deriveOldAssetHash(args) {
 	if (resolved.containerUri === void 0) return void 0;
 	const candidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
 	if (!candidate) return void 0;
-	const manifest = await assetLoader.loadManifest(cdkOutDir, candidate.stackName);
+	const manifestFile = stacks.find((s) => s.stackName === candidate.stackName)?.assetManifestPath;
+	const manifestDir = manifestFile !== void 0 ? dirname(manifestFile) : cdkOutDir;
+	const manifest = await assetLoader.loadManifest(manifestDir, candidate.stackName);
 	if (!manifest) return void 0;
 	return getDockerImageBySourceHash(manifest, resolved.containerUri)?.hash;
 }
@@ -94841,7 +94906,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 			...options.profile && { profile: options.profile },
 			...Object.keys(context).length > 0 && { context }
 		};
-		const { stacks } = await synthesizer.synthesize(synthOpts);
+		const { stacks, assemblyDir } = await synthesizer.synthesize(synthOpts);
 		const resolvedTarget = await resolveSingleTarget(target, {
 			entries: listTargets(stacks).agentCoreRuntimes,
 			message: "Select an AgentCore Runtime to invoke",
@@ -94879,6 +94944,7 @@ async function localInvokeAgentCoreCommand(target, options) {
 		const boot = await bootAgentCoreContainer({
 			resolved,
 			options,
+			assemblyDir,
 			profileCredentials,
 			profileCredsFile,
 			stateProvider,
@@ -95089,9 +95155,9 @@ function isAgentCoreWatchEligible(protocol) {
 */
 async function bootAgentCoreContainer(args) {
 	const logger = getLogger();
-	const { resolved, options, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext, isMcp, isA2a } = args;
+	const { resolved, options, assemblyDir, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext, isMcp, isA2a } = args;
 	await resolveFromS3BucketIntrinsic(resolved, stateProvider, loadedState, imageContext);
-	const image = await resolveAgentCoreImage(resolved, options, loadedState);
+	const image = await resolveAgentCoreImage(resolved, options, assemblyDir, loadedState);
 	const { env: dockerEnv, sensitiveEnvKeys } = await buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext);
 	const hostPort = await pickFreePort();
 	const containerHost = options.containerHost;
@@ -95138,7 +95204,7 @@ async function bootAgentCoreContainer(args) {
 async function rebuildAgentCoreContainer(args) {
 	const { cleanupBefore, resolvedTarget, options, synthesizer, synthOpts, profileCredentials, profileCredsFile, stateProvider, isMcp, isA2a } = args;
 	await cleanupBefore();
-	const { stacks: newStacks } = await synthesizer.synthesize(synthOpts);
+	const { stacks: newStacks, assemblyDir: newAssemblyDir } = await synthesizer.synthesize(synthOpts);
 	const newCandidate = pickAgentCoreCandidateStack$1(resolvedTarget, newStacks);
 	const { context: newImageContext, loaded: newLoaded } = stateProvider && newCandidate ? await buildAgentCoreImageContext(newCandidate, stateProvider, options) : {
 		context: void 0,
@@ -95148,6 +95214,7 @@ async function rebuildAgentCoreContainer(args) {
 		...await bootAgentCoreContainer({
 			resolved: resolveAgentCoreTarget(resolvedTarget, newStacks, newImageContext),
 			options,
+			assemblyDir: newAssemblyDir,
 			profileCredentials,
 			profileCredsFile,
 			stateProvider,
@@ -95328,11 +95395,18 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 * `loaded` is the `--from-cfn-stack` state record (when available) — threaded
 * through so a bare `--assume-role` can resolve the execution-role ARN from
 * state for the fromS3 download.
+*
+* `assemblyDir` is the ASSEMBLY ROOT as `Synthesizer.synthesize` reported it,
+* and is the containment bound for an asset path read out of the manifest
+* (issue go-to-k/cdkd#3489). It is NOT `options.output`: under
+* `-a <pre-synthesized dir>` synthesis is skipped and the assembly root is
+* `resolve(options.app)` while `--output` keeps its `cdk.out` default, so
+* binding to `--output` would refuse every asset of an untouched assembly.
 */
-async function resolveAgentCoreImage(resolved, options, loaded) {
+async function resolveAgentCoreImage(resolved, options, assemblyDir, loaded) {
 	const logger = getLogger();
 	const architecture = platformToArchitecture(options.platform);
-	if (resolved.codeArtifact) return resolveAgentCoreCodeImage(resolved, resolved.codeArtifact, options, architecture, loaded);
+	if (resolved.codeArtifact) return resolveAgentCoreCodeImage(resolved, resolved.codeArtifact, options, architecture, assemblyDir, loaded);
 	const containerUri = resolved.containerUri;
 	if (containerUri === void 0) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' has neither a container image nor a code artifact to run.`, "LOCAL_INVOKE_AGENTCORE_NO_ARTIFACT");
 	const manifestPath = resolved.stack.assetManifestPath;
@@ -95368,7 +95442,7 @@ async function resolveAgentCoreImage(resolved, options, loaded) {
 *   run the same from-source build (generated Dockerfile → install deps → run
 *   EntryPoint).
 */
-async function resolveAgentCoreCodeImage(resolved, code, options, architecture, loaded) {
+async function resolveAgentCoreCodeImage(resolved, code, options, architecture, assemblyDir, loaded) {
 	if (code.s3Source) return resolveAgentCoreCodeImageFromS3(resolved, code, code.s3Source, options, architecture, loaded);
 	const manifestPath = resolved.stack.assetManifestPath;
 	if (!manifestPath) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' uses a code artifact, but its stack has no asset manifest in cdk.out to read the bundle source from.`, "LOCAL_INVOKE_AGENTCORE_CODE_NO_MANIFEST");
@@ -95378,8 +95452,8 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
-	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset);
-	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' code bundle source '${sourceDir}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
+	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, assemblyDir);
+	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle source '${displaySafe(sourceDir)}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
 		runtime: code.runtime,
@@ -97037,6 +97111,31 @@ function applyProfileCredentialsOverlay(env, profileCreds, assumeRoleActive) {
 	else delete env["AWS_SESSION_TOKEN"];
 }
 /**
+* Where an inline `Code.ZipFile` body is written inside `dir`, refusing a
+* `Handler` whose module path escapes it (issue
+* [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+*
+* `Handler` is template-supplied, and `materializeInlineCode` turned it into a
+* FILENAME and then `mkdirSync(dirname, { recursive: true })` + `writeFileSync`
+* — so `Handler: '../../victim/evil.handler'` wrote attacker-chosen JavaScript
+* to an arbitrary host path. Measured: the file was created outside the temp
+* directory. That is a write, not the "we run their handler in a container"
+* trade cdkd already accepts.
+*
+* `dir` is a temp directory cdkd just created rather than the assembly, but
+* the containment question is identical and `resolveAssemblyPath` answers it
+* unchanged: `mkdtemp` sits under `/var/folders/...`, reached through macOS's
+* `/var -> /private/var` link, and the helper realpaths BOTH sides so that is
+* a no-op. Only the refusal's provenance differs, so it is passed explicitly.
+*
+* Exported for unit testing.
+*/
+function resolveInlineCodeFilePath(dir, modulePath, fileExtension, handler) {
+	const resolved = resolveAssemblyPath(dir, `${modulePath}${fileExtension}`);
+	if (!resolved.contained) throw new Error(`Handler '${displaySafe(handler)}' names a module path that ${renderAssemblyPathEscape(resolved, dir, "materialize it", "A Handler's module path names a file inside the function's own code directory; one that leaves it would write the inline Code.ZipFile body to an arbitrary path on this machine. Refusing to materialize it.")}`);
+	return resolved.path;
+}
+/**
 * Materialize an inline Lambda body (`Code.ZipFile`) to a tmpdir and
 * return the directory the container should mount at /var/task. The
 * filename is derived from the function's Handler property and the
@@ -97058,9 +97157,19 @@ function materializeInlineCode(handler, source, fileExtension) {
 	if (lastDot <= 0) throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
 	const dir = mkdtempSync(path.join(tmpdir(), "cdkd-local-invoke-"));
-	const filePath = path.join(dir, `${modulePath}${fileExtension}`);
-	mkdirSync(path.dirname(filePath), { recursive: true });
-	writeFileSync(filePath, source, "utf-8");
+	try {
+		const filePath = resolveInlineCodeFilePath(dir, modulePath, fileExtension, handler);
+		mkdirSync(path.dirname(filePath), { recursive: true });
+		writeFileSync(filePath, source, "utf-8");
+	} catch (e) {
+		try {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+		throw e;
+	}
 	return dir;
 }
 /**
@@ -97234,4 +97343,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-HtHlEaZm.js.map
+//# sourceMappingURL=program-Bh8a5wjj.js.map