@go-to-k/cdkd 0.290.48 → 0.290.49

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-78yzIsS6.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-usurnP89.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-DZoyIJCj.js");
+	const { buildProgram } = await import("./program-DGTp7UIn.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-Defy0tTm.js → deploy-engine-Cs0cRQIM.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-78yzIsS6.js";
+import { t as getCdkdVersion } from "./version-usurnP89.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -35,6 +35,7 @@ import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } fro
 import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBalancingV2Client } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
+import { isAbsolute as isAbsolute$1, resolve as resolve$1 } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
 import { inspect } from "node:util";
 import { hostname } from "os";
@@ -3031,18 +3032,30 @@ function resolveAssemblyPath(dir, candidate, options) {
 * empty `path.relative` means "names the directory rather than a file inside
 * it". An asset path legitimately names a DIRECTORY, so a value equal to the
 * bound is inside it and reporting it as outside would be a false statement.
+*
+* **The real-path walk runs on the ACCEPTING side too, not only to find a
+* symlink escape.** The two paths arrive here INDEPENDENTLY — the bound from
+* `-a` or the assembly's own `directoryName`, the target from the manifest —
+* so they can be two spellings of one directory (`/var/…` and `/private/var/…`
+* on macOS). `resolveAssemblyPath` never meets that, its candidate being built
+* by joining onto the base. Left alone it warned "outside the assembly" about
+* an ordinary `cdk synth --no-staging` asset, and a warning that cries wolf is
+* worse than none.
 */
 function absoluteAssemblyPathEscape(bound, absolutePath) {
 	const resolvedBound = path.resolve(bound);
 	const target = path.resolve(absolutePath);
-	if (!isInside(resolvedBound, target) && target !== resolvedBound) return {
-		contained: false,
-		escape: "lexical",
-		path: target
-	};
 	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	if (!isInside(resolvedBound, target) && target !== resolvedBound) {
+		if (realBound === void 0 || realTarget === void 0 || !isInside(realBound, realTarget) && realTarget !== realBound) return {
+			contained: false,
+			escape: "lexical",
+			path: target
+		};
+		return;
+	}
 	if (realBound !== void 0) {
-		const realTarget = resolveThroughLinks(target);
 		if (realTarget !== void 0 && !isInside(realBound, realTarget) && realTarget !== realBound) return {
 			contained: false,
 			escape: "symlink",
@@ -3052,6 +3065,38 @@ function absoluteAssemblyPathEscape(bound, absolutePath) {
 	}
 }
 /**
+* Whether `candidate` names the SAME DIRECTORY as `bound`, by any spelling.
+*
+* It lives here, beside {@link absoluteAssemblyPathEscape}, because it asks
+* that function's question one step further on and must use its machinery to
+* answer: `path.resolve` equality is a LEXICAL test, and the two paths reach a
+* caller independently — the bound from `-a` or the assembly's own
+* `directoryName`, the candidate from the manifest — so one directory has
+* several spellings. `/tmp/cdk.out` and `/private/tmp/cdk.out` on macOS;
+* `<cdk.out>/self` where `self` is a symlink to `cdk.out`; both at once.
+*
+* **A caller that re-spells this as `resolve(a) === resolve(b)` gets a test
+* that misses every spelling but one**, which is how
+* [#3532](https://github.com/go-to-k/cdkd/issues/3532)'s asset resolvers first
+* shipped their whole-assembly warning: `absoluteAssemblyPathEscape`
+* exonerates a second spelling of the bound as INSIDE — correctly — and the
+* lexical equality beside it then said "not the bound", so the one value
+* meaning "the entire assembly is this asset" passed both tests in silence.
+* Ask this instead; do not re-derive it.
+*
+* Conservative on failure: an unresolvable side answers from the lexical
+* comparison alone, so it can only ever say "not the same", never wrongly
+* claim identity.
+*/
+function namesTheSameDirectory(bound, candidate) {
+	const resolvedBound = path.resolve(bound);
+	const target = path.resolve(candidate);
+	if (target === resolvedBound) return true;
+	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
+}
+/**
 * The shared tail of every containment refusal: what the value resolved to,
 * what it escaped, and why that means the assembly is not CDK-generated. Each
 * call site supplies its own subject ("Stack 'X' has templateFile='...' which
@@ -7020,6 +7065,36 @@ function setsEqual(a, b) {
 	return true;
 }
 
+//#endregion
+//#region src/assets/absolute-asset-path-warning.ts
+/**
+* The one OTHER thing worth a line: the source resolves to the app's output
+* directory ITSELF, so the sink gets the whole assembly — every template and
+* every staged asset — rather than one asset directory.
+*
+* It is a WARNING and not a refusal for the same reason its sibling is, and it
+* must not be silent for a reason the sibling does not share: both resolvers
+* accept this value (issue
+* [#3532](https://github.com/go-to-k/cdkd/issues/3532)) because the absolute
+* arm treats the bound as inside and the two arms must agree, and because the
+* local twin legitimately bind-mounts a directory. But on THIS layer the sink
+* is an upload or an image build, so "package the whole output directory and
+* send it to a bucket this manifest named" is exactly the sentence a user
+* needs and exactly the one an accept-silently arm withholds. No real `cdk
+* synth` emits `source.path: "."`, so this costs a legitimate run nothing.
+*/
+function warnWholeAssemblyAsSource(w) {
+	getLogger().child("assets").warn(`${w.subject} has ${w.field} naming the output directory ITSELF: '${displaySafe(w.outdir)}'. cdkd will ${w.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`);
+}
+/**
+* Emit it. Deliberately `warn`, never `throw`: the one producer of this shape
+* is a real `cdk synth --no-staging`, and refusing rejects the output of a
+* documented CDK CLI flag.
+*/
+function warnAbsoluteAssetPath(w) {
+	getLogger().child("assets").warn(`${w.subject} has an absolute ${w.field} pointing outside the assembly: '${displaySafe(w.absolute)}'` + (w.escape.escape === "symlink" ? ` (through a symbolic link to '${displaySafe(w.escape.realPath)}')` : "") + `. cdkd will ${w.sink}. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted: an absolute source path is honoured as written, so nothing but this line stands between it and that step.`);
+}
+
 //#endregion
 //#region src/assets/asset-manifest-loader.ts
 /**
@@ -7034,9 +7109,80 @@ function setsEqual(a, b) {
 * primitive with the caller's own credentials, which is the harm the manifest
 * FILE's own containment check cites. One function so the loader and the
 * publisher cannot disagree about which file is published.
-*/
-function resolveFileAssetSourcePath(manifestDir, asset, assetOutdir = manifestDir) {
+*
+* **An ABSOLUTE `source.path` is HONOURED, and warned about when it leaves
+* `assetOutdir`** (issue
+* [#3532](https://github.com/go-to-k/cdkd/issues/3532)). It used to be neither
+* honoured nor refused: `resolveAssemblyPath` joins with `path.join`, which
+* does not honour a leading separator, so an absolute value was folded INTO
+* the outdir, read as CONTAINED, and died later at `statSync` with an `ENOENT`
+* naming a path that exists nowhere and that the user never wrote. Three
+* things decide the arm:
+*
+* - `cdk synth --no-staging` emits exactly this shape. Under
+*   `aws:cdk:disable-asset-staging` upstream `AssetStaging.relativeStagedPath`
+*   returns the staged path verbatim, so every `files[*].source.path` is the
+*   asset's absolute SOURCE directory, normally outside the outdir. Refusing it
+*   rejects the output of a documented CDK CLI flag.
+* - Upstream `cdk deploy` resolves the field with `path.resolve(manifestDir,
+*   p)`, which honours an absolute value and publishes it. Refusing here would
+*   make cdkd diverge from the CLI it is meant to complement.
+* - So for an ABSOLUTE value the warning is the whole signal, and no
+*   containment boundary is left.
+*
+* **State plainly what that gave up, because the first version of this comment
+* did not and was wrong.** It copied the local twin's line — "the relative arm
+* buys nothing against an adversary, who would write the absolute spelling" —
+* which is TRUE there and FALSE here, and the difference is the whole point.
+* `resolveAssetCodeDirectory` already honoured absolute paths before
+* [#3494](https://github.com/go-to-k/cdkd/issues/3494), so that change only
+* added a warning to an open door. HERE the door was SHUT: measured on
+* `path.resolve(path.join(base, c))`, `/Users/victim/.aws`, `/etc/passwd`,
+* `//etc/passwd` and `/etc/./passwd` all folded INSIDE the outdir and died at
+* `statSync`, `/../etc/passwd` was refused lexically, and a planted symlink
+* was refused by the symlink arm — so NO spelling reached an arbitrary host
+* file. Accidentally, but completely.
+*
+* What this opens, therefore, is real and new: a hand-written manifest can now
+* have any readable directory zipped to a bucket it names, with the operator's
+* credentials, gated only by the warning. It is accepted because upstream
+* `@aws-cdk/cdk-assets-lib` does the same with no containment at all
+* (`path.resolve(this.workDir, source.path)`, `private/handlers/files.js`), so
+* cdkd stays strictly MORE protective than the CLI it complements while still
+* running what `cdk synth --no-staging` emits. The relative arm still catches
+* an accidental or legacy `..` and costs nothing, which is why it stays — but
+* it is no longer a boundary against anyone who chose the value. The docs say
+* this to users in the same words; do not soften either copy.
+*/
+function resolveFileAssetSourcePath(manifestDir, asset, assetOutdir, sink) {
+	if (isAbsolute$1(asset.source.path)) {
+		const absolute = resolve$1(asset.source.path);
+		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
+		if (escape !== void 0) warnAbsoluteAssetPath({
+			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			field: "source.path",
+			absolute,
+			escape,
+			sink
+		});
+		else if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource({
+			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			field: "source.path",
+			outdir: absolute,
+			sink
+		});
+		return absolute;
+	}
 	const resolved = resolveAssemblyPath(manifestDir, asset.source.path, { containWithin: assetOutdir });
+	if (!resolved.contained && namesTheSameDirectory(assetOutdir, resolved.path)) {
+		warnWholeAssemblyAsSource({
+			subject: `File asset '${displaySafe(asset.displayName)}'`,
+			field: "source.path",
+			outdir: resolved.path,
+			sink
+		});
+		return resolved.path;
+	}
 	if (!resolved.contained) throw new Error(`File asset '${displaySafe(asset.displayName)}' has source.path='${displaySafe(asset.source.path)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
 	return resolved.path;
 }
@@ -7110,18 +7256,26 @@ var AssetManifestLoader = class {
 	/**
 	* Get asset source path (absolute path)
 	*
-	* Refuses a `source.path` resolving outside `cdkOutputDir` (issue
-	* [#3489](https://github.com/go-to-k/cdkd/issues/3489)). The manifest is
-	* assembly-supplied and `cdkd deploy -a <dir>` consumes a pre-synthesized
-	* one, so a `source.path` of `../../../home/<user>/.aws` would otherwise be
-	* packaged and uploaded to a bucket the SAME manifest names.
+	* Refuses a RELATIVE `source.path` resolving outside `assetOutdir` (issue
+	* [#3489](https://github.com/go-to-k/cdkd/issues/3489)); an ABSOLUTE one is
+	* honoured and warned about instead (issue
+	* [#3532](https://github.com/go-to-k/cdkd/issues/3532)) — see
+	* {@link resolveFileAssetSourcePath} for why the two arms differ. The
+	* manifest is assembly-supplied and `cdkd deploy -a <dir>` consumes a
+	* pre-synthesized one, so a `source.path` of `../../../home/<user>/.aws`
+	* would otherwise be packaged and uploaded to a bucket the SAME manifest
+	* names.
 	*
 	* @param cdkOutputDir CDK output directory
 	* @param asset File asset
+	* @param assetOutdir The app's outdir — the containment / warning bound.
+	*   REQUIRED for the reason {@link resolveFileAssetSourcePath}'s own
+	*   parameter is: a dropped bound narrows to the manifest directory and
+	*   silently refuses every Stage asset.
 	* @returns Absolute path to asset source
 	*/
-	getAssetSourcePath(cdkOutputDir, asset, assetOutdir) {
-		return resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir ?? cdkOutputDir);
+	getAssetSourcePath(cdkOutputDir, asset, assetOutdir, sink) {
+		return resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir, sink);
 	}
 	/**
 	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
@@ -7211,10 +7365,16 @@ var FileAssetPublisher = class {
 	* @param cdkOutputDir CDK output directory (cdk.out)
 	* @param accountId AWS account ID
 	* @param region AWS region
-	* @param profile AWS profile (optional)
+	*
+	* There is deliberately NO `profile` parameter. It was unused, and being
+	* OPTIONAL and last it let a pre-go-to-k/cdkd#3532 call
+	* `(…, accountId, region, profile)` keep compiling with the profile NAME
+	* bound to `assetOutdir` — the required bound catches a DROP, not a SWAP,
+	* so the parameter that made the swap expressible is gone instead.
 	*/
-	async publish(assetHash, asset, cdkOutputDir, accountId, region, _profile, assetOutdir) {
-		const sourcePath = resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir ?? cdkOutputDir);
+	async publish(assetHash, asset, cdkOutputDir, accountId, region, assetOutdir) {
+		const destinations = Object.values(asset.destinations).map((d) => `s3://${this.resolvePlaceholders(d.bucketName, accountId, region)}/${this.resolvePlaceholders(d.objectKey, accountId, region)}`).map((u) => displaySafe(u));
+		const sourcePath = resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir, destinations.length > 0 ? `package that path and upload it to ${destinations.join(", ")}` : "package that path, though this manifest names no destination for it");
 		for (const [, dest] of Object.entries(asset.destinations)) {
 			const bucketName = this.resolvePlaceholders(dest.bucketName, accountId, region);
 			const objectKey = this.resolvePlaceholders(dest.objectKey, accountId, region);
@@ -8548,9 +8708,12 @@ function describeDockerCapturedOutput(error, args, fallback) {
 //#endregion
 //#region src/assets/docker-build.ts
 /**
-* Where a Docker asset's build context lives, refusing a `source.directory`
-* that resolves outside `cdkOutDir` (issue
-* [#3489](https://github.com/go-to-k/cdkd/issues/3489)).
+* Where a Docker asset's build context lives, refusing a RELATIVE
+* `source.directory` that resolves outside `assetOutdir` (issue
+* [#3489](https://github.com/go-to-k/cdkd/issues/3489)) and HONOURING an
+* ABSOLUTE one with a warning when it leaves that bound (issue
+* [#3532](https://github.com/go-to-k/cdkd/issues/3532); the reasoning is in
+* `resolveFileAssetSourcePath`, and the two must not diverge).
 *
 * The field is assembly-supplied and used BOTH as the executable's cwd and as
 * the `docker build` cwd, so an escaping value sends a directory from outside
@@ -8564,11 +8727,42 @@ function describeDockerCapturedOutput(error, args, fallback) {
 * Twin of `resolveFileAssetSourcePath` and `resolveVerboseTemplatePath`.
 * Exported for unit testing.
 */
-function resolveDockerContextDirectory(manifestDir, directory, wrapError, assetOutdir = manifestDir) {
+function resolveDockerContextDirectory(manifestDir, directory, wrapError, assetOutdir, sink, assetId) {
+	if (isAbsolute$1(directory)) {
+		const absolute = resolve$1(directory);
+		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
+		if (escape !== void 0) warnAbsoluteAssetPath({
+			subject: dockerSubject(assetId),
+			field: "source.directory",
+			absolute,
+			escape,
+			sink
+		});
+		else if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource({
+			subject: dockerSubject(assetId),
+			field: "source.directory",
+			outdir: absolute,
+			sink
+		});
+		return absolute;
+	}
 	const resolved = resolveAssemblyPath(manifestDir, directory, { containWithin: assetOutdir });
+	if (!resolved.contained && namesTheSameDirectory(assetOutdir, resolved.path)) {
+		warnWholeAssemblyAsSource({
+			subject: dockerSubject(assetId),
+			field: "source.directory",
+			outdir: resolved.path,
+			sink
+		});
+		return resolved.path;
+	}
 	if (!resolved.contained) throw wrapError(`asset source.directory='${displaySafe(directory)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "build it")}`);
 	return resolved.path;
 }
+/** One spelling of the warning subject, so the two arms cannot drift. */
+function dockerSubject(assetId) {
+	return assetId === void 0 ? "A Docker asset" : `Docker asset '${displaySafe(assetId)}'`;
+}
 /**
 * Build a Docker image from a CDK asset source. Returns the local image
 * tag the caller should use for `docker tag` / `docker push` (publisher)
@@ -8587,11 +8781,11 @@ function resolveDockerContextDirectory(manifestDir, directory, wrapError, assetO
 async function buildDockerImage(asset, cdkOutDir, options) {
 	const source = asset.source;
 	const logger = getLogger().child("docker-build");
-	const contextDirectory = (directory) => resolveDockerContextDirectory(cdkOutDir, directory, options.wrapError, options.assetOutdir);
+	const contextDirectory = (directory, sink) => resolveDockerContextDirectory(cdkOutDir, directory, options.wrapError, options.assetOutdir ?? cdkOutDir, sink, options.tag);
 	if (source.executable && source.executable.length > 0) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
-		const cwd = source.directory ? contextDirectory(source.directory) : cdkOutDir;
+		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
 		const shownExecutable = redactDockerArgvValues(source.executable).join(" ");
 		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
 		let result;
@@ -8615,7 +8809,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	}
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
-	const contextDir = contextDirectory(source.directory);
+	const contextDir = contextDirectory(source.directory, "send that directory to BuildKit as the build context and bake it into the image pushed to the repository this manifest names");
 	buildArgs.push(".");
 	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displaySafe(contextDir)})`);
 	try {
@@ -8730,7 +8924,7 @@ var DockerAssetPublisher = class {
 					continue;
 				}
 				const localTag = `cdkd-asset-${assetHash}`;
-				await this.buildImage(asset, cdkOutputDir, localTag);
+				await this.buildImage(asset, cdkOutputDir, localTag, cdkOutputDir);
 				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, accountId, destRegion);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
@@ -8807,7 +9001,7 @@ var DockerAssetPublisher = class {
 	async buildImage(asset, cdkOutputDir, tag, assetOutdir) {
 		const actualTag = await buildDockerImage(asset, cdkOutputDir, {
 			tag,
-			...assetOutdir !== void 0 && { assetOutdir },
+			assetOutdir,
 			wrapError: (stderr) => new AssetError(`Docker build failed: ${stderr}`)
 		});
 		if (actualTag !== tag) {
@@ -10199,8 +10393,7 @@ var AssetPublisher = class {
 					cdkOutputDir,
 					assetOutdir,
 					accountId: options.accountId,
-					region: options.region,
-					...options.profile && { profile: options.profile }
+					region: options.region
 				}
 			});
 			nodeIds.push(nodeId);
@@ -10247,7 +10440,7 @@ var AssetPublisher = class {
 	*/
 	async executeNode(node) {
 		const data = node.data;
-		if (data.kind === "file") await this.filePublisher.publish(data.hash, data.asset, data.cdkOutputDir, data.accountId, data.region, data.profile, data.assetOutdir);
+		if (data.kind === "file") await this.filePublisher.publish(data.hash, data.asset, data.cdkOutputDir, data.accountId, data.region, data.assetOutdir);
 		else if (data.kind === "docker-build") await this.dockerPublisher.build(data.asset, data.cdkOutputDir, data.localTag, data.assetOutdir);
 		else if (data.kind === "docker-publish") await this.dockerPublisher.push(data.asset, data.accountId, data.region, data.localTag);
 		this.logger.debug(`✅ ${node.id}`);
@@ -34669,7 +34862,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CTrrSFjd.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-06Q6iut6.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -48379,4 +48572,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { yellow as $, AssemblyReader as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, ProvisioningError as Aa, resolveCaptureObservedState as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, withErrorHandling as Ba, MIGRATE_TMP_PREFIX as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, IntrinsicResolutionRefusalError as Ca, getDockerImageBySourceHash as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, MalformedProducerRecordRefusalError as Da, getLegacyStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, LockError as Ea, getDefaultStateBucketName as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, StateError as Fa, stateBucketExistenceConfirmed as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, markNonRetryable as Ga, injectiveKeyPrefix as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isRetryableTransientError as Ha, uploadCfnTemplate as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, SynthesisError as Ia, warnDeprecatedNoPrefixCliFlag as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, describeAwsFailure as Ja, decodeListingKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, markRedactedCause as Ka, producerCoordinateKey as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, formatError as La, ssmResolvedValueType as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, ResourceUpdateNotSupportedError as Ma, resolveStateBucketWithDefault as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, StackHasActiveImportsError as Na, resolveStateBucketWithDefaultAndSource as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, NestedStackChildDirectDestroyError as Oa, resolveApp as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StackTerminationProtectionError as Pa, resolveUseCdkBootstrapAssets as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, derivePartitionAndUrlSuffix as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, isCdkdError as Ra, CFN_TEMPLATE_BODY_LIMIT as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, DynamicReferenceRegionAmbiguousError as Sa, AssetManifestLoader as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LocalStartServiceError as Ta, synthesisStatusMessage as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isThrottlingError as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, isMarkedNonRetryable as Va, findLargeInlineResources as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isTransientServerError as Wa, injectiveKey as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, __exportAll as Xa, PARTITION_TABLE as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, safeStringify$1 as Ya, expectedOwnerParam as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, canonicalizeRegion as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, CdkdError as _a, redactDockerArgvValues as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, nullPrototypeRecord as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, DependencyError as ba, escapeRegExp$1 as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, renderAssemblyPathEscape as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, resolveBucketRegion as da, describeDockerExecFailure as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, failedStageNote as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, AwsClients as fa, describeDockerFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, AssetError as ga, partitionSensitiveEnv as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, setAwsClients as ha, getDockerCmd as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasPlainPrototype$1 as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ResourceTimeoutError as ja, resolveSkipPrefix as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, PartialFailureError as ka, resolveAutoAssetStorage as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, resolveAssemblyPath as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resetAwsClients as ma, formatDockerLoginError as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, defineOwnKey as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, ownValue as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, getAwsClients as pa, dockerSpawnEnvWithSensitive as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, retryClassificationText as qa, producerRecordKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, hasOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, absoluteAssemblyPathEscape as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, clearBucketRegionCache as ua, describeDockerCapturedOutput as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, ConfigError as va, runDockerForeground as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, LocalInvokeBuildError as wa, Synthesizer as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DeployCancelledError as xa, stripControlChars as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, CrossAccountSecretRefusalError as ya, runDockerStreaming as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, normalizeAwsError as za, CFN_TEMPLATE_URL_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-Defy0tTm.js.map
+//# sourceMappingURL=deploy-engine-Cs0cRQIM.js.map