@go-to-k/cdkd 0.291.0 → 0.291.1

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-9CxYEFh_.js";
+import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-BZtFQu2S.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-GASr9bAF.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-Cs7N6T4j.js → program-B2qAWvE2.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-9CxYEFh_.js";
+import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-BZtFQu2S.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-kDWCn_Jq.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CZ5keDoC.js";
+import { t as getCdkdVersion } from "./version-DREZx_Q6.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-IJRO7-KI.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -88774,8 +88774,53 @@ function extractImageLambdaProperties(args) {
 * `tests/unit/local/local-asset-code-path-containment.test.ts`.
 *
 * Exported for unit testing and for `local-start-api.ts`'s copy of the caller.
-*/
-function resolveAssetCodeDirectory(manifestDir, assetPath, wrapError, assetOutdir, logicalId) {
+*
+* **Takes EVERY value in a bag** (issue
+* [#3549](https://github.com/go-to-k/cdkd/issues/3549)), the shape
+* [#3544](https://github.com/go-to-k/cdkd/issues/3544) gave the Docker twin
+* and for a sharper version of the same reason. Positionals left FOUR `string`
+* parameters in a row, of which two pairs were transposable and neither
+* typechecked its way out:
+*
+* - `(manifestDir, assetPath)` — the assembly-derived base a relative value
+*   resolves FROM, and the attacker-chosen `aws:asset:path`. Swapping them
+*   changes which directory is resolved and which is contained, for a value
+*   that is then BIND-MOUNTED into a running container. That is the Docker
+*   twin's hazard with a worse sink.
+* - `(assetOutdir, logicalId)` — the containment bound and a string that only
+*   ever reaches a message. A swap made the bound `path.resolve('<logicalId>')`
+*   under the cwd, disjoint from the base, so every path was refused. Caught
+*   by tests rather than by the compiler, which is the wrong layer for it.
+*
+* Required-ness caught a DROP and never a TRANSPOSITION, and the DROP it
+* caught was real: a call passing the outdir as the fourth argument and
+* stopping there used to COMPILE while binding the outdir to `logicalId` and
+* defaulting the bound to `manifestDir`, silently reinstating
+* [#3493](https://github.com/go-to-k/cdkd/issues/3493)'s B1 and naming the
+* Lambda `/path/to/cdk.out` in the refusal.
+*
+* **What the bag does NOT do, because the first draft of this paragraph
+* claimed it did**: it does not make a transposition inexpressible, only
+* UNORDERABLE. `{ manifestDir: assetOutdir, assetOutdir: manifestDir }` still
+* compiles, and it is still the defect. Measured: that spelling passes every
+* source-level check and reds three cases in
+* `local-asset-code-path-containment.test.ts`, which drives both call sites
+* against a STAGE manifest where the two directories differ. The compiler now
+* rejects the silent POSITIONAL swap; that suite is what catches the named
+* one. Do not write a source scan that claims to cover this — one was written
+* here and passed the real defect.
+*
+* Two conventions this comment has learned the hard way and keeps:
+*
+* - **No count of how often it has been wrong.** Such a tally ticks on the
+*   very revision that fixes it, so it is stale the moment it is written —
+*   which is how the previous one went stale.
+* - **Do not cite the Docker twin's PARAMETER LIST.** Two revisions did, and
+*   both were left describing a signature that had moved. Citing its SHAPE
+*   (an options bag, as above) is stable; citing its arguments is not.
+*/
+function resolveAssetCodeDirectory(opts) {
+	const { manifestDir, assetPath, wrapError, assetOutdir, logicalId } = opts;
 	if (isAbsolute(assetPath)) {
 		const absolute = resolve(assetPath);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
@@ -88841,7 +88886,13 @@ function resolveAssetCodePath$1(stack, logicalId, resource) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
 	if (typeof assetPath !== "string" || assetPath.length === 0) throw new LocalInvokeResolutionError(`Lambda '${displaySafe(logicalId)}' has no Metadata['aws:asset:path']. cdkd local invoke needs this hint to find the local asset directory. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
-	const abs = resolveAssetCodeDirectory(manifestDir, assetPath, (message) => new LocalInvokeResolutionError(message), assetOutdir, logicalId);
+	const abs = resolveAssetCodeDirectory({
+		manifestDir,
+		assetPath,
+		wrapError: (message) => new LocalInvokeResolutionError(message),
+		assetOutdir,
+		logicalId
+	});
 	if (!existsSync(abs) || !statSync(abs).isDirectory()) throw new LocalInvokeResolutionError(`Lambda '${displaySafe(logicalId)}' asset directory '${displaySafe(abs)}' does not exist or is not a directory. Re-synthesize the app and retry.`);
 	return abs;
 }
@@ -92919,7 +92970,13 @@ function resolveAssetCodePath(stack, logicalId, resource) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
 	if (typeof assetPath !== "string" || assetPath.length === 0) throw new Error(`Lambda '${displaySafe(logicalId)}' has no Metadata['aws:asset:path']. cdkd local start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
-	return resolveAssetCodeDirectory(manifestDir, assetPath, (message) => new Error(message), assetOutdir, logicalId);
+	return resolveAssetCodeDirectory({
+		manifestDir,
+		assetPath,
+		wrapError: (message) => new Error(message),
+		assetOutdir,
+		logicalId
+	});
 }
 /**
 * Print the discovered route table to stdout. Format mirrors the spec
@@ -95106,7 +95163,10 @@ async function loadAgentCoreAssetContext(args) {
 		if (!manifest) return void 0;
 		const asset = assetLoader.getFileAssets(manifest).get(resolved.codeArtifact.codeAssetHash);
 		if (!asset) return void 0;
-		const sourceDir = assetLoader.getAssetSourcePath(manifestDir, asset, assetOutdir, "copy that directory into the running container's workspace");
+		const sourceDir = assetLoader.getAssetSourcePath(manifestDir, asset, {
+			assetOutdir,
+			sink: "copy that directory into the running container's workspace"
+		});
 		return {
 			...oldAssetHash !== void 0 && { oldAssetHash },
 			newAssetHash: resolved.codeArtifact.codeAssetHash,
@@ -95121,7 +95181,13 @@ async function loadAgentCoreAssetContext(args) {
 	if (!dockerImageEntry) return void 0;
 	const newDockerImage = dockerImageEntry.asset;
 	if (!newDockerImage.source.directory) return void 0;
-	const newAssetSourceDir = resolveDockerContextDirectory(manifestDir, newDockerImage.source.directory, (message) => new Error(message), assetOutdir, "copy that directory into the running container's workspace");
+	const newAssetSourceDir = resolveDockerContextDirectory({
+		manifestDir,
+		directory: newDockerImage.source.directory,
+		wrapError: (message) => new Error(message),
+		assetOutdir,
+		sink: "copy that directory into the running container's workspace"
+	});
 	return {
 		...oldAssetHash !== void 0 && { oldAssetHash },
 		newAssetHash: dockerImageEntry.hash,
@@ -95781,7 +95847,10 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
-	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, assemblyDir, "read that directory and build a local image from it");
+	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
+		assetOutdir: assemblyDir,
+		sink: "read that directory and build a local image from it"
+	});
 	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle source '${displaySafe(sourceDir)}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
@@ -97672,4 +97741,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Cs7N6T4j.js.map
+//# sourceMappingURL=program-B2qAWvE2.js.map