@go-to-k/cdkd 0.291.0 → 0.291.2

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-9CxYEFh_.js";
+import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-C1w5fjW1.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-GASr9bAF.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-Cs7N6T4j.js → program-DnmYd7BO.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-9CxYEFh_.js";
+import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-C1w5fjW1.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-kDWCn_Jq.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CZ5keDoC.js";
+import { t as getCdkdVersion } from "./version-5OUR3VB2.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DPGr3o8N.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -88774,8 +88774,53 @@ function extractImageLambdaProperties(args) {
 * `tests/unit/local/local-asset-code-path-containment.test.ts`.
 *
 * Exported for unit testing and for `local-start-api.ts`'s copy of the caller.
-*/
-function resolveAssetCodeDirectory(manifestDir, assetPath, wrapError, assetOutdir, logicalId) {
+*
+* **Takes EVERY value in a bag** (issue
+* [#3549](https://github.com/go-to-k/cdkd/issues/3549)), the shape
+* [#3544](https://github.com/go-to-k/cdkd/issues/3544) gave the Docker twin
+* and for a sharper version of the same reason. Positionals left FOUR `string`
+* parameters in a row, of which two pairs were transposable and neither
+* typechecked its way out:
+*
+* - `(manifestDir, assetPath)` — the assembly-derived base a relative value
+*   resolves FROM, and the attacker-chosen `aws:asset:path`. Swapping them
+*   changes which directory is resolved and which is contained, for a value
+*   that is then BIND-MOUNTED into a running container. That is the Docker
+*   twin's hazard with a worse sink.
+* - `(assetOutdir, logicalId)` — the containment bound and a string that only
+*   ever reaches a message. A swap made the bound `path.resolve('<logicalId>')`
+*   under the cwd, disjoint from the base, so every path was refused. Caught
+*   by tests rather than by the compiler, which is the wrong layer for it.
+*
+* Required-ness caught a DROP and never a TRANSPOSITION, and the DROP it
+* caught was real: a call passing the outdir as the fourth argument and
+* stopping there used to COMPILE while binding the outdir to `logicalId` and
+* defaulting the bound to `manifestDir`, silently reinstating
+* [#3493](https://github.com/go-to-k/cdkd/issues/3493)'s B1 and naming the
+* Lambda `/path/to/cdk.out` in the refusal.
+*
+* **What the bag does NOT do, because the first draft of this paragraph
+* claimed it did**: it does not make a transposition inexpressible, only
+* UNORDERABLE. `{ manifestDir: assetOutdir, assetOutdir: manifestDir }` still
+* compiles, and it is still the defect. Measured: that spelling passes every
+* source-level check and reds three cases in
+* `local-asset-code-path-containment.test.ts`, which drives both call sites
+* against a STAGE manifest where the two directories differ. The compiler now
+* rejects the silent POSITIONAL swap; that suite is what catches the named
+* one. Do not write a source scan that claims to cover this — one was written
+* here and passed the real defect.
+*
+* Two conventions this comment has learned the hard way and keeps:
+*
+* - **No count of how often it has been wrong.** Such a tally ticks on the
+*   very revision that fixes it, so it is stale the moment it is written —
+*   which is how the previous one went stale.
+* - **Do not cite the Docker twin's PARAMETER LIST.** Two revisions did, and
+*   both were left describing a signature that had moved. Citing its SHAPE
+*   (an options bag, as above) is stable; citing its arguments is not.
+*/
+function resolveAssetCodeDirectory(opts) {
+	const { manifestDir, assetPath, wrapError, assetOutdir, logicalId } = opts;
 	if (isAbsolute(assetPath)) {
 		const absolute = resolve(assetPath);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
@@ -88841,7 +88886,13 @@ function resolveAssetCodePath$1(stack, logicalId, resource) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
 	if (typeof assetPath !== "string" || assetPath.length === 0) throw new LocalInvokeResolutionError(`Lambda '${displaySafe(logicalId)}' has no Metadata['aws:asset:path']. cdkd local invoke needs this hint to find the local asset directory. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
-	const abs = resolveAssetCodeDirectory(manifestDir, assetPath, (message) => new LocalInvokeResolutionError(message), assetOutdir, logicalId);
+	const abs = resolveAssetCodeDirectory({
+		manifestDir,
+		assetPath,
+		wrapError: (message) => new LocalInvokeResolutionError(message),
+		assetOutdir,
+		logicalId
+	});
 	if (!existsSync(abs) || !statSync(abs).isDirectory()) throw new LocalInvokeResolutionError(`Lambda '${displaySafe(logicalId)}' asset directory '${displaySafe(abs)}' does not exist or is not a directory. Re-synthesize the app and retry.`);
 	return abs;
 }
@@ -88946,33 +88997,37 @@ const LAYER_ARN_PATTERN = new RegExp(`^arn:([a-z][a-z0-9-]*):lambda:([a-z]{2,}(?
 * is what the repo already does everywhere else it needs a partition, so the
 * list is not spelled a fourth time and cannot go stale here independently.
 *
-* **This fixes the PARSE only, and the download behind it is still commercial-
-* only.** `materializeLayerFromArn` (`src/local/layer-arn-materializer.ts`) is
-* a one-line shim over cdk-local, whose implementation rebuilds the ARN with a
-* hardcoded `aws`:
-*
-* ```js
-* // node_modules/cdk-local/dist/local-studio-BBtUAVNy.js:15214
-* const command = await buildGetLayerVersionCommand(
-*   `arn:aws:lambda:${layer.region}:${layer.accountId}:layer:${layer.name}`, Number(layer.version));
-* ```
-*
-* So a layer in ANY of the seven non-commercial partitions still fails at
-* `lambda:GetLayerVersion`. That includes `aws-cn` and `aws-us-gov`, which the
-* old alternation ALREADY parsed and which therefore gain nothing here. What
-* this change moves is confined to the five that previously did not parse
-* (`aws-iso`, `aws-iso-b`, `aws-iso-e`, `aws-iso-f`, `aws-eusc`): for them the
-* failure shifts from "cdkd cannot resolve locally" to an AWS-side error, so
-* the parse stops being the blocker and the message names the true one. That
-* is a real improvement and it is NOT end-to-end support; nothing in this repo
-* can make it so, and the remaining half is filed as go-to-k/cdk-local#575.
+* **The download behind it is no longer commercial-only.** This paragraph used
+* to say the opposite, citing a cdk-local build that rebuilt the ARN with a
+* hardcoded `aws` — go-to-k/cdk-local#575, which CLOSED on 2026-08-27 and
+* shipped in cdk-local 0.147.13 three minutes later. The text was wrong from
+* that moment, for USERS TOO and not only about upstream: cdkd declares
+* `cdk-local` as a plain runtime dependency with no `bundledDependencies`, so
+* a consumer resolves the RANGE rather than this repo's lockfile, and the
+* range then in effect (`^0.147.7`) already admitted 0.147.13. What lagged was
+* this repo's own pinned tree — `pnpm-lock.yaml` stayed on 0.147.7 until the
+* 0.148.4 bump on 2026-09-12 — so cdkd's CI ran the broken engine for sixteen
+* more days than anyone installing cdkd did. The claim survived all of it
+* because it cited a content-hashed bundle chunk and a line number, which
+* nobody could check (go-to-k/cdkd#3551). Measured on cdk-local 0.149.1:
+* `fetchLayerContentUrl` strips only the `:<version>` suffix from the ARN the
+* caller supplied and hands the remainder to `GetLayerVersionCommand` as
+* `LayerName`, so whatever partition the ARN names is preserved. Its own
+* refusal message spells the expected shape `arn:<partition>:lambda:...`.
+*
+* So the parse fix and the download now agree, and a layer ARN in any of the
+* eight partitions resolves as far as AWS itself allows. Re-check with
+* `grep -n 'function fetchLayerContentUrl' node_modules/cdk-local/dist/local-studio-*.js`
+* rather than by trusting this paragraph.
 *
 * Deriving also makes the pair SELF-CONSISTENT, which the alternation could
 * not: `arn:aws-cn:lambda:us-east-1:...` used to parse, pairing China's
 * partition with a commercial region. It is now REFUSED — a deliberate
-* behaviour break, asked for by issue #2143's own direction. Nothing is lost
-* by refusing early, since the commercial-ARN rebuild above means such a layer
-* could never have been fetched from the partition its ARN named.
+* behaviour break, asked for by issue #2143's own direction. The refusal stands
+* on its own terms rather than on the rebuild it used to lean on: a
+* region-partition pair that cannot both be true names a region that does not
+* exist in that partition, so the fetch could not have succeeded whatever the
+* downstream does with the ARN.
 *
 * The fallback direction is worth stating, since `derivePartitionAndUrlSuffix`
 * answers `aws` for a region it does not recognise. A brand-new COMMERCIAL
@@ -92919,7 +92974,13 @@ function resolveAssetCodePath(stack, logicalId, resource) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
 	if (typeof assetPath !== "string" || assetPath.length === 0) throw new Error(`Lambda '${displaySafe(logicalId)}' has no Metadata['aws:asset:path']. cdkd local start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
-	return resolveAssetCodeDirectory(manifestDir, assetPath, (message) => new Error(message), assetOutdir, logicalId);
+	return resolveAssetCodeDirectory({
+		manifestDir,
+		assetPath,
+		wrapError: (message) => new Error(message),
+		assetOutdir,
+		logicalId
+	});
 }
 /**
 * Print the discovered route table to stdout. Format mirrors the spec
@@ -95106,7 +95167,10 @@ async function loadAgentCoreAssetContext(args) {
 		if (!manifest) return void 0;
 		const asset = assetLoader.getFileAssets(manifest).get(resolved.codeArtifact.codeAssetHash);
 		if (!asset) return void 0;
-		const sourceDir = assetLoader.getAssetSourcePath(manifestDir, asset, assetOutdir, "copy that directory into the running container's workspace");
+		const sourceDir = assetLoader.getAssetSourcePath(manifestDir, asset, {
+			assetOutdir,
+			sink: "copy that directory into the running container's workspace"
+		});
 		return {
 			...oldAssetHash !== void 0 && { oldAssetHash },
 			newAssetHash: resolved.codeArtifact.codeAssetHash,
@@ -95121,7 +95185,13 @@ async function loadAgentCoreAssetContext(args) {
 	if (!dockerImageEntry) return void 0;
 	const newDockerImage = dockerImageEntry.asset;
 	if (!newDockerImage.source.directory) return void 0;
-	const newAssetSourceDir = resolveDockerContextDirectory(manifestDir, newDockerImage.source.directory, (message) => new Error(message), assetOutdir, "copy that directory into the running container's workspace");
+	const newAssetSourceDir = resolveDockerContextDirectory({
+		manifestDir,
+		directory: newDockerImage.source.directory,
+		wrapError: (message) => new Error(message),
+		assetOutdir,
+		sink: "copy that directory into the running container's workspace"
+	});
 	return {
 		...oldAssetHash !== void 0 && { oldAssetHash },
 		newAssetHash: dockerImageEntry.hash,
@@ -95781,7 +95851,10 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkdError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
-	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, assemblyDir, "read that directory and build a local image from it");
+	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
+		assetOutdir: assemblyDir,
+		sink: "read that directory and build a local image from it"
+	});
 	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle source '${displaySafe(sourceDir)}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
@@ -96467,20 +96540,28 @@ function collectLambdaTargetLogicalIds(frontDoor) {
 * `cdkd local start-cloudfront` REFUSES cdkd's state flags outright
 * ([#2528](https://github.com/go-to-k/cdkd/issues/2528)) because NO consumer on
 * that command's path reads a host-registered state source. `start-alb` is
-* partial, not total, so the same remedy would delete a working capability:
-*
-* - **ECS service targets DO honor `--from-state`.** `bootOneTarget` /
-*   `rollOneTarget` (`cdk-local@0.147.7`, `dist/local-studio-BBtUAVNy.js`
-*   `:26474` / `:26422`) hand `createLocalStateProvider` the FULL options bag,
+* partial, not total, so the same remedy would delete a working capability.
+*
+* Measured against the bundled engine, and cited by VERSION AND SYMBOL NAME rather
+* than by file and line: the chunk name is content-hashed and the offsets move
+* on any upstream edit, so a citation naming them is born stale at the next
+* release (go-to-k/cdkd#3551 — these lines named `cdk-local@0.147.7` and a
+* chunk that no longer exists). Re-check with
+* `grep -n 'function bootOneTarget' node_modules/cdk-local/dist/local-studio-*.js`
+* (and the same for each symbol named below).
+* Last verified: **cdk-local 0.149.1**. What splits the two target kinds:
+*
+* - **ECS service targets DO honor `--from-state`.** `bootOneTarget` and
+*   `rollOneTarget` hand `createLocalStateProvider` the FULL options bag,
 *   so cdkd's `fromState` factory is selected and the task containers'
 *   images / env / secrets / volumes resolve against S3 state.
-* - **Lambda target groups do NOT.** `resolveAlbLambdaTargetEnv` (`:26614`)
+* - **Lambda target groups do NOT.** `resolveAlbLambdaTargetEnv`
 *   rebuilds the bag it hands the shared `resolveLambdaContainerEnv` as a
 *   SIX-KEY allow-list — `fromCfnStack` / `assumeRole` / `region` / `profile` /
-*   `stackRegion` / `envVars` (`:26619-26626`) — dropping `fromState` /
+*   `stackRegion` / `envVars` — dropping `fromState` /
 *   `stateBucket` / `statePrefix`. It forwards `extraStateProviders` faithfully,
 *   but the dispatcher activates an extra provider only when `options[key]` is
-*   truthy (`:4894`), and the key it looks for is exactly the one the bag no
+*   truthy, and the key it looks for is exactly the one the bag no
 *   longer carries. So cdkd's factory is registered and never selected, and the
 *   Lambda boots with its intrinsics dropped — one WARN per variable, none of
 *   which says the flag was the problem.
@@ -96594,18 +96675,29 @@ function createLocalStartAlbCommand() {
 *
 * The `extraStateProviders` seam cdk-local's factory accepts (go-to-k/cdk-local#426)
 * is wired in below, and cdkd's S3-backed `--from-state` factory reaches it — but
-* NOTHING in this command's code path consults it. Verified against the installed
-* `cdk-local@0.147.7` bundle (`dist/local-studio-BBtUAVNy.js`), all three consumers
-* miss, for two independent reasons:
-*
-*   1. `resolveDeployedS3Origins` (`:30872`) and `attachKvsModules` (`:30680`)
+* NOTHING in this command's code path consults it. Verified against the
+* installed bundle — cited by VERSION AND SYMBOL NAME, never by file and line: the
+* chunk name is content-hashed and the offsets move on any upstream edit, so a
+* citation naming them is born stale at the next release
+* (go-to-k/cdkd#3551 — these lines named `cdk-local@0.147.7` and a chunk that
+* no longer exists). Re-check with
+* `grep -n 'function resolveDeployedS3Origins' node_modules/cdk-local/dist/local-studio-*.js`
+* (and the same for each symbol named below).
+* Last verified: **cdk-local 0.149.1**. All three consumers miss, for two
+* independent reasons:
+*
+*   1. `resolveDeployedS3Origins` and `attachKvsModules`
 *      both gate on `isCfnFlagPresent(options)` — i.e. `--from-cfn-stack`
-*      specifically — rather than on the "any state source is active" predicate
-*      `start-api` uses (`:15830`). With `--from-state` alone they return before
-*      a provider is constructed.
-*   2. `bootLambdaUrlOrigins` (`:30764`) and `bootLambdaEdgeFunctions` (`:30813`)
+*      specifically. With `--from-state` alone they return BEFORE a provider
+*      is constructed, so cdkd's registered factory is never consulted.
+*      `start-api` has no such gate: it calls `createLocalStateProvider`
+*      unconditionally and skips only on a falsy result, which is why the same
+*      flags work there. (An earlier revision called that an "any state source
+*      is active" PREDICATE — there is no such symbol; the difference is a
+*      gate versus no gate.)
+*   2. `bootLambdaUrlOrigins` and `bootLambdaEdgeFunctions`
 *      call `resolveLambdaContainerEnv` WITHOUT its fourth `extraStateProviders`
-*      parameter, and the `envOptions` bag they hand it (`:30982`) is an
+*      parameter, and the `envOptions` bag they hand it is an
 *      allow-list of five keys that drops cdkd's state fields anyway.
 *
 * So the flags parse and do nothing, on exactly the command where a user is
@@ -97672,4 +97764,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Cs7N6T4j.js.map
+//# sourceMappingURL=program-DnmYd7BO.js.map