@go-to-k/cdkd 0.291.1 → 0.291.2

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-BZtFQu2S.js";
+import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-C1w5fjW1.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-GASr9bAF.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-B2qAWvE2.js → program-DnmYd7BO.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-BZtFQu2S.js";
+import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-C1w5fjW1.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-DREZx_Q6.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-IJRO7-KI.js";
+import { t as getCdkdVersion } from "./version-5OUR3VB2.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DPGr3o8N.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -88997,33 +88997,37 @@ const LAYER_ARN_PATTERN = new RegExp(`^arn:([a-z][a-z0-9-]*):lambda:([a-z]{2,}(?
 * is what the repo already does everywhere else it needs a partition, so the
 * list is not spelled a fourth time and cannot go stale here independently.
 *
-* **This fixes the PARSE only, and the download behind it is still commercial-
-* only.** `materializeLayerFromArn` (`src/local/layer-arn-materializer.ts`) is
-* a one-line shim over cdk-local, whose implementation rebuilds the ARN with a
-* hardcoded `aws`:
-*
-* ```js
-* // node_modules/cdk-local/dist/local-studio-BBtUAVNy.js:15214
-* const command = await buildGetLayerVersionCommand(
-*   `arn:aws:lambda:${layer.region}:${layer.accountId}:layer:${layer.name}`, Number(layer.version));
-* ```
-*
-* So a layer in ANY of the seven non-commercial partitions still fails at
-* `lambda:GetLayerVersion`. That includes `aws-cn` and `aws-us-gov`, which the
-* old alternation ALREADY parsed and which therefore gain nothing here. What
-* this change moves is confined to the five that previously did not parse
-* (`aws-iso`, `aws-iso-b`, `aws-iso-e`, `aws-iso-f`, `aws-eusc`): for them the
-* failure shifts from "cdkd cannot resolve locally" to an AWS-side error, so
-* the parse stops being the blocker and the message names the true one. That
-* is a real improvement and it is NOT end-to-end support; nothing in this repo
-* can make it so, and the remaining half is filed as go-to-k/cdk-local#575.
+* **The download behind it is no longer commercial-only.** This paragraph used
+* to say the opposite, citing a cdk-local build that rebuilt the ARN with a
+* hardcoded `aws` — go-to-k/cdk-local#575, which CLOSED on 2026-08-27 and
+* shipped in cdk-local 0.147.13 three minutes later. The text was wrong from
+* that moment, for USERS TOO and not only about upstream: cdkd declares
+* `cdk-local` as a plain runtime dependency with no `bundledDependencies`, so
+* a consumer resolves the RANGE rather than this repo's lockfile, and the
+* range then in effect (`^0.147.7`) already admitted 0.147.13. What lagged was
+* this repo's own pinned tree — `pnpm-lock.yaml` stayed on 0.147.7 until the
+* 0.148.4 bump on 2026-09-12 — so cdkd's CI ran the broken engine for sixteen
+* more days than anyone installing cdkd did. The claim survived all of it
+* because it cited a content-hashed bundle chunk and a line number, which
+* nobody could check (go-to-k/cdkd#3551). Measured on cdk-local 0.149.1:
+* `fetchLayerContentUrl` strips only the `:<version>` suffix from the ARN the
+* caller supplied and hands the remainder to `GetLayerVersionCommand` as
+* `LayerName`, so whatever partition the ARN names is preserved. Its own
+* refusal message spells the expected shape `arn:<partition>:lambda:...`.
+*
+* So the parse fix and the download now agree, and a layer ARN in any of the
+* eight partitions resolves as far as AWS itself allows. Re-check with
+* `grep -n 'function fetchLayerContentUrl' node_modules/cdk-local/dist/local-studio-*.js`
+* rather than by trusting this paragraph.
 *
 * Deriving also makes the pair SELF-CONSISTENT, which the alternation could
 * not: `arn:aws-cn:lambda:us-east-1:...` used to parse, pairing China's
 * partition with a commercial region. It is now REFUSED — a deliberate
-* behaviour break, asked for by issue #2143's own direction. Nothing is lost
-* by refusing early, since the commercial-ARN rebuild above means such a layer
-* could never have been fetched from the partition its ARN named.
+* behaviour break, asked for by issue #2143's own direction. The refusal stands
+* on its own terms rather than on the rebuild it used to lean on: a
+* region-partition pair that cannot both be true names a region that does not
+* exist in that partition, so the fetch could not have succeeded whatever the
+* downstream does with the ARN.
 *
 * The fallback direction is worth stating, since `derivePartitionAndUrlSuffix`
 * answers `aws` for a region it does not recognise. A brand-new COMMERCIAL
@@ -96536,20 +96540,28 @@ function collectLambdaTargetLogicalIds(frontDoor) {
 * `cdkd local start-cloudfront` REFUSES cdkd's state flags outright
 * ([#2528](https://github.com/go-to-k/cdkd/issues/2528)) because NO consumer on
 * that command's path reads a host-registered state source. `start-alb` is
-* partial, not total, so the same remedy would delete a working capability:
-*
-* - **ECS service targets DO honor `--from-state`.** `bootOneTarget` /
-*   `rollOneTarget` (`cdk-local@0.147.7`, `dist/local-studio-BBtUAVNy.js`
-*   `:26474` / `:26422`) hand `createLocalStateProvider` the FULL options bag,
+* partial, not total, so the same remedy would delete a working capability.
+*
+* Measured against the bundled engine, and cited by VERSION AND SYMBOL NAME rather
+* than by file and line: the chunk name is content-hashed and the offsets move
+* on any upstream edit, so a citation naming them is born stale at the next
+* release (go-to-k/cdkd#3551 — these lines named `cdk-local@0.147.7` and a
+* chunk that no longer exists). Re-check with
+* `grep -n 'function bootOneTarget' node_modules/cdk-local/dist/local-studio-*.js`
+* (and the same for each symbol named below).
+* Last verified: **cdk-local 0.149.1**. What splits the two target kinds:
+*
+* - **ECS service targets DO honor `--from-state`.** `bootOneTarget` and
+*   `rollOneTarget` hand `createLocalStateProvider` the FULL options bag,
 *   so cdkd's `fromState` factory is selected and the task containers'
 *   images / env / secrets / volumes resolve against S3 state.
-* - **Lambda target groups do NOT.** `resolveAlbLambdaTargetEnv` (`:26614`)
+* - **Lambda target groups do NOT.** `resolveAlbLambdaTargetEnv`
 *   rebuilds the bag it hands the shared `resolveLambdaContainerEnv` as a
 *   SIX-KEY allow-list — `fromCfnStack` / `assumeRole` / `region` / `profile` /
-*   `stackRegion` / `envVars` (`:26619-26626`) — dropping `fromState` /
+*   `stackRegion` / `envVars` — dropping `fromState` /
 *   `stateBucket` / `statePrefix`. It forwards `extraStateProviders` faithfully,
 *   but the dispatcher activates an extra provider only when `options[key]` is
-*   truthy (`:4894`), and the key it looks for is exactly the one the bag no
+*   truthy, and the key it looks for is exactly the one the bag no
 *   longer carries. So cdkd's factory is registered and never selected, and the
 *   Lambda boots with its intrinsics dropped — one WARN per variable, none of
 *   which says the flag was the problem.
@@ -96663,18 +96675,29 @@ function createLocalStartAlbCommand() {
 *
 * The `extraStateProviders` seam cdk-local's factory accepts (go-to-k/cdk-local#426)
 * is wired in below, and cdkd's S3-backed `--from-state` factory reaches it — but
-* NOTHING in this command's code path consults it. Verified against the installed
-* `cdk-local@0.147.7` bundle (`dist/local-studio-BBtUAVNy.js`), all three consumers
-* miss, for two independent reasons:
-*
-*   1. `resolveDeployedS3Origins` (`:30872`) and `attachKvsModules` (`:30680`)
+* NOTHING in this command's code path consults it. Verified against the
+* installed bundle — cited by VERSION AND SYMBOL NAME, never by file and line: the
+* chunk name is content-hashed and the offsets move on any upstream edit, so a
+* citation naming them is born stale at the next release
+* (go-to-k/cdkd#3551 — these lines named `cdk-local@0.147.7` and a chunk that
+* no longer exists). Re-check with
+* `grep -n 'function resolveDeployedS3Origins' node_modules/cdk-local/dist/local-studio-*.js`
+* (and the same for each symbol named below).
+* Last verified: **cdk-local 0.149.1**. All three consumers miss, for two
+* independent reasons:
+*
+*   1. `resolveDeployedS3Origins` and `attachKvsModules`
 *      both gate on `isCfnFlagPresent(options)` — i.e. `--from-cfn-stack`
-*      specifically — rather than on the "any state source is active" predicate
-*      `start-api` uses (`:15830`). With `--from-state` alone they return before
-*      a provider is constructed.
-*   2. `bootLambdaUrlOrigins` (`:30764`) and `bootLambdaEdgeFunctions` (`:30813`)
+*      specifically. With `--from-state` alone they return BEFORE a provider
+*      is constructed, so cdkd's registered factory is never consulted.
+*      `start-api` has no such gate: it calls `createLocalStateProvider`
+*      unconditionally and skips only on a falsy result, which is why the same
+*      flags work there. (An earlier revision called that an "any state source
+*      is active" PREDICATE — there is no such symbol; the difference is a
+*      gate versus no gate.)
+*   2. `bootLambdaUrlOrigins` and `bootLambdaEdgeFunctions`
 *      call `resolveLambdaContainerEnv` WITHOUT its fourth `extraStateProviders`
-*      parameter, and the `envOptions` bag they hand it (`:30982`) is an
+*      parameter, and the `envOptions` bag they hand it is an
 *      allow-list of five keys that drops cdkd's state fields anyway.
 *
 * So the flags parse and do nothing, on exactly the command where a user is
@@ -97741,4 +97764,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-B2qAWvE2.js.map
+//# sourceMappingURL=program-DnmYd7BO.js.map