@go-to-k/cdkd 0.291.1 → 0.291.3

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-BZtFQu2S.js";
+import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-5fdODHji.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-GASr9bAF.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-B2qAWvE2.js → program-lTNPrurx.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-BZtFQu2S.js";
+import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-5fdODHji.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-DREZx_Q6.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-IJRO7-KI.js";
+import { t as getCdkdVersion } from "./version-BKm47b9j.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CLqajoRp.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2046,6 +2046,99 @@ function createBootstrapCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/stack-matcher.ts
+/**
+* Match stacks against user-supplied name patterns.
+*
+* Patterns are evaluated against two fields:
+*
+* - `stackName` — the physical CloudFormation stack name (e.g. `MyStage-MyStack`)
+* - `displayName` — the hierarchical CDK path (e.g. `MyStage/MyStack`); falls
+*   back to `stackName` when the assembly does not carry one
+*
+* Routing is decided by whether the pattern contains `/`:
+*
+* - Pattern contains `/` → matched only against `displayName` (a `/` cannot
+*   appear in a CloudFormation stack name, so this is unambiguous)
+* - Pattern contains no `/` → matched only against `stackName`
+*
+* Wildcards (`*`) are supported in either case. Results are de-duplicated by
+* `stackName`, so a pattern that incidentally matches the same stack via both
+* fields is returned only once.
+*/
+function matchStacks(stacks, patterns) {
+	if (patterns.length === 0) return [];
+	const seen = /* @__PURE__ */ new Set();
+	const result = [];
+	for (const stack of stacks) if (patterns.some((pattern) => stackMatchesPattern(stack, pattern)) && !seen.has(stack.stackName)) {
+		seen.add(stack.stackName);
+		result.push(stack);
+	}
+	return result;
+}
+/**
+* Render a stack for diagnostic messages. When `displayName` differs from the
+* physical name, both are shown so the user can see which forms are valid as
+* patterns (e.g. `MyStage-Api (MyStage/Api)`).
+*
+* Both names come from the Cloud Assembly, and every one of this helper's
+* render sites interpolates the result into PROSE cdkd authors — `Available:
+* ...`, `Multiple stacks found: ...`, `Publishing assets for stack: ...`, the
+* last of which prints on a normal run rather than only on an error. So they
+* go through `displayIdent` ([#3277](https://github.com/go-to-k/cdkd/issues/3277)):
+* a `stackName` carrying `ESC [ 2 K` plus a carriage return ERASES cdkd's own
+* line and a newline forges a second one, and a value carrying quotes and
+* periods writes a cdkd-sounding clause.
+*
+* It is the identity on every legitimate `stackName` — a CloudFormation stack
+* name is `[A-Za-z0-9-]`, inside `PLAIN_IDENT`. It is NOT the identity on
+* every legitimate `displayName`: CDK sets that to the construct path, and
+* `constructs` rewrites only `/` in an id, so `new Stack(app, 'My Stack')` is
+* legal and prints `MyStack ("My Stack")`. Those quotes are not part of any
+* pattern, in a clause whose job is to say which forms ARE valid as patterns —
+* accepted, because the alternative is `displaySafe`, which passes the quotes
+* and spaces a crafted value needs, and the pattern still matches the RAW
+* name either way (`matchStacks` never sees this rendering).
+*
+* Sanitizing HERE rather than at the call sites is what keeps the rule whole:
+* the sites include `scrub.ts` and `destroy.ts`, which this change does not
+* touch, and a rule widened by hand is how the class survived being closed
+* twice already.
+*/
+function describeStack(stack) {
+	const name = displayIdent(stack.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayIdent(stack.displayName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`;
+	return name;
+}
+/**
+* The message a command raises when SELECTION came back empty — shared by
+* `deploy`, `diff`, `list` and `publish-assets`, which all built the identical
+* string by hand.
+*
+* `assembly` is required AND so is its `failedStages` member, which is the
+* point: a Stage that failed to load dropped every stack under it from
+* `available`, so "no stacks matching" names the wrong problem unless the
+* failure is reported with it (issue
+* [#3482](https://github.com/go-to-k/cdkd/issues/3482)). A REQUIRED member,
+* not an optional one — `{ failedStages?: ... }` accepts `{}`, so it fences
+* the argument while leaving the content unfenced, which is the wiring hole
+* this signature exists to close. `SynthesisResult.failedStages` is required
+* for the same reason, so passing the result satisfies it and an ad-hoc `{}`
+* does not.
+*
+* What it does NOT fence: a caller passing a STALE or empty list. That is
+* behaviour, not shape, and it is covered by a wiring test per command.
+*/
+function renderNoStackMatch(patterns, available, assembly) {
+	return (patterns.length > 0 ? `No stacks matching ${patterns.join(", ")} found in assembly. ` + (available.length > 0 ? `Available: ${available.map(describeStack).join(", ")}` : "The assembly has no stacks") : "No stacks found in assembly") + failedStageNote(patterns, assembly.failedStages);
+}
+function stackMatchesPattern(stack, pattern) {
+	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
+	if (pattern.includes("*")) return new RegExp("^" + pattern.replace(/\*/g, ".*") + "$").test(target);
+	return target === pattern;
+}
+
 //#endregion
 //#region src/utils/yaml.ts
 /**
@@ -2293,7 +2386,7 @@ function resolveVerboseTemplatePath(outputDir, stackName) {
 * (go-to-k/cdkd#3489): the guard has its own cases, but reverting the CALL
 * SITE left the suite green.
 */
-async function synthCommand(options) {
+async function synthCommand(stackPatterns, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	reserveStdoutForPayload();
@@ -2319,7 +2412,11 @@ async function synthCommand(options) {
 		...options.profile && { profile: options.profile },
 		...Object.keys(context).length > 0 && { context }
 	};
-	const { stacks, assemblyDir } = await synthesizer.synthesize(synthOptions);
+	const result = await synthesizer.synthesize(synthOptions);
+	const { stacks: allStacks, assemblyDir } = result;
+	const selected = stackPatterns.length > 0 ? matchStacks(allStacks, stackPatterns) : allStacks;
+	if (selected.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
+	const stacks = selected;
 	processStackMessages(stacks, logger, {
 		strict: options.strict === true,
 		ignoreErrors: options.ignoreErrors === true
@@ -2327,8 +2424,9 @@ async function synthCommand(options) {
 	if (stacks.length === 1) {
 		const template = stacks[0].template;
 		process.stdout.write(toYaml(template));
-	}
-	logger.info(`\n${green("✓")} ${bold("Synthesis complete!")} Found ${stacks.length} stack(s):`);
+	} else logger.info(`Supply a stack id (${stacks.map(describeStack).join(", ")}) to display its template.`);
+	const found = stacks.length === allStacks.length ? `Found ${stacks.length} stack(s):` : `Found ${stacks.length} of ${allStacks.length} stack(s):`;
+	logger.info(`\n${green("✓")} ${bold("Synthesis complete!")} ${found}`);
 	for (const stack of stacks) {
 		const resourceCount = countDeployableResources(stack.template);
 		const outputCount = Object.keys(stack.template.Outputs ?? {}).length;
@@ -2348,7 +2446,7 @@ async function synthCommand(options) {
 * Create synth command
 */
 function createSynthCommand() {
-	const cmd = new Command("synth").description("Synthesize CDK app to CloudFormation template").action(withErrorHandling(synthCommand));
+	const cmd = new Command("synth").description("Synthesize CDK app to CloudFormation template").argument("[stacks...]", "Stack name(s) whose template to print. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*'). Every stack is synthesized either way -- the selection decides what reaches stdout.").action(withErrorHandling(synthCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -2359,99 +2457,6 @@ function createSynthCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/cli/stack-matcher.ts
-/**
-* Match stacks against user-supplied name patterns.
-*
-* Patterns are evaluated against two fields:
-*
-* - `stackName` — the physical CloudFormation stack name (e.g. `MyStage-MyStack`)
-* - `displayName` — the hierarchical CDK path (e.g. `MyStage/MyStack`); falls
-*   back to `stackName` when the assembly does not carry one
-*
-* Routing is decided by whether the pattern contains `/`:
-*
-* - Pattern contains `/` → matched only against `displayName` (a `/` cannot
-*   appear in a CloudFormation stack name, so this is unambiguous)
-* - Pattern contains no `/` → matched only against `stackName`
-*
-* Wildcards (`*`) are supported in either case. Results are de-duplicated by
-* `stackName`, so a pattern that incidentally matches the same stack via both
-* fields is returned only once.
-*/
-function matchStacks(stacks, patterns) {
-	if (patterns.length === 0) return [];
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const stack of stacks) if (patterns.some((pattern) => stackMatchesPattern(stack, pattern)) && !seen.has(stack.stackName)) {
-		seen.add(stack.stackName);
-		result.push(stack);
-	}
-	return result;
-}
-/**
-* Render a stack for diagnostic messages. When `displayName` differs from the
-* physical name, both are shown so the user can see which forms are valid as
-* patterns (e.g. `MyStage-Api (MyStage/Api)`).
-*
-* Both names come from the Cloud Assembly, and every one of this helper's
-* render sites interpolates the result into PROSE cdkd authors — `Available:
-* ...`, `Multiple stacks found: ...`, `Publishing assets for stack: ...`, the
-* last of which prints on a normal run rather than only on an error. So they
-* go through `displayIdent` ([#3277](https://github.com/go-to-k/cdkd/issues/3277)):
-* a `stackName` carrying `ESC [ 2 K` plus a carriage return ERASES cdkd's own
-* line and a newline forges a second one, and a value carrying quotes and
-* periods writes a cdkd-sounding clause.
-*
-* It is the identity on every legitimate `stackName` — a CloudFormation stack
-* name is `[A-Za-z0-9-]`, inside `PLAIN_IDENT`. It is NOT the identity on
-* every legitimate `displayName`: CDK sets that to the construct path, and
-* `constructs` rewrites only `/` in an id, so `new Stack(app, 'My Stack')` is
-* legal and prints `MyStack ("My Stack")`. Those quotes are not part of any
-* pattern, in a clause whose job is to say which forms ARE valid as patterns —
-* accepted, because the alternative is `displaySafe`, which passes the quotes
-* and spaces a crafted value needs, and the pattern still matches the RAW
-* name either way (`matchStacks` never sees this rendering).
-*
-* Sanitizing HERE rather than at the call sites is what keeps the rule whole:
-* the sites include `scrub.ts` and `destroy.ts`, which this change does not
-* touch, and a rule widened by hand is how the class survived being closed
-* twice already.
-*/
-function describeStack(stack) {
-	const name = displayIdent(stack.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
-	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayIdent(stack.displayName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`;
-	return name;
-}
-/**
-* The message a command raises when SELECTION came back empty — shared by
-* `deploy`, `diff`, `list` and `publish-assets`, which all built the identical
-* string by hand.
-*
-* `assembly` is required AND so is its `failedStages` member, which is the
-* point: a Stage that failed to load dropped every stack under it from
-* `available`, so "no stacks matching" names the wrong problem unless the
-* failure is reported with it (issue
-* [#3482](https://github.com/go-to-k/cdkd/issues/3482)). A REQUIRED member,
-* not an optional one — `{ failedStages?: ... }` accepts `{}`, so it fences
-* the argument while leaving the content unfenced, which is the wiring hole
-* this signature exists to close. `SynthesisResult.failedStages` is required
-* for the same reason, so passing the result satisfies it and an ad-hoc `{}`
-* does not.
-*
-* What it does NOT fence: a caller passing a STALE or empty list. That is
-* behaviour, not shape, and it is covered by a wiring test per command.
-*/
-function renderNoStackMatch(patterns, available, assembly) {
-	return (patterns.length > 0 ? `No stacks matching ${patterns.join(", ")} found in assembly. ` + (available.length > 0 ? `Available: ${available.map(describeStack).join(", ")}` : "The assembly has no stacks") : "No stacks found in assembly") + failedStageNote(patterns, assembly.failedStages);
-}
-function stackMatchesPattern(stack, pattern) {
-	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
-	if (pattern.includes("*")) return new RegExp("^" + pattern.replace(/\*/g, ".*") + "$").test(target);
-	return target === pattern;
-}
-
 //#endregion
 //#region src/cli/commands/list.ts
 /**
@@ -88997,33 +89002,37 @@ const LAYER_ARN_PATTERN = new RegExp(`^arn:([a-z][a-z0-9-]*):lambda:([a-z]{2,}(?
 * is what the repo already does everywhere else it needs a partition, so the
 * list is not spelled a fourth time and cannot go stale here independently.
 *
-* **This fixes the PARSE only, and the download behind it is still commercial-
-* only.** `materializeLayerFromArn` (`src/local/layer-arn-materializer.ts`) is
-* a one-line shim over cdk-local, whose implementation rebuilds the ARN with a
-* hardcoded `aws`:
-*
-* ```js
-* // node_modules/cdk-local/dist/local-studio-BBtUAVNy.js:15214
-* const command = await buildGetLayerVersionCommand(
-*   `arn:aws:lambda:${layer.region}:${layer.accountId}:layer:${layer.name}`, Number(layer.version));
-* ```
-*
-* So a layer in ANY of the seven non-commercial partitions still fails at
-* `lambda:GetLayerVersion`. That includes `aws-cn` and `aws-us-gov`, which the
-* old alternation ALREADY parsed and which therefore gain nothing here. What
-* this change moves is confined to the five that previously did not parse
-* (`aws-iso`, `aws-iso-b`, `aws-iso-e`, `aws-iso-f`, `aws-eusc`): for them the
-* failure shifts from "cdkd cannot resolve locally" to an AWS-side error, so
-* the parse stops being the blocker and the message names the true one. That
-* is a real improvement and it is NOT end-to-end support; nothing in this repo
-* can make it so, and the remaining half is filed as go-to-k/cdk-local#575.
+* **The download behind it is no longer commercial-only.** This paragraph used
+* to say the opposite, citing a cdk-local build that rebuilt the ARN with a
+* hardcoded `aws` — go-to-k/cdk-local#575, which CLOSED on 2026-08-27 and
+* shipped in cdk-local 0.147.13 three minutes later. The text was wrong from
+* that moment, for USERS TOO and not only about upstream: cdkd declares
+* `cdk-local` as a plain runtime dependency with no `bundledDependencies`, so
+* a consumer resolves the RANGE rather than this repo's lockfile, and the
+* range then in effect (`^0.147.7`) already admitted 0.147.13. What lagged was
+* this repo's own pinned tree — `pnpm-lock.yaml` stayed on 0.147.7 until the
+* 0.148.4 bump on 2026-09-12 — so cdkd's CI ran the broken engine for sixteen
+* more days than anyone installing cdkd did. The claim survived all of it
+* because it cited a content-hashed bundle chunk and a line number, which
+* nobody could check (go-to-k/cdkd#3551). Measured on cdk-local 0.149.1:
+* `fetchLayerContentUrl` strips only the `:<version>` suffix from the ARN the
+* caller supplied and hands the remainder to `GetLayerVersionCommand` as
+* `LayerName`, so whatever partition the ARN names is preserved. Its own
+* refusal message spells the expected shape `arn:<partition>:lambda:...`.
+*
+* So the parse fix and the download now agree, and a layer ARN in any of the
+* eight partitions resolves as far as AWS itself allows. Re-check with
+* `grep -n 'function fetchLayerContentUrl' node_modules/cdk-local/dist/local-studio-*.js`
+* rather than by trusting this paragraph.
 *
 * Deriving also makes the pair SELF-CONSISTENT, which the alternation could
 * not: `arn:aws-cn:lambda:us-east-1:...` used to parse, pairing China's
 * partition with a commercial region. It is now REFUSED — a deliberate
-* behaviour break, asked for by issue #2143's own direction. Nothing is lost
-* by refusing early, since the commercial-ARN rebuild above means such a layer
-* could never have been fetched from the partition its ARN named.
+* behaviour break, asked for by issue #2143's own direction. The refusal stands
+* on its own terms rather than on the rebuild it used to lean on: a
+* region-partition pair that cannot both be true names a region that does not
+* exist in that partition, so the fetch could not have succeeded whatever the
+* downstream does with the ARN.
 *
 * The fallback direction is worth stating, since `derivePartitionAndUrlSuffix`
 * answers `aws` for a region it does not recognise. A brand-new COMMERCIAL
@@ -96536,20 +96545,28 @@ function collectLambdaTargetLogicalIds(frontDoor) {
 * `cdkd local start-cloudfront` REFUSES cdkd's state flags outright
 * ([#2528](https://github.com/go-to-k/cdkd/issues/2528)) because NO consumer on
 * that command's path reads a host-registered state source. `start-alb` is
-* partial, not total, so the same remedy would delete a working capability:
-*
-* - **ECS service targets DO honor `--from-state`.** `bootOneTarget` /
-*   `rollOneTarget` (`cdk-local@0.147.7`, `dist/local-studio-BBtUAVNy.js`
-*   `:26474` / `:26422`) hand `createLocalStateProvider` the FULL options bag,
+* partial, not total, so the same remedy would delete a working capability.
+*
+* Measured against the bundled engine, and cited by VERSION AND SYMBOL NAME rather
+* than by file and line: the chunk name is content-hashed and the offsets move
+* on any upstream edit, so a citation naming them is born stale at the next
+* release (go-to-k/cdkd#3551 — these lines named `cdk-local@0.147.7` and a
+* chunk that no longer exists). Re-check with
+* `grep -n 'function bootOneTarget' node_modules/cdk-local/dist/local-studio-*.js`
+* (and the same for each symbol named below).
+* Last verified: **cdk-local 0.149.1**. What splits the two target kinds:
+*
+* - **ECS service targets DO honor `--from-state`.** `bootOneTarget` and
+*   `rollOneTarget` hand `createLocalStateProvider` the FULL options bag,
 *   so cdkd's `fromState` factory is selected and the task containers'
 *   images / env / secrets / volumes resolve against S3 state.
-* - **Lambda target groups do NOT.** `resolveAlbLambdaTargetEnv` (`:26614`)
+* - **Lambda target groups do NOT.** `resolveAlbLambdaTargetEnv`
 *   rebuilds the bag it hands the shared `resolveLambdaContainerEnv` as a
 *   SIX-KEY allow-list — `fromCfnStack` / `assumeRole` / `region` / `profile` /
-*   `stackRegion` / `envVars` (`:26619-26626`) — dropping `fromState` /
+*   `stackRegion` / `envVars` — dropping `fromState` /
 *   `stateBucket` / `statePrefix`. It forwards `extraStateProviders` faithfully,
 *   but the dispatcher activates an extra provider only when `options[key]` is
-*   truthy (`:4894`), and the key it looks for is exactly the one the bag no
+*   truthy, and the key it looks for is exactly the one the bag no
 *   longer carries. So cdkd's factory is registered and never selected, and the
 *   Lambda boots with its intrinsics dropped — one WARN per variable, none of
 *   which says the flag was the problem.
@@ -96663,18 +96680,29 @@ function createLocalStartAlbCommand() {
 *
 * The `extraStateProviders` seam cdk-local's factory accepts (go-to-k/cdk-local#426)
 * is wired in below, and cdkd's S3-backed `--from-state` factory reaches it — but
-* NOTHING in this command's code path consults it. Verified against the installed
-* `cdk-local@0.147.7` bundle (`dist/local-studio-BBtUAVNy.js`), all three consumers
-* miss, for two independent reasons:
-*
-*   1. `resolveDeployedS3Origins` (`:30872`) and `attachKvsModules` (`:30680`)
+* NOTHING in this command's code path consults it. Verified against the
+* installed bundle — cited by VERSION AND SYMBOL NAME, never by file and line: the
+* chunk name is content-hashed and the offsets move on any upstream edit, so a
+* citation naming them is born stale at the next release
+* (go-to-k/cdkd#3551 — these lines named `cdk-local@0.147.7` and a chunk that
+* no longer exists). Re-check with
+* `grep -n 'function resolveDeployedS3Origins' node_modules/cdk-local/dist/local-studio-*.js`
+* (and the same for each symbol named below).
+* Last verified: **cdk-local 0.149.1**. All three consumers miss, for two
+* independent reasons:
+*
+*   1. `resolveDeployedS3Origins` and `attachKvsModules`
 *      both gate on `isCfnFlagPresent(options)` — i.e. `--from-cfn-stack`
-*      specifically — rather than on the "any state source is active" predicate
-*      `start-api` uses (`:15830`). With `--from-state` alone they return before
-*      a provider is constructed.
-*   2. `bootLambdaUrlOrigins` (`:30764`) and `bootLambdaEdgeFunctions` (`:30813`)
+*      specifically. With `--from-state` alone they return BEFORE a provider
+*      is constructed, so cdkd's registered factory is never consulted.
+*      `start-api` has no such gate: it calls `createLocalStateProvider`
+*      unconditionally and skips only on a falsy result, which is why the same
+*      flags work there. (An earlier revision called that an "any state source
+*      is active" PREDICATE — there is no such symbol; the difference is a
+*      gate versus no gate.)
+*   2. `bootLambdaUrlOrigins` and `bootLambdaEdgeFunctions`
 *      call `resolveLambdaContainerEnv` WITHOUT its fourth `extraStateProviders`
-*      parameter, and the `envOptions` bag they hand it (`:30982`) is an
+*      parameter, and the `envOptions` bag they hand it is an
 *      allow-list of five keys that drops cdkd's state fields anyway.
 *
 * So the flags parse and do nothing, on exactly the command where a user is
@@ -97741,4 +97769,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-B2qAWvE2.js.map
+//# sourceMappingURL=program-lTNPrurx.js.map