@go-to-k/cdkd 0.291.15 → 0.291.17

package/dist/{program-CGsbW6A4.js → program-hXXls0hg.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as normalizeAwsError, $i as uploadCfnTemplate, $n as repairMalformedResourcePropertiesForReadOnly, $r as createAssetRedirectResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as warnFinchArgvExposure, An as malformedOutputsRefusalMessage, Ar as S3StateBackend, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as resolveAutoAssetStorage, Bn as refuseMalformedOrphansForDestroy, Br as hasReadableExportSet, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as getDockerCmd, Cn as isReadableResourceEntry, Cr as pathCrossesDottedKey, Ct as UNSPECIFIED_SKIP_REASON, D as PRE_DELETE_SNAPSHOT_TYPES, Da as resetAwsClients, Di as redactDockerArgvValues, Dn as malformedOrphanRecordsWarning, Dr as redactSecretsForState, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as getAwsClients, Ei as partitionSensitiveEnv, En as malformedLocalOutputsWarning, Er as recoverMaskedOutput, Et as isWaitAbandonedError, F as extractDeploymentEventError, Fa as DeployCancelledError, Fi as Synthesizer, Fn as malformedResourcesWarning, Fr as forceQuitRecoveryClause, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as ResourceTimeoutError, Gi as resolveUseCdkBootstrapAssets, Gn as refuseMalformedResourceEntries, Gr as isReadableBag, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as NestedStackChildDirectDestroyError, Hi as resolveSkipPrefix, Hn as refuseMalformedOutputs, Hr as hasUnverifiableParameterRefusal, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as DynamicReferenceRegionAmbiguousError, Ii as synthesisStatusMessage, In as malformedStateRefusalMessage, Ir as formatLockExpiry, It as isNamelessDynamicReferenceError, J as bold, Ja as StackTerminationProtectionError, Ji as ssmResolvedValueType, Jn as refuseMalformedResourcesForDestroy, Jr as shouldRetainResource, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as ResourceUpdateNotSupportedError, Ki as stateBucketExistenceConfirmed, Kn as refuseMalformedResourceEntriesForOrphan, Kr as orphansAfterRollback, Kt as coerceCfnInteger, L as planOrphanAdoption, La as IntrinsicResolutionRefusalError, Li as getDefaultStateBucketName, Ln as refuseDivergentRecordRegionForDestroy, Lr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as stripControlChars, Mn as malformedRenderedContainersWarning, Mr as UNREPRODUCIBLE_LOCK_CLAUSE, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as CrossAccountSecretRefusalError, Ni as AssetManifestLoader, Nn as malformedResourceEntriesWarning, Nr as buildForceUnlockCommand, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as runWithStackAwsClients, Oi as runDockerForeground, On as malformedOrphansRefusalMessage, Or as scrubResourceRecord, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as getDockerImageBySourceHash, Pn as malformedResourcePropertiesWarning, Pr as buildLockContentionMessage, Pt as getAccountInfo, Q as red, Qi as findLargeInlineResources, Qn as repairMalformedResourceEntriesForReadOnly, Qr as buildAssetRedirectMap, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as LocalInvokeBuildError$1, Ri as getLegacyStateBucketName, Rn as refuseMalformedNestedChildOutputs, Rr as DEFAULT_STATE_PREFIX, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as resolveAssemblyPath, Si as formatDockerLoginError, Sn as hasReadableResources, Sr as maskSecretsInText, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as AwsClients, Ti as isMalformedEnvKey, Tn as malformedExportSourceWarning, Tr as recordMaskOnlyValuesIn, Tt as deleteSkipReason, U as coerceWarmThroughput$1, Ua as PartialFailureError, Ui as resolveStateBucketWithDefault, Un as refuseMalformedOutputsForDestroy, Ur as importableOutputKeys, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as MalformedProducerRecordRefusalError, Vi as resolveCaptureObservedState, Vn as refuseMalformedOrphansForOrphan, Vr as hasReasonlessBaselineRefusal, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as ProvisioningError, Wi as resolveStateBucketWithDefaultAndSource, Wn as refuseMalformedResourceAttributesForOrphan, Wr as importableOutputs, Wt as assertRegionMatch, X as gray, Xa as SynthesisError, Xi as CFN_TEMPLATE_URL_LIMIT, Xn as repairMalformedOrphansForReadOnly, Xr as stringifyValue, Xt as readConfigString, Y as cyan, Yi as CFN_TEMPLATE_BODY_LIMIT, Yn as refuseMalformedState, Yr as AssetPublisher, Yt as configStringRefusal, Z as green, Zi as MIGRATE_TMP_PREFIX, Zn as repairMalformedOutputsForReadOnly, Zr as WorkGraph, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as nullPrototypeRecord, _i as describeDockerCapturedOutput, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as decodeListingKey, ai as ensureAssetStorage, an as s3BucketDomainName, ao as isThrottlingError, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as displayAssemblyPath, bi as dockerSpawnEnvWithSensitive, bn as hasReadableOrphans, br as markSameGenerationBag, bt as startInterruptWatch, c as replayFailedOperations, ca as canonicalizeRegion, ci as parseBootstrapMarker, cn as s3BucketWebsiteUrl, co as markRedactedCause, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as failedStageNote, di as validateContainerRepoName, dn as applyCallerIdentityCredentials, do as safeStringify, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ei as loadPublishableAssetManifest, en as requireConfigString, eo as withErrorHandling, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as globMatches, fi as buildDenyExternalAccessPolicy, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as hasPlainPrototype, gi as warnManifestExecutable, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as hasOwnKey, hi as resolveDockerContextDirectory, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as producerRecordKey, ii as assertAssetBucketRegion, in as s3BucketArn, io as isRetryableTransientError, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as CdkdError, ji as escapeRegExp, jn as malformedOutputsWarning, jr as rebuildClientForBucketRegion, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as setAwsClients, ki as runDockerStreaming, kn as malformedOrphansWarning, kr as LockManager, kt as IntrinsicFunctionResolver, l as replayRollback, la as derivePartitionAndUrlSuffix, li as readBootstrapMarkerBody, ln as applyRoleArnIfSet, lo as retryClassificationText, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as defineOwnKey, mi as buildDockerImage, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as injectiveKeyPrefix, ni as AssetModeResolver, nn as producerRegionsFromState, no as shellQuote, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as expectedOwnerParam, oi as getBootstrapMarkerKey, on as s3BucketDualStackDomainName, oo as isTransientServerError, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as processStackMessages, pi as assertCdkLocalDockerContextContained, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as StackHasActiveImportsError, qi as warnDeprecatedNoPrefixCliFlag, qn as refuseMalformedResourcePropertiesForOrphan, qr as orphansCarriedFrom, qt as configBooleanRefusal, r as DeployEngine, ra as producerCoordinateKey, ri as BOOTSTRAP_MARKER_PREFIX, rn as withSharedDrainBudget, ro as isMarkedNonRetryable, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as PARTITION_TABLE, si as isCrossRegionRedirect, sn as s3BucketRegionalDomainName, so as markNonRetryable, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as injectiveKey, ti as rewriteTemplateAssetReferences, tn as classifyReplaySecretRegion, to as pasteableCommand, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as AssemblyReader, ui as validateAssetBucketName, un as AWS_CREDENTIAL_ENV_KEYS, uo as describeAwsFailure, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as ownValue, vi as describeDockerExecFailure, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as resolveBucketRegion, wi as isDockerClientEnvKey, wn as malformedExportNamesWarning, wr as recordMaskOnlyValue, wt as deleteIndeterminateGuards, x as bindingSkippedOutputs, xa as renderAssemblyPathEscape, xi as finchSecretArgvRefusal, xn as hasReadableOutputs, xr as maskSecretsInError, xt as CloudControlProvider, y as keptWholeReasonText, ya as absoluteAssemblyPathEscape, yi as describeDockerFailure, yn as displayLogicalId, yr as isUncertifiedBaselineMaskPosition, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as LocalStartServiceError, zi as resolveApp, zn as refuseMalformedOrphans, zr as exportNamesCarriedFrom, zt as refStateLookupFromResource } from "./deploy-engine-Bt0ttXRi.js";
+import { $ as yellow, $i as findLargeInlineResources, $n as repairMalformedOutputsForReadOnly, $r as WorkGraph, $t as replayWarn, A as createPreDeleteFinalSnapshot, Aa as setAwsClients, Ai as runDockerStreaming, An as malformedOrphansRefusalMessage, Ar as scrubResourceRecord, At as isTerminationProtectionPropagationError, B as isStatefulRecreateTargetSync, Ba as LocalStartServiceError, Bi as resolveApp, Bn as refuseMalformedNestedChildOutputs, Br as DEFAULT_STATE_PREFIX, Bt as parameterTypeMayLoseSecretIdentity, C as namesAnyDeclaredParameter, Ca as resolveAssemblyPath, Ci as formatDockerLoginError, Cn as hasReadableOutputs, Cr as maskSecretsInError, Ct as CloudControlProvider, D as PRE_DELETE_SNAPSHOT_TYPES, Da as getAwsClients, Di as partitionSensitiveEnv, Dn as malformedExportSourceWarning, Dr as recordMaskOnlyValuesIn, Dt as deleteSkipReason, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as AwsClients, Ei as isMalformedEnvKey, En as malformedExportNamesWarning, Er as recordMaskOnlyValue, Et as deleteIndeterminateGuards, F as extractDeploymentEventError, Fi as getDockerImageBySourceHash, Fn as malformedResourceEntriesWarning, Fr as buildForceUnlockCommand, Ft as coerceParameterTypedValue, G as toCfnInteger, Ga as ProvisioningError, Gi as resolveStateBucketWithDefaultAndSource, Gn as refuseMalformedOutputsForDestroy, Gr as importableOutputKeys, Gt as resolveExplicitPhysicalId, H as WARM_THROUGHPUT_MEMBERS, Ha as MalformedProducerRecordRefusalError, Hi as resolveCaptureObservedState, Hn as refuseMalformedOrphansForDestroy, Hr as hasReadableExportSet, Ht as isSettledInstanceState, I as makeSiblingClaimReader, Ia as DeployCancelledError, Ii as Synthesizer, In as malformedResourcePropertiesWarning, Ir as buildLockContentionMessage, It as getAccountInfo, J as bold, Ja as StackHasActiveImportsError, Ji as warnDeprecatedNoPrefixCliFlag, Jn as refuseMalformedResourceEntriesForOrphan, Jr as orphansAfterRollback, Jt as coerceCfnInteger, K as toFiniteNumber, Ka as ResourceTimeoutError, Ki as resolveUseCdkBootstrapAssets, Kn as refuseMalformedResourceAttributesForOrphan, Kr as importableOutputs, Kt as assertRegionMatch, L as planOrphanAdoption, La as DynamicReferenceRegionAmbiguousError, Li as synthesisStatusMessage, Ln as malformedResourcesWarning, Lr as forceQuitRecoveryClause, Lt as isImpossibleEmptyStoredAttribute, M as refusesFinalSnapshot, Ma as CdkdError, Mi as escapeRegExp, Mn as malformedOutputsRefusalMessage, Mr as S3StateBackend, Mt as carriesDynamicReference, N as unsupportedFinalSnapshotError, Ni as stripControlChars, Nn as malformedOutputsWarning, Nr as rebuildClientForBucketRegion, Nt as carriesFetchableDynamicReference, O as buildFinalSnapshotIdentifier, Oa as resetAwsClients, Oi as redactDockerArgvValues, On as malformedLocalOutputsWarning, Or as recoverMaskedOutput, Ot as isWaitAbandonedError, P as makeCanonicalizePropertiesFn, Pa as CrossAccountSecretRefusalError, Pi as AssetManifestLoader, Pn as malformedRenderedContainersWarning, Pr as UNREPRODUCIBLE_LOCK_CLAUSE, Pt as cfnRefValueFromPhysicalId, Q as red, Qi as MIGRATE_TMP_PREFIX, Qn as repairMalformedOrphansForReadOnly, Qr as stringifyValue, Qt as readConfigString, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as IntrinsicResolutionRefusalError, Ri as getDefaultStateBucketName, Rn as malformedStateRefusalMessage, Rr as formatLockExpiry, Rt as isNamelessDynamicReferenceError, S as computeParameterTaint, Sa as renderAssemblyPathEscape, Si as finchSecretArgvRefusal, Sn as hasReadableOrphans, Sr as markSameGenerationBag, St as startInterruptWatch, T as resourcesNamingDeclaredParameter, Ta as resolveBucketRegion, Ti as isDockerClientEnvKey, Tn as isReadableResourceEntry, Tr as pathCrossesDottedKey, Tt as UNSPECIFIED_SKIP_REASON, U as coerceWarmThroughput$1, Ua as NestedStackChildDirectDestroyError, Ui as resolveSkipPrefix, Un as refuseMalformedOrphansForOrphan, Ur as hasReasonlessBaselineRefusal, Ut as WAFv2WebACLProvider, V as renderStatefulReason, Vi as resolveAutoAssetStorage, Vn as refuseMalformedOrphans, Vr as exportNamesCarriedFrom, Vt as refStateLookupFromResource, W as isWarmThroughputDecrease, Wa as PartialFailureError, Wi as resolveStateBucketWithDefault, Wn as refuseMalformedOutputs, Wr as hasUnverifiableParameterRefusal, Wt as normalizeAwsTagsToCfn, X as gray, Xi as CFN_TEMPLATE_BODY_LIMIT, Xn as refuseMalformedResourcesForDestroy, Xr as shouldRetainResource, Xt as configIntegerRefusal, Y as cyan, Ya as StackTerminationProtectionError, Yi as ssmResolvedValueType, Yn as refuseMalformedResourcePropertiesForOrphan, Yr as orphansCarriedFrom, Yt as configBooleanRefusal, Z as green, Za as SynthesisError, Zi as CFN_TEMPLATE_URL_LIMIT, Zn as refuseMalformedState, Zr as AssetPublisher, Zt as configStringRefusal, _ as bagHoldsSecretExpression, _a as hasPlainPrototype, _i as resolveDockerContextDirectory, _n as INTRINSIC_KEYS, _r as dynamicReferenceTokens, _t as maskerOrIdentity, a as DeploymentEventsStore, aa as producerRecordKey, ai as BOOTSTRAP_MARKER_PREFIX, an as withSharedDrainBudget, ao as isRetryableTransientError, ar as findActionableSilentDrops, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as absoluteAssemblyPathEscape, bi as describeDockerFailure, bn as UNREADABLE_RESOURCES_MAP_ROW, br as isSingleDynamicReferenceToken, bt as interruptWatchListenerCount, c as replayFailedOperations, ca as PARTITION_TABLE, ci as getBootstrapMarkerKey, cn as s3BucketDualStackDomainName, co as markNonRetryable, cr as withRetry, ct as IAMRoleProvider, d as updatePartialMessage, da as AssemblyReader, di as readBootstrapMarkerBody, dn as applyRoleArnIfSet, do as describeAwsFailure, dr as STATE_SOURCED_BASELINE_RULES, dt as definedAttributes, ea as uploadCfnTemplate, ei as buildAssetRedirectMap, en as requireConfigArray, eo as normalizeAwsError, er as repairMalformedResourceEntriesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as failedStageNote, fi as validateAssetBucketName, fn as AWS_CREDENTIAL_ENV_KEYS, fo as safeStringify, fr as STATE_SOURCED_CROSS_GENERATION_RULES, ft as stringifyIfAssigned, g as computeImplicitDeleteEdges, ga as hasOwnKey, gi as buildDockerImage, gn as DiffCalculator, gr as createSecretMasker, gt as maskDeep, h as IMPLICIT_DELETE_DEPENDENCIES, ha as defineOwnKey, hi as assertCdkLocalDockerContextContained, hn as envCredentialsAreAssumedRole, hr as carriesSecretMask, ht as createMaskedRetryLogger, i as DeploymentEventsReader, ia as producerCoordinateKey, ii as AssetModeResolver, in as producerRegionsFromState, io as isMarkedNonRetryable, ir as safeStackName, it as secretBearing, j as isFinalSnapshotError, ji as warnFinchArgvExposure, jn as malformedOrphansWarning, jr as LockManager, jt as IntrinsicFunctionResolver, k as ccRoutedFinalSnapshotError, ka as runWithStackAwsClients, ki as runDockerForeground, kn as malformedOrphanRecordsWarning, kr as redactSecretsForState, kt as disableInstanceApiTermination, l as replayRollback, la as canonicalizeRegion, li as isCrossRegionRedirect, ln as s3BucketRegionalDomainName, lo as markRedactedCause, lr as DagBuilder, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as processStackMessages, mi as buildDenyExternalAccessPolicy, mn as callerEnvCredentials, mr as TEMPLATE_SOURCED_RULES, mt as wouldReturnToSdkProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as injectiveKey, ni as loadPublishableAssetManifest, nn as requireConfigString, no as pasteableCommand, nr as repairMalformedResourcesForReadOnly, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as decodeListingKey, oi as assertAssetBucketRegion, on as s3BucketArn, oo as isThrottlingError, or as findSilentDropProperties, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as globMatches, pi as validateContainerRepoName, pn as applyCallerIdentityCredentials, pr as STATE_SOURCED_READBACK_RULES, pt as ProviderRegistry, q as formatResourceLine, qa as ResourceUpdateNotSupportedError, qi as stateBucketExistenceConfirmed, qn as refuseMalformedResourceEntries, qr as isReadableBag, qt as coerceCfnBoolean, r as DeployEngine, ra as injectiveKeyPrefix, ri as rewriteTemplateAssetReferences, rn as classifyReplaySecretRegion, ro as shellQuote, rr as safeRegion, rt as isExportAliasCollision, s as planRollback, sa as expectedOwnerParam, si as ensureAssetStorage, sn as s3BucketDomainName, so as isTransientServerError, sr as describeTypeWithThrottleRetry, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ti as createAssetRedirectResolver, tn as requireConfigObject, to as withErrorHandling, tr as repairMalformedResourcePropertiesForReadOnly, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as derivePartitionAndUrlSuffix, ui as parseBootstrapMarker, un as s3BucketWebsiteUrl, uo as retryClassificationText, ur as TemplateParser, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as nullPrototypeRecord, vi as describeDockerCapturedOutput, vn as STATE_RESOURCES_MALFORMED, vr as errorCauseChain, vt as beginCommandInterruptScope, w as reachableDivergentParameters, wi as getDockerCmd, wn as hasReadableResources, wr as maskSecretsInText, wt as slowCcOperationTimeoutMs, x as bindingSkippedOutputs, xa as displayAssemblyPath, xi as dockerSpawnEnvWithSensitive, xn as displayLogicalId, xr as isUncertifiedBaselineMaskPosition, xt as isInterruptedWaitError, y as keptWholeReasonText, ya as ownValue, yi as describeDockerExecFailure, yn as UNREADABLE_ORPHANS_CONTAINER_ROW, yr as identityKeyFor, yt as endCommandInterruptScope, z as isStatefulRecreateTargetForReplace, za as LocalInvokeBuildError$1, zi as getLegacyStateBucketName, zn as refuseDivergentRecordRegionForDestroy, zr as CUSTOM_RESOURCE_RESPONSE_PREFIX, zt as isUnboundTemplateParameter } from "./deploy-engine-xxVOQPPr.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-2myEXI65.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CEGHMZnN.js";
+import { t as getCdkdVersion } from "./version-DMRkEtU2.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CHM7_WdJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -767,7 +767,7 @@ const RESOURCE_PROPERTY_FORMAT = /^[A-Z][A-Za-z0-9]+(::[A-Z][A-Za-z0-9]+)+:[A-Z]
 function parseRouteEntries(value, previous, flag) {
 	const parsed = value.split(",").map((s) => s.trim()).filter(Boolean);
 	for (const token of parsed) {
-		if (!RESOURCE_PROPERTY_FORMAT.test(token)) throw new Error(`Invalid ${flag} value "${token}": expected <ResourceType>:<PropertyName> with PascalCase on both halves (e.g. AWS::Lambda::Function:RuntimeManagementConfig).`);
+		if (!RESOURCE_PROPERTY_FORMAT.test(token)) throw new Error(`Invalid ${flag} value "${token}": expected <ResourceType>:<PropertyName> with PascalCase on both halves (e.g. AWS::ApiGatewayV2::Api:Body).`);
 		if (token.startsWith("Custom::")) throw new Error(`Invalid ${flag} value "${token}": Custom:: resources are routed through cfn-response and have no write-side silent drop at cdkd, so the flag would have no effect. Use --allow-unsupported-types for type-level escape hatches instead.`);
 	}
 	return [...previous ?? [], ...parsed];
@@ -813,7 +813,7 @@ function parseAllowUnsupportedPropertiesToken(value, previous) {
 * values go UNWRITTEN when the preference is honoured, and that it is ignored
 * when the resource routes to Cloud Control for another reason.
 */
-const preferSdkRouteOption = new Option("--prefer-sdk-route <entries>", "Comma-separated <ResourceType>:<PropertyName> tokens to keep on the SDK provider instead of auto-routing the resource to Cloud Control. The named values are then NOT written to AWS — the deployed resource is missing the field. Ignored for a resource that routes to Cloud Control for another reason (a sibling unwired property, or a sticky cc-api state record), where the values are written after all. Example: --prefer-sdk-route AWS::Lambda::Function:RuntimeManagementConfig").argParser(parsePreferSdkRouteToken);
+const preferSdkRouteOption = new Option("--prefer-sdk-route <entries>", "Comma-separated <ResourceType>:<PropertyName> tokens to keep on the SDK provider instead of auto-routing the resource to Cloud Control. The named values are then NOT written to AWS — the deployed resource is missing the field. Ignored for a resource that routes to Cloud Control for another reason (a sibling unwired property, or a sticky cc-api state record), where the values are written after all. Example: --prefer-sdk-route AWS::ApiGatewayV2::Api:Body").argParser(parsePreferSdkRouteToken);
 /**
 * The deprecated spelling. HIDDEN from `--help` so new users meet only the
 * successor, but still parsed so existing scripts keep working; it warns once
@@ -2937,9 +2937,9 @@ function isPromptAbortError(error) {
 *      scope for v1; no `--force-stateful-recreation` bypass since
 *      this is a structural limitation, not a data-loss footgun.
 *
-* Plus one cross-flag invariant: `--recreate-via-cc-api MyLambda`
-* combined with `--allow-unsupported-properties AWS::Lambda::Function:RuntimeManagementConfig`
-* on a resource whose template carries `RuntimeManagementConfig` is **ambiguous
+* Plus one cross-flag invariant: `--recreate-via-cc-api MyApi`
+* combined with `--prefer-sdk-route AWS::ApiGatewayV2::Api:Body`
+* on a resource whose template carries `Body` is **ambiguous
 * intent** — does the user want SDK + silent drop, or CC migration?
 * Fail fast and let the user pick one strategy per resource.
 */
@@ -12537,6 +12537,16 @@ function isSqsQueueUrl(value) {
 */
 const SNS_MAXIMUM_MESSAGE_SIZE_DEFAULT = "262144";
 /**
+* The attribute map `create()` records, from the topic ARN (the physical id).
+* `import()` returns it too (issue #3627).
+*/
+function snsTopicAttributes(topicArn) {
+	return {
+		TopicArn: topicArn,
+		TopicName: topicArn.split(":").pop()
+	};
+}
+/**
 * AWS SNS Topic Provider
 *
 * Implements resource provisioning for AWS::SNS::Topic using the SNS SDK.
@@ -13038,7 +13048,7 @@ var SNSTopicProvider = class {
 			await this.snsClient.send(new GetTopicAttributesCommand({ TopicArn: input.knownPhysicalId }));
 			return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: snsTopicAttributes(input.knownPhysicalId)
 			};
 		} catch (err) {
 			if (err instanceof NotFoundException) return null;
@@ -13053,7 +13063,7 @@ var SNSTopicProvider = class {
 				if (!t.TopicArn) continue;
 				if (t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1) === desiredName) return {
 					physicalId: t.TopicArn,
-					attributes: {}
+					attributes: snsTopicAttributes(t.TopicArn)
 				};
 			}
 			marker = list.NextToken;
@@ -13377,88 +13387,6 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 	return result;
 }
 
-//#endregion
-//#region src/provisioning/attribute-map.ts
-/**
-* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
-* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
-* shape `docs/provider-development.md` forbids under "Never store an
-* empty-string placeholder"):
-*
-*   an attribute cdkd could not read back is ABSENT from the map — never
-*   recorded as the empty string, and never as a present-but-`undefined` key.
-*
-* The consumers of `ResourceState.attributes` all key off exactly that
-* distinction, and a sentinel puts every one of them on the wrong branch:
-*
-*  - the deploy engine persists the map as-is, so `''` becomes the recorded
-*    value of a field AWS never assigned;
-*  - the intrinsic resolver serves a stored attribute whenever it is not
-*    `undefined`, so `''` shadows `constructAttribute` forever — the
-*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
-*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
-*    only on a MISS;
-*  - the Outputs export pass publishes whatever the resolver returned, so a
-*    stored `''` is exported to every `Fn::ImportValue` consumer.
-*
-* It exists as a MODULE rather than a per-provider idiom because the rule was
-* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
-* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
-* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
-* that DROPS the key is the one form a provider cannot spell wrong by habit.
-*
-* Two values are treated as "not read back":
-*
-*  - `undefined`: the SDK's spelling of an unassigned optional member.
-*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
-*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
-*    like `''` does.
-*
-* Every other value is kept verbatim — INCLUDING an empty string AWS itself
-* reported (`false`, `0`, an empty array and an object likewise). The helper
-* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
-* off the wire is a known value with a meaning the provider owns. The EC2
-* Instance provider is where that distinction is load-bearing: a `running`
-* instance with no public address is described with `PublicDnsName: ''` and
-* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
-* empty, recorded as such so a reference does not degrade to the instance id
-* on every resolution — while the same `''` on a `pending` instance means
-* "not yet", which that provider maps to `undefined` BEFORE calling this
-* helper (its `describedInstanceAttributes`). A caller that knows a `''`
-* means "unknown" is the one that must say so; this helper cannot tell.
-*
-* Deliberately NOT a general "compact this record" utility: it is scoped to
-* attribute maps. A property bag keeps its `undefined`-valued keys out by other
-* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
-* than setting it to `undefined`").
-*
-* A LEAF module (imports nothing) so every provider can take it without adding
-* an edge to the provider import ring.
-*/
-/**
-* Build an attribute map from read-back values, omitting every key whose value
-* is `undefined` or `null`.
-*/
-function definedAttributes(entries) {
-	const out = {};
-	for (const [key, value] of Object.entries(entries)) {
-		if (value === void 0 || value === null) continue;
-		out[key] = value;
-	}
-	return out;
-}
-/**
-* `String(value)` for a numeric read-back whose CloudFormation attribute is a
-* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
-* `definedAttributes` drops the key instead of recording the literal
-* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
-* `?? ''` is merely deleted.
-*/
-function stringifyIfAssigned(value) {
-	if (value === void 0 || value === null) return void 0;
-	return String(value);
-}
-
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 /**
@@ -15949,11 +15877,21 @@ var LambdaEventSourceMappingProvider = class {
 	* returned by `create()`).
 	*/
 	async import(input) {
-		if (input.knownPhysicalId) return {
+		if (!input.knownPhysicalId) return null;
+		let resp;
+		try {
+			resp = await this.lambdaClient.send(new GetEventSourceMappingCommand({ UUID: input.knownPhysicalId }));
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException) return null;
+			throw err;
+		}
+		return {
 			physicalId: input.knownPhysicalId,
-			attributes: { Id: input.knownPhysicalId }
+			attributes: definedAttributes({
+				Id: input.knownPhysicalId,
+				EventSourceMappingArn: resp.EventSourceMappingArn
+			})
 		};
-		return null;
 	}
 };
 
@@ -21919,10 +21857,15 @@ var DynamoDBTableProvider = class {
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "TableName");
 		if (explicit) try {
-			await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: explicit }));
+			const resp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					Arn: resp.Table?.TableArn,
+					TableId: resp.Table?.TableId,
+					StreamArn: resp.Table?.LatestStreamArn,
+					TableName: resp.Table?.TableName ?? explicit
+				})
 			};
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return null;
@@ -24096,10 +24039,15 @@ var DynamoDBGlobalTableProvider = class {
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "TableName");
 		if (explicit) try {
-			await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: explicit }));
+			const resp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					Arn: resp.Table?.TableArn,
+					TableId: resp.Table?.TableId,
+					StreamArn: resp.Table?.LatestStreamArn,
+					TableName: resp.Table?.TableName ?? explicit
+				})
 			};
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return null;
@@ -43419,6 +43367,39 @@ var RDSDBProxyTargetGroupProvider = class {
 //#endregion
 //#region src/provisioning/providers/docdb-provider.ts
 /**
+* The attribute map a DocumentDB DB cluster records (issue #3650), under
+* CloudFormation's `Fn::GetAtt` names (`Endpoint`, `Port`, `ReadEndpoint`,
+* `ClusterResourceId`). The RDS-style dotted keys (`Endpoint.Address`, ...)
+* are kept for records and readers that already use them; no
+* `Fn::GetAtt` names them for this service, so on their own they left
+* `Fn::GetAtt [Cluster, Endpoint]` resolving to the cluster identifier.
+*/
+function clusterAttributes$1(cluster) {
+	return definedAttributes({
+		Endpoint: cluster?.Endpoint,
+		Port: stringifyIfAssigned(cluster?.Port),
+		ReadEndpoint: cluster?.ReaderEndpoint,
+		"Endpoint.Address": cluster?.Endpoint,
+		"Endpoint.Port": stringifyIfAssigned(cluster?.Port),
+		"ReadEndpoint.Address": cluster?.ReaderEndpoint,
+		Arn: cluster?.DBClusterArn,
+		ClusterResourceId: cluster?.DbClusterResourceId
+	});
+}
+/**
+* The attribute map a DocumentDB DB instance records (issue #3650): `Endpoint` /
+* `Port` are CloudFormation's `Fn::GetAtt` names, the dotted keys are kept.
+*/
+function instanceAttributes$1(instance) {
+	return definedAttributes({
+		Endpoint: instance?.Endpoint?.Address,
+		Port: stringifyIfAssigned(instance?.Endpoint?.Port),
+		"Endpoint.Address": instance?.Endpoint?.Address,
+		"Endpoint.Port": stringifyIfAssigned(instance?.Endpoint?.Port),
+		Arn: instance?.DBInstanceArn
+	});
+}
+/**
 * AWS DocumentDB Provider
 *
 * Implements resource provisioning for DocumentDB resources:
@@ -43601,16 +43582,9 @@ var DocDBProvider = class {
 			}))).DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(dbClusterIdentifier);
-			const described = await this.describeDBCluster(dbClusterIdentifier);
 			return {
 				physicalId: dbClusterIdentifier,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint,
-					"Endpoint.Port": stringifyIfAssigned(described?.Port),
-					"ReadEndpoint.Address": described?.ReaderEndpoint,
-					Arn: described?.DBClusterArn,
-					ClusterResourceId: described?.DbClusterResourceId
-				})
+				attributes: clusterAttributes$1(await this.describeDBCluster(dbClusterIdentifier))
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43642,13 +43616,7 @@ var DocDBProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint,
-					"Endpoint.Port": stringifyIfAssigned(described?.Port),
-					"ReadEndpoint.Address": described?.ReaderEndpoint,
-					Arn: described?.DBClusterArn,
-					ClusterResourceId: described?.DbClusterResourceId
-				})
+				attributes: clusterAttributes$1(described)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -43710,14 +43678,9 @@ var DocDBProvider = class {
 			}))).DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created DocDB DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(dbInstanceIdentifier);
-			const described = await this.describeDBInstance(dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
-					Arn: described?.DBInstanceArn
-				})
+				attributes: instanceAttributes$1(await this.describeDBInstance(dbInstanceIdentifier))
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43741,11 +43704,7 @@ var DocDBProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
-					Arn: described?.DBInstanceArn
-				})
+				attributes: instanceAttributes$1(described)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -44014,11 +43973,7 @@ var DocDBProvider = class {
 			const described = (await this.getClient().send(new DescribeDBInstancesCommand$1({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
-					Arn: described?.DBInstanceArn
-				})
+				attributes: instanceAttributes$1(described)
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -44029,10 +43984,9 @@ var DocDBProvider = class {
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBClustersCommand$1({ DBClusterIdentifier: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: clusterAttributes$1((await this.getClient().send(new DescribeDBClustersCommand$1({ DBClusterIdentifier: explicit }))).DBClusters?.[0])
 			};
 		} catch (err) {
 			if (err.name === "DBClusterNotFoundFault") return null;
@@ -44059,6 +44013,38 @@ var DocDBProvider = class {
 //#endregion
 //#region src/provisioning/providers/neptune-provider.ts
 /**
+* The attribute map a Neptune DB cluster records (issue #3650), under
+* CloudFormation's `Fn::GetAtt` names (`Endpoint`, `Port`, `ReadEndpoint`,
+* `ClusterResourceId`). The RDS-style dotted keys (`Endpoint.Address`, ...)
+* are kept for records and readers that already use them; no
+* `Fn::GetAtt` names them for this service, so on their own they left
+* `Fn::GetAtt [Cluster, Endpoint]` resolving to the cluster identifier.
+*/
+function clusterAttributes(cluster) {
+	return definedAttributes({
+		Endpoint: cluster?.Endpoint,
+		Port: stringifyIfAssigned(cluster?.Port),
+		ReadEndpoint: cluster?.ReaderEndpoint,
+		"Endpoint.Address": cluster?.Endpoint,
+		"Endpoint.Port": stringifyIfAssigned(cluster?.Port),
+		"ReadEndpoint.Address": cluster?.ReaderEndpoint,
+		ClusterResourceId: cluster?.DbClusterResourceId
+	});
+}
+/**
+* The attribute map a Neptune DB instance records (issue #3650): `Endpoint` /
+* `Port` are CloudFormation's `Fn::GetAtt` names, the dotted keys are kept.
+*/
+function instanceAttributes(instance) {
+	return definedAttributes({
+		Endpoint: instance?.Endpoint?.Address,
+		Port: stringifyIfAssigned(instance?.Endpoint?.Port),
+		"Endpoint.Address": instance?.Endpoint?.Address,
+		"Endpoint.Port": stringifyIfAssigned(instance?.Endpoint?.Port),
+		Arn: instance?.DBInstanceArn
+	});
+}
+/**
 * AWS Neptune Provider
 *
 * Implements resource provisioning for Neptune resources:
@@ -44244,15 +44230,9 @@ var NeptuneProvider = class {
 			}))).DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created Neptune DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(dbClusterIdentifier);
-			const described = await this.describeDBCluster(dbClusterIdentifier);
 			return {
 				physicalId: dbClusterIdentifier,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint,
-					"Endpoint.Port": stringifyIfAssigned(described?.Port),
-					"ReadEndpoint.Address": described?.ReaderEndpoint,
-					ClusterResourceId: described?.DbClusterResourceId
-				})
+				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -44284,12 +44264,7 @@ var NeptuneProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint,
-					"Endpoint.Port": stringifyIfAssigned(described?.Port),
-					"ReadEndpoint.Address": described?.ReaderEndpoint,
-					ClusterResourceId: described?.DbClusterResourceId
-				})
+				attributes: clusterAttributes(described)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -44354,13 +44329,9 @@ var NeptuneProvider = class {
 			}))).DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created Neptune DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(dbInstanceIdentifier);
-			const described = await this.describeDBInstance(dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port)
-				})
+				attributes: instanceAttributes(await this.describeDBInstance(dbInstanceIdentifier))
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -44386,10 +44357,7 @@ var NeptuneProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port)
-				})
+				attributes: instanceAttributes(described)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -44661,11 +44629,7 @@ var NeptuneProvider = class {
 			const described = (await this.getClient().send(new DescribeDBInstancesCommand$2({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
-					Arn: described?.DBInstanceArn
-				})
+				attributes: instanceAttributes(described)
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -44676,10 +44640,9 @@ var NeptuneProvider = class {
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBClustersCommand$2({ DBClusterIdentifier: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: clusterAttributes((await this.getClient().send(new DescribeDBClustersCommand$2({ DBClusterIdentifier: explicit }))).DBClusters?.[0])
 			};
 		} catch (err) {
 			if (err.name === "DBClusterNotFoundFault") return null;
@@ -68865,7 +68828,7 @@ const EMPTY_ALLOW_SET = /* @__PURE__ */ new Set();
 *
 *  - **Fresh hits**: a resource whose template uses one or more
 *    silent-drop top-level CFn properties. Annotation value is the list
-*    of property names (e.g. `RuntimeManagementConfig`).
+*    of property names (e.g. `Body`).
 *  - **Sticky hits**: a resource whose deployed state records
 *    `provisionedBy: 'cc-api'` (from a prior deploy) even when the
 *    current template's silent-drop set is empty. Annotation value is
@@ -87799,6 +87762,8 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 			properties: tmplResource.Properties ?? {},
 			attributes: rowAttributes ?? priorAttributes ?? {},
 			dependencies: deps,
+			deletionPolicy: tmplResource.DeletionPolicy,
+			updateReplacePolicy: tmplResource.UpdateReplacePolicy,
 			provisionedBy: "sdk",
 			...prior && prior.physicalId === row.physicalId && (hasUnverifiableParameterRefusal(prior) || hasReasonlessBaselineRefusal(prior) && (namesParameter ??= resourcesNamingDeclaredParameter(template))(row.logicalId)) && {
 				observedBaselineRefused: true,
@@ -91369,24 +91334,26 @@ const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 * boundary, so a local-invoke build failure still surfaces with cdkd's exit code
 * / branding. `architectureToPlatform` is a pure helper (re-exported directly).
 *
-* It is also where the build context is CONTAINED: cdk-local joins
-* `source.directory` onto `cdkOutDir` with no check, so the shim refuses an
-* escaping value before delegating, against a REQUIRED `assetOutdir` bound
-* (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
+* The build context is CONTAINED twice, against one REQUIRED `assetOutdir`
+* bound (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)). The
+* engine refuses an escaping `source.directory` itself since cdk-local 0.149.3,
+* and the bound is FORWARDED to it: without one the engine narrows to the
+* manifest directory and refuses a `cdk.Stage` image's `../asset.<hash>`
+* (issue [#3597](https://github.com/go-to-k/cdkd/issues/3597)). cdkd still
+* refuses first, because the engine's refusal quotes the manifest value in a
+* boundary the value itself can close (go-to-k/cdk-local#758); once that
+* ships, go-to-k/cdkd#3652 drops cdkd's copy.
 * See cdk-local's `src/local/docker-image-builder.ts`.
 */
 async function buildContainerImage$1(asset, cdkOutDir, options) {
-	const executable = asset?.source?.executable;
-	if (executable && executable.length > 0) warnManifestExecutable(executable);
-	const { assetOutdir, ...implOptions } = options;
 	assertCdkLocalDockerContextContained({
 		manifestDir: cdkOutDir,
 		source: asset.source,
-		assetOutdir,
+		assetOutdir: options.assetOutdir,
 		wrapError: (message) => new LocalInvokeBuildError$1(`Refusing to build the container image: ${message}`)
 	});
 	try {
-		return await buildContainerImage(asset, cdkOutDir, implOptions);
+		return await buildContainerImage(asset, cdkOutDir, options);
 	} catch (e) {
 		if (e instanceof LocalInvokeBuildError) throw new LocalInvokeBuildError$1(e.message);
 		throw e;
@@ -91430,7 +91397,25 @@ function canonicalizeImageUriHost(imageUri) {
 	if (slash < 0) return imageUri;
 	const host = imageUri.slice(0, slash);
 	if (!isRegistryHostComponent(host)) return imageUri;
-	return host.toLowerCase() + imageUri.slice(slash);
+	return foldAsciiUpperCase(host) + imageUri.slice(slash);
+}
+/**
+* Lower-case ONLY the ASCII letters `A`-`Z`, leaving every other code point
+* as written.
+*
+* `String.prototype.toLowerCase` performs full Unicode case folding, so the
+* Kelvin sign U+212A folds to a plain ASCII `k`. Folding with it here, BEFORE
+* `parseEcrRegistryHost`, handed that parser an already-ASCII host and defeated
+* the raw-capture charset guard it applies to the region and suffix (see
+* `CANONICAL_REGION_SEGMENT` in `src/utils/ecr-uri.ts`):
+* `<acct>.dkr.ecr-fips.us-<U+212A>east-1.amazonaws.com/...` parsed as the
+* region `us-keast-1`, a region the host does not name, and a Kelvin sign in
+* the LABELS resolved to the plain form. An ASCII-only fold keeps the case
+* fold the #1801 login / pull agreement needs (DNS case-insensitivity is
+* ASCII-only) while leaving any other code point for that guard to refuse.
+*/
+function foldAsciiUpperCase(value) {
+	return value.replace(/[A-Z]+/g, (run) => run.toLowerCase());
 }
 /** Docker's rule for "component 1 is a registry, not a repository segment". */
 function isRegistryHostComponent(component) {
@@ -91503,7 +91488,9 @@ function isCredentialFresh(creds) {
 * the same one the DERIVED `docker login` endpoint names — an
 * AWS-reported `proxyEndpoint` still wins over that fallback (it can be
 * a VPC-endpoint host), which is correct: AWS names the endpoint its own
-* token authenticates, and it reports it lower-cased.
+* token authenticates, and it reports it lower-cased. That precedence holds
+* only for the PLAIN host form: a FIPS or dual-stack pull logs in to its own
+* host, since `proxyEndpoint` always names the plain one (issue #1855).
 */
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
@@ -91554,7 +91541,11 @@ async function pullEcrImage(imageUri, options) {
 		...assumed && { credentials: assumed }
 	});
 	try {
-		await ecrLogin(ecr, parsed.accountId, parsed.region);
+		await ecrLogin(ecr, {
+			accountId: parsed.accountId,
+			region: parsed.region,
+			registryHost: canonicalUri.slice(0, canonicalUri.indexOf("/"))
+		});
 	} finally {
 		ecr.destroy();
 	}
@@ -91605,14 +91596,26 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 * Authenticate the local docker daemon against the target ECR registry.
 * Mirrors `DockerAssetPublisher.ecrLogin` but stays in this module so the
 * local-invoke path doesn't depend on the publisher's larger surface area.
-*/
-async function ecrLogin(client, accountId, region) {
-	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region})`);
+*
+* The login endpoint must name the host the PULL targets (issue #1855):
+* docker's credential store is keyed on the hostname verbatim, so a login to
+* the plain host followed by a pull from a FIPS or dual-stack host sends no
+* credentials (`no basic auth credentials`). `GetAuthorizationToken` reports
+* the PLAIN host as its `proxyEndpoint`, so that value, and the derived
+* fallback, are used only when the pull targets the plain form; every other
+* form logs in to `registryHost` itself. The token is registry-scoped, not
+* host-scoped: measured against real ECR, one token authenticated `/v2/` on
+* all four host forms `ECR_REGISTRY_HOST_FORMS` lists.
+*/
+async function ecrLogin(client, target) {
+	const { accountId, region, registryHost } = target;
+	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
 	const authData = (await client.send(new GetAuthorizationTokenCommand({}))).authorizationData?.[0];
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError$1("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+	const plainHost = `${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+	const endpoint = registryHost === plainHost ? authData.proxyEndpoint || `https://${plainHost}` : `https://${registryHost}`;
 	const loginArgs = [
 		"login",
 		"--username",
@@ -95798,10 +95801,14 @@ function createLocalRunTaskCommand() {
 * (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
 *
 * `cdkd local start-service` / `start-alb` hand the whole run to cdk-local's
-* `runEcsServiceEmulator`, which reads each stack's asset manifest itself and
-* joins `source.directory` onto the manifest directory raw — for an ECS
-* container image and for an ALB Lambda target's container image alike. No
-* argument reaches that join, so cdkd judges the manifests here instead.
+* `runEcsServiceEmulator`, which reads each stack's asset manifest itself —
+* for an ECS container image and for an ALB Lambda target's container image
+* alike. Since cdk-local 0.149.3 the engine refuses an escaping
+* `source.directory` at each build and each `--watch` soft reload
+* (go-to-k/cdkd#3597). This check stays in front of it, for the whole
+* assembly at once, because the engine's refusal quotes the assembly-chosen
+* value in a boundary the value can close (go-to-k/cdk-local#758);
+* go-to-k/cdkd#3652 removes it once that ships.
 *
 * `resolveBoots` is the seam because the engine calls it after every synth —
 * at boot, and again on every `--watch` reload — and before any image is
@@ -95871,7 +95878,7 @@ function assertEmulatorDockerContextsContained(stacks) {
 * only while the directory is named `assembly-*` AND its parent's
 * `manifest.json` declares it as a `cdk:cloud-assembly` artifact, and WARN
 * whenever a climb happens, since the predicate is read from the tree being
-* judged. Replace with the upstream export once one exists (go-to-k/cdkd#3597).
+* judged. Deleted with this module by go-to-k/cdkd#3652.
 */
 function engineAssemblyRoot(outdir) {
 	let dir = resolve(outdir);
@@ -98812,4 +98819,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CGsbW6A4.js.map
+//# sourceMappingURL=program-hXXls0hg.js.map