@go-to-k/cdkd 0.291.16 → 0.291.17

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $a as formatError, Ct as CloudControlProvider, Da as AwsClients, Ea as resolveBucketRegion, Ha as LockError, Ia as DependencyError, Ka as ProvisioningError, Li as Synthesizer, Ma as AssetError, Mr as S3StateBackend, Na as CdkdError, Oa as getAwsClients, Pa as ConfigError, Qa as SynthesisError, Ta as clearBucketRegionCache, Za as StateError, Zr as AssetPublisher, ct as IAMRoleProvider, eo as isCdkdError, fa as AssemblyReader, gn as DiffCalculator, ja as setAwsClients, jr as LockManager, ka as resetAwsClients, lr as DagBuilder, pt as ProviderRegistry, r as DeployEngine, to as normalizeAwsError, ur as TemplateParser } from "./deploy-engine-yukC8N_f.js";
+import { $a as isCdkdError, Aa as setAwsClients, Ct as CloudControlProvider, Da as getAwsClients, Ea as AwsClients, Fa as DependencyError, Ga as ProvisioningError, Ii as Synthesizer, Ma as CdkdError, Mr as S3StateBackend, Na as ConfigError, Oa as resetAwsClients, Qa as formatError, Ta as resolveBucketRegion, Va as LockError, Xa as StateError, Za as SynthesisError, Zr as AssetPublisher, ct as IAMRoleProvider, da as AssemblyReader, eo as normalizeAwsError, gn as DiffCalculator, ja as AssetError, jr as LockManager, lr as DagBuilder, pt as ProviderRegistry, r as DeployEngine, ur as TemplateParser, wa as clearBucketRegionCache } from "./deploy-engine-xxVOQPPr.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-GASr9bAF.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-DjkAPWi0.js → program-hXXls0hg.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as MIGRATE_TMP_PREFIX, $n as repairMalformedOutputsForReadOnly, $r as WorkGraph, $t as replayWarn, A as createPreDeleteFinalSnapshot, Aa as runWithStackAwsClients, Ai as runDockerForeground, An as malformedOrphansRefusalMessage, Ar as scrubResourceRecord, At as isTerminationProtectionPropagationError, B as isStatefulRecreateTargetSync, Ba as LocalInvokeBuildError$1, Bi as getLegacyStateBucketName, Bn as refuseMalformedNestedChildOutputs, Br as DEFAULT_STATE_PREFIX, Bt as parameterTypeMayLoseSecretIdentity, C as namesAnyDeclaredParameter, Ca as renderAssemblyPathEscape, Ci as finchSecretArgvRefusal, Cn as hasReadableOutputs, Cr as maskSecretsInError, Ct as CloudControlProvider, D as PRE_DELETE_SNAPSHOT_TYPES, Da as AwsClients, Di as isMalformedEnvKey, Dn as malformedExportSourceWarning, Dr as recordMaskOnlyValuesIn, Dt as deleteSkipReason, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as resolveBucketRegion, Ei as isDockerClientEnvKey, En as malformedExportNamesWarning, Er as recordMaskOnlyValue, Et as deleteIndeterminateGuards, F as extractDeploymentEventError, Fa as CrossAccountSecretRefusalError, Fi as AssetManifestLoader, Fn as malformedResourceEntriesWarning, Fr as buildForceUnlockCommand, Ft as coerceParameterTypedValue, G as toCfnInteger, Ga as PartialFailureError, Gi as resolveStateBucketWithDefault, Gn as refuseMalformedOutputsForDestroy, Gr as importableOutputKeys, Gt as resolveExplicitPhysicalId, H as WARM_THROUGHPUT_MEMBERS, Hi as resolveAutoAssetStorage, Hn as refuseMalformedOrphansForDestroy, Hr as hasReadableExportSet, Ht as isSettledInstanceState, I as makeSiblingClaimReader, Ii as getDockerImageBySourceHash, In as malformedResourcePropertiesWarning, Ir as buildLockContentionMessage, It as getAccountInfo, J as bold, Ja as ResourceUpdateNotSupportedError, Ji as stateBucketExistenceConfirmed, Jn as refuseMalformedResourceEntriesForOrphan, Jr as orphansAfterRollback, Jt as coerceCfnInteger, K as toFiniteNumber, Ka as ProvisioningError, Ki as resolveStateBucketWithDefaultAndSource, Kn as refuseMalformedResourceAttributesForOrphan, Kr as importableOutputs, Kt as assertRegionMatch, L as planOrphanAdoption, La as DeployCancelledError, Li as Synthesizer, Ln as malformedResourcesWarning, Lr as forceQuitRecoveryClause, Lt as isImpossibleEmptyStoredAttribute, M as refusesFinalSnapshot, Mi as warnFinchArgvExposure, Mn as malformedOutputsRefusalMessage, Mr as S3StateBackend, Mt as carriesDynamicReference, N as unsupportedFinalSnapshotError, Na as CdkdError, Ni as escapeRegExp, Nn as malformedOutputsWarning, Nr as rebuildClientForBucketRegion, Nt as carriesFetchableDynamicReference, O as buildFinalSnapshotIdentifier, Oa as getAwsClients, Oi as partitionSensitiveEnv, On as malformedLocalOutputsWarning, Or as recoverMaskedOutput, Ot as isWaitAbandonedError, P as makeCanonicalizePropertiesFn, Pi as stripControlChars, Pn as malformedRenderedContainersWarning, Pr as UNREPRODUCIBLE_LOCK_CLAUSE, Pt as cfnRefValueFromPhysicalId, Q as red, Qa as SynthesisError, Qi as CFN_TEMPLATE_URL_LIMIT, Qn as repairMalformedOrphansForReadOnly, Qr as stringifyValue, Qt as readConfigString, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as DynamicReferenceRegionAmbiguousError, Ri as synthesisStatusMessage, Rn as malformedStateRefusalMessage, Rr as formatLockExpiry, Rt as isNamelessDynamicReferenceError, S as computeParameterTaint, Sa as displayAssemblyPath, Si as dockerSpawnEnvWithSensitive, Sn as hasReadableOrphans, Sr as markSameGenerationBag, St as startInterruptWatch, T as resourcesNamingDeclaredParameter, Ti as getDockerCmd, Tn as isReadableResourceEntry, Tr as pathCrossesDottedKey, Tt as UNSPECIFIED_SKIP_REASON, U as coerceWarmThroughput$1, Ua as MalformedProducerRecordRefusalError, Ui as resolveCaptureObservedState, Un as refuseMalformedOrphansForOrphan, Ur as hasReasonlessBaselineRefusal, Ut as WAFv2WebACLProvider, V as renderStatefulReason, Va as LocalStartServiceError, Vi as resolveApp, Vn as refuseMalformedOrphans, Vr as exportNamesCarriedFrom, Vt as refStateLookupFromResource, W as isWarmThroughputDecrease, Wa as NestedStackChildDirectDestroyError, Wi as resolveSkipPrefix, Wn as refuseMalformedOutputs, Wr as hasUnverifiableParameterRefusal, Wt as normalizeAwsTagsToCfn, X as gray, Xa as StackTerminationProtectionError, Xi as ssmResolvedValueType, Xn as refuseMalformedResourcesForDestroy, Xr as shouldRetainResource, Xt as configIntegerRefusal, Y as cyan, Ya as StackHasActiveImportsError, Yi as warnDeprecatedNoPrefixCliFlag, Yn as refuseMalformedResourcePropertiesForOrphan, Yr as orphansCarriedFrom, Yt as configBooleanRefusal, Z as green, Zi as CFN_TEMPLATE_BODY_LIMIT, Zn as refuseMalformedState, Zr as AssetPublisher, Zt as configStringRefusal, _ as bagHoldsSecretExpression, _a as hasOwnKey, _i as resolveDockerContextDirectory, _n as INTRINSIC_KEYS, _r as dynamicReferenceTokens, _t as maskerOrIdentity, a as DeploymentEventsStore, aa as producerCoordinateKey, ai as BOOTSTRAP_MARKER_PREFIX, an as withSharedDrainBudget, ao as isMarkedNonRetryable, ar as findActionableSilentDrops, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as ownValue, bi as describeDockerExecFailure, bn as UNREADABLE_RESOURCES_MAP_ROW, br as isSingleDynamicReferenceToken, bt as interruptWatchListenerCount, c as replayFailedOperations, ca as expectedOwnerParam, ci as getBootstrapMarkerKey, cn as s3BucketDualStackDomainName, co as isTransientServerError, cr as withRetry, ct as IAMRoleProvider, d as updatePartialMessage, da as derivePartitionAndUrlSuffix, di as readBootstrapMarkerBody, dn as applyRoleArnIfSet, do as retryClassificationText, dr as STATE_SOURCED_BASELINE_RULES, dt as definedAttributes, ea as findLargeInlineResources, ei as buildAssetRedirectMap, en as requireConfigArray, er as repairMalformedResourceEntriesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as AssemblyReader, fi as validateAssetBucketName, fn as AWS_CREDENTIAL_ENV_KEYS, fo as describeAwsFailure, fr as STATE_SOURCED_CROSS_GENERATION_RULES, ft as stringifyIfAssigned, g as computeImplicitDeleteEdges, ga as defineOwnKey, gi as buildDockerImage, gn as DiffCalculator, gr as createSecretMasker, gt as maskDeep, h as IMPLICIT_DELETE_DEPENDENCIES, ha as processStackMessages, hi as assertCdkLocalDockerContextContained, hn as envCredentialsAreAssumedRole, hr as carriesSecretMask, ht as createMaskedRetryLogger, i as DeploymentEventsReader, ia as injectiveKeyPrefix, ii as AssetModeResolver, in as producerRegionsFromState, io as shellQuote, ir as safeStackName, it as secretBearing, j as isFinalSnapshotError, ja as setAwsClients, ji as runDockerStreaming, jn as malformedOrphansWarning, jr as LockManager, jt as IntrinsicFunctionResolver, k as ccRoutedFinalSnapshotError, ka as resetAwsClients, ki as redactDockerArgvValues, kn as malformedOrphanRecordsWarning, kr as redactSecretsForState, kt as disableInstanceApiTermination, l as replayRollback, la as PARTITION_TABLE, li as isCrossRegionRedirect, ln as s3BucketRegionalDomainName, lo as markNonRetryable, lr as DagBuilder, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as globMatches, mi as buildDenyExternalAccessPolicy, mn as callerEnvCredentials, mr as TEMPLATE_SOURCED_RULES, mt as wouldReturnToSdkProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ni as loadPublishableAssetManifest, nn as requireConfigString, no as withErrorHandling, nr as repairMalformedResourcesForReadOnly, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as producerRecordKey, oi as assertAssetBucketRegion, on as s3BucketArn, oo as isRetryableTransientError, or as findSilentDropProperties, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as failedStageNote, pi as validateContainerRepoName, pn as applyCallerIdentityCredentials, po as safeStringify, pr as STATE_SOURCED_READBACK_RULES, pt as ProviderRegistry, q as formatResourceLine, qa as ResourceTimeoutError, qi as resolveUseCdkBootstrapAssets, qn as refuseMalformedResourceEntries, qr as isReadableBag, qt as coerceCfnBoolean, r as DeployEngine, ra as injectiveKey, ri as rewriteTemplateAssetReferences, rn as classifyReplaySecretRegion, ro as pasteableCommand, rr as safeRegion, rt as isExportAliasCollision, s as planRollback, sa as decodeListingKey, si as ensureAssetStorage, sn as s3BucketDomainName, so as isThrottlingError, sr as describeTypeWithThrottleRetry, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as uploadCfnTemplate, ti as createAssetRedirectResolver, tn as requireConfigObject, to as normalizeAwsError, tr as repairMalformedResourcePropertiesForReadOnly, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as canonicalizeRegion, ui as parseBootstrapMarker, un as s3BucketWebsiteUrl, uo as markRedactedCause, ur as TemplateParser, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as hasPlainPrototype, vi as warnManifestExecutable, vn as STATE_RESOURCES_MALFORMED, vr as errorCauseChain, vt as beginCommandInterruptScope, w as reachableDivergentParameters, wa as resolveAssemblyPath, wi as formatDockerLoginError, wn as hasReadableResources, wr as maskSecretsInText, wt as slowCcOperationTimeoutMs, x as bindingSkippedOutputs, xa as absoluteAssemblyPathEscape, xi as describeDockerFailure, xn as displayLogicalId, xr as isUncertifiedBaselineMaskPosition, xt as isInterruptedWaitError, y as keptWholeReasonText, ya as nullPrototypeRecord, yi as describeDockerCapturedOutput, yn as UNREADABLE_ORPHANS_CONTAINER_ROW, yr as identityKeyFor, yt as endCommandInterruptScope, z as isStatefulRecreateTargetForReplace, za as IntrinsicResolutionRefusalError, zi as getDefaultStateBucketName, zn as refuseDivergentRecordRegionForDestroy, zr as CUSTOM_RESOURCE_RESPONSE_PREFIX, zt as isUnboundTemplateParameter } from "./deploy-engine-yukC8N_f.js";
+import { $ as yellow, $i as findLargeInlineResources, $n as repairMalformedOutputsForReadOnly, $r as WorkGraph, $t as replayWarn, A as createPreDeleteFinalSnapshot, Aa as setAwsClients, Ai as runDockerStreaming, An as malformedOrphansRefusalMessage, Ar as scrubResourceRecord, At as isTerminationProtectionPropagationError, B as isStatefulRecreateTargetSync, Ba as LocalStartServiceError, Bi as resolveApp, Bn as refuseMalformedNestedChildOutputs, Br as DEFAULT_STATE_PREFIX, Bt as parameterTypeMayLoseSecretIdentity, C as namesAnyDeclaredParameter, Ca as resolveAssemblyPath, Ci as formatDockerLoginError, Cn as hasReadableOutputs, Cr as maskSecretsInError, Ct as CloudControlProvider, D as PRE_DELETE_SNAPSHOT_TYPES, Da as getAwsClients, Di as partitionSensitiveEnv, Dn as malformedExportSourceWarning, Dr as recordMaskOnlyValuesIn, Dt as deleteSkipReason, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as AwsClients, Ei as isMalformedEnvKey, En as malformedExportNamesWarning, Er as recordMaskOnlyValue, Et as deleteIndeterminateGuards, F as extractDeploymentEventError, Fi as getDockerImageBySourceHash, Fn as malformedResourceEntriesWarning, Fr as buildForceUnlockCommand, Ft as coerceParameterTypedValue, G as toCfnInteger, Ga as ProvisioningError, Gi as resolveStateBucketWithDefaultAndSource, Gn as refuseMalformedOutputsForDestroy, Gr as importableOutputKeys, Gt as resolveExplicitPhysicalId, H as WARM_THROUGHPUT_MEMBERS, Ha as MalformedProducerRecordRefusalError, Hi as resolveCaptureObservedState, Hn as refuseMalformedOrphansForDestroy, Hr as hasReadableExportSet, Ht as isSettledInstanceState, I as makeSiblingClaimReader, Ia as DeployCancelledError, Ii as Synthesizer, In as malformedResourcePropertiesWarning, Ir as buildLockContentionMessage, It as getAccountInfo, J as bold, Ja as StackHasActiveImportsError, Ji as warnDeprecatedNoPrefixCliFlag, Jn as refuseMalformedResourceEntriesForOrphan, Jr as orphansAfterRollback, Jt as coerceCfnInteger, K as toFiniteNumber, Ka as ResourceTimeoutError, Ki as resolveUseCdkBootstrapAssets, Kn as refuseMalformedResourceAttributesForOrphan, Kr as importableOutputs, Kt as assertRegionMatch, L as planOrphanAdoption, La as DynamicReferenceRegionAmbiguousError, Li as synthesisStatusMessage, Ln as malformedResourcesWarning, Lr as forceQuitRecoveryClause, Lt as isImpossibleEmptyStoredAttribute, M as refusesFinalSnapshot, Ma as CdkdError, Mi as escapeRegExp, Mn as malformedOutputsRefusalMessage, Mr as S3StateBackend, Mt as carriesDynamicReference, N as unsupportedFinalSnapshotError, Ni as stripControlChars, Nn as malformedOutputsWarning, Nr as rebuildClientForBucketRegion, Nt as carriesFetchableDynamicReference, O as buildFinalSnapshotIdentifier, Oa as resetAwsClients, Oi as redactDockerArgvValues, On as malformedLocalOutputsWarning, Or as recoverMaskedOutput, Ot as isWaitAbandonedError, P as makeCanonicalizePropertiesFn, Pa as CrossAccountSecretRefusalError, Pi as AssetManifestLoader, Pn as malformedRenderedContainersWarning, Pr as UNREPRODUCIBLE_LOCK_CLAUSE, Pt as cfnRefValueFromPhysicalId, Q as red, Qi as MIGRATE_TMP_PREFIX, Qn as repairMalformedOrphansForReadOnly, Qr as stringifyValue, Qt as readConfigString, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as IntrinsicResolutionRefusalError, Ri as getDefaultStateBucketName, Rn as malformedStateRefusalMessage, Rr as formatLockExpiry, Rt as isNamelessDynamicReferenceError, S as computeParameterTaint, Sa as renderAssemblyPathEscape, Si as finchSecretArgvRefusal, Sn as hasReadableOrphans, Sr as markSameGenerationBag, St as startInterruptWatch, T as resourcesNamingDeclaredParameter, Ta as resolveBucketRegion, Ti as isDockerClientEnvKey, Tn as isReadableResourceEntry, Tr as pathCrossesDottedKey, Tt as UNSPECIFIED_SKIP_REASON, U as coerceWarmThroughput$1, Ua as NestedStackChildDirectDestroyError, Ui as resolveSkipPrefix, Un as refuseMalformedOrphansForOrphan, Ur as hasReasonlessBaselineRefusal, Ut as WAFv2WebACLProvider, V as renderStatefulReason, Vi as resolveAutoAssetStorage, Vn as refuseMalformedOrphans, Vr as exportNamesCarriedFrom, Vt as refStateLookupFromResource, W as isWarmThroughputDecrease, Wa as PartialFailureError, Wi as resolveStateBucketWithDefault, Wn as refuseMalformedOutputs, Wr as hasUnverifiableParameterRefusal, Wt as normalizeAwsTagsToCfn, X as gray, Xi as CFN_TEMPLATE_BODY_LIMIT, Xn as refuseMalformedResourcesForDestroy, Xr as shouldRetainResource, Xt as configIntegerRefusal, Y as cyan, Ya as StackTerminationProtectionError, Yi as ssmResolvedValueType, Yn as refuseMalformedResourcePropertiesForOrphan, Yr as orphansCarriedFrom, Yt as configBooleanRefusal, Z as green, Za as SynthesisError, Zi as CFN_TEMPLATE_URL_LIMIT, Zn as refuseMalformedState, Zr as AssetPublisher, Zt as configStringRefusal, _ as bagHoldsSecretExpression, _a as hasPlainPrototype, _i as resolveDockerContextDirectory, _n as INTRINSIC_KEYS, _r as dynamicReferenceTokens, _t as maskerOrIdentity, a as DeploymentEventsStore, aa as producerRecordKey, ai as BOOTSTRAP_MARKER_PREFIX, an as withSharedDrainBudget, ao as isRetryableTransientError, ar as findActionableSilentDrops, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as absoluteAssemblyPathEscape, bi as describeDockerFailure, bn as UNREADABLE_RESOURCES_MAP_ROW, br as isSingleDynamicReferenceToken, bt as interruptWatchListenerCount, c as replayFailedOperations, ca as PARTITION_TABLE, ci as getBootstrapMarkerKey, cn as s3BucketDualStackDomainName, co as markNonRetryable, cr as withRetry, ct as IAMRoleProvider, d as updatePartialMessage, da as AssemblyReader, di as readBootstrapMarkerBody, dn as applyRoleArnIfSet, do as describeAwsFailure, dr as STATE_SOURCED_BASELINE_RULES, dt as definedAttributes, ea as uploadCfnTemplate, ei as buildAssetRedirectMap, en as requireConfigArray, eo as normalizeAwsError, er as repairMalformedResourceEntriesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as failedStageNote, fi as validateAssetBucketName, fn as AWS_CREDENTIAL_ENV_KEYS, fo as safeStringify, fr as STATE_SOURCED_CROSS_GENERATION_RULES, ft as stringifyIfAssigned, g as computeImplicitDeleteEdges, ga as hasOwnKey, gi as buildDockerImage, gn as DiffCalculator, gr as createSecretMasker, gt as maskDeep, h as IMPLICIT_DELETE_DEPENDENCIES, ha as defineOwnKey, hi as assertCdkLocalDockerContextContained, hn as envCredentialsAreAssumedRole, hr as carriesSecretMask, ht as createMaskedRetryLogger, i as DeploymentEventsReader, ia as producerCoordinateKey, ii as AssetModeResolver, in as producerRegionsFromState, io as isMarkedNonRetryable, ir as safeStackName, it as secretBearing, j as isFinalSnapshotError, ji as warnFinchArgvExposure, jn as malformedOrphansWarning, jr as LockManager, jt as IntrinsicFunctionResolver, k as ccRoutedFinalSnapshotError, ka as runWithStackAwsClients, ki as runDockerForeground, kn as malformedOrphanRecordsWarning, kr as redactSecretsForState, kt as disableInstanceApiTermination, l as replayRollback, la as canonicalizeRegion, li as isCrossRegionRedirect, ln as s3BucketRegionalDomainName, lo as markRedactedCause, lr as DagBuilder, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as processStackMessages, mi as buildDenyExternalAccessPolicy, mn as callerEnvCredentials, mr as TEMPLATE_SOURCED_RULES, mt as wouldReturnToSdkProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as injectiveKey, ni as loadPublishableAssetManifest, nn as requireConfigString, no as pasteableCommand, nr as repairMalformedResourcesForReadOnly, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as decodeListingKey, oi as assertAssetBucketRegion, on as s3BucketArn, oo as isThrottlingError, or as findSilentDropProperties, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as globMatches, pi as validateContainerRepoName, pn as applyCallerIdentityCredentials, pr as STATE_SOURCED_READBACK_RULES, pt as ProviderRegistry, q as formatResourceLine, qa as ResourceUpdateNotSupportedError, qi as stateBucketExistenceConfirmed, qn as refuseMalformedResourceEntries, qr as isReadableBag, qt as coerceCfnBoolean, r as DeployEngine, ra as injectiveKeyPrefix, ri as rewriteTemplateAssetReferences, rn as classifyReplaySecretRegion, ro as shellQuote, rr as safeRegion, rt as isExportAliasCollision, s as planRollback, sa as expectedOwnerParam, si as ensureAssetStorage, sn as s3BucketDomainName, so as isTransientServerError, sr as describeTypeWithThrottleRetry, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ti as createAssetRedirectResolver, tn as requireConfigObject, to as withErrorHandling, tr as repairMalformedResourcePropertiesForReadOnly, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as derivePartitionAndUrlSuffix, ui as parseBootstrapMarker, un as s3BucketWebsiteUrl, uo as retryClassificationText, ur as TemplateParser, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as nullPrototypeRecord, vi as describeDockerCapturedOutput, vn as STATE_RESOURCES_MALFORMED, vr as errorCauseChain, vt as beginCommandInterruptScope, w as reachableDivergentParameters, wi as getDockerCmd, wn as hasReadableResources, wr as maskSecretsInText, wt as slowCcOperationTimeoutMs, x as bindingSkippedOutputs, xa as displayAssemblyPath, xi as dockerSpawnEnvWithSensitive, xn as displayLogicalId, xr as isUncertifiedBaselineMaskPosition, xt as isInterruptedWaitError, y as keptWholeReasonText, ya as ownValue, yi as describeDockerExecFailure, yn as UNREADABLE_ORPHANS_CONTAINER_ROW, yr as identityKeyFor, yt as endCommandInterruptScope, z as isStatefulRecreateTargetForReplace, za as LocalInvokeBuildError$1, zi as getLegacyStateBucketName, zn as refuseDivergentRecordRegionForDestroy, zr as CUSTOM_RESOURCE_RESPONSE_PREFIX, zt as isUnboundTemplateParameter } from "./deploy-engine-xxVOQPPr.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-Qigb_6I0.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DAvRcbyS.js";
+import { t as getCdkdVersion } from "./version-DMRkEtU2.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CHM7_WdJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -43367,6 +43367,39 @@ var RDSDBProxyTargetGroupProvider = class {
 //#endregion
 //#region src/provisioning/providers/docdb-provider.ts
 /**
+* The attribute map a DocumentDB DB cluster records (issue #3650), under
+* CloudFormation's `Fn::GetAtt` names (`Endpoint`, `Port`, `ReadEndpoint`,
+* `ClusterResourceId`). The RDS-style dotted keys (`Endpoint.Address`, ...)
+* are kept for records and readers that already use them; no
+* `Fn::GetAtt` names them for this service, so on their own they left
+* `Fn::GetAtt [Cluster, Endpoint]` resolving to the cluster identifier.
+*/
+function clusterAttributes$1(cluster) {
+	return definedAttributes({
+		Endpoint: cluster?.Endpoint,
+		Port: stringifyIfAssigned(cluster?.Port),
+		ReadEndpoint: cluster?.ReaderEndpoint,
+		"Endpoint.Address": cluster?.Endpoint,
+		"Endpoint.Port": stringifyIfAssigned(cluster?.Port),
+		"ReadEndpoint.Address": cluster?.ReaderEndpoint,
+		Arn: cluster?.DBClusterArn,
+		ClusterResourceId: cluster?.DbClusterResourceId
+	});
+}
+/**
+* The attribute map a DocumentDB DB instance records (issue #3650): `Endpoint` /
+* `Port` are CloudFormation's `Fn::GetAtt` names, the dotted keys are kept.
+*/
+function instanceAttributes$1(instance) {
+	return definedAttributes({
+		Endpoint: instance?.Endpoint?.Address,
+		Port: stringifyIfAssigned(instance?.Endpoint?.Port),
+		"Endpoint.Address": instance?.Endpoint?.Address,
+		"Endpoint.Port": stringifyIfAssigned(instance?.Endpoint?.Port),
+		Arn: instance?.DBInstanceArn
+	});
+}
+/**
 * AWS DocumentDB Provider
 *
 * Implements resource provisioning for DocumentDB resources:
@@ -43549,16 +43582,9 @@ var DocDBProvider = class {
 			}))).DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(dbClusterIdentifier);
-			const described = await this.describeDBCluster(dbClusterIdentifier);
 			return {
 				physicalId: dbClusterIdentifier,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint,
-					"Endpoint.Port": stringifyIfAssigned(described?.Port),
-					"ReadEndpoint.Address": described?.ReaderEndpoint,
-					Arn: described?.DBClusterArn,
-					ClusterResourceId: described?.DbClusterResourceId
-				})
+				attributes: clusterAttributes$1(await this.describeDBCluster(dbClusterIdentifier))
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43590,13 +43616,7 @@ var DocDBProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint,
-					"Endpoint.Port": stringifyIfAssigned(described?.Port),
-					"ReadEndpoint.Address": described?.ReaderEndpoint,
-					Arn: described?.DBClusterArn,
-					ClusterResourceId: described?.DbClusterResourceId
-				})
+				attributes: clusterAttributes$1(described)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -43658,14 +43678,9 @@ var DocDBProvider = class {
 			}))).DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created DocDB DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(dbInstanceIdentifier);
-			const described = await this.describeDBInstance(dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
-					Arn: described?.DBInstanceArn
-				})
+				attributes: instanceAttributes$1(await this.describeDBInstance(dbInstanceIdentifier))
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43689,11 +43704,7 @@ var DocDBProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
-					Arn: described?.DBInstanceArn
-				})
+				attributes: instanceAttributes$1(described)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -43962,11 +43973,7 @@ var DocDBProvider = class {
 			const described = (await this.getClient().send(new DescribeDBInstancesCommand$1({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
-					Arn: described?.DBInstanceArn
-				})
+				attributes: instanceAttributes$1(described)
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -43977,10 +43984,9 @@ var DocDBProvider = class {
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBClustersCommand$1({ DBClusterIdentifier: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: clusterAttributes$1((await this.getClient().send(new DescribeDBClustersCommand$1({ DBClusterIdentifier: explicit }))).DBClusters?.[0])
 			};
 		} catch (err) {
 			if (err.name === "DBClusterNotFoundFault") return null;
@@ -44007,6 +44013,38 @@ var DocDBProvider = class {
 //#endregion
 //#region src/provisioning/providers/neptune-provider.ts
 /**
+* The attribute map a Neptune DB cluster records (issue #3650), under
+* CloudFormation's `Fn::GetAtt` names (`Endpoint`, `Port`, `ReadEndpoint`,
+* `ClusterResourceId`). The RDS-style dotted keys (`Endpoint.Address`, ...)
+* are kept for records and readers that already use them; no
+* `Fn::GetAtt` names them for this service, so on their own they left
+* `Fn::GetAtt [Cluster, Endpoint]` resolving to the cluster identifier.
+*/
+function clusterAttributes(cluster) {
+	return definedAttributes({
+		Endpoint: cluster?.Endpoint,
+		Port: stringifyIfAssigned(cluster?.Port),
+		ReadEndpoint: cluster?.ReaderEndpoint,
+		"Endpoint.Address": cluster?.Endpoint,
+		"Endpoint.Port": stringifyIfAssigned(cluster?.Port),
+		"ReadEndpoint.Address": cluster?.ReaderEndpoint,
+		ClusterResourceId: cluster?.DbClusterResourceId
+	});
+}
+/**
+* The attribute map a Neptune DB instance records (issue #3650): `Endpoint` /
+* `Port` are CloudFormation's `Fn::GetAtt` names, the dotted keys are kept.
+*/
+function instanceAttributes(instance) {
+	return definedAttributes({
+		Endpoint: instance?.Endpoint?.Address,
+		Port: stringifyIfAssigned(instance?.Endpoint?.Port),
+		"Endpoint.Address": instance?.Endpoint?.Address,
+		"Endpoint.Port": stringifyIfAssigned(instance?.Endpoint?.Port),
+		Arn: instance?.DBInstanceArn
+	});
+}
+/**
 * AWS Neptune Provider
 *
 * Implements resource provisioning for Neptune resources:
@@ -44192,15 +44230,9 @@ var NeptuneProvider = class {
 			}))).DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created Neptune DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(dbClusterIdentifier);
-			const described = await this.describeDBCluster(dbClusterIdentifier);
 			return {
 				physicalId: dbClusterIdentifier,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint,
-					"Endpoint.Port": stringifyIfAssigned(described?.Port),
-					"ReadEndpoint.Address": described?.ReaderEndpoint,
-					ClusterResourceId: described?.DbClusterResourceId
-				})
+				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -44232,12 +44264,7 @@ var NeptuneProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint,
-					"Endpoint.Port": stringifyIfAssigned(described?.Port),
-					"ReadEndpoint.Address": described?.ReaderEndpoint,
-					ClusterResourceId: described?.DbClusterResourceId
-				})
+				attributes: clusterAttributes(described)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -44302,13 +44329,9 @@ var NeptuneProvider = class {
 			}))).DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created Neptune DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(dbInstanceIdentifier);
-			const described = await this.describeDBInstance(dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port)
-				})
+				attributes: instanceAttributes(await this.describeDBInstance(dbInstanceIdentifier))
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -44334,10 +44357,7 @@ var NeptuneProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port)
-				})
+				attributes: instanceAttributes(described)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -44609,11 +44629,7 @@ var NeptuneProvider = class {
 			const described = (await this.getClient().send(new DescribeDBInstancesCommand$2({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: definedAttributes({
-					"Endpoint.Address": described?.Endpoint?.Address,
-					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
-					Arn: described?.DBInstanceArn
-				})
+				attributes: instanceAttributes(described)
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -44624,10 +44640,9 @@ var NeptuneProvider = class {
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBClustersCommand$2({ DBClusterIdentifier: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: clusterAttributes((await this.getClient().send(new DescribeDBClustersCommand$2({ DBClusterIdentifier: explicit }))).DBClusters?.[0])
 			};
 		} catch (err) {
 			if (err.name === "DBClusterNotFoundFault") return null;
@@ -91319,24 +91334,26 @@ const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 * boundary, so a local-invoke build failure still surfaces with cdkd's exit code
 * / branding. `architectureToPlatform` is a pure helper (re-exported directly).
 *
-* It is also where the build context is CONTAINED: cdk-local joins
-* `source.directory` onto `cdkOutDir` with no check, so the shim refuses an
-* escaping value before delegating, against a REQUIRED `assetOutdir` bound
-* (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
+* The build context is CONTAINED twice, against one REQUIRED `assetOutdir`
+* bound (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)). The
+* engine refuses an escaping `source.directory` itself since cdk-local 0.149.3,
+* and the bound is FORWARDED to it: without one the engine narrows to the
+* manifest directory and refuses a `cdk.Stage` image's `../asset.<hash>`
+* (issue [#3597](https://github.com/go-to-k/cdkd/issues/3597)). cdkd still
+* refuses first, because the engine's refusal quotes the manifest value in a
+* boundary the value itself can close (go-to-k/cdk-local#758); once that
+* ships, go-to-k/cdkd#3652 drops cdkd's copy.
 * See cdk-local's `src/local/docker-image-builder.ts`.
 */
 async function buildContainerImage$1(asset, cdkOutDir, options) {
-	const executable = asset?.source?.executable;
-	if (executable && executable.length > 0) warnManifestExecutable(executable);
-	const { assetOutdir, ...implOptions } = options;
 	assertCdkLocalDockerContextContained({
 		manifestDir: cdkOutDir,
 		source: asset.source,
-		assetOutdir,
+		assetOutdir: options.assetOutdir,
 		wrapError: (message) => new LocalInvokeBuildError$1(`Refusing to build the container image: ${message}`)
 	});
 	try {
-		return await buildContainerImage(asset, cdkOutDir, implOptions);
+		return await buildContainerImage(asset, cdkOutDir, options);
 	} catch (e) {
 		if (e instanceof LocalInvokeBuildError) throw new LocalInvokeBuildError$1(e.message);
 		throw e;
@@ -91380,7 +91397,25 @@ function canonicalizeImageUriHost(imageUri) {
 	if (slash < 0) return imageUri;
 	const host = imageUri.slice(0, slash);
 	if (!isRegistryHostComponent(host)) return imageUri;
-	return host.toLowerCase() + imageUri.slice(slash);
+	return foldAsciiUpperCase(host) + imageUri.slice(slash);
+}
+/**
+* Lower-case ONLY the ASCII letters `A`-`Z`, leaving every other code point
+* as written.
+*
+* `String.prototype.toLowerCase` performs full Unicode case folding, so the
+* Kelvin sign U+212A folds to a plain ASCII `k`. Folding with it here, BEFORE
+* `parseEcrRegistryHost`, handed that parser an already-ASCII host and defeated
+* the raw-capture charset guard it applies to the region and suffix (see
+* `CANONICAL_REGION_SEGMENT` in `src/utils/ecr-uri.ts`):
+* `<acct>.dkr.ecr-fips.us-<U+212A>east-1.amazonaws.com/...` parsed as the
+* region `us-keast-1`, a region the host does not name, and a Kelvin sign in
+* the LABELS resolved to the plain form. An ASCII-only fold keeps the case
+* fold the #1801 login / pull agreement needs (DNS case-insensitivity is
+* ASCII-only) while leaving any other code point for that guard to refuse.
+*/
+function foldAsciiUpperCase(value) {
+	return value.replace(/[A-Z]+/g, (run) => run.toLowerCase());
 }
 /** Docker's rule for "component 1 is a registry, not a repository segment". */
 function isRegistryHostComponent(component) {
@@ -91453,7 +91488,9 @@ function isCredentialFresh(creds) {
 * the same one the DERIVED `docker login` endpoint names — an
 * AWS-reported `proxyEndpoint` still wins over that fallback (it can be
 * a VPC-endpoint host), which is correct: AWS names the endpoint its own
-* token authenticates, and it reports it lower-cased.
+* token authenticates, and it reports it lower-cased. That precedence holds
+* only for the PLAIN host form: a FIPS or dual-stack pull logs in to its own
+* host, since `proxyEndpoint` always names the plain one (issue #1855).
 */
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
@@ -91504,7 +91541,11 @@ async function pullEcrImage(imageUri, options) {
 		...assumed && { credentials: assumed }
 	});
 	try {
-		await ecrLogin(ecr, parsed.accountId, parsed.region);
+		await ecrLogin(ecr, {
+			accountId: parsed.accountId,
+			region: parsed.region,
+			registryHost: canonicalUri.slice(0, canonicalUri.indexOf("/"))
+		});
 	} finally {
 		ecr.destroy();
 	}
@@ -91555,14 +91596,26 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 * Authenticate the local docker daemon against the target ECR registry.
 * Mirrors `DockerAssetPublisher.ecrLogin` but stays in this module so the
 * local-invoke path doesn't depend on the publisher's larger surface area.
-*/
-async function ecrLogin(client, accountId, region) {
-	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region})`);
+*
+* The login endpoint must name the host the PULL targets (issue #1855):
+* docker's credential store is keyed on the hostname verbatim, so a login to
+* the plain host followed by a pull from a FIPS or dual-stack host sends no
+* credentials (`no basic auth credentials`). `GetAuthorizationToken` reports
+* the PLAIN host as its `proxyEndpoint`, so that value, and the derived
+* fallback, are used only when the pull targets the plain form; every other
+* form logs in to `registryHost` itself. The token is registry-scoped, not
+* host-scoped: measured against real ECR, one token authenticated `/v2/` on
+* all four host forms `ECR_REGISTRY_HOST_FORMS` lists.
+*/
+async function ecrLogin(client, target) {
+	const { accountId, region, registryHost } = target;
+	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
 	const authData = (await client.send(new GetAuthorizationTokenCommand({}))).authorizationData?.[0];
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError$1("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+	const plainHost = `${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+	const endpoint = registryHost === plainHost ? authData.proxyEndpoint || `https://${plainHost}` : `https://${registryHost}`;
 	const loginArgs = [
 		"login",
 		"--username",
@@ -95748,10 +95801,14 @@ function createLocalRunTaskCommand() {
 * (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
 *
 * `cdkd local start-service` / `start-alb` hand the whole run to cdk-local's
-* `runEcsServiceEmulator`, which reads each stack's asset manifest itself and
-* joins `source.directory` onto the manifest directory raw — for an ECS
-* container image and for an ALB Lambda target's container image alike. No
-* argument reaches that join, so cdkd judges the manifests here instead.
+* `runEcsServiceEmulator`, which reads each stack's asset manifest itself —
+* for an ECS container image and for an ALB Lambda target's container image
+* alike. Since cdk-local 0.149.3 the engine refuses an escaping
+* `source.directory` at each build and each `--watch` soft reload
+* (go-to-k/cdkd#3597). This check stays in front of it, for the whole
+* assembly at once, because the engine's refusal quotes the assembly-chosen
+* value in a boundary the value can close (go-to-k/cdk-local#758);
+* go-to-k/cdkd#3652 removes it once that ships.
 *
 * `resolveBoots` is the seam because the engine calls it after every synth —
 * at boot, and again on every `--watch` reload — and before any image is
@@ -95821,7 +95878,7 @@ function assertEmulatorDockerContextsContained(stacks) {
 * only while the directory is named `assembly-*` AND its parent's
 * `manifest.json` declares it as a `cdk:cloud-assembly` artifact, and WARN
 * whenever a climb happens, since the predicate is read from the tree being
-* judged. Replace with the upstream export once one exists (go-to-k/cdkd#3597).
+* judged. Deleted with this module by go-to-k/cdkd#3652.
 */
 function engineAssemblyRoot(outdir) {
 	let dir = resolve(outdir);
@@ -98762,4 +98819,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DjkAPWi0.js.map
+//# sourceMappingURL=program-hXXls0hg.js.map