@go-to-k/cdkd 0.291.18 → 0.291.20

package/dist/{program-DxyHPT8E.js → program-CwcF5msU.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as NestedStackChildDirectDestroyError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as readConfigString, A as createPreDeleteFinalSnapshot, Aa as absoluteAssemblyPathEscape, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as disableInstanceApiTermination, B as isStatefulRecreateTargetSync, Ba as setAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as isUnboundTemplateParameter, C as namesAnyDeclaredParameter, Ca as globMatches, Ci as validateAssetBucketName, Cn as displayLogicalId, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as CloudControlProvider, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasPlainPrototype, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as deleteIndeterminateGuards, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as hasOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as UNSPECIFIED_SKIP_REASON, F as extractDeploymentEventError, Fa as resolveBucketRegion, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as cfnRefValueFromPhysicalId, G as toCfnInteger, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as normalizeAwsTagsToCfn, H as WARM_THROUGHPUT_MEMBERS, Ha as CdkdError, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as refStateLookupFromResource, I as makeSiblingClaimReader, Ia as AwsClients, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as coerceParameterTypedValue, J as bold, Ja as IntrinsicResolutionRefusalError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as coerceCfnBoolean, K as toFiniteNumber, Ka as DeployCancelledError, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as resolveExplicitPhysicalId, L as planOrphanAdoption, La as getAwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as getAccountInfo, M as refusesFinalSnapshot, Ma as renderAssemblyPathEscape, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as IntrinsicFunctionResolver, N as unsupportedFinalSnapshotError, Na as resolveAssemblyPath, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as carriesDynamicReference, O as buildFinalSnapshotIdentifier, Oa as nullPrototypeRecord, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as deleteSkipReason, P as makeCanonicalizePropertiesFn, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as carriesFetchableDynamicReference, Q as red, Qa as MalformedProducerRecordRefusalError, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as configStringRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as resetAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isImpossibleEmptyStoredAttribute, S as computeParameterTaint, Sa as failedStageNote, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as safeStringify, Sr as STATE_SOURCED_BASELINE_RULES, St as startInterruptWatch, T as resourcesNamingDeclaredParameter, Ta as defineOwnKey, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as ccProtectionRegistryTypes, U as coerceWarmThroughput$1, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as isSettledInstanceState, V as renderStatefulReason, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as parameterTypeMayLoseSecretIdentity, W as isWarmThroughputDecrease, Wa as CrossAccountSecretRefusalError, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as WAFv2WebACLProvider, X as gray, Xa as LocalStartServiceError, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configBooleanRefusal, Y as cyan, Ya as LocalInvokeBuildError$1, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as coerceCfnInteger, Z as green, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as configIntegerRefusal, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isTransientServerError, _r as findSilentDropProperties, _t as maskerOrIdentity, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackTerminationProtectionError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as retryClassificationText, br as DagBuilder, bt as interruptWatchListenerCount, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as withErrorHandling, dr as repairMalformedResourcesForReadOnly, dt as definedAttributes, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as replayWarn, eo as PartialFailureError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as pasteableCommand, fr as safeRegion, ft as stringifyIfAssigned, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isThrottlingError, gr as findActionableSilentDrops, gt as maskDeep, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isRetryableTransientError, hr as unreadableOrphanRecords, ht as createMaskedRetryLogger, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as StackHasActiveImportsError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as displayAssemblyPath, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as isTerminationProtectionPropagationError, k as ccRoutedFinalSnapshotError, ka as ownValue, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isWaitAbandonedError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as isMarkedNonRetryable, mr as unpreviewableOrphanRecords, mt as wouldReturnToSdkProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as requireConfigObject, no as ResourceTimeoutError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as shellQuote, pr as safeStackName, pt as ProviderRegistry, q as formatResourceLine, qa as DynamicReferenceRegionAmbiguousError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as assertRegionMatch, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as requireConfigString, ro as ResourceUpdateNotSupportedError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, so as SynthesisError, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigArray, to as ProvisioningError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, uo as normalizeAwsError, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as markNonRetryable, vr as describeTypeWithThrottleRetry, vt as beginCommandInterruptScope, w as reachableDivergentParameters, wa as processStackMessages, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as slowCcOperationTimeoutMs, x as bindingSkippedOutputs, xa as AssemblyReader, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as describeAwsFailure, xr as TemplateParser, xt as isInterruptedWaitError, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markRedactedCause, yr as withRetry, yt as endCommandInterruptScope, z as isStatefulRecreateTargetForReplace, za as runWithStackAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as isNamelessDynamicReferenceError } from "./deploy-engine-BwDlgFRs.js";
+import { $ as yellow, $a as MalformedProducerRecordRefusalError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as requireConfigArray, A as createPreDeleteFinalSnapshot, Aa as ownValue, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as IntrinsicFunctionResolver, B as isStatefulRecreateTargetSync, Ba as runWithStackAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as refStateLookupFromResource, C as namesAnyDeclaredParameter, Ca as failedStageNote, Ci as validateAssetBucketName, Cn as displayLogicalId, Co as safeStringify, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as ccProtectionRegistryTypes, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasOwnKey, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as isWaitAbandonedError, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as defineOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as getAccountInfo, G as toCfnInteger, Ga as CrossAccountSecretRefusalError, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as assertRegionMatch, H as WARM_THROUGHPUT_MEMBERS, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as WAFv2WebACLProvider, I as makeSiblingClaimReader, Ia as resolveBucketRegion, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as isImpossibleEmptyStoredAttribute, J as bold, Ja as DynamicReferenceRegionAmbiguousError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as configBooleanRefusal, K as toFiniteNumber, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as coerceCfnBoolean, L as planOrphanAdoption, La as AwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as isNamelessDynamicReferenceError, M as refusesFinalSnapshot, Ma as displayAssemblyPath, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as carriesFetchableDynamicReference, N as unsupportedFinalSnapshotError, Na as renderAssemblyPathEscape, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as cfnRefValueFromPhysicalId, O as buildFinalSnapshotIdentifier, Oa as hasPlainPrototype, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as disableInstanceApiTermination, P as makeCanonicalizePropertiesFn, Pa as resolveAssemblyPath, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as coerceParameterTypedValue, Q as red, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as replayWarn, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as getAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isUnboundTemplateParameter, S as computeParameterTaint, Sa as AssemblyReader, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as describeAwsFailure, Sr as STATE_SOURCED_BASELINE_RULES, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as processStackMessages, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as CdkdError, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as normalizeAwsTagsToCfn, V as renderStatefulReason, Va as setAwsClients, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as isSettledInstanceState, W as isWarmThroughputDecrease, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as resolveExplicitPhysicalId, X as gray, Xa as LocalInvokeBuildError$1, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configStringRefusal, Y as cyan, Ya as IntrinsicResolutionRefusalError, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as configIntegerRefusal, Z as green, Za as LocalStartServiceError, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as readConfigString, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isThrottlingError, _r as findSilentDropProperties, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackHasActiveImportsError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as markRedactedCause, br as DagBuilder, bt as startInterruptWatch, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, co as SynthesisError, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as normalizeAwsError, dr as repairMalformedResourcesForReadOnly, dt as ProviderRegistry, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as requireConfigObject, eo as NestedStackChildDirectDestroyError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as withErrorHandling, fr as safeRegion, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isRetryableTransientError, gr as findActionableSilentDrops, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isMarkedNonRetryable, hr as unreadableOrphanRecords, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as ResourceUpdateNotSupportedError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as absoluteAssemblyPathEscape, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as carriesDynamicReference, k as ccRoutedFinalSnapshotError, ka as nullPrototypeRecord, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isTerminationProtectionPropagationError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as shellQuote, mr as unpreviewableOrphanRecords, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as definedAttributes, no as ProvisioningError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, oo as StackTerminationProtectionError, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as pasteableCommand, pr as safeStackName, pt as createMaskedRetryLogger, q as formatResourceLine, qa as DeployCancelledError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as coerceCfnInteger, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as stringifyIfAssigned, ro as ResourceTimeoutError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigString, to as PartialFailureError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as isTransientServerError, vr as describeTypeWithThrottleRetry, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as globMatches, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as ambientClientDefaults, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as retryClassificationText, xr as TemplateParser, xt as CloudControlProvider, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markNonRetryable, yr as withRetry, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as resetAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as parameterTypeMayLoseSecretIdentity } from "./deploy-engine-CkF6PyFY.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-CJkb2usU.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DR5gOGbi.js";
+import { t as getCdkdVersion } from "./version-BYrVI73L.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-C0qLsIu5.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -22163,7 +22163,7 @@ var DynamoDBGlobalTableProvider = class {
 		const cached = this.regionalClientCache.get(region);
 		if (cached) return cached;
 		const client = new DynamoDBClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region
 		});
 		this.regionalClientCache.set(region, client);
@@ -22184,7 +22184,7 @@ var DynamoDBGlobalTableProvider = class {
 		const cached = this.regionalAutoScalingClientCache.get(region);
 		if (cached) return cached;
 		const client = new ApplicationAutoScalingClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region
 		});
 		this.regionalAutoScalingClientCache.set(region, client);
@@ -22202,7 +22202,7 @@ var DynamoDBGlobalTableProvider = class {
 		if (this.localAutoScalingClient) return this.localAutoScalingClient;
 		const region = await this.dynamoDBClient.config.region() ?? "";
 		this.localAutoScalingClient = new ApplicationAutoScalingClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region
 		});
 		return this.localAutoScalingClient;
@@ -23888,7 +23888,7 @@ var DynamoDBGlobalTableProvider = class {
 		const resourceId = autoScalingResourceId(tableName, indexName);
 		try {
 			const asClient = client ?? new ApplicationAutoScalingClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: await this.dynamoDBClient.config.region() ?? ""
 			});
 			const targets = (await asClient.send(new DescribeScalableTargetsCommand({
@@ -34413,7 +34413,7 @@ var ApiGatewayV2Provider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new ApiGatewayV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -38213,6 +38213,15 @@ var AgentCoreEvaluatorProvider = class {
 //#endregion
 //#region src/provisioning/providers/stepfunctions-provider.ts
 /**
+* CloudFormation's `StateMachineRevisionId` for a described state machine.
+* `DescribeStateMachine` omits `revisionId` until the machine is first
+* updated, and CloudFormation then reports `INITIAL` (measured live,
+* 2026-09-25, issue #3627), so the absent value maps to that.
+*/
+function stateMachineRevisionId(described) {
+	return described.revisionId ?? "INITIAL";
+}
+/**
 * AWS Step Functions State Machine Provider
 *
 * Implements resource provisioning for AWS::StepFunctions::StateMachine using the SFN SDK.
@@ -38240,14 +38249,14 @@ var StepFunctionsProvider = class {
 	])]]);
 	getClient() {
 		if (!this.sfnClient) this.sfnClient = new SFNClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.sfnClient;
 	}
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -38280,17 +38289,23 @@ var StepFunctionsProvider = class {
 				tags,
 				encryptionConfiguration
 			};
-			const response = await this.getClient().send(new CreateStateMachineCommand(createParams));
-			const stateMachineArn = response.stateMachineArn;
+			const stateMachineArn = (await this.getClient().send(new CreateStateMachineCommand(createParams))).stateMachineArn;
 			if (!stateMachineArn) throw new Error("CreateStateMachine did not return stateMachineArn");
 			this.logger.debug(`Successfully created Step Functions state machine ${logicalId}: ${stateMachineArn}`);
+			const name = stateMachineArn.split(":").pop() || stateMachineName;
+			let revisionId;
+			try {
+				revisionId = stateMachineRevisionId(await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn })));
+			} catch (describeError) {
+				this.logger.debug(`Could not read the revision id of ${logicalId} after create: ${describeAwsFailure(describeError).detail}`);
+			}
 			return {
 				physicalId: stateMachineArn,
-				attributes: {
+				attributes: definedAttributes({
 					Arn: stateMachineArn,
-					Name: stateMachineArn.split(":").pop() || stateMachineName,
-					StateMachineRevisionId: response.stateMachineVersionArn
-				}
+					Name: name,
+					StateMachineRevisionId: revisionId
+				})
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -38325,7 +38340,7 @@ var StepFunctionsProvider = class {
 				attributes: {
 					Arn: physicalId,
 					Name: describeResponse.name,
-					StateMachineRevisionId: describeResponse.revisionId
+					StateMachineRevisionId: stateMachineRevisionId(describeResponse)
 				}
 			};
 		} catch (error) {
@@ -38433,10 +38448,14 @@ var StepFunctionsProvider = class {
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: input.knownPhysicalId }));
+			const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: input.knownPhysicalId }));
 			return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: definedAttributes({
+					Arn: input.knownPhysicalId,
+					Name: resp.name,
+					StateMachineRevisionId: stateMachineRevisionId(resp)
+				})
 			};
 		} catch (err) {
 			if (err instanceof StateMachineDoesNotExist) return null;
@@ -38879,7 +38898,7 @@ var ECSProvider = class {
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
 	getClient() {
 		if (!this.ecsClient) this.ecsClient = new ECSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.ecsClient;
@@ -40698,7 +40717,7 @@ var ELBv2Provider = class {
 	]);
 	getClient() {
 		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.elbv2Client;
@@ -41970,7 +41989,7 @@ var RDSProvider = class {
 	])]]);
 	getClient() {
 		if (!this.rdsClient) this.rdsClient = new RDSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.rdsClient;
@@ -42647,10 +42666,16 @@ var RDSProvider = class {
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: explicit }));
+			const described = (await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: explicit }))).DBClusters?.[0];
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					Arn: described?.DBClusterArn,
+					DBClusterResourceId: described?.DbClusterResourceId
+				})
 			};
 		} catch (err) {
 			if (err.name === "DBClusterNotFoundFault") return null;
@@ -42732,7 +42757,7 @@ var RDSDBProxyProvider = class {
 	])]]);
 	getClient() {
 		if (!this.rdsClient) this.rdsClient = new RDSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.rdsClient;
@@ -43070,7 +43095,7 @@ var RDSDBProxyEndpointProvider = class {
 	])]]);
 	getClient() {
 		if (!this.rdsClient) this.rdsClient = new RDSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.rdsClient;
@@ -43382,7 +43407,7 @@ var RDSDBProxyTargetGroupProvider = class {
 	])]]);
 	getClient() {
 		if (!this.rdsClient) this.rdsClient = new RDSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.rdsClient;
@@ -43730,7 +43755,7 @@ var DocDBProvider = class {
 	]);
 	getClient() {
 		if (!this.docdbClient) this.docdbClient = new DocDBClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.docdbClient;
@@ -44379,7 +44404,7 @@ var NeptuneProvider = class {
 	]);
 	getClient() {
 		if (!this.neptuneClient) this.neptuneClient = new NeptuneClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.neptuneClient;
@@ -45128,7 +45153,7 @@ var Route53Provider = class {
 	])]]);
 	getClient() {
 		if (!this.route53Client) this.route53Client = new Route53Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.route53Client;
@@ -47266,7 +47291,7 @@ var CognitoUserPoolProvider = class {
 	}
 	getClient() {
 		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.cognitoClient;
@@ -48042,6 +48067,21 @@ var CognitoUserPoolProvider = class {
 		return result;
 	}
 	/**
+	* The attribute map a user pool records, derived as `create()` / `update()`
+	* derive it (issue #3627): the resolver served the pool id for
+	* `ProviderName` / `ProviderURL` after an import.
+	*/
+	async userPoolAttributes(userPoolId, arn) {
+		const region = await this.getClient().config.region();
+		const { urlSuffix } = derivePartitionAndUrlSuffix(region);
+		return definedAttributes({
+			Arn: arn,
+			ProviderName: `cognito-idp.${region}.${urlSuffix}/${userPoolId}`,
+			ProviderURL: `https://cognito-idp.${region}.${urlSuffix}/${userPoolId}`,
+			UserPoolId: userPoolId
+		});
+	}
+	/**
 	* Adopt an existing Cognito User Pool into cdkd state.
 	*
 	* User Pool physical id is the AWS-generated `<region>_<random>` id.
@@ -48059,10 +48099,10 @@ var CognitoUserPoolProvider = class {
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: input.knownPhysicalId }));
+			const resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: input.knownPhysicalId }));
 			return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: await this.userPoolAttributes(input.knownPhysicalId, resp.UserPool?.Arn)
 			};
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$9) return null;
@@ -48076,10 +48116,19 @@ var CognitoUserPoolProvider = class {
 				MaxResults: 60,
 				...marker && { NextToken: marker }
 			}));
-			for (const pool of list.UserPools ?? []) if (pool.Id && pool.Name === desiredName) return {
-				physicalId: pool.Id,
-				attributes: {}
-			};
+			for (const pool of list.UserPools ?? []) if (pool.Id && pool.Name === desiredName) {
+				let resp;
+				try {
+					resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$9) return null;
+					throw err;
+				}
+				return {
+					physicalId: pool.Id,
+					attributes: await this.userPoolAttributes(pool.Id, resp.UserPool?.Arn)
+				};
+			}
 			marker = list.NextToken;
 		} while (marker);
 		return null;
@@ -48136,7 +48185,7 @@ var ElastiCacheProvider = class {
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
 	getClient() {
 		if (!this.client) this.client = new ElastiCacheClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -48673,14 +48722,14 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	]);
 	getClient() {
 		if (!this.client) this.client = new ServiceDiscoveryClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
 	}
 	getStsClient() {
 		if (!this.stsClient) this.stsClient = new STSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.stsClient;
@@ -49739,7 +49788,7 @@ var AppSyncProvider = class {
 	]);
 	getClient() {
 		if (!this.client) this.client = new AppSyncClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -49935,7 +49984,7 @@ var AppSyncProvider = class {
 	*/
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -51600,7 +51649,7 @@ var GlueProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -52454,7 +52503,7 @@ var GlueWorkflowProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -52585,7 +52634,7 @@ var GlueWorkflowProvider = class {
 	async getAccountId() {
 		if (this.cachedAccountId) return this.cachedAccountId;
 		if (!this.stsClient) this.stsClient = new STSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		const identity = await this.stsClient.send(new GetCallerIdentityCommand({}));
@@ -52613,7 +52662,7 @@ var GlueSecurityConfigurationProvider = class {
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::SecurityConfiguration", /* @__PURE__ */ new Set(["Name", "EncryptionConfiguration"])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -52977,14 +53026,14 @@ var GlueJobProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
 	}
 	getStsClient() {
 		if (!this.stsClient) this.stsClient = new STSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.stsClient;
@@ -53357,14 +53406,14 @@ var GlueCrawlerProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
 	}
 	getStsClient() {
 		if (!this.stsClient) this.stsClient = new STSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.stsClient;
@@ -53672,7 +53721,7 @@ var GlueConnectionProvider = class {
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -53838,14 +53887,14 @@ var GlueTriggerProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
 	}
 	getStsClient() {
 		if (!this.stsClient) this.stsClient = new STSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.stsClient;
@@ -54063,7 +54112,7 @@ var KMSProvider = class {
 	])], ["AWS::KMS::Alias", /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"])]]);
 	getClient() {
 		if (!this.client) this.client = new KMSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -54512,7 +54561,7 @@ var BudgetsBudgetProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new BudgetsClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -55131,7 +55180,7 @@ var KinesisStreamProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new KinesisClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -55612,7 +55661,7 @@ var KinesisStreamConsumerProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new KinesisClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -55901,7 +55950,7 @@ var SchedulerScheduleProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new SchedulerClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -56202,7 +56251,7 @@ var EFSProvider = class {
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]])]]);
 	getClient() {
 		if (!this.client) this.client = new EFSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -57125,7 +57174,7 @@ var FSxFileSystemProvider = class {
 	unhandledByDesign = /* @__PURE__ */ new Map();
 	getClient() {
 		if (!this.client) this.client = new FSxClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -58244,7 +58293,7 @@ var EMRClusterProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new EMRClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -59019,7 +59068,7 @@ var EMRInstanceGroupConfigProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new EMRClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -59345,7 +59394,7 @@ var EMRInstanceFleetConfigProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new EMRClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -59650,7 +59699,7 @@ var FirehoseProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new FirehoseClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -61000,7 +61049,7 @@ var CloudTrailProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new CloudTrailClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -61349,7 +61398,7 @@ var CodeBuildProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new CodeBuildClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -61916,14 +61965,14 @@ var CodeCommitRepositoryProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new CodeCommitClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
 	}
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -62359,7 +62408,7 @@ var DLMLifecyclePolicyProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new DLMClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -62655,7 +62704,7 @@ var S3VectorsProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new S3VectorsClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -62857,18 +62906,27 @@ var S3VectorsProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.VectorBucketName`
 	*     → verify via `GetVectorBucket`. The physical id is the bucket name.
+	*     An `s3vectors` bucket ARN — CloudFormation's physical id, which
+	*     `--migrate-from-cloudformation` passes verbatim — is looked up BY ARN,
+	*     and the name AWS reports is recorded (issue #3627).
 	*/
 	async import(input) {
 		const explicit = input.knownPhysicalId ?? (typeof input.properties?.["VectorBucketName"] === "string" && input.properties["VectorBucketName"].length > 0 ? input.properties["VectorBucketName"] : void 0);
-		if (explicit) try {
-			await this.getClient().send(new GetVectorBucketCommand({ vectorBucketName: explicit }));
-			return {
-				physicalId: explicit,
-				attributes: {}
-			};
-		} catch (err) {
-			if (this.isNotFoundError(err)) return null;
-			throw err;
+		if (explicit) {
+			const isArn = explicit.startsWith("arn:");
+			if (isArn && !/^arn:[^:]+:s3vectors:[^:]*:[^:]*:bucket\/[^/]+$/.test(explicit)) return null;
+			try {
+				const resp = await this.getClient().send(new GetVectorBucketCommand(isArn ? { vectorBucketArn: explicit } : { vectorBucketName: explicit }));
+				const name = isArn ? resp.vectorBucket?.vectorBucketName : explicit;
+				if (!name) return null;
+				return {
+					physicalId: name,
+					attributes: definedAttributes({ VectorBucketArn: resp.vectorBucket?.vectorBucketArn })
+				};
+			} catch (err) {
+				if (this.isNotFoundError(err)) return null;
+				throw err;
+			}
 		}
 		return null;
 	}
@@ -62968,7 +63026,7 @@ var S3DirectoryBucketProvider = class {
 	}
 	getEc2Client() {
 		if (!this.ec2Client) this.ec2Client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.ec2Client;
@@ -62982,7 +63040,7 @@ var S3DirectoryBucketProvider = class {
 	*/
 	getS3ControlClient() {
 		if (!this.s3ControlClient) this.s3ControlClient = new S3ControlClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3ControlClient;
@@ -64200,7 +64258,7 @@ var ECRProvider = class {
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new ECRClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.client;
@@ -69464,7 +69522,7 @@ function renderDiffTree(node, isRoot, logFn) {
 		const outputs = renderOutputChangeLines(node.outputChanges, logFn);
 		logFn(`\n${create} to create, ${update} to update, ${del} to delete`);
 		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
-		if (node.adoptedOrphans.length > 0) logFn(`${node.adoptedOrphans.length} resource(s) to adopt from a previous rollback: ${node.adoptedOrphans.map(stripControlChars).join(", ")}`);
+		if (node.adoptedOrphans.length > 0) logFn(`${node.adoptedOrphans.length} resource(s) to adopt from a previous rollback: ${node.adoptedOrphans.map((id) => displayLogicalId(id)).join(", ")}`);
 		if (node.unreadable.length > 0) {
 			const named = node.unreadable.slice(0, UNREADABLE_PREVIEW_NAMES).map((id) => id === "(resources map)" || id === "(orphans container)" ? id : displayLogicalId(id));
 			const rest = node.unreadable.length - named.length;
@@ -77561,7 +77619,7 @@ async function stateMigrateCommand(options) {
 		logger.info(`  destination: ${newBucket}`);
 		const probeRegion = "us-east-1";
 		const probe = new S3Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region: probeRegion
 		});
 		let sourceExists;
@@ -77574,7 +77632,7 @@ async function stateMigrateCommand(options) {
 		const legacyRegion = await resolveBucketRegion(legacyBucket);
 		logger.info(`  source bucket actual region: ${legacyRegion}`);
 		const legacyS3 = new S3Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region: legacyRegion
 		});
 		try {
@@ -77680,7 +77738,7 @@ async function assertNoActiveLocks(s3, bucket) {
 }
 async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	const probe = new S3Client({
-		...awsClientDefaults(),
+		...ambientClientDefaults(),
 		region
 	});
 	let exists;
@@ -77694,13 +77752,13 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 		const actual = await resolveBucketRegion(bucketName);
 		if (actual !== region) logger.warn(`Destination bucket lives in ${actual}, but source is in ${region}. Cross-region copy is supported but slower; objects will be replicated to ${actual}.`);
 		return new S3Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region: actual
 		});
 	}
 	logger.info(`Creating destination bucket ${bucketName} in ${region}...`);
 	const s3 = new S3Client({
-		...awsClientDefaults(),
+		...ambientClientDefaults(),
 		region
 	});
 	const createParams = { Bucket: bucketName };
@@ -87177,7 +87235,7 @@ async function publishAssetsCommand(stacks, options) {
 	const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const stsClient = new STSClient({
-		...awsClientDefaults(),
+		...ambientClientDefaults(),
 		region: baseRegion
 	});
 	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -91981,10 +92039,10 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 }
 /**
 * Authenticate the local docker daemon against the target ECR registry.
-* Kept apart from `DockerAssetPublisher.ecrLogin`, and it no longer mirrors it:
-* the publisher still prefers `proxyEndpoint`, which is right only because it
-* pushes to the CALLER's own registry, while a pull here can name any account
-* and any host form, so this one always logs in to the pull host.
+* Kept apart from `DockerAssetPublisher.ecrLogin`, which follows the same rule
+* (it logs in to the push host, #3681) but builds its host from an account and
+* region, while a pull here can name any account and any host form parsed from
+* the image URI.
 *
 * The login endpoint is ALWAYS the host the PULL targets (issues #1855 /
 * #3670): docker's credential store is keyed on the hostname verbatim, so a
@@ -99068,4 +99126,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DxyHPT8E.js.map
+//# sourceMappingURL=program-CwcF5msU.js.map