@go-to-k/cdkd 0.291.19 → 0.291.21

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ct as CloudControlProvider, Fa as clearBucketRegionCache, Ha as AssetError, Hr as LockManager, Ia as resolveBucketRegion, Ka as DependencyError, Ki as Synthesizer, La as AwsClients, Qa as LockError, Ra as getAwsClients, Sa as AssemblyReader, Ua as CdkdError, Ur as S3StateBackend, Va as setAwsClients, Wa as ConfigError, _n as DiffCalculator, br as DagBuilder, ci as AssetPublisher, co as SynthesisError, ct as IAMRoleProvider, do as normalizeAwsError, lo as formatError, no as ProvisioningError, pt as ProviderRegistry, r as DeployEngine, so as StateError, uo as isCdkdError, xr as TemplateParser, za as resetAwsClients } from "./deploy-engine-OgrMdBRR.js";
+import { Fa as clearBucketRegionCache, Ha as AssetError, Hr as LockManager, Ia as resolveBucketRegion, Ka as DependencyError, Ki as Synthesizer, La as AwsClients, Qa as LockError, Ra as getAwsClients, Sa as AssemblyReader, Ua as CdkdError, Ur as S3StateBackend, Va as setAwsClients, Wa as ConfigError, _n as DiffCalculator, br as DagBuilder, ci as AssetPublisher, co as SynthesisError, ct as IAMRoleProvider, do as normalizeAwsError, dt as ProviderRegistry, lo as formatError, no as ProvisioningError, r as DeployEngine, so as StateError, uo as isCdkdError, xr as TemplateParser, xt as CloudControlProvider, za as resetAwsClients } from "./deploy-engine-BAOtjfHX.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Bt0RGDfb.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-L-XPPVLA.js → program-C6B7leIq.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as MalformedProducerRecordRefusalError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as readConfigString, A as createPreDeleteFinalSnapshot, Aa as ownValue, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as disableInstanceApiTermination, B as isStatefulRecreateTargetSync, Ba as runWithStackAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as isUnboundTemplateParameter, C as namesAnyDeclaredParameter, Ca as failedStageNote, Ci as validateAssetBucketName, Cn as displayLogicalId, Co as safeStringify, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as CloudControlProvider, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasOwnKey, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as deleteIndeterminateGuards, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as defineOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as UNSPECIFIED_SKIP_REASON, F as extractDeploymentEventError, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as cfnRefValueFromPhysicalId, G as toCfnInteger, Ga as CrossAccountSecretRefusalError, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as normalizeAwsTagsToCfn, H as WARM_THROUGHPUT_MEMBERS, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as refStateLookupFromResource, I as makeSiblingClaimReader, Ia as resolveBucketRegion, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as coerceParameterTypedValue, J as bold, Ja as DynamicReferenceRegionAmbiguousError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as coerceCfnBoolean, K as toFiniteNumber, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as resolveExplicitPhysicalId, L as planOrphanAdoption, La as AwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as getAccountInfo, M as refusesFinalSnapshot, Ma as displayAssemblyPath, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as IntrinsicFunctionResolver, N as unsupportedFinalSnapshotError, Na as renderAssemblyPathEscape, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as carriesDynamicReference, O as buildFinalSnapshotIdentifier, Oa as hasPlainPrototype, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as deleteSkipReason, P as makeCanonicalizePropertiesFn, Pa as resolveAssemblyPath, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as carriesFetchableDynamicReference, Q as red, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as configStringRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as getAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isImpossibleEmptyStoredAttribute, S as computeParameterTaint, Sa as AssemblyReader, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as describeAwsFailure, Sr as STATE_SOURCED_BASELINE_RULES, St as startInterruptWatch, T as resourcesNamingDeclaredParameter, Ta as processStackMessages, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as ccProtectionRegistryTypes, U as coerceWarmThroughput$1, Ua as CdkdError, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as isSettledInstanceState, V as renderStatefulReason, Va as setAwsClients, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as parameterTypeMayLoseSecretIdentity, W as isWarmThroughputDecrease, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as WAFv2WebACLProvider, X as gray, Xa as LocalInvokeBuildError$1, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configBooleanRefusal, Y as cyan, Ya as IntrinsicResolutionRefusalError, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as coerceCfnInteger, Z as green, Za as LocalStartServiceError, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as configIntegerRefusal, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isThrottlingError, _r as findSilentDropProperties, _t as maskerOrIdentity, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackHasActiveImportsError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as markRedactedCause, br as DagBuilder, bt as interruptWatchListenerCount, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, co as SynthesisError, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as normalizeAwsError, dr as repairMalformedResourcesForReadOnly, dt as definedAttributes, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as replayWarn, eo as NestedStackChildDirectDestroyError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as withErrorHandling, fr as safeRegion, ft as stringifyIfAssigned, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isRetryableTransientError, gr as findActionableSilentDrops, gt as maskDeep, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isMarkedNonRetryable, hr as unreadableOrphanRecords, ht as createMaskedRetryLogger, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as ResourceUpdateNotSupportedError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as absoluteAssemblyPathEscape, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as isTerminationProtectionPropagationError, k as ccRoutedFinalSnapshotError, ka as nullPrototypeRecord, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isWaitAbandonedError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as shellQuote, mr as unpreviewableOrphanRecords, mt as wouldReturnToSdkProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as requireConfigObject, no as ProvisioningError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, oo as StackTerminationProtectionError, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as pasteableCommand, pr as safeStackName, pt as ProviderRegistry, q as formatResourceLine, qa as DeployCancelledError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as assertRegionMatch, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as requireConfigString, ro as ResourceTimeoutError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigArray, to as PartialFailureError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as isTransientServerError, vr as describeTypeWithThrottleRetry, vt as beginCommandInterruptScope, w as reachableDivergentParameters, wa as globMatches, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as slowCcOperationTimeoutMs, x as bindingSkippedOutputs, xa as ambientClientDefaults, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as retryClassificationText, xr as TemplateParser, xt as isInterruptedWaitError, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markNonRetryable, yr as withRetry, yt as endCommandInterruptScope, z as isStatefulRecreateTargetForReplace, za as resetAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as isNamelessDynamicReferenceError } from "./deploy-engine-OgrMdBRR.js";
+import { $ as yellow, $a as MalformedProducerRecordRefusalError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as requireConfigArray, A as createPreDeleteFinalSnapshot, Aa as ownValue, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as IntrinsicFunctionResolver, B as isStatefulRecreateTargetSync, Ba as runWithStackAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as refStateLookupFromResource, C as namesAnyDeclaredParameter, Ca as failedStageNote, Ci as validateAssetBucketName, Cn as displayLogicalId, Co as safeStringify, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as ccProtectionRegistryTypes, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasOwnKey, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as isWaitAbandonedError, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as defineOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as getAccountInfo, G as toCfnInteger, Ga as CrossAccountSecretRefusalError, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as assertRegionMatch, H as WARM_THROUGHPUT_MEMBERS, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as WAFv2WebACLProvider, I as makeSiblingClaimReader, Ia as resolveBucketRegion, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as isImpossibleEmptyStoredAttribute, J as bold, Ja as DynamicReferenceRegionAmbiguousError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as configBooleanRefusal, K as toFiniteNumber, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as coerceCfnBoolean, L as planOrphanAdoption, La as AwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as isNamelessDynamicReferenceError, M as refusesFinalSnapshot, Ma as displayAssemblyPath, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as carriesFetchableDynamicReference, N as unsupportedFinalSnapshotError, Na as renderAssemblyPathEscape, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as cfnRefValueFromPhysicalId, O as buildFinalSnapshotIdentifier, Oa as hasPlainPrototype, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as disableInstanceApiTermination, P as makeCanonicalizePropertiesFn, Pa as resolveAssemblyPath, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as coerceParameterTypedValue, Q as red, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as replayWarn, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as getAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isUnboundTemplateParameter, S as computeParameterTaint, Sa as AssemblyReader, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as describeAwsFailure, Sr as STATE_SOURCED_BASELINE_RULES, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as processStackMessages, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as CdkdError, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as normalizeAwsTagsToCfn, V as renderStatefulReason, Va as setAwsClients, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as isSettledInstanceState, W as isWarmThroughputDecrease, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as resolveExplicitPhysicalId, X as gray, Xa as LocalInvokeBuildError$1, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configStringRefusal, Y as cyan, Ya as IntrinsicResolutionRefusalError, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as configIntegerRefusal, Z as green, Za as LocalStartServiceError, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as readConfigString, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isThrottlingError, _r as findSilentDropProperties, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackHasActiveImportsError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as markRedactedCause, br as DagBuilder, bt as startInterruptWatch, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, co as SynthesisError, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as normalizeAwsError, dr as repairMalformedResourcesForReadOnly, dt as ProviderRegistry, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as requireConfigObject, eo as NestedStackChildDirectDestroyError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as withErrorHandling, fr as safeRegion, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isRetryableTransientError, gr as findActionableSilentDrops, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isMarkedNonRetryable, hr as unreadableOrphanRecords, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as ResourceUpdateNotSupportedError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as absoluteAssemblyPathEscape, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as carriesDynamicReference, k as ccRoutedFinalSnapshotError, ka as nullPrototypeRecord, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isTerminationProtectionPropagationError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as shellQuote, mr as unpreviewableOrphanRecords, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as definedAttributes, no as ProvisioningError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, oo as StackTerminationProtectionError, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as pasteableCommand, pr as safeStackName, pt as createMaskedRetryLogger, q as formatResourceLine, qa as DeployCancelledError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as coerceCfnInteger, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as stringifyIfAssigned, ro as ResourceTimeoutError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigString, to as PartialFailureError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as isTransientServerError, vr as describeTypeWithThrottleRetry, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as globMatches, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as ambientClientDefaults, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as retryClassificationText, xr as TemplateParser, xt as CloudControlProvider, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markNonRetryable, yr as withRetry, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as resetAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as parameterTypeMayLoseSecretIdentity } from "./deploy-engine-BAOtjfHX.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-2QIPw29e.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Dpki2-Xd.js";
+import { t as getCdkdVersion } from "./version-ELgusB_X.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-HsFVvUCB.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -38213,6 +38213,15 @@ var AgentCoreEvaluatorProvider = class {
 //#endregion
 //#region src/provisioning/providers/stepfunctions-provider.ts
 /**
+* CloudFormation's `StateMachineRevisionId` for a described state machine.
+* `DescribeStateMachine` omits `revisionId` until the machine is first
+* updated, and CloudFormation then reports `INITIAL` (measured live,
+* 2026-09-25, issue #3627), so the absent value maps to that.
+*/
+function stateMachineRevisionId(described) {
+	return described.revisionId ?? "INITIAL";
+}
+/**
 * AWS Step Functions State Machine Provider
 *
 * Implements resource provisioning for AWS::StepFunctions::StateMachine using the SFN SDK.
@@ -38280,17 +38289,23 @@ var StepFunctionsProvider = class {
 				tags,
 				encryptionConfiguration
 			};
-			const response = await this.getClient().send(new CreateStateMachineCommand(createParams));
-			const stateMachineArn = response.stateMachineArn;
+			const stateMachineArn = (await this.getClient().send(new CreateStateMachineCommand(createParams))).stateMachineArn;
 			if (!stateMachineArn) throw new Error("CreateStateMachine did not return stateMachineArn");
 			this.logger.debug(`Successfully created Step Functions state machine ${logicalId}: ${stateMachineArn}`);
+			const name = stateMachineArn.split(":").pop() || stateMachineName;
+			let revisionId;
+			try {
+				revisionId = stateMachineRevisionId(await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn })));
+			} catch (describeError) {
+				this.logger.debug(`Could not read the revision id of ${logicalId} after create: ${describeAwsFailure(describeError).detail}`);
+			}
 			return {
 				physicalId: stateMachineArn,
-				attributes: {
+				attributes: definedAttributes({
 					Arn: stateMachineArn,
-					Name: stateMachineArn.split(":").pop() || stateMachineName,
-					StateMachineRevisionId: response.stateMachineVersionArn
-				}
+					Name: name,
+					StateMachineRevisionId: revisionId
+				})
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -38325,7 +38340,7 @@ var StepFunctionsProvider = class {
 				attributes: {
 					Arn: physicalId,
 					Name: describeResponse.name,
-					StateMachineRevisionId: describeResponse.revisionId
+					StateMachineRevisionId: stateMachineRevisionId(describeResponse)
 				}
 			};
 		} catch (error) {
@@ -38433,10 +38448,14 @@ var StepFunctionsProvider = class {
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: input.knownPhysicalId }));
+			const resp = await this.getClient().send(new DescribeStateMachineCommand({ stateMachineArn: input.knownPhysicalId }));
 			return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: definedAttributes({
+					Arn: input.knownPhysicalId,
+					Name: resp.name,
+					StateMachineRevisionId: stateMachineRevisionId(resp)
+				})
 			};
 		} catch (err) {
 			if (err instanceof StateMachineDoesNotExist) return null;
@@ -42647,10 +42666,16 @@ var RDSProvider = class {
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: explicit }));
+			const described = (await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: explicit }))).DBClusters?.[0];
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					Arn: described?.DBClusterArn,
+					DBClusterResourceId: described?.DbClusterResourceId
+				})
 			};
 		} catch (err) {
 			if (err.name === "DBClusterNotFoundFault") return null;
@@ -48042,6 +48067,21 @@ var CognitoUserPoolProvider = class {
 		return result;
 	}
 	/**
+	* The attribute map a user pool records, derived as `create()` / `update()`
+	* derive it (issue #3627): the resolver served the pool id for
+	* `ProviderName` / `ProviderURL` after an import.
+	*/
+	async userPoolAttributes(userPoolId, arn) {
+		const region = await this.getClient().config.region();
+		const { urlSuffix } = derivePartitionAndUrlSuffix(region);
+		return definedAttributes({
+			Arn: arn,
+			ProviderName: `cognito-idp.${region}.${urlSuffix}/${userPoolId}`,
+			ProviderURL: `https://cognito-idp.${region}.${urlSuffix}/${userPoolId}`,
+			UserPoolId: userPoolId
+		});
+	}
+	/**
 	* Adopt an existing Cognito User Pool into cdkd state.
 	*
 	* User Pool physical id is the AWS-generated `<region>_<random>` id.
@@ -48059,10 +48099,10 @@ var CognitoUserPoolProvider = class {
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: input.knownPhysicalId }));
+			const resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: input.knownPhysicalId }));
 			return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: await this.userPoolAttributes(input.knownPhysicalId, resp.UserPool?.Arn)
 			};
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$9) return null;
@@ -48076,10 +48116,19 @@ var CognitoUserPoolProvider = class {
 				MaxResults: 60,
 				...marker && { NextToken: marker }
 			}));
-			for (const pool of list.UserPools ?? []) if (pool.Id && pool.Name === desiredName) return {
-				physicalId: pool.Id,
-				attributes: {}
-			};
+			for (const pool of list.UserPools ?? []) if (pool.Id && pool.Name === desiredName) {
+				let resp;
+				try {
+					resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$9) return null;
+					throw err;
+				}
+				return {
+					physicalId: pool.Id,
+					attributes: await this.userPoolAttributes(pool.Id, resp.UserPool?.Arn)
+				};
+			}
 			marker = list.NextToken;
 		} while (marker);
 		return null;
@@ -62857,18 +62906,27 @@ var S3VectorsProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.VectorBucketName`
 	*     → verify via `GetVectorBucket`. The physical id is the bucket name.
+	*     An `s3vectors` bucket ARN — CloudFormation's physical id, which
+	*     `--migrate-from-cloudformation` passes verbatim — is looked up BY ARN,
+	*     and the name AWS reports is recorded (issue #3627).
 	*/
 	async import(input) {
 		const explicit = input.knownPhysicalId ?? (typeof input.properties?.["VectorBucketName"] === "string" && input.properties["VectorBucketName"].length > 0 ? input.properties["VectorBucketName"] : void 0);
-		if (explicit) try {
-			await this.getClient().send(new GetVectorBucketCommand({ vectorBucketName: explicit }));
-			return {
-				physicalId: explicit,
-				attributes: {}
-			};
-		} catch (err) {
-			if (this.isNotFoundError(err)) return null;
-			throw err;
+		if (explicit) {
+			const isArn = explicit.startsWith("arn:");
+			if (isArn && !/^arn:[^:]+:s3vectors:[^:]*:[^:]*:bucket\/[^/]+$/.test(explicit)) return null;
+			try {
+				const resp = await this.getClient().send(new GetVectorBucketCommand(isArn ? { vectorBucketArn: explicit } : { vectorBucketName: explicit }));
+				const name = isArn ? resp.vectorBucket?.vectorBucketName : explicit;
+				if (!name) return null;
+				return {
+					physicalId: name,
+					attributes: definedAttributes({ VectorBucketArn: resp.vectorBucket?.vectorBucketArn })
+				};
+			} catch (err) {
+				if (this.isNotFoundError(err)) return null;
+				throw err;
+			}
 		}
 		return null;
 	}
@@ -68584,6 +68642,14 @@ function deployRefusesPropertiesReason(logicalIds) {
 * nothing to report and `--fail` exited 0.
 */
 const DEPLOY_REFUSES_OUTPUTS_REASON = "The 'outputs' bag cannot be read. This preview repaired it to empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
+const DEPLOY_REFUSES_RESOURCES_BAG_REASON = "The 'resources' map cannot be read. This preview read it as empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
+function deployRefusesResourceEntriesReason(logicalIds) {
+	return `${logicalIds.length} resource record(s) in 'resources' cannot be read as resources. This preview dropped them; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.`;
+}
+const DEPLOY_REFUSES_ORPHANS_CONTAINER_REASON = "The 'orphans' field is not a list. This preview read it as empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
+function deployRefusesDroppedOrphanRowsReason(logicalIds) {
+	return `${logicalIds.length} rollback-orphan record(s) in 'orphans' cannot be read as resources. This preview dropped them; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.`;
+}
 /** How many unreadable row names the human preview lists before summarizing. */
 const UNREADABLE_PREVIEW_NAMES = 10;
 /** Empty template used to diff a removed nested child's state → all DELETE. */
@@ -68655,11 +68721,13 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		if (repairMalformedResourcesForReadOnly(result.state)) {
 			logger.warn(malformedResourcesWarning(stackName, region));
 			unreadable.push(UNREADABLE_RESOURCES_MAP_ROW);
+			deployRefusals.push(DEPLOY_REFUSES_RESOURCES_BAG_REASON);
 		}
 		const dropped = repairMalformedResourceEntriesForReadOnly(result.state);
 		if (dropped.length > 0) {
 			logger.warn(malformedResourceEntriesWarning(stackName, region, dropped));
-			unreadable.push(...dropped);
+			for (const id of dropped) unreadable.push(id);
+			deployRefusals.push(deployRefusesResourceEntriesReason(dropped));
 		}
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
 		if (unreadableProps.length > 0) {
@@ -68673,6 +68741,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		if (repairMalformedOrphansForReadOnly(result.state)) {
 			logger.warn(malformedOrphansWarning(stackName, region));
 			unreadable.push(UNREADABLE_ORPHANS_CONTAINER_ROW);
+			deployRefusals.push(DEPLOY_REFUSES_ORPHANS_CONTAINER_REASON);
 		}
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
 		return {
@@ -68846,7 +68915,10 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	if (currentState.orphans?.length && options.previewOrphanAdoption) {
 		for (const id of unpreviewableOrphanRecords(currentState)) unreadableOrphans.push(id);
 		const readableOrphans = previewableOrphanRecords(currentState);
-		if (unreadableOrphans.length > 0) logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans, false));
+		if (unreadableOrphans.length > 0) {
+			logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans, false));
+			deployRefusals.push(deployRefusesDroppedOrphanRowsReason(unreadableOrphans));
+		}
 		let reportedByTheAdoptedPropertiesArm = [];
 		const plan = await options.previewOrphanAdoption({
 			...currentState,
@@ -91981,10 +92053,10 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 }
 /**
 * Authenticate the local docker daemon against the target ECR registry.
-* Kept apart from `DockerAssetPublisher.ecrLogin`, and it no longer mirrors it:
-* the publisher still prefers `proxyEndpoint`, which is right only because it
-* pushes to the CALLER's own registry, while a pull here can name any account
-* and any host form, so this one always logs in to the pull host.
+* Kept apart from `DockerAssetPublisher.ecrLogin`, which follows the same rule
+* (it logs in to the push host, #3681) but builds its host from an account and
+* region, while a pull here can name any account and any host form parsed from
+* the image URI.
 *
 * The login endpoint is ALWAYS the host the PULL targets (issues #1855 /
 * #3670): docker's credential store is keyed on the hostname verbatim, so a
@@ -99068,4 +99140,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-L-XPPVLA.js.map
+//# sourceMappingURL=program-C6B7leIq.js.map