@go-to-k/cdkd 0.291.2 → 0.291.3

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-C1w5fjW1.js";
+import { Ba as normalizeAwsError, Cr as LockManager, Da as LockError, Ia as StateError, La as SynthesisError, Ra as formatError, Ti as Synthesizer, Wr as AssetPublisher, _a as AssetError, ar as TemplateParser, ct as IAMRoleProvider, da as clearBucketRegionCache, dt as ProviderRegistry, ea as AssemblyReader, fa as resolveBucketRegion, ga as setAwsClients, ha as resetAwsClients, ir as DagBuilder, ja as ProvisioningError, ma as getAwsClients, mn as DiffCalculator, pa as AwsClients, r as DeployEngine, va as CdkdError, wr as S3StateBackend, xa as DependencyError, xt as CloudControlProvider, ya as ConfigError, za as isCdkdError } from "./deploy-engine-5fdODHji.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-GASr9bAF.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-DnmYd7BO.js → program-lTNPrurx.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-C1w5fjW1.js";
+import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-5fdODHji.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-5OUR3VB2.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DPGr3o8N.js";
+import { t as getCdkdVersion } from "./version-BKm47b9j.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CLqajoRp.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2046,6 +2046,99 @@ function createBootstrapCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/stack-matcher.ts
+/**
+* Match stacks against user-supplied name patterns.
+*
+* Patterns are evaluated against two fields:
+*
+* - `stackName` — the physical CloudFormation stack name (e.g. `MyStage-MyStack`)
+* - `displayName` — the hierarchical CDK path (e.g. `MyStage/MyStack`); falls
+*   back to `stackName` when the assembly does not carry one
+*
+* Routing is decided by whether the pattern contains `/`:
+*
+* - Pattern contains `/` → matched only against `displayName` (a `/` cannot
+*   appear in a CloudFormation stack name, so this is unambiguous)
+* - Pattern contains no `/` → matched only against `stackName`
+*
+* Wildcards (`*`) are supported in either case. Results are de-duplicated by
+* `stackName`, so a pattern that incidentally matches the same stack via both
+* fields is returned only once.
+*/
+function matchStacks(stacks, patterns) {
+	if (patterns.length === 0) return [];
+	const seen = /* @__PURE__ */ new Set();
+	const result = [];
+	for (const stack of stacks) if (patterns.some((pattern) => stackMatchesPattern(stack, pattern)) && !seen.has(stack.stackName)) {
+		seen.add(stack.stackName);
+		result.push(stack);
+	}
+	return result;
+}
+/**
+* Render a stack for diagnostic messages. When `displayName` differs from the
+* physical name, both are shown so the user can see which forms are valid as
+* patterns (e.g. `MyStage-Api (MyStage/Api)`).
+*
+* Both names come from the Cloud Assembly, and every one of this helper's
+* render sites interpolates the result into PROSE cdkd authors — `Available:
+* ...`, `Multiple stacks found: ...`, `Publishing assets for stack: ...`, the
+* last of which prints on a normal run rather than only on an error. So they
+* go through `displayIdent` ([#3277](https://github.com/go-to-k/cdkd/issues/3277)):
+* a `stackName` carrying `ESC [ 2 K` plus a carriage return ERASES cdkd's own
+* line and a newline forges a second one, and a value carrying quotes and
+* periods writes a cdkd-sounding clause.
+*
+* It is the identity on every legitimate `stackName` — a CloudFormation stack
+* name is `[A-Za-z0-9-]`, inside `PLAIN_IDENT`. It is NOT the identity on
+* every legitimate `displayName`: CDK sets that to the construct path, and
+* `constructs` rewrites only `/` in an id, so `new Stack(app, 'My Stack')` is
+* legal and prints `MyStack ("My Stack")`. Those quotes are not part of any
+* pattern, in a clause whose job is to say which forms ARE valid as patterns —
+* accepted, because the alternative is `displaySafe`, which passes the quotes
+* and spaces a crafted value needs, and the pattern still matches the RAW
+* name either way (`matchStacks` never sees this rendering).
+*
+* Sanitizing HERE rather than at the call sites is what keeps the rule whole:
+* the sites include `scrub.ts` and `destroy.ts`, which this change does not
+* touch, and a rule widened by hand is how the class survived being closed
+* twice already.
+*/
+function describeStack(stack) {
+	const name = displayIdent(stack.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayIdent(stack.displayName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`;
+	return name;
+}
+/**
+* The message a command raises when SELECTION came back empty — shared by
+* `deploy`, `diff`, `list` and `publish-assets`, which all built the identical
+* string by hand.
+*
+* `assembly` is required AND so is its `failedStages` member, which is the
+* point: a Stage that failed to load dropped every stack under it from
+* `available`, so "no stacks matching" names the wrong problem unless the
+* failure is reported with it (issue
+* [#3482](https://github.com/go-to-k/cdkd/issues/3482)). A REQUIRED member,
+* not an optional one — `{ failedStages?: ... }` accepts `{}`, so it fences
+* the argument while leaving the content unfenced, which is the wiring hole
+* this signature exists to close. `SynthesisResult.failedStages` is required
+* for the same reason, so passing the result satisfies it and an ad-hoc `{}`
+* does not.
+*
+* What it does NOT fence: a caller passing a STALE or empty list. That is
+* behaviour, not shape, and it is covered by a wiring test per command.
+*/
+function renderNoStackMatch(patterns, available, assembly) {
+	return (patterns.length > 0 ? `No stacks matching ${patterns.join(", ")} found in assembly. ` + (available.length > 0 ? `Available: ${available.map(describeStack).join(", ")}` : "The assembly has no stacks") : "No stacks found in assembly") + failedStageNote(patterns, assembly.failedStages);
+}
+function stackMatchesPattern(stack, pattern) {
+	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
+	if (pattern.includes("*")) return new RegExp("^" + pattern.replace(/\*/g, ".*") + "$").test(target);
+	return target === pattern;
+}
+
 //#endregion
 //#region src/utils/yaml.ts
 /**
@@ -2293,7 +2386,7 @@ function resolveVerboseTemplatePath(outputDir, stackName) {
 * (go-to-k/cdkd#3489): the guard has its own cases, but reverting the CALL
 * SITE left the suite green.
 */
-async function synthCommand(options) {
+async function synthCommand(stackPatterns, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	reserveStdoutForPayload();
@@ -2319,7 +2412,11 @@ async function synthCommand(options) {
 		...options.profile && { profile: options.profile },
 		...Object.keys(context).length > 0 && { context }
 	};
-	const { stacks, assemblyDir } = await synthesizer.synthesize(synthOptions);
+	const result = await synthesizer.synthesize(synthOptions);
+	const { stacks: allStacks, assemblyDir } = result;
+	const selected = stackPatterns.length > 0 ? matchStacks(allStacks, stackPatterns) : allStacks;
+	if (selected.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
+	const stacks = selected;
 	processStackMessages(stacks, logger, {
 		strict: options.strict === true,
 		ignoreErrors: options.ignoreErrors === true
@@ -2327,8 +2424,9 @@ async function synthCommand(options) {
 	if (stacks.length === 1) {
 		const template = stacks[0].template;
 		process.stdout.write(toYaml(template));
-	}
-	logger.info(`\n${green("✓")} ${bold("Synthesis complete!")} Found ${stacks.length} stack(s):`);
+	} else logger.info(`Supply a stack id (${stacks.map(describeStack).join(", ")}) to display its template.`);
+	const found = stacks.length === allStacks.length ? `Found ${stacks.length} stack(s):` : `Found ${stacks.length} of ${allStacks.length} stack(s):`;
+	logger.info(`\n${green("✓")} ${bold("Synthesis complete!")} ${found}`);
 	for (const stack of stacks) {
 		const resourceCount = countDeployableResources(stack.template);
 		const outputCount = Object.keys(stack.template.Outputs ?? {}).length;
@@ -2348,7 +2446,7 @@ async function synthCommand(options) {
 * Create synth command
 */
 function createSynthCommand() {
-	const cmd = new Command("synth").description("Synthesize CDK app to CloudFormation template").action(withErrorHandling(synthCommand));
+	const cmd = new Command("synth").description("Synthesize CDK app to CloudFormation template").argument("[stacks...]", "Stack name(s) whose template to print. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*'). Every stack is synthesized either way -- the selection decides what reaches stdout.").action(withErrorHandling(synthCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -2359,99 +2457,6 @@ function createSynthCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/cli/stack-matcher.ts
-/**
-* Match stacks against user-supplied name patterns.
-*
-* Patterns are evaluated against two fields:
-*
-* - `stackName` — the physical CloudFormation stack name (e.g. `MyStage-MyStack`)
-* - `displayName` — the hierarchical CDK path (e.g. `MyStage/MyStack`); falls
-*   back to `stackName` when the assembly does not carry one
-*
-* Routing is decided by whether the pattern contains `/`:
-*
-* - Pattern contains `/` → matched only against `displayName` (a `/` cannot
-*   appear in a CloudFormation stack name, so this is unambiguous)
-* - Pattern contains no `/` → matched only against `stackName`
-*
-* Wildcards (`*`) are supported in either case. Results are de-duplicated by
-* `stackName`, so a pattern that incidentally matches the same stack via both
-* fields is returned only once.
-*/
-function matchStacks(stacks, patterns) {
-	if (patterns.length === 0) return [];
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const stack of stacks) if (patterns.some((pattern) => stackMatchesPattern(stack, pattern)) && !seen.has(stack.stackName)) {
-		seen.add(stack.stackName);
-		result.push(stack);
-	}
-	return result;
-}
-/**
-* Render a stack for diagnostic messages. When `displayName` differs from the
-* physical name, both are shown so the user can see which forms are valid as
-* patterns (e.g. `MyStage-Api (MyStage/Api)`).
-*
-* Both names come from the Cloud Assembly, and every one of this helper's
-* render sites interpolates the result into PROSE cdkd authors — `Available:
-* ...`, `Multiple stacks found: ...`, `Publishing assets for stack: ...`, the
-* last of which prints on a normal run rather than only on an error. So they
-* go through `displayIdent` ([#3277](https://github.com/go-to-k/cdkd/issues/3277)):
-* a `stackName` carrying `ESC [ 2 K` plus a carriage return ERASES cdkd's own
-* line and a newline forges a second one, and a value carrying quotes and
-* periods writes a cdkd-sounding clause.
-*
-* It is the identity on every legitimate `stackName` — a CloudFormation stack
-* name is `[A-Za-z0-9-]`, inside `PLAIN_IDENT`. It is NOT the identity on
-* every legitimate `displayName`: CDK sets that to the construct path, and
-* `constructs` rewrites only `/` in an id, so `new Stack(app, 'My Stack')` is
-* legal and prints `MyStack ("My Stack")`. Those quotes are not part of any
-* pattern, in a clause whose job is to say which forms ARE valid as patterns —
-* accepted, because the alternative is `displaySafe`, which passes the quotes
-* and spaces a crafted value needs, and the pattern still matches the RAW
-* name either way (`matchStacks` never sees this rendering).
-*
-* Sanitizing HERE rather than at the call sites is what keeps the rule whole:
-* the sites include `scrub.ts` and `destroy.ts`, which this change does not
-* touch, and a rule widened by hand is how the class survived being closed
-* twice already.
-*/
-function describeStack(stack) {
-	const name = displayIdent(stack.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
-	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayIdent(stack.displayName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`;
-	return name;
-}
-/**
-* The message a command raises when SELECTION came back empty — shared by
-* `deploy`, `diff`, `list` and `publish-assets`, which all built the identical
-* string by hand.
-*
-* `assembly` is required AND so is its `failedStages` member, which is the
-* point: a Stage that failed to load dropped every stack under it from
-* `available`, so "no stacks matching" names the wrong problem unless the
-* failure is reported with it (issue
-* [#3482](https://github.com/go-to-k/cdkd/issues/3482)). A REQUIRED member,
-* not an optional one — `{ failedStages?: ... }` accepts `{}`, so it fences
-* the argument while leaving the content unfenced, which is the wiring hole
-* this signature exists to close. `SynthesisResult.failedStages` is required
-* for the same reason, so passing the result satisfies it and an ad-hoc `{}`
-* does not.
-*
-* What it does NOT fence: a caller passing a STALE or empty list. That is
-* behaviour, not shape, and it is covered by a wiring test per command.
-*/
-function renderNoStackMatch(patterns, available, assembly) {
-	return (patterns.length > 0 ? `No stacks matching ${patterns.join(", ")} found in assembly. ` + (available.length > 0 ? `Available: ${available.map(describeStack).join(", ")}` : "The assembly has no stacks") : "No stacks found in assembly") + failedStageNote(patterns, assembly.failedStages);
-}
-function stackMatchesPattern(stack, pattern) {
-	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
-	if (pattern.includes("*")) return new RegExp("^" + pattern.replace(/\*/g, ".*") + "$").test(target);
-	return target === pattern;
-}
-
 //#endregion
 //#region src/cli/commands/list.ts
 /**
@@ -97764,4 +97769,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DnmYd7BO.js.map
+//# sourceMappingURL=program-lTNPrurx.js.map