@go-to-k/cdkd 0.291.20 → 0.291.22

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Fa as clearBucketRegionCache, Ha as AssetError, Hr as LockManager, Ia as resolveBucketRegion, Ka as DependencyError, Ki as Synthesizer, La as AwsClients, Qa as LockError, Ra as getAwsClients, Sa as AssemblyReader, Ua as CdkdError, Ur as S3StateBackend, Va as setAwsClients, Wa as ConfigError, _n as DiffCalculator, br as DagBuilder, ci as AssetPublisher, co as SynthesisError, ct as IAMRoleProvider, do as normalizeAwsError, dt as ProviderRegistry, lo as formatError, no as ProvisioningError, r as DeployEngine, so as StateError, uo as isCdkdError, xr as TemplateParser, xt as CloudControlProvider, za as resetAwsClients } from "./deploy-engine-CkF6PyFY.js";
+import { Fa as clearBucketRegionCache, Ha as AssetError, Hr as LockManager, Ia as resolveBucketRegion, Ka as DependencyError, Ki as Synthesizer, La as AwsClients, Qa as LockError, Ra as getAwsClients, Sa as AssemblyReader, Ua as CdkdError, Ur as S3StateBackend, Va as setAwsClients, Wa as ConfigError, _n as DiffCalculator, br as DagBuilder, ci as AssetPublisher, co as SynthesisError, ct as IAMRoleProvider, do as normalizeAwsError, dt as ProviderRegistry, lo as formatError, no as ProvisioningError, r as DeployEngine, so as StateError, uo as isCdkdError, xr as TemplateParser, xt as CloudControlProvider, za as resetAwsClients } from "./deploy-engine-DGV6XNWO.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Bt0RGDfb.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CwcF5msU.js → program-BKAJWkPf.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as MalformedProducerRecordRefusalError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as requireConfigArray, A as createPreDeleteFinalSnapshot, Aa as ownValue, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as IntrinsicFunctionResolver, B as isStatefulRecreateTargetSync, Ba as runWithStackAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as refStateLookupFromResource, C as namesAnyDeclaredParameter, Ca as failedStageNote, Ci as validateAssetBucketName, Cn as displayLogicalId, Co as safeStringify, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as ccProtectionRegistryTypes, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasOwnKey, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as isWaitAbandonedError, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as defineOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as getAccountInfo, G as toCfnInteger, Ga as CrossAccountSecretRefusalError, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as assertRegionMatch, H as WARM_THROUGHPUT_MEMBERS, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as WAFv2WebACLProvider, I as makeSiblingClaimReader, Ia as resolveBucketRegion, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as isImpossibleEmptyStoredAttribute, J as bold, Ja as DynamicReferenceRegionAmbiguousError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as configBooleanRefusal, K as toFiniteNumber, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as coerceCfnBoolean, L as planOrphanAdoption, La as AwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as isNamelessDynamicReferenceError, M as refusesFinalSnapshot, Ma as displayAssemblyPath, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as carriesFetchableDynamicReference, N as unsupportedFinalSnapshotError, Na as renderAssemblyPathEscape, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as cfnRefValueFromPhysicalId, O as buildFinalSnapshotIdentifier, Oa as hasPlainPrototype, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as disableInstanceApiTermination, P as makeCanonicalizePropertiesFn, Pa as resolveAssemblyPath, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as coerceParameterTypedValue, Q as red, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as replayWarn, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as getAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isUnboundTemplateParameter, S as computeParameterTaint, Sa as AssemblyReader, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as describeAwsFailure, Sr as STATE_SOURCED_BASELINE_RULES, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as processStackMessages, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as CdkdError, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as normalizeAwsTagsToCfn, V as renderStatefulReason, Va as setAwsClients, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as isSettledInstanceState, W as isWarmThroughputDecrease, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as resolveExplicitPhysicalId, X as gray, Xa as LocalInvokeBuildError$1, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configStringRefusal, Y as cyan, Ya as IntrinsicResolutionRefusalError, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as configIntegerRefusal, Z as green, Za as LocalStartServiceError, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as readConfigString, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isThrottlingError, _r as findSilentDropProperties, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackHasActiveImportsError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as markRedactedCause, br as DagBuilder, bt as startInterruptWatch, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, co as SynthesisError, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as normalizeAwsError, dr as repairMalformedResourcesForReadOnly, dt as ProviderRegistry, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as requireConfigObject, eo as NestedStackChildDirectDestroyError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as withErrorHandling, fr as safeRegion, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isRetryableTransientError, gr as findActionableSilentDrops, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isMarkedNonRetryable, hr as unreadableOrphanRecords, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as ResourceUpdateNotSupportedError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as absoluteAssemblyPathEscape, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as carriesDynamicReference, k as ccRoutedFinalSnapshotError, ka as nullPrototypeRecord, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isTerminationProtectionPropagationError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as shellQuote, mr as unpreviewableOrphanRecords, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as definedAttributes, no as ProvisioningError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, oo as StackTerminationProtectionError, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as pasteableCommand, pr as safeStackName, pt as createMaskedRetryLogger, q as formatResourceLine, qa as DeployCancelledError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as coerceCfnInteger, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as stringifyIfAssigned, ro as ResourceTimeoutError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigString, to as PartialFailureError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as isTransientServerError, vr as describeTypeWithThrottleRetry, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as globMatches, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as ambientClientDefaults, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as retryClassificationText, xr as TemplateParser, xt as CloudControlProvider, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markNonRetryable, yr as withRetry, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as resetAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as parameterTypeMayLoseSecretIdentity } from "./deploy-engine-CkF6PyFY.js";
+import { $ as yellow, $a as MalformedProducerRecordRefusalError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as requireConfigArray, A as createPreDeleteFinalSnapshot, Aa as ownValue, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as IntrinsicFunctionResolver, B as isStatefulRecreateTargetSync, Ba as runWithStackAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as refStateLookupFromResource, C as namesAnyDeclaredParameter, Ca as failedStageNote, Ci as validateAssetBucketName, Cn as displayLogicalId, Co as safeStringify, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as ccProtectionRegistryTypes, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasOwnKey, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as isWaitAbandonedError, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as defineOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as getAccountInfo, G as toCfnInteger, Ga as CrossAccountSecretRefusalError, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as assertRegionMatch, H as WARM_THROUGHPUT_MEMBERS, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as WAFv2WebACLProvider, I as makeSiblingClaimReader, Ia as resolveBucketRegion, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as isImpossibleEmptyStoredAttribute, J as bold, Ja as DynamicReferenceRegionAmbiguousError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as configBooleanRefusal, K as toFiniteNumber, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as coerceCfnBoolean, L as planOrphanAdoption, La as AwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as isNamelessDynamicReferenceError, M as refusesFinalSnapshot, Ma as displayAssemblyPath, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as carriesFetchableDynamicReference, N as unsupportedFinalSnapshotError, Na as renderAssemblyPathEscape, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as cfnRefValueFromPhysicalId, O as buildFinalSnapshotIdentifier, Oa as hasPlainPrototype, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as disableInstanceApiTermination, P as makeCanonicalizePropertiesFn, Pa as resolveAssemblyPath, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as coerceParameterTypedValue, Q as red, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as replayWarn, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as getAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isUnboundTemplateParameter, S as computeParameterTaint, Sa as AssemblyReader, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as describeAwsFailure, Sr as STATE_SOURCED_BASELINE_RULES, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as processStackMessages, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as CdkdError, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as normalizeAwsTagsToCfn, V as renderStatefulReason, Va as setAwsClients, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as isSettledInstanceState, W as isWarmThroughputDecrease, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as resolveExplicitPhysicalId, X as gray, Xa as LocalInvokeBuildError$1, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configStringRefusal, Y as cyan, Ya as IntrinsicResolutionRefusalError, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as configIntegerRefusal, Z as green, Za as LocalStartServiceError, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as readConfigString, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isThrottlingError, _r as findSilentDropProperties, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackHasActiveImportsError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as markRedactedCause, br as DagBuilder, bt as startInterruptWatch, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, co as SynthesisError, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as normalizeAwsError, dr as repairMalformedResourcesForReadOnly, dt as ProviderRegistry, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as requireConfigObject, eo as NestedStackChildDirectDestroyError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as withErrorHandling, fr as safeRegion, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isRetryableTransientError, gr as findActionableSilentDrops, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isMarkedNonRetryable, hr as unreadableOrphanRecords, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as ResourceUpdateNotSupportedError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as absoluteAssemblyPathEscape, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as carriesDynamicReference, k as ccRoutedFinalSnapshotError, ka as nullPrototypeRecord, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isTerminationProtectionPropagationError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as shellQuote, mr as unpreviewableOrphanRecords, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as definedAttributes, no as ProvisioningError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, oo as StackTerminationProtectionError, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as pasteableCommand, pr as safeStackName, pt as createMaskedRetryLogger, q as formatResourceLine, qa as DeployCancelledError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as coerceCfnInteger, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as stringifyIfAssigned, ro as ResourceTimeoutError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigString, to as PartialFailureError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as isTransientServerError, vr as describeTypeWithThrottleRetry, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as globMatches, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as ambientClientDefaults, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as retryClassificationText, xr as TemplateParser, xt as CloudControlProvider, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markNonRetryable, yr as withRetry, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as resetAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as parameterTypeMayLoseSecretIdentity } from "./deploy-engine-DGV6XNWO.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-BYrVI73L.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-C0qLsIu5.js";
+import { t as getCdkdVersion } from "./version-BuD41yiK.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B5acrjOr.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -64617,6 +64617,10 @@ var ECRProvider = class {
 * child's own state file (`<parent>~<logicalId>`) — see `skippedStateTargets`.
 */
 const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
+/**
+* The protection flag per type. `countProtectedResources` reads it the same
+* way in `properties` and then `observedProperties`.
+*/
 const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Logs::LogGroup": "DeletionProtectionEnabled",
 	"AWS::RDS::DBInstance": "DeletionProtection",
@@ -64625,10 +64629,16 @@ const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Neptune::DBCluster": "DeletionProtection",
 	"AWS::Neptune::DBInstance": "DeletionProtection",
 	"AWS::DynamoDB::Table": "DeletionProtectionEnabled",
-	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled",
+	"AWS::DynamoDB::GlobalTable": (bag, region) => extractLocalDeletionProtection(bag, region ?? ""),
 	"AWS::EC2::Instance": "DisableApiTermination",
 	"AWS::Cognito::UserPool": "DeletionProtection",
 	"AWS::AutoScaling::AutoScalingGroup": "DeletionProtection",
+	"AWS::ElasticLoadBalancingV2::LoadBalancer": (bag) => {
+		const attrs = bag["LoadBalancerAttributes"];
+		if (!Array.isArray(attrs)) return void 0;
+		return attrs.find((a) => typeof a === "object" && a !== null && a.Key === "deletion_protection.enabled")?.Value;
+	},
+	"AWS::EMR::Cluster": ["Instances", "TerminationProtected"],
 	"AWS::DSQL::Cluster": "DeletionProtectionEnabled",
 	"AWS::NeptuneGraph::Graph": "DeletionProtection",
 	"AWS::SMSVOICE::ProtectConfiguration": "DeletionProtectionEnabled",
@@ -64654,31 +64664,47 @@ const PROTECTION_ACTIVE_VALUES_BY_TYPE = {
 */
 const PROTECTION_ACTIVE_PREDICATE_BY_TYPE = { "AWS::VerifiedPermissions::PolicyStore": (value) => typeof value === "object" && value !== null && value.Mode === "ENABLED" };
 /**
+* The flag's recorded value in `bag`. A missing or torn container on the way
+* (`null`, a string, a list) yields `undefined`, which leaves the count to the
+* other bag rather than throwing mid-prompt.
+*/
+function readProtection(bag, locator, region) {
+	if (typeof locator === "function") {
+		if (typeof bag !== "object" || bag === null || Array.isArray(bag)) return void 0;
+		return locator(bag, region);
+	}
+	let value = bag;
+	for (const key of typeof locator === "string" ? [locator] : locator) {
+		if (value === null || value === void 0) return void 0;
+		value = value[key];
+	}
+	return value;
+}
+/**
+* An OWN entry of one of the per-type maps. A plain-object map answers a
+* `resourceType` of `constructor` or `__proto__` with an inherited value, and a
+* hand-edited record can carry one.
+*/
+function perType(map, resourceType) {
+	return typeof resourceType === "string" && Object.hasOwn(map, resourceType) ? map[resourceType] : void 0;
+}
+/**
 * Count how many resources in a stack's recorded state appear to have
-* deletion protection enabled. Walks `properties` and `observedProperties`
-* for the property name registered against each resource type in
-* `PROTECTION_PROPERTY_BY_TYPE`. ELBv2 LoadBalancer protection lives in
-* `LoadBalancerAttributes` (a CFn `Array<{Key, Value}>`), so it's
-* handled separately via the `deletion_protection.enabled` key.
+* deletion protection enabled, reading each type's flag through its
+* `PROTECTION_PROPERTY_BY_TYPE` locator in `properties` and in
+* `observedProperties`.
 */
 function countProtectedResources(state) {
 	let count = 0;
 	for (const resource of Object.values(state.resources ?? {})) {
-		const propName = PROTECTION_PROPERTY_BY_TYPE[resource.resourceType];
-		if (propName) {
-			const recorded = resource.properties?.[propName] ?? resource.observedProperties?.[propName];
-			const activePredicate = PROTECTION_ACTIVE_PREDICATE_BY_TYPE[resource.resourceType];
-			const activeValues = PROTECTION_ACTIVE_VALUES_BY_TYPE[resource.resourceType];
-			if (activePredicate) {
-				if (activePredicate(recorded)) count++;
-			} else if (activeValues) {
-				if (activeValues.has(recorded)) count++;
-			} else if (recorded === true) count++;
+		const locator = perType(PROTECTION_PROPERTY_BY_TYPE, resource.resourceType);
+		if (locator) {
+			const activePredicate = perType(PROTECTION_ACTIVE_PREDICATE_BY_TYPE, resource.resourceType);
+			const activeValues = perType(PROTECTION_ACTIVE_VALUES_BY_TYPE, resource.resourceType);
+			const isActive = (recorded) => activePredicate ? activePredicate(recorded) : activeValues ? activeValues.has(recorded) : isTruthyCfnBoolean(recorded);
+			if (isActive(readProtection(resource.properties, locator, state.region)) || isActive(readProtection(resource.observedProperties, locator, state.region))) count++;
 			continue;
 		}
-		if (resource.resourceType === "AWS::ElasticLoadBalancingV2::LoadBalancer") {
-			if (((resource.properties?.["LoadBalancerAttributes"] ?? resource.observedProperties?.["LoadBalancerAttributes"])?.find((a) => a?.Key === "deletion_protection.enabled"))?.Value === "true") count++;
-		}
 	}
 	return count;
 }
@@ -68642,6 +68668,14 @@ function deployRefusesPropertiesReason(logicalIds) {
 * nothing to report and `--fail` exited 0.
 */
 const DEPLOY_REFUSES_OUTPUTS_REASON = "The 'outputs' bag cannot be read. This preview repaired it to empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
+const DEPLOY_REFUSES_RESOURCES_BAG_REASON = "The 'resources' map cannot be read. This preview read it as empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
+function deployRefusesResourceEntriesReason(logicalIds) {
+	return `${logicalIds.length} resource record(s) in 'resources' cannot be read as resources. This preview dropped them; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.`;
+}
+const DEPLOY_REFUSES_ORPHANS_CONTAINER_REASON = "The 'orphans' field is not a list. This preview read it as empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
+function deployRefusesDroppedOrphanRowsReason(logicalIds) {
+	return `${logicalIds.length} rollback-orphan record(s) in 'orphans' cannot be read as resources. This preview dropped them; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.`;
+}
 /** How many unreadable row names the human preview lists before summarizing. */
 const UNREADABLE_PREVIEW_NAMES = 10;
 /** Empty template used to diff a removed nested child's state → all DELETE. */
@@ -68713,11 +68747,13 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		if (repairMalformedResourcesForReadOnly(result.state)) {
 			logger.warn(malformedResourcesWarning(stackName, region));
 			unreadable.push(UNREADABLE_RESOURCES_MAP_ROW);
+			deployRefusals.push(DEPLOY_REFUSES_RESOURCES_BAG_REASON);
 		}
 		const dropped = repairMalformedResourceEntriesForReadOnly(result.state);
 		if (dropped.length > 0) {
 			logger.warn(malformedResourceEntriesWarning(stackName, region, dropped));
-			unreadable.push(...dropped);
+			for (const id of dropped) unreadable.push(id);
+			deployRefusals.push(deployRefusesResourceEntriesReason(dropped));
 		}
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
 		if (unreadableProps.length > 0) {
@@ -68731,6 +68767,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		if (repairMalformedOrphansForReadOnly(result.state)) {
 			logger.warn(malformedOrphansWarning(stackName, region));
 			unreadable.push(UNREADABLE_ORPHANS_CONTAINER_ROW);
+			deployRefusals.push(DEPLOY_REFUSES_ORPHANS_CONTAINER_REASON);
 		}
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
 		return {
@@ -68904,7 +68941,10 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	if (currentState.orphans?.length && options.previewOrphanAdoption) {
 		for (const id of unpreviewableOrphanRecords(currentState)) unreadableOrphans.push(id);
 		const readableOrphans = previewableOrphanRecords(currentState);
-		if (unreadableOrphans.length > 0) logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans, false));
+		if (unreadableOrphans.length > 0) {
+			logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans, false));
+			deployRefusals.push(deployRefusesDroppedOrphanRowsReason(unreadableOrphans));
+		}
 		let reportedByTheAdoptedPropertiesArm = [];
 		const plan = await options.previewOrphanAdoption({
 			...currentState,
@@ -99126,4 +99166,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CwcF5msU.js.map
+//# sourceMappingURL=program-BKAJWkPf.js.map