@go-to-k/cdkd 0.291.21 → 0.291.23

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/failed-stages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAYA;;UAsBe;EAUf;EAMA;EAQA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EA6DA;EAiEA;;UA0Ce;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Te;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC3lCU,uBAAuB;KA6zOvB,gBAAgB;;;UCh2OX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UAmDC,sBAAsB;EAmBrC;EAmCA;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EAkBA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCnxC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;qBCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;wBAerB,aAAa;wBAUb,UAAU,QAAQ;;;qBCzWrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;qBAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;qBAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;qBA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;qBAgTC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;qBAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;wBA0avB,YAAY,iBAAiB,SAAS;wBAOtC,YAAY;UAkIX;EACf;EACA;;wBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCp+BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;qBAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA6DR;MA4BA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;wBAwCc,cAAc,SAAS,kBAAkB;wBAkCzC,cAAc,SAAS;wBAOvB;;;UC5tBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;wBAgEoB,oBACpB,oBACA,OAAM,6BACL;wBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KC7GF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UClCe;EAgCf;EAcA;;;;UC3Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAwBA;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;UASI;EAEf,QAAQ;EAMR,cAAc;;qBAwDH;UACH;EAKR,aAAa,sBAAsB;EA2BnC,aACE,qBACA,UAAU,kBACV,uBACC;EAYH,aACE,qBACA,UAAU,kBAOV,uBACC;UASK;EAkIR,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAmC9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAkCA;EA6KR,UAAU,WAAW;;;;UClmBN;EACf;EACA;IACE;IACA;IACA;;;;;UCQa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCJe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;EAaR,cAAc;;qBAWH;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EA2J/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC7UO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;qBCwYE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;mBAqBA;mBAOA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EA+IR,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA8VJ;UA2EA;UAiIA;UA8LA;EA+GR,iBACJ,sBACA,qBACC,QAAQ;UAiDG;UAoRA;UAgHA;UA+CN;UAyCM;UA2CA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCr0HJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;qBAsNW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;UAqBA;EAiCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA+DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA4BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EA8BhB,iCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAkPI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UCltBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UC2ME;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;EAkBA;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCntBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UC7Fe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;qBAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA+BhD,SACJ,mBACA,iBACC;IACD,OAAO;IACP;IACA;IAaA;;EAkHI,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EAsFtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAwChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EA8D9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UA8DA;UA+DM;UA4EA;UAwBA;UAQA;UA6FN;;;;UC9gDO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCpGH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;qBAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;IAMX;;EA4IE,YAAY,MAAM,WAAW;EA6B7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UClUK;EAEf;EASA;;qBA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;qBCh5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EA6CjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KChZA,YAAY,SAAS;UAQT;EAMf;;qBASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EAkJ9C,mBAAmB,OAAO;UAuDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UA2BA;UASA;UAwBA;UAwBA;;;;KC1dE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;qBAoDQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAgaf;UAmKA;iBA+IO;iBAuBA;iBAoBA;UA2ED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;qBC/wClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC31BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UA8EA;UA0CN;UAyBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCxlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;qBAiSW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAcA;UAUA;UAaA;UAUA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAkEnE;UAuJA;UA2EA;UAiDA;UAiBA;UAyGA;iBA6GO;UA6PP;UAuFA;UA4EA;UA8BA;UAYM;UAmEN;UAsBA;UAUA;UA0IA;UAiDA;UAmCA;UAwBA;UA2BA;UAkCM;UAwGA;UA0GN;UAiDA;UA2IM;UA+hCA;UAqpBA;UA8FA;UA4DA;UAgCA;UA+BA;UA4CN;UAoCM;UA4CA;UAoVN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAgMA;UAiqEN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UAgFA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/failed-stages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAYA;;UAsBe;EAUf;EAMA;EAQA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EA6DA;EAiEA;;UA0Ce;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Te;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC3lCU,uBAAuB;KA8zOvB,gBAAgB;;;UCj2OX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UAmDC,sBAAsB;EAmBrC;EAmCA;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EAkBA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCnxC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;qBCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;wBAerB,aAAa;wBAUb,UAAU,QAAQ;;;qBCzWrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;qBAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;qBAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;qBA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;qBAgTC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;qBAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;wBA0avB,YAAY,iBAAiB,SAAS;wBAOtC,YAAY;UAkIX;EACf;EACA;;wBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCp+BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;qBAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA6DR;MA4BA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;wBAwCc,cAAc,SAAS,kBAAkB;wBAkCzC,cAAc,SAAS;wBAOvB;;;UC5tBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;wBAgEoB,oBACpB,oBACA,OAAM,6BACL;wBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KC7GF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UClCe;EAgCf;EAcA;;;;UC3Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAwBA;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;UASI;EAEf,QAAQ;EAMR,cAAc;;qBAwDH;UACH;EAKR,aAAa,sBAAsB;EA2BnC,aACE,qBACA,UAAU,kBACV,uBACC;EAYH,aACE,qBACA,UAAU,kBAOV,uBACC;UASK;EAkIR,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAmC9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAkCA;EA6KR,UAAU,WAAW;;;;UClmBN;EACf;EACA;IACE;IACA;IACA;;;;;UCQa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCHe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;EAaR,cAAc;;qBAWH;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EA+J/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KClVO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;qBCyYE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;mBAqBA;mBAOA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EA+IR,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA8VJ;UA2EA;UAiIA;UA8LA;EA+GR,iBACJ,sBACA,qBACC,QAAQ;UAiDG;UAoRA;UAgHA;UA+CN;UAyCM;UA2CA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EA0JL,OAAO,OAAO,sBAAsB,QAAQ;UAgJpC;;;;KCp1HJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;qBAsNW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;UAqBA;EAiCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA+DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA4BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EA8BhB,iCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAkPI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UCltBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UC2ME;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;EAkBA;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCntBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UC7Fe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;qBAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA+BhD,SACJ,mBACA,iBACC;IACD,OAAO;IACP;IACA;IAaA;;EAkHI,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EAsFtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAwChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EA8D9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UA8DA;UA+DM;UA4EA;UAwBA;UAQA;UA6FN;;;;UC9gDO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCpGH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;qBAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;IAMX;;EA4IE,YAAY,MAAM,WAAW;EA6B7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UClUK;EAEf;EASA;;qBA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;qBCh5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EA6CjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KChZA,YAAY,SAAS;UAQT;EAMf;;qBASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EAkJ9C,mBAAmB,OAAO;UAuDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UA2BA;UASA;UAwBA;UAwBA;;;;KC1dE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;qBAoDQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAgaf;UAmKA;iBA+IO;iBAuBA;iBAoBA;UA2ED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;qBC/wClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC31BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UA8EA;UA0CN;UAyBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCxlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;qBAiSW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAcA;UAUA;UAaA;UAUA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAkEnE;UAuJA;UA2EA;UAiDA;UAiBA;UAyGA;iBA6GO;UA6PP;UAuFA;UA4EA;UA8BA;UAYM;UAmEN;UAsBA;UAUA;UA0IA;UAiDA;UAmCA;UAwBA;UA2BA;UAkCM;UAwGA;UA0GN;UAiDA;UA2IM;UA+hCA;UAqpBA;UA8FA;UA4DA;UAgCA;UA+BA;UA4CN;UAoCM;UA4CA;UAoVN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAgMA;UAiqEN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UAgFA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Fa as clearBucketRegionCache, Ha as AssetError, Hr as LockManager, Ia as resolveBucketRegion, Ka as DependencyError, Ki as Synthesizer, La as AwsClients, Qa as LockError, Ra as getAwsClients, Sa as AssemblyReader, Ua as CdkdError, Ur as S3StateBackend, Va as setAwsClients, Wa as ConfigError, _n as DiffCalculator, br as DagBuilder, ci as AssetPublisher, co as SynthesisError, ct as IAMRoleProvider, do as normalizeAwsError, dt as ProviderRegistry, lo as formatError, no as ProvisioningError, r as DeployEngine, so as StateError, uo as isCdkdError, xr as TemplateParser, xt as CloudControlProvider, za as resetAwsClients } from "./deploy-engine-BAOtjfHX.js";
+import { $a as DependencyError, Ga as getAwsClients, Ha as clearBucketRegionCache, Ja as setAwsClients, Ka as resetAwsClients, Kr as LockManager, Tr as TemplateParser, Ua as resolveBucketRegion, Wa as AwsClients, Xa as CdkdError, Xi as Synthesizer, Ya as AssetError, Za as ConfigError, _o as isCdkdError, ao as LockError, ct as IAMRoleProvider, dt as ProviderRegistry, fi as AssetPublisher, go as formatError, ho as SynthesisError, ka as AssemblyReader, lo as ProvisioningError, mo as StateError, qr as S3StateBackend, r as DeployEngine, vo as normalizeAwsError, vt as CloudControlProvider, wr as DagBuilder, xn as DiffCalculator } from "./deploy-engine-CCvNP_dA.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Bt0RGDfb.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-C6B7leIq.js → program-nxeZp1Qs.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as MalformedProducerRecordRefusalError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as requireConfigArray, A as createPreDeleteFinalSnapshot, Aa as ownValue, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as IntrinsicFunctionResolver, B as isStatefulRecreateTargetSync, Ba as runWithStackAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as refStateLookupFromResource, C as namesAnyDeclaredParameter, Ca as failedStageNote, Ci as validateAssetBucketName, Cn as displayLogicalId, Co as safeStringify, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as ccProtectionRegistryTypes, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasOwnKey, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as isWaitAbandonedError, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as defineOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as getAccountInfo, G as toCfnInteger, Ga as CrossAccountSecretRefusalError, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as assertRegionMatch, H as WARM_THROUGHPUT_MEMBERS, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as WAFv2WebACLProvider, I as makeSiblingClaimReader, Ia as resolveBucketRegion, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as isImpossibleEmptyStoredAttribute, J as bold, Ja as DynamicReferenceRegionAmbiguousError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as configBooleanRefusal, K as toFiniteNumber, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as coerceCfnBoolean, L as planOrphanAdoption, La as AwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as isNamelessDynamicReferenceError, M as refusesFinalSnapshot, Ma as displayAssemblyPath, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as carriesFetchableDynamicReference, N as unsupportedFinalSnapshotError, Na as renderAssemblyPathEscape, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as cfnRefValueFromPhysicalId, O as buildFinalSnapshotIdentifier, Oa as hasPlainPrototype, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as disableInstanceApiTermination, P as makeCanonicalizePropertiesFn, Pa as resolveAssemblyPath, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as coerceParameterTypedValue, Q as red, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as replayWarn, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as getAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isUnboundTemplateParameter, S as computeParameterTaint, Sa as AssemblyReader, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as describeAwsFailure, Sr as STATE_SOURCED_BASELINE_RULES, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as processStackMessages, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as CdkdError, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as normalizeAwsTagsToCfn, V as renderStatefulReason, Va as setAwsClients, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as isSettledInstanceState, W as isWarmThroughputDecrease, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as resolveExplicitPhysicalId, X as gray, Xa as LocalInvokeBuildError$1, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configStringRefusal, Y as cyan, Ya as IntrinsicResolutionRefusalError, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as configIntegerRefusal, Z as green, Za as LocalStartServiceError, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as readConfigString, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isThrottlingError, _r as findSilentDropProperties, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackHasActiveImportsError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as markRedactedCause, br as DagBuilder, bt as startInterruptWatch, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, co as SynthesisError, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as normalizeAwsError, dr as repairMalformedResourcesForReadOnly, dt as ProviderRegistry, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as requireConfigObject, eo as NestedStackChildDirectDestroyError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as withErrorHandling, fr as safeRegion, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isRetryableTransientError, gr as findActionableSilentDrops, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isMarkedNonRetryable, hr as unreadableOrphanRecords, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as ResourceUpdateNotSupportedError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as absoluteAssemblyPathEscape, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as carriesDynamicReference, k as ccRoutedFinalSnapshotError, ka as nullPrototypeRecord, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isTerminationProtectionPropagationError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as shellQuote, mr as unpreviewableOrphanRecords, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as definedAttributes, no as ProvisioningError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, oo as StackTerminationProtectionError, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as pasteableCommand, pr as safeStackName, pt as createMaskedRetryLogger, q as formatResourceLine, qa as DeployCancelledError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as coerceCfnInteger, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as stringifyIfAssigned, ro as ResourceTimeoutError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigString, to as PartialFailureError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as isTransientServerError, vr as describeTypeWithThrottleRetry, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as globMatches, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as ambientClientDefaults, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as retryClassificationText, xr as TemplateParser, xt as CloudControlProvider, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markNonRetryable, yr as withRetry, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as resetAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as parameterTypeMayLoseSecretIdentity } from "./deploy-engine-BAOtjfHX.js";
+import { $ as yellow, $i as getLegacyStateBucketName, $n as refuseMalformedOrphans, $r as formatLockExpiry, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as failedStageNote, Ai as buildDockerImage, An as hasReadableResources, Ao as safeStringify, Ar as carriesSecretMask, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as renderAssemblyPathEscape, Bi as isMalformedEnvKey, Bn as malformedOrphansWarning, Br as pathCrossesDottedKey, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as canonicalizeRegion, Ci as getBootstrapMarkerKey, Cn as STATE_RESOURCES_MALFORMED, Co as isRetryableTransientError, Cr as withRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as clientDefaultsFor, Di as validateAssetBucketName, Dn as displayLogicalId, Do as markRedactedCause, Dr as STATE_SOURCED_CROSS_GENERATION_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as ambientCredentialConfig, Ei as readBootstrapMarkerBody, En as deployRefusesOrphanRowsReason, Eo as markNonRetryable, Er as STATE_SOURCED_BASELINE_RULES, Et as maskDeep, F as extractDeploymentEventError, Fa as hasPlainPrototype, Fi as dockerSpawnEnvWithSensitive, Fn as malformedLocalOutputsWarning, Fr as isSingleDynamicReferenceToken, Ft as carriesDynamicReference, G as toCfnInteger, Ga as getAwsClients, Gi as warnFinchArgvExposure, Gn as malformedResourcePropertiesWarning, Gr as scrubResourceRecord, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Hi as redactDockerArgvValues, Hn as malformedOutputsWarning, Hr as recordMaskOnlyValuesIn, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as nullPrototypeRecord, Ii as finchSecretArgvRefusal, In as malformedOrphanRecordsRefusalMessage, Ir as isUncertifiedBaselineMaskPosition, It as carriesFetchableDynamicReference, J as bold, Ja as setAwsClients, Ji as AssetManifestLoader, Jn as previewableOrphanRecords, Jr as rebuildClientForBucketRegion, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as resetAwsClients, Ki as escapeRegExp, Kn as malformedResourcesWarning, Kr as LockManager, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as ownValue, Li as formatDockerLoginError, Ln as malformedOrphanRecordsWarning, Lr as markSameGenerationBag, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as processStackMessages, Mi as describeDockerCapturedOutput, Mn as isReadableResourceEntry, Mr as dynamicReferenceTokens, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as defineOwnKey, Ni as describeDockerExecFailure, Nn as malformedExportNamesWarning, Nr as errorCauseChain, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as credentialFingerprint, Oi as validateContainerRepoName, On as hasReadableOrphans, Oo as retryClassificationText, Or as STATE_SOURCED_READBACK_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as hasOwnKey, Pi as describeDockerFailure, Pn as malformedExportSourceWarning, Pr as identityKeyFor, Pt as IntrinsicFunctionResolver, Q as red, Qa as CrossAccountSecretRefusalError, Qi as getDefaultStateBucketName, Qn as refuseMalformedOrphanRecordsForDestroy, Qr as forceQuitRecoveryClause, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as absoluteAssemblyPathEscape, Ri as getDockerCmd, Rn as malformedOrphanRowsKeptWarning, Rr as maskSecretsInError, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as PARTITION_TABLE, Si as ensureAssetStorage, Sn as INTRINSIC_KEYS, So as isMarkedNonRetryable, Sr as describeTypeWithThrottleRetry, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as ambientClientDefaults, Ti as parseBootstrapMarker, Tn as UNREADABLE_RESOURCES_MAP_ROW, To as isTransientServerError, Tr as TemplateParser, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as resolveBucketRegion, Ui as runDockerForeground, Un as malformedRenderedContainersWarning, Ur as recoverMaskedOutput, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as resolveAssemblyPath, Vi as partitionSensitiveEnv, Vn as malformedOutputsRefusalMessage, Vr as recordMaskOnlyValue, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wa as AwsClients, Wi as runDockerStreaming, Wn as malformedResourceEntriesWarning, Wr as redactSecretsForState, Wt as refStateLookupFromResource, X as gray, Xa as CdkdError, Xi as Synthesizer, Xn as refuseMalformedNestedChildOutputs, Xr as buildForceUnlockCommand, Xt as coerceCfnBoolean, Y as cyan, Yi as getDockerImageBySourceHash, Yn as refuseDivergentRecordRegionForDestroy, Yr as UNREPRODUCIBLE_LOCK_CLAUSE, Yt as assertRegionMatch, Z as green, Zi as synthesisStatusMessage, Zn as refuseMalformedOrphanRecords, Zr as buildLockContentionMessage, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as injectiveKeyPrefix, _i as loadPublishableAssetManifest, _n as AWS_CREDENTIAL_ENV_KEYS, _r as safeStackName, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveStateBucketWithDefaultAndSource, ai as hasUnverifiableParameterRefusal, an as requireConfigString, ar as refuseMalformedResourceEntries, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as decodeListingKey, bi as BOOTSTRAP_MARKER_PREFIX, bn as envCredentialsAreAssumedRole, bo as pasteableCommand, br as findActionableSilentDrops, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as warnDeprecatedNoPrefixCliFlag, ci as isReadableBag, cn as classifyReplaySecretRegion, co as PartialFailureError, cr as refuseMalformedResourcesForDestroy, ct as IAMRoleProvider, d as updatePartialMessage, da as CFN_TEMPLATE_URL_LIMIT, di as shouldRetainResource, dn as s3BucketArn, do as ResourceUpdateNotSupportedError, dr as repairMalformedOrphansForReadOnly, dt as ProviderRegistry, ea as resolveApp, ei as CUSTOM_RESOURCE_RESPONSE_PREFIX, en as configStringRefusal, eo as DeployCancelledError, er as refuseMalformedOrphansForDestroy, et as collectDeclaredOutputNames, f as updatePartialReason, fa as MIGRATE_TMP_PREFIX, fi as AssetPublisher, fn as s3BucketDomainName, fo as StackHasActiveImportsError, fr as repairMalformedOutputsForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as injectiveKey, gi as createAssetRedirectResolver, gn as applyRoleArnIfSet, gr as safeRegion, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, hi as buildAssetRedirectMap, hn as s3BucketWebsiteUrl, ho as SynthesisError, hr as repairMalformedResourcesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveStateBucketWithDefault, ii as hasReasonlessBaselineRefusal, in as requireConfigObject, io as LocalStartServiceError, ir as refuseMalformedResourceAttributesForOrphan, it as secretBearing, j as isFinalSnapshotError, ja as globMatches, ji as resolveDockerContextDirectory, jn as isReadableOrphanRecord, jr as createSecretMasker, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as AssemblyReader, ki as buildDenyExternalAccessPolicy, kn as hasReadableOutputs, ko as describeAwsFailure, kr as TEMPLATE_SOURCED_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as ssmResolvedValueType, li as orphansAfterRollback, ln as producerRegionsFromState, lo as ProvisioningError, lr as refuseMalformedState, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as uploadCfnTemplate, mi as WorkGraph, mn as s3BucketRegionalDomainName, mr as repairMalformedResourcePropertiesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveCaptureObservedState, ni as exportNamesCarriedFrom, nn as replayWarn, no as IntrinsicResolutionRefusalError, nr as refuseMalformedOutputs, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveUseCdkBootstrapAssets, oi as importableOutputKeys, on as definedAttributes, oo as MalformedProducerRecordRefusalError, or as refuseMalformedResourceEntriesForOrphan, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as findLargeInlineResources, pi as stringifyValue, pn as s3BucketDualStackDomainName, po as StackTerminationProtectionError, pr as repairMalformedResourceEntriesForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as runWithStackAwsClients, qi as stripControlChars, qn as malformedStateRefusalMessage, qr as S3StateBackend, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveSkipPrefix, ri as hasReadableExportSet, rn as requireConfigArray, ro as LocalInvokeBuildError$1, rr as refuseMalformedOutputsForDestroy, rt as isExportAliasCollision, s as planRollback, sa as stateBucketExistenceConfirmed, si as importableOutputs, sn as stringifyIfAssigned, so as NestedStackChildDirectDestroyError, sr as refuseMalformedResourcePropertiesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveAutoAssetStorage, ti as DEFAULT_STATE_PREFIX, tn as readConfigString, to as DynamicReferenceRegionAmbiguousError, tr as refuseMalformedOrphansForOrphan, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as CFN_TEMPLATE_BODY_LIMIT, ui as orphansCarriedFrom, un as withSharedDrainBudget, uo as ResourceTimeoutError, ur as repairMalformedOrphanRecordsForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as producerCoordinateKey, vi as rewriteTemplateAssetReferences, vn as applyCallerIdentityCredentials, vo as normalizeAwsError, vr as unpreviewableOrphanRecords, vt as CloudControlProvider, w as reachableDivergentParameters, wa as derivePartitionAndUrlSuffix, wi as isCrossRegionRedirect, wn as UNREADABLE_ORPHANS_CONTAINER_ROW, wo as isThrottlingError, wr as DagBuilder, wt as packCompositeId, x as bindingSkippedOutputs, xa as expectedOwnerParam, xi as assertAssetBucketRegion, xn as DiffCalculator, xo as shellQuote, xr as findSilentDropProperties, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as producerRecordKey, yi as AssetModeResolver, yn as callerEnvCredentials, yo as withErrorHandling, yr as unreadableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as displayAssemblyPath, zi as isDockerClientEnvKey, zn as malformedOrphansRefusalMessage, zr as maskSecretsInText, zt as getAccountInfo } from "./deploy-engine-CCvNP_dA.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-ELgusB_X.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-HsFVvUCB.js";
+import { t as getCdkdVersion } from "./version-BLo_Pzd-.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-ChgXLoRA.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -16192,210 +16192,6 @@ var LambdaLayerVersionProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/composite-id.ts
-/**
-* Refuse a composite physicalId whose segments would make it ambiguous
-* (issue [#1672](https://github.com/go-to-k/cdkd/issues/1672)).
-*
-* ## Why a composite id exists at all
-*
-* `ResourceProvider` passes a SINGLE `physicalId: string` as a resource's
-* identity, while CloudFormation keeps the physical id and its containing
-* scope as separate values. So every provider whose type needs more than one
-* value to address the resource PACKS them into one string joined by
-* {@link COMPOSITE_ID_SEPARATOR} — `<databaseName>|<tableName>` for
-* `AWS::Glue::Table`, `<apiId>|<typeName>|<fieldName>` for
-* `AWS::AppSync::Resolver`, and so on.
-*
-* ## Why it has to be guarded
-*
-* The separator is NOT escaped, so a segment that itself contains a `|`
-* produces an id with the wrong arity. Every decode site splits the stored id
-* back apart and the extra segment shifts everything — for a Glue table named
-* `a|b` in database `mydb` the recorded id `mydb|a|b` decodes to database
-* `mydb`, table `a`. Both halves are non-empty, so every existing
-* "is this id well-formed?" guard passes and the deploy SUCCEEDS. What breaks
-* is everything afterwards: `cdkd destroy` deletes the WRONG resource if one
-* exists under the decoded pair (or warn-and-skips, reporting success while
-* the real resource stays alive and billing), and `cdkd drift` reads back
-* `undefined` forever.
-*
-* AWS itself accepts such a name — verified live us-east-1 2026-08-12,
-* `glue:CreateTable` with `TableInput.Name: 'a|b'` succeeds — and
-* CloudFormation manages the resource fine. The limitation is cdkd's own, so
-* the honest answer is to REFUSE at deploy time with a message that says so,
-* rather than to record an id that silently names something else. Escaping the
-* separator, or dropping the packing where the decode sites already receive
-* the properties bag, are the two real fixes and both remain open on #1672;
-* this guard is what closes the data-loss path in the meantime.
-*
-* ## Two entry points, mirroring `config-shape.ts`
-*
-* {@link packCompositeId} is the ACTION (throw, or warn-and-pack under the
-* replay downgrade) and {@link compositeIdSeparatorRefusal} is the bare
-* PREDICATE, for a caller whose response is neither — the `import()` paths
-* warn and return `null` (`skipped-not-found`), which is the idiom those
-* methods already use for every other unusable id. Both share one message
-* builder so the two can never drift.
-*
-* ## Where to place the call
-*
-* Prefer computing the id BEFORE the create call rather than after it. The
-* refusal is a pre-flight check, and a throw placed after the AWS mutation has
-* already committed would leave an orphan resource behind with no state
-* record. Only where a segment is derived from the create RESPONSE (an
-* AWS-generated id) does the call have to sit after it — and those segments
-* are structurally incapable of carrying a `|` anyway. A post-call site must
-* also sit OUTSIDE the `try` whose `catch` re-wraps as
-* `ProvisioningError('Failed to create …')`, or a refusal would be
-* mis-reported as an AWS creation failure.
-*
-* ## What this does NOT cover
-*
-* The claim is "every composite packer this change reaches", not "every `|`
-* join in the tree". One deliberate exclusion, recorded so the scope is not
-* read as wider than it is:
-*
-* - **`intrinsic-function-resolver.ts`'s `|` joins** (the WAFv2 and
-*   `AWS::Events::Rule` arms) are out of scope by KIND, not by ownership: they
-*   build a `Ref` VALUE for the template resolver, never a physicalId cdkd
-*   records and later splits. Nothing decodes them, so an ambiguous join has
-*   no decode site to go wrong at.
-*
-* ## Guarding the PACKERS is not the whole story
-*
-* A packer that refuses ambiguity does nothing about an id an EARLIER binary
-* already recorded, or one an `import` was handed — and a type whose decoder is
-* loose will mis-decode both. Issue #1711 is where that was learned:
-* `AWS::Route53::RecordSet`'s `parseRecordSetCompositeId` accepts any three
-* NON-EMPTY segments, so a record name carrying two pipes decoded to a
-* DIFFERENT hosted zone at three sites this helper never sees — an `import`
-* early accept, an identity-resolution short-circuit, and `delete`'s own parse,
-* where `cdkd destroy` then reported success over a live record. When adopting
-* this guard for a new type, audit its DECODE sites in the same change and make
-* each one cross-check the parsed segments against something it can verify them
-* with (Route 53 uses the template's own `Name` / `Type`).
-*/
-/** The character every composite physicalId in this codebase joins segments with. */
-const COMPOSITE_ID_SEPARATOR = "|";
-/** The issue tracking the real fix (escaping, or not packing at all). */
-const COMPOSITE_ID_ISSUE_URL = "https://github.com/go-to-k/cdkd/issues/1672";
-/** Render `<a>|<b>|<c>` from the segment names. */
-function idShape(segments) {
-	return segments.map((segment) => `<${segment.name}>`).join("|");
-}
-/**
-* The refusal sentence for a composite id whose segments carry the separator,
-* or `undefined` when the id is unambiguous.
-*
-* Every offending segment is named, not just the first: a template that
-* mis-names one value frequently mis-names its sibling too, and reporting them
-* one deploy at a time is the shape of remedy nobody finishes.
-*/
-function compositeIdSeparatorRefusal(resourceType, logicalId, segments, maskSecrets) {
-	const offending = segments.filter((segment) => String(segment.value).includes("|"));
-	if (offending.length === 0) return void 0;
-	const mask = maskerOrIdentity(maskSecrets);
-	return `${resourceType} ${logicalId}: ${offending.map((segment) => `${segment.name} '${mask(String(segment.value))}'`).join(" and ")} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. AWS accepts the name and CloudFormation manages such a resource fine; this is a cdkd limitation tracked in ${COMPOSITE_ID_ISSUE_URL}. Rename the resource so no segment contains '${"|"}', or manage it outside cdkd.`;
-}
-/**
-* Join the segments into a composite physicalId, REFUSING one that would be
-* ambiguous.
-*
-* @throws ProvisioningError when a segment contains {@link COMPOSITE_ID_SEPARATOR},
-*   unless `options.onRefusal` is supplied — under which the message is handed
-*   to the callback and the ambiguous id is returned, keeping the pre-guard
-*   behavior.
-*/
-function packCompositeId(resourceType, logicalId, segments, options) {
-	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments, options?.maskSecrets);
-	if (refusal !== void 0) {
-		if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
-		else throw new ProvisioningError(refusal, resourceType, logicalId);
-	}
-	return segments.map((segment) => String(segment.value)).join("|");
-}
-/** Render the expected id shape, e.g. `<databaseName>|<tableName>`. */
-function formatShape(segments) {
-	return segments.map((segment) => `<${segment}>`).join("|");
-}
-/**
-* The message EVERY malformed-composite-id decode site emits (issue
-* [#1657](https://github.com/go-to-k/cdkd/issues/1657)).
-*
-* ## Why one builder
-*
-* Roughly half the decode sites stated the expected shape and half only echoed
-* the value back, and the format is documented nowhere else — so on the silent
-* half the message was the user's only possible route to the answer and it did
-* not carry it. Routing the sites that already got it right through the same
-* builder is what stops them drifting back.
-*
-* ## This is a WORDING fix, not an acceptance change
-*
-* Each caller keeps its own split-and-guard exactly as it was. The arities
-* genuinely differ (some sites accept AT LEAST N segments, some destructure the
-* first N and tolerate extras — the #1672 ambiguity, tracked separately), and
-* folding them into one predicate here would silently change which ids deploy.
-*
-* ## The `skipping` variant
-*
-* On the DELETE path the established policy is warn-and-continue, so a
-* malformed record leaves the AWS resource ALIVE. That policy is unchanged —
-* the warning says what the skip costs, because an orphan the user is never
-* told about is one they cannot go and delete.
-*
-* Since issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) the ACCOUNTING
-* around it is no longer a lie: an arm emitting this message must also return
-* `{ outcome: 'skipped', reason: COMPOSITE_ID_SKIP_REASON }` so `cdkd destroy`
-* prints a `⚠ … skipped` line instead of `✓ … deleted`, reports
-* `N deleted, 1 skipped`, KEEPS the state record, and exits non-zero. The
-* wording here changed accordingly — it used to promise unconditionally that
-* cdkd "will report this delete as successful", which is no longer true on
-* either path. Issue [#1762](https://github.com/go-to-k/cdkd/issues/1762) then
-* taught the deploy engine to consume the outcome too, so the message no longer
-* warns that deploy drops the record: the template-removal DELETE keeps it,
-* exactly like destroy. What it DOES still distinguish is the replacement /
-* rollback delete, which fails the resource and can leave the old one
-* untracked — there "drop the record with 'cdkd state orphan'" is not the
-* remedy, deleting the resource by hand is.
-*/
-function compositeIdFormatMessage(format, logicalId, physicalId, options) {
-	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
-	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
-	if (!options?.skipping) return head;
-	return `${head}. Skipping the delete — no AWS call is issued, so the resource is LEFT IN PLACE. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy (which re-attempts it on the next deploy). So repair the id in state.json and re-run, or delete the resource by hand and drop the record with 'cdkd state orphan'. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so delete it by hand.`;
-}
-/**
-* The short `ResourceDeleteResult.reason` every malformed-composite-id DELETE
-* skip reports (issue [#1752](https://github.com/go-to-k/cdkd/issues/1752)).
-*
-* Deliberately short and IDENTICAL across the five arms: it is rendered inline
-* on the per-resource status line (`⚠ MyTable (AWS::Glue::Table) skipped
-* (malformed physicalId in state — no delete issued)`), where the full
-* remediation sentence built by {@link compositeIdFormatMessage} would not fit.
-* The full text is still emitted, as the `logger.warn` right beside it.
-*
-* A shared constant rather than five literals so the five arms cannot drift and
-* a grep for the wording finds all of them.
-*/
-const COMPOSITE_ID_SKIP_REASON = "malformed physicalId in state — no delete issued";
-/**
-* The `ResourceDeleteResult` a malformed-composite-id DELETE arm returns.
-*
-* Pairs with the `{ skipping: true }` warning: emit the warning, return this.
-* Providers call it as `return compositeIdSkipResult();` so the arm reads as
-* the deliberate skip it is rather than as the bare `return;` that made issue
-* #1752's mis-accounting possible.
-*/
-function compositeIdSkipResult() {
-	return {
-		outcome: "skipped",
-		reason: COMPOSITE_ID_SKIP_REASON
-	};
-}
-
 //#endregion
 //#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
 /**
@@ -64617,6 +64413,10 @@ var ECRProvider = class {
 * child's own state file (`<parent>~<logicalId>`) — see `skippedStateTargets`.
 */
 const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
+/**
+* The protection flag per type. `countProtectedResources` reads it the same
+* way in `properties` and then `observedProperties`.
+*/
 const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Logs::LogGroup": "DeletionProtectionEnabled",
 	"AWS::RDS::DBInstance": "DeletionProtection",
@@ -64625,10 +64425,16 @@ const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Neptune::DBCluster": "DeletionProtection",
 	"AWS::Neptune::DBInstance": "DeletionProtection",
 	"AWS::DynamoDB::Table": "DeletionProtectionEnabled",
-	"AWS::DynamoDB::GlobalTable": "DeletionProtectionEnabled",
+	"AWS::DynamoDB::GlobalTable": (bag, region) => extractLocalDeletionProtection(bag, region ?? ""),
 	"AWS::EC2::Instance": "DisableApiTermination",
 	"AWS::Cognito::UserPool": "DeletionProtection",
 	"AWS::AutoScaling::AutoScalingGroup": "DeletionProtection",
+	"AWS::ElasticLoadBalancingV2::LoadBalancer": (bag) => {
+		const attrs = bag["LoadBalancerAttributes"];
+		if (!Array.isArray(attrs)) return void 0;
+		return attrs.find((a) => typeof a === "object" && a !== null && a.Key === "deletion_protection.enabled")?.Value;
+	},
+	"AWS::EMR::Cluster": ["Instances", "TerminationProtected"],
 	"AWS::DSQL::Cluster": "DeletionProtectionEnabled",
 	"AWS::NeptuneGraph::Graph": "DeletionProtection",
 	"AWS::SMSVOICE::ProtectConfiguration": "DeletionProtectionEnabled",
@@ -64654,31 +64460,47 @@ const PROTECTION_ACTIVE_VALUES_BY_TYPE = {
 */
 const PROTECTION_ACTIVE_PREDICATE_BY_TYPE = { "AWS::VerifiedPermissions::PolicyStore": (value) => typeof value === "object" && value !== null && value.Mode === "ENABLED" };
 /**
+* The flag's recorded value in `bag`. A missing or torn container on the way
+* (`null`, a string, a list) yields `undefined`, which leaves the count to the
+* other bag rather than throwing mid-prompt.
+*/
+function readProtection(bag, locator, region) {
+	if (typeof locator === "function") {
+		if (typeof bag !== "object" || bag === null || Array.isArray(bag)) return void 0;
+		return locator(bag, region);
+	}
+	let value = bag;
+	for (const key of typeof locator === "string" ? [locator] : locator) {
+		if (value === null || value === void 0) return void 0;
+		value = value[key];
+	}
+	return value;
+}
+/**
+* An OWN entry of one of the per-type maps. A plain-object map answers a
+* `resourceType` of `constructor` or `__proto__` with an inherited value, and a
+* hand-edited record can carry one.
+*/
+function perType(map, resourceType) {
+	return typeof resourceType === "string" && Object.hasOwn(map, resourceType) ? map[resourceType] : void 0;
+}
+/**
 * Count how many resources in a stack's recorded state appear to have
-* deletion protection enabled. Walks `properties` and `observedProperties`
-* for the property name registered against each resource type in
-* `PROTECTION_PROPERTY_BY_TYPE`. ELBv2 LoadBalancer protection lives in
-* `LoadBalancerAttributes` (a CFn `Array<{Key, Value}>`), so it's
-* handled separately via the `deletion_protection.enabled` key.
+* deletion protection enabled, reading each type's flag through its
+* `PROTECTION_PROPERTY_BY_TYPE` locator in `properties` and in
+* `observedProperties`.
 */
 function countProtectedResources(state) {
 	let count = 0;
 	for (const resource of Object.values(state.resources ?? {})) {
-		const propName = PROTECTION_PROPERTY_BY_TYPE[resource.resourceType];
-		if (propName) {
-			const recorded = resource.properties?.[propName] ?? resource.observedProperties?.[propName];
-			const activePredicate = PROTECTION_ACTIVE_PREDICATE_BY_TYPE[resource.resourceType];
-			const activeValues = PROTECTION_ACTIVE_VALUES_BY_TYPE[resource.resourceType];
-			if (activePredicate) {
-				if (activePredicate(recorded)) count++;
-			} else if (activeValues) {
-				if (activeValues.has(recorded)) count++;
-			} else if (recorded === true) count++;
+		const locator = perType(PROTECTION_PROPERTY_BY_TYPE, resource.resourceType);
+		if (locator) {
+			const activePredicate = perType(PROTECTION_ACTIVE_PREDICATE_BY_TYPE, resource.resourceType);
+			const activeValues = perType(PROTECTION_ACTIVE_VALUES_BY_TYPE, resource.resourceType);
+			const isActive = (recorded) => activePredicate ? activePredicate(recorded) : activeValues ? activeValues.has(recorded) : isTruthyCfnBoolean(recorded);
+			if (isActive(readProtection(resource.properties, locator, state.region)) || isActive(readProtection(resource.observedProperties, locator, state.region))) count++;
 			continue;
 		}
-		if (resource.resourceType === "AWS::ElasticLoadBalancingV2::LoadBalancer") {
-			if (((resource.properties?.["LoadBalancerAttributes"] ?? resource.observedProperties?.["LoadBalancerAttributes"])?.find((a) => a?.Key === "deletion_protection.enabled"))?.Value === "true") count++;
-		}
 	}
 	return count;
 }
@@ -91909,16 +91731,21 @@ function parseEcrUri(imageUri) {
 	};
 }
 /**
-* Module-level cache for STS-issued AssumeRole credentials, keyed by
-* `(ecrRoleArn, callerRegion)`. Closes the reviewer's MAJOR finding: ECS
+* Module-level cache for STS-issued AssumeRole credentials, per SOURCE credential
+* identity and then per `(ecrRoleArn, callerRegion)`. Closes the reviewer's MAJOR finding: ECS
 * run-task with N containers under one `--ecr-role-arn` would otherwise issue
 * N× `AssumeRole` and N× `GetCallerIdentity` for identical credentials valid
 * for 3600s. The cache keeps a 5-minute safety margin against the recorded
 * `Expiration` so STS-side / local-clock skew never lets a stale entry through.
 *
-* Cache key is intentionally `(roleArn, region)` rather than full caller
-* identity — STS issues per-region session creds, and a switch of `--region`
-* between two `local invoke` calls in the same process must re-issue.
+* The inner key is `(roleArn, region)`: STS issues per-region session creds,
+* so a switch of `--region` between two `local invoke` calls in the same
+* process must re-issue. The OUTER key is the source identity (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588), as in `role-arn.ts`),
+* so a library caller that installs `AwsClients` with other explicit
+* credentials is never handed credentials the first identity obtained. It is
+* {@link credentialFingerprint} — profile plus access key id, never a secret —
+* and neither key is ever rendered.
 *
 * NOT cleared on process exit — Node's module scope evaporates with the
 * process, and no inter-process sharing is desired (each `cdkd local invoke`
@@ -91926,12 +91753,15 @@ function parseEcrUri(imageUri) {
 */
 const ASSUMED_ROLE_CACHE = /* @__PURE__ */ new Map();
 /**
-* Module-level cache for `STS:GetCallerIdentity`. The result is identity-only
-* (`Account`) and invariant for the lifetime of the process under one set of
-* default credentials. Keyed by `callerRegion` to avoid a cross-region leak
-* when the caller flips `AWS_REGION` mid-process (STS is global but the SDK
-* uses regional endpoints; the result is invariant in practice, but we key
-* on region for safety).
+* Module-level cache for `STS:GetCallerIdentity`, keyed by
+* `(credential identity, callerRegion)`. The account is a function of the
+* identity that asked, so the identity is part of the key (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)): a library caller that
+* installs `AwsClients` with other explicit credentials must not be told the
+* first identity's account. The region half avoids a cross-region leak when the
+* caller flips `AWS_REGION` mid-process (STS is global but the SDK uses
+* regional endpoints; the result is invariant in practice, but we key on region
+* for safety). Never rendered.
 */
 const CALLER_IDENTITY_CACHE = /* @__PURE__ */ new Map();
 /** 5-minute safety margin against the recorded STS expiration timestamp. */
@@ -91962,11 +91792,13 @@ async function pullEcrImage(imageUri, options) {
 		await verifyImageInLocalCache(canonicalUri);
 		return canonicalUri;
 	}
-	const callerIdentityKey = callerRegion ?? "_unset";
+	const credentialConfig = ambientCredentialConfig();
+	const identityFingerprint = credentialFingerprint(credentialConfig);
+	const callerIdentityKey = injectiveKey(identityFingerprint, callerRegion ?? "_unset");
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
 	if (callerAccount === void 0) {
 		const sts = new STSClient({
-			...awsClientDefaults(),
+			...clientDefaultsFor(credentialConfig),
 			...callerRegion && { region: callerRegion }
 		});
 		try {
@@ -91983,19 +91815,24 @@ async function pullEcrImage(imageUri, options) {
 	let assumed;
 	if (options.ecrRoleArn) {
 		const cacheKey = `${options.ecrRoleArn}|${callerRegion ?? "_unset"}`;
-		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
+		let roleCache = ASSUMED_ROLE_CACHE.get(identityFingerprint);
+		if (roleCache === void 0) {
+			roleCache = /* @__PURE__ */ new Map();
+			ASSUMED_ROLE_CACHE.set(identityFingerprint, roleCache);
+		}
+		const cached = roleCache.get(cacheKey);
 		if (cached && isCredentialFresh(cached)) {
 			assumed = cached;
 			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 613 })}`);
 		} else {
-			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, logger);
-			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
+			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, credentialConfig, logger);
+			roleCache.set(cacheKey, assumed);
 			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 613 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
 		}
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
 	const ecr = new ECRClient({
-		...awsClientDefaults(),
+		...clientDefaultsFor(credentialConfig),
 		region: parsed.region,
 		...assumed && { credentials: assumed }
 	});
@@ -92018,16 +91855,17 @@ async function pullEcrImage(imageUri, options) {
 	return canonicalUri;
 }
 /**
-* Assume the supplied role via the SDK default credential chain and
+* Assume the supplied role as the caller's active credential configuration
+* (`credentialConfig`, the same reading `pullEcrImage` keys its caches on) and
 * return the resulting temporary credentials. The STS client is built
 * with the caller's profile region (or unset) — STS is a global
 * service so the region is informational, but threading it through
 * mirrors the convention used by `src/utils/role-arn.ts`.
 */
-async function assumeRoleForEcr(roleArn, callerRegion, logger) {
+async function assumeRoleForEcr(roleArn, callerRegion, credentialConfig, logger) {
 	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull...`);
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...clientDefaultsFor(credentialConfig),
 		...callerRegion && { region: callerRegion }
 	});
 	try {
@@ -99140,4 +98978,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-C6B7leIq.js.map
+//# sourceMappingURL=program-nxeZp1Qs.js.map