@go-to-k/cdkd 0.291.22 → 0.291.24

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/failed-stages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAYA;;UAsBe;EAUf;EAMA;EAQA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EA6DA;EAiEA;;UA0Ce;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Te;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC3lCU,uBAAuB;KA6zOvB,gBAAgB;;;UCh2OX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UAmDC,sBAAsB;EAmBrC;EAmCA;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EAkBA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCnxC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;qBCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;wBAerB,aAAa;wBAUb,UAAU,QAAQ;;;qBCzWrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;qBAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;qBAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;qBA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;qBAgTC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;qBAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;wBA0avB,YAAY,iBAAiB,SAAS;wBAOtC,YAAY;UAkIX;EACf;EACA;;wBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCp+BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;qBAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA6DR;MA4BA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;wBAwCc,cAAc,SAAS,kBAAkB;wBAkCzC,cAAc,SAAS;wBAOvB;;;UC5tBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;wBAgEoB,oBACpB,oBACA,OAAM,6BACL;wBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KC7GF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UClCe;EAgCf;EAcA;;;;UC3Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAwBA;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;UASI;EAEf,QAAQ;EAMR,cAAc;;qBAwDH;UACH;EAKR,aAAa,sBAAsB;EA2BnC,aACE,qBACA,UAAU,kBACV,uBACC;EAYH,aACE,qBACA,UAAU,kBAOV,uBACC;UASK;EAkIR,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAmC9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAkCA;EA6KR,UAAU,WAAW;;;;UClmBN;EACf;EACA;IACE;IACA;IACA;;;;;UCQa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCJe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;EAaR,cAAc;;qBAWH;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EA2J/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC7UO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;qBCwYE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;mBAqBA;mBAOA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EA+IR,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA8VJ;UA2EA;UAiIA;UA8LA;EA+GR,iBACJ,sBACA,qBACC,QAAQ;UAiDG;UAoRA;UAgHA;UA+CN;UAyCM;UA2CA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCr0HJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;qBAsNW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;UAqBA;EAiCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA+DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA4BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EA8BhB,iCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAkPI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UCltBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UC2ME;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;EAkBA;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCntBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UC7Fe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;qBAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA+BhD,SACJ,mBACA,iBACC;IACD,OAAO;IACP;IACA;IAaA;;EAkHI,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EAsFtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAwChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EA8D9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UA8DA;UA+DM;UA4EA;UAwBA;UAQA;UA6FN;;;;UC9gDO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCpGH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;qBAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;IAMX;;EA4IE,YAAY,MAAM,WAAW;EA6B7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UClUK;EAEf;EASA;;qBA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;qBCh5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EA6CjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KChZA,YAAY,SAAS;UAQT;EAMf;;qBASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EAkJ9C,mBAAmB,OAAO;UAuDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UA2BA;UASA;UAwBA;UAwBA;;;;KC1dE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;qBAoDQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAgaf;UAmKA;iBA+IO;iBAuBA;iBAoBA;UA2ED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;qBC/wClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC31BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UA8EA;UA0CN;UAyBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCxlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;qBAiSW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAcA;UAUA;UAaA;UAUA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAkEnE;UAuJA;UA2EA;UAiDA;UAiBA;UAyGA;iBA6GO;UA6PP;UAuFA;UA4EA;UA8BA;UAYM;UAmEN;UAsBA;UAUA;UA0IA;UAiDA;UAmCA;UAwBA;UA2BA;UAkCM;UAwGA;UA0GN;UAiDA;UA2IM;UA+hCA;UAqpBA;UA8FA;UA4DA;UAgCA;UA+BA;UA4CN;UAoCM;UA4CA;UAoVN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAgMA;UAiqEN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UAgFA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/failed-stages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAYA;;UAsBe;EAUf;EAMA;EAQA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EA6DA;EAiEA;;UA0Ce;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Te;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC3lCU,uBAAuB;KA8zOvB,gBAAgB;;;UCj2OX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UAmDC,sBAAsB;EAmBrC;EAmCA;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EAkBA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCnxC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;qBCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;wBAerB,aAAa;wBAUb,UAAU,QAAQ;;;qBCzWrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;qBAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;qBAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;qBA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;qBAgTC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;qBAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;wBA0avB,YAAY,iBAAiB,SAAS;wBAOtC,YAAY;UAkIX;EACf;EACA;;wBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCp+BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;qBAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA6DR;MA4BA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;wBAwCc,cAAc,SAAS,kBAAkB;wBAkCzC,cAAc,SAAS;wBAOvB;;;UC5tBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;wBAgEoB,oBACpB,oBACA,OAAM,6BACL;wBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KC7GF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UClCe;EAgCf;EAcA;;;;UC3Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAwBA;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;UASI;EAEf,QAAQ;EAMR,cAAc;;qBAwDH;UACH;EAKR,aAAa,sBAAsB;EA2BnC,aACE,qBACA,UAAU,kBACV,uBACC;EAYH,aACE,qBACA,UAAU,kBAOV,uBACC;UASK;EAkIR,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAmC9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAkCA;EA6KR,UAAU,WAAW;;;;UClmBN;EACf;EACA;IACE;IACA;IACA;;;;;UCQa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCHe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;EAaR,cAAc;;qBAWH;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EA+J/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KClVO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;qBCyYE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;mBAqBA;mBAOA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EA+IR,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA8VJ;UA2EA;UAiIA;UA8LA;EA+GR,iBACJ,sBACA,qBACC,QAAQ;UAiDG;UAoRA;UAgHA;UA+CN;UAyCM;UA2CA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EA0JL,OAAO,OAAO,sBAAsB,QAAQ;UAgJpC;;;;KCp1HJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;qBAsNW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;UAqBA;EAiCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA+DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA4BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EA8BhB,iCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAkPI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UCltBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UC2ME;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;EAkBA;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCntBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UC7Fe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;qBAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA+BhD,SACJ,mBACA,iBACC;IACD,OAAO;IACP;IACA;IAaA;;EAkHI,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EAsFtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAwChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EA8D9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UA8DA;UA+DM;UA4EA;UAwBA;UAQA;UA6FN;;;;UC9gDO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCpGH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;qBAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;IAMX;;EA4IE,YAAY,MAAM,WAAW;EA6B7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UClUK;EAEf;EASA;;qBA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;qBCh5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EA6CjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KChZA,YAAY,SAAS;UAQT;EAMf;;qBASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EAkJ9C,mBAAmB,OAAO;UAuDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UA2BA;UASA;UAwBA;UAwBA;;;;KC1dE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;qBAoDQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAgaf;UAmKA;iBA+IO;iBAuBA;iBAoBA;UA2ED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;qBC/wClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC31BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UA8EA;UA0CN;UAyBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCxlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;qBAiSW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAcA;UAUA;UAaA;UAUA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAkEnE;UAuJA;UA2EA;UAiDA;UAiBA;UAyGA;iBA6GO;UA6PP;UAuFA;UA4EA;UA8BA;UAYM;UAmEN;UAsBA;UAUA;UA0IA;UAiDA;UAmCA;UAwBA;UA2BA;UAkCM;UAwGA;UA0GN;UAiDA;UA2IM;UA+hCA;UAqpBA;UA8FA;UA4DA;UAgCA;UA+BA;UA4CN;UAoCM;UA4CA;UAoVN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAgMA;UAiqEN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UAgFA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Fa as clearBucketRegionCache, Ha as AssetError, Hr as LockManager, Ia as resolveBucketRegion, Ka as DependencyError, Ki as Synthesizer, La as AwsClients, Qa as LockError, Ra as getAwsClients, Sa as AssemblyReader, Ua as CdkdError, Ur as S3StateBackend, Va as setAwsClients, Wa as ConfigError, _n as DiffCalculator, br as DagBuilder, ci as AssetPublisher, co as SynthesisError, ct as IAMRoleProvider, do as normalizeAwsError, dt as ProviderRegistry, lo as formatError, no as ProvisioningError, r as DeployEngine, so as StateError, uo as isCdkdError, xr as TemplateParser, xt as CloudControlProvider, za as resetAwsClients } from "./deploy-engine-DGV6XNWO.js";
+import { $a as ConfigError, Er as TemplateParser, Ga as resolveBucketRegion, Ja as resetAwsClients, Jr as S3StateBackend, Ka as AwsClients, Qa as CdkdError, Qi as Synthesizer, Tr as DagBuilder, Wa as clearBucketRegionCache, Xa as setAwsClients, Za as AssetError, _o as SynthesisError, bo as normalizeAwsError, ct as IAMRoleProvider, do as ProvisioningError, dt as ProviderRegistry, go as StateError, ja as AssemblyReader, mi as AssetPublisher, qa as getAwsClients, qr as LockManager, r as DeployEngine, so as LockError, to as DependencyError, vo as formatError, vt as CloudControlProvider, xn as DiffCalculator, yo as isCdkdError } from "./deploy-engine-Czuf7jgT.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Bt0RGDfb.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-BKAJWkPf.js → program-CQ_Y14q1.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as MalformedProducerRecordRefusalError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as requireConfigArray, A as createPreDeleteFinalSnapshot, Aa as ownValue, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as IntrinsicFunctionResolver, B as isStatefulRecreateTargetSync, Ba as runWithStackAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as refStateLookupFromResource, C as namesAnyDeclaredParameter, Ca as failedStageNote, Ci as validateAssetBucketName, Cn as displayLogicalId, Co as safeStringify, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as ccProtectionRegistryTypes, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasOwnKey, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as isWaitAbandonedError, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as defineOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as deleteSkipReason, F as extractDeploymentEventError, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as getAccountInfo, G as toCfnInteger, Ga as CrossAccountSecretRefusalError, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as assertRegionMatch, H as WARM_THROUGHPUT_MEMBERS, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as WAFv2WebACLProvider, I as makeSiblingClaimReader, Ia as resolveBucketRegion, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as isImpossibleEmptyStoredAttribute, J as bold, Ja as DynamicReferenceRegionAmbiguousError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as configBooleanRefusal, K as toFiniteNumber, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as coerceCfnBoolean, L as planOrphanAdoption, La as AwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as isNamelessDynamicReferenceError, M as refusesFinalSnapshot, Ma as displayAssemblyPath, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as carriesFetchableDynamicReference, N as unsupportedFinalSnapshotError, Na as renderAssemblyPathEscape, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as cfnRefValueFromPhysicalId, O as buildFinalSnapshotIdentifier, Oa as hasPlainPrototype, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as disableInstanceApiTermination, P as makeCanonicalizePropertiesFn, Pa as resolveAssemblyPath, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as coerceParameterTypedValue, Q as red, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as replayWarn, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as getAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isUnboundTemplateParameter, S as computeParameterTaint, Sa as AssemblyReader, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as describeAwsFailure, Sr as STATE_SOURCED_BASELINE_RULES, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as processStackMessages, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as CdkdError, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as normalizeAwsTagsToCfn, V as renderStatefulReason, Va as setAwsClients, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as isSettledInstanceState, W as isWarmThroughputDecrease, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as resolveExplicitPhysicalId, X as gray, Xa as LocalInvokeBuildError$1, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configStringRefusal, Y as cyan, Ya as IntrinsicResolutionRefusalError, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as configIntegerRefusal, Z as green, Za as LocalStartServiceError, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as readConfigString, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isThrottlingError, _r as findSilentDropProperties, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackHasActiveImportsError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as markRedactedCause, br as DagBuilder, bt as startInterruptWatch, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, co as SynthesisError, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as normalizeAwsError, dr as repairMalformedResourcesForReadOnly, dt as ProviderRegistry, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as requireConfigObject, eo as NestedStackChildDirectDestroyError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as withErrorHandling, fr as safeRegion, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isRetryableTransientError, gr as findActionableSilentDrops, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isMarkedNonRetryable, hr as unreadableOrphanRecords, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as ResourceUpdateNotSupportedError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as absoluteAssemblyPathEscape, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as carriesDynamicReference, k as ccRoutedFinalSnapshotError, ka as nullPrototypeRecord, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isTerminationProtectionPropagationError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as shellQuote, mr as unpreviewableOrphanRecords, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as definedAttributes, no as ProvisioningError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, oo as StackTerminationProtectionError, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as pasteableCommand, pr as safeStackName, pt as createMaskedRetryLogger, q as formatResourceLine, qa as DeployCancelledError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as coerceCfnInteger, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as stringifyIfAssigned, ro as ResourceTimeoutError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigString, to as PartialFailureError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as isTransientServerError, vr as describeTypeWithThrottleRetry, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as globMatches, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as ambientClientDefaults, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as retryClassificationText, xr as TemplateParser, xt as CloudControlProvider, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markNonRetryable, yr as withRetry, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as resetAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as parameterTypeMayLoseSecretIdentity } from "./deploy-engine-DGV6XNWO.js";
+import { $ as yellow, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as retryClassificationText, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as shellQuote, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isTransientServerError, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as isThrottlingError, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Ga as resolveBucketRegion, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as renderAssemblyPathEscape, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as resetAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as AwsClients, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as safeStringify, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as markNonRetryable, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qa as CdkdError, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as pasteableCommand, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as isRetryableTransientError, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as resolveAssemblyPath, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as displayAssemblyPath, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as setAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as runWithStackAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _o as SynthesisError, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as LocalInvokeBuildError$1, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, bo as normalizeAwsError, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, co as MalformedProducerRecordRefusalError, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as ProvisioningError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, eo as CrossAccountSecretRefusalError, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ResourceTimeoutError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackTerminationProtectionError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as IntrinsicResolutionRefusalError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as describeAwsFailure, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as markRedactedCause, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as NestedStackChildDirectDestroyError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as StackHasActiveImportsError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, no as DeployCancelledError, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalStartServiceError, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceUpdateNotSupportedError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as getAwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DynamicReferenceRegionAmbiguousError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as PartialFailureError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as isMarkedNonRetryable, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as withErrorHandling, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-Czuf7jgT.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-BuD41yiK.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B5acrjOr.js";
+import { t as getCdkdVersion } from "./version-BI33Emlj.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CXNAEgyw.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -16192,210 +16192,6 @@ var LambdaLayerVersionProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/composite-id.ts
-/**
-* Refuse a composite physicalId whose segments would make it ambiguous
-* (issue [#1672](https://github.com/go-to-k/cdkd/issues/1672)).
-*
-* ## Why a composite id exists at all
-*
-* `ResourceProvider` passes a SINGLE `physicalId: string` as a resource's
-* identity, while CloudFormation keeps the physical id and its containing
-* scope as separate values. So every provider whose type needs more than one
-* value to address the resource PACKS them into one string joined by
-* {@link COMPOSITE_ID_SEPARATOR} — `<databaseName>|<tableName>` for
-* `AWS::Glue::Table`, `<apiId>|<typeName>|<fieldName>` for
-* `AWS::AppSync::Resolver`, and so on.
-*
-* ## Why it has to be guarded
-*
-* The separator is NOT escaped, so a segment that itself contains a `|`
-* produces an id with the wrong arity. Every decode site splits the stored id
-* back apart and the extra segment shifts everything — for a Glue table named
-* `a|b` in database `mydb` the recorded id `mydb|a|b` decodes to database
-* `mydb`, table `a`. Both halves are non-empty, so every existing
-* "is this id well-formed?" guard passes and the deploy SUCCEEDS. What breaks
-* is everything afterwards: `cdkd destroy` deletes the WRONG resource if one
-* exists under the decoded pair (or warn-and-skips, reporting success while
-* the real resource stays alive and billing), and `cdkd drift` reads back
-* `undefined` forever.
-*
-* AWS itself accepts such a name — verified live us-east-1 2026-08-12,
-* `glue:CreateTable` with `TableInput.Name: 'a|b'` succeeds — and
-* CloudFormation manages the resource fine. The limitation is cdkd's own, so
-* the honest answer is to REFUSE at deploy time with a message that says so,
-* rather than to record an id that silently names something else. Escaping the
-* separator, or dropping the packing where the decode sites already receive
-* the properties bag, are the two real fixes and both remain open on #1672;
-* this guard is what closes the data-loss path in the meantime.
-*
-* ## Two entry points, mirroring `config-shape.ts`
-*
-* {@link packCompositeId} is the ACTION (throw, or warn-and-pack under the
-* replay downgrade) and {@link compositeIdSeparatorRefusal} is the bare
-* PREDICATE, for a caller whose response is neither — the `import()` paths
-* warn and return `null` (`skipped-not-found`), which is the idiom those
-* methods already use for every other unusable id. Both share one message
-* builder so the two can never drift.
-*
-* ## Where to place the call
-*
-* Prefer computing the id BEFORE the create call rather than after it. The
-* refusal is a pre-flight check, and a throw placed after the AWS mutation has
-* already committed would leave an orphan resource behind with no state
-* record. Only where a segment is derived from the create RESPONSE (an
-* AWS-generated id) does the call have to sit after it — and those segments
-* are structurally incapable of carrying a `|` anyway. A post-call site must
-* also sit OUTSIDE the `try` whose `catch` re-wraps as
-* `ProvisioningError('Failed to create …')`, or a refusal would be
-* mis-reported as an AWS creation failure.
-*
-* ## What this does NOT cover
-*
-* The claim is "every composite packer this change reaches", not "every `|`
-* join in the tree". One deliberate exclusion, recorded so the scope is not
-* read as wider than it is:
-*
-* - **`intrinsic-function-resolver.ts`'s `|` joins** (the WAFv2 and
-*   `AWS::Events::Rule` arms) are out of scope by KIND, not by ownership: they
-*   build a `Ref` VALUE for the template resolver, never a physicalId cdkd
-*   records and later splits. Nothing decodes them, so an ambiguous join has
-*   no decode site to go wrong at.
-*
-* ## Guarding the PACKERS is not the whole story
-*
-* A packer that refuses ambiguity does nothing about an id an EARLIER binary
-* already recorded, or one an `import` was handed — and a type whose decoder is
-* loose will mis-decode both. Issue #1711 is where that was learned:
-* `AWS::Route53::RecordSet`'s `parseRecordSetCompositeId` accepts any three
-* NON-EMPTY segments, so a record name carrying two pipes decoded to a
-* DIFFERENT hosted zone at three sites this helper never sees — an `import`
-* early accept, an identity-resolution short-circuit, and `delete`'s own parse,
-* where `cdkd destroy` then reported success over a live record. When adopting
-* this guard for a new type, audit its DECODE sites in the same change and make
-* each one cross-check the parsed segments against something it can verify them
-* with (Route 53 uses the template's own `Name` / `Type`).
-*/
-/** The character every composite physicalId in this codebase joins segments with. */
-const COMPOSITE_ID_SEPARATOR = "|";
-/** The issue tracking the real fix (escaping, or not packing at all). */
-const COMPOSITE_ID_ISSUE_URL = "https://github.com/go-to-k/cdkd/issues/1672";
-/** Render `<a>|<b>|<c>` from the segment names. */
-function idShape(segments) {
-	return segments.map((segment) => `<${segment.name}>`).join("|");
-}
-/**
-* The refusal sentence for a composite id whose segments carry the separator,
-* or `undefined` when the id is unambiguous.
-*
-* Every offending segment is named, not just the first: a template that
-* mis-names one value frequently mis-names its sibling too, and reporting them
-* one deploy at a time is the shape of remedy nobody finishes.
-*/
-function compositeIdSeparatorRefusal(resourceType, logicalId, segments, maskSecrets) {
-	const offending = segments.filter((segment) => String(segment.value).includes("|"));
-	if (offending.length === 0) return void 0;
-	const mask = maskerOrIdentity(maskSecrets);
-	return `${resourceType} ${logicalId}: ${offending.map((segment) => `${segment.name} '${mask(String(segment.value))}'`).join(" and ")} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. AWS accepts the name and CloudFormation manages such a resource fine; this is a cdkd limitation tracked in ${COMPOSITE_ID_ISSUE_URL}. Rename the resource so no segment contains '${"|"}', or manage it outside cdkd.`;
-}
-/**
-* Join the segments into a composite physicalId, REFUSING one that would be
-* ambiguous.
-*
-* @throws ProvisioningError when a segment contains {@link COMPOSITE_ID_SEPARATOR},
-*   unless `options.onRefusal` is supplied — under which the message is handed
-*   to the callback and the ambiguous id is returned, keeping the pre-guard
-*   behavior.
-*/
-function packCompositeId(resourceType, logicalId, segments, options) {
-	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments, options?.maskSecrets);
-	if (refusal !== void 0) {
-		if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
-		else throw new ProvisioningError(refusal, resourceType, logicalId);
-	}
-	return segments.map((segment) => String(segment.value)).join("|");
-}
-/** Render the expected id shape, e.g. `<databaseName>|<tableName>`. */
-function formatShape(segments) {
-	return segments.map((segment) => `<${segment}>`).join("|");
-}
-/**
-* The message EVERY malformed-composite-id decode site emits (issue
-* [#1657](https://github.com/go-to-k/cdkd/issues/1657)).
-*
-* ## Why one builder
-*
-* Roughly half the decode sites stated the expected shape and half only echoed
-* the value back, and the format is documented nowhere else — so on the silent
-* half the message was the user's only possible route to the answer and it did
-* not carry it. Routing the sites that already got it right through the same
-* builder is what stops them drifting back.
-*
-* ## This is a WORDING fix, not an acceptance change
-*
-* Each caller keeps its own split-and-guard exactly as it was. The arities
-* genuinely differ (some sites accept AT LEAST N segments, some destructure the
-* first N and tolerate extras — the #1672 ambiguity, tracked separately), and
-* folding them into one predicate here would silently change which ids deploy.
-*
-* ## The `skipping` variant
-*
-* On the DELETE path the established policy is warn-and-continue, so a
-* malformed record leaves the AWS resource ALIVE. That policy is unchanged —
-* the warning says what the skip costs, because an orphan the user is never
-* told about is one they cannot go and delete.
-*
-* Since issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) the ACCOUNTING
-* around it is no longer a lie: an arm emitting this message must also return
-* `{ outcome: 'skipped', reason: COMPOSITE_ID_SKIP_REASON }` so `cdkd destroy`
-* prints a `⚠ … skipped` line instead of `✓ … deleted`, reports
-* `N deleted, 1 skipped`, KEEPS the state record, and exits non-zero. The
-* wording here changed accordingly — it used to promise unconditionally that
-* cdkd "will report this delete as successful", which is no longer true on
-* either path. Issue [#1762](https://github.com/go-to-k/cdkd/issues/1762) then
-* taught the deploy engine to consume the outcome too, so the message no longer
-* warns that deploy drops the record: the template-removal DELETE keeps it,
-* exactly like destroy. What it DOES still distinguish is the replacement /
-* rollback delete, which fails the resource and can leave the old one
-* untracked — there "drop the record with 'cdkd state orphan'" is not the
-* remedy, deleting the resource by hand is.
-*/
-function compositeIdFormatMessage(format, logicalId, physicalId, options) {
-	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
-	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
-	if (!options?.skipping) return head;
-	return `${head}. Skipping the delete — no AWS call is issued, so the resource is LEFT IN PLACE. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy (which re-attempts it on the next deploy). So repair the id in state.json and re-run, or delete the resource by hand and drop the record with 'cdkd state orphan'. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so delete it by hand.`;
-}
-/**
-* The short `ResourceDeleteResult.reason` every malformed-composite-id DELETE
-* skip reports (issue [#1752](https://github.com/go-to-k/cdkd/issues/1752)).
-*
-* Deliberately short and IDENTICAL across the five arms: it is rendered inline
-* on the per-resource status line (`⚠ MyTable (AWS::Glue::Table) skipped
-* (malformed physicalId in state — no delete issued)`), where the full
-* remediation sentence built by {@link compositeIdFormatMessage} would not fit.
-* The full text is still emitted, as the `logger.warn` right beside it.
-*
-* A shared constant rather than five literals so the five arms cannot drift and
-* a grep for the wording finds all of them.
-*/
-const COMPOSITE_ID_SKIP_REASON = "malformed physicalId in state — no delete issued";
-/**
-* The `ResourceDeleteResult` a malformed-composite-id DELETE arm returns.
-*
-* Pairs with the `{ skipping: true }` warning: emit the warning, return this.
-* Providers call it as `return compositeIdSkipResult();` so the arm reads as
-* the deliberate skip it is rather than as the bare `return;` that made issue
-* #1752's mis-accounting possible.
-*/
-function compositeIdSkipResult() {
-	return {
-		outcome: "skipped",
-		reason: COMPOSITE_ID_SKIP_REASON
-	};
-}
-
 //#endregion
 //#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
 /**
@@ -84163,6 +83959,53 @@ function safeRoleArn(value) {
 	return displayIdent(value, { maxCodePoints: 613 });
 }
 /**
+* Refuse a rollback over a record whose body `region` disagreed with the key it
+* was read from, while it still lists resources (go-to-k/cdkd#3370) — the
+* rollback half of `refuseDivergentRecordRegionForDestroy` (go-to-k/cdkd#3328).
+*
+* The replay acts in the KEY's region (`RollbackExecutorContext.region`) and
+* reads a `*NotFound` delete as "already gone", exactly as the destroy does: if
+* the record's own region is the honest half, a rolled-back CREATE's delete
+* comes back not-found, the replay drops the row and saves, and the resource is
+* left live in the other region with nothing naming it.
+*
+* ONE refusal for the whole command rather than one per replay arm, because the
+* trigger already partitions the arms exactly. Every arm that calls AWS — the
+* CREATE delete, the in-place `revert`, BOTH reverse-replacement arms (whose
+* re-CREATE writes as well as deletes), and `--revert-failed`'s delete and
+* forced update — requires a CURRENT state row for the op's logical id
+* (`classifyRollbackOp` / `classifyFailedOp`); a completed DELETE is
+* `unrecoverable-delete` and calls nothing. So a record listing no resources can
+* replay nothing against AWS, and is let through for the reason the destroy
+* gives: it is the recovery path, not the hazard. A record listing any can
+* reach every arm, so every arm is refused.
+*
+* Its own message rather than the destroy's builder, whose opening, consequence
+* and remedy all speak about a DESTROY. This one offers no command at all — the
+* remedy is a repair — so it needs none of that builder's exact-rendering gate,
+* and it names the stack the way every other message in this file does. The
+* body's value is withheld and its KIND printed, the rule `getState`'s warn
+* takes: a region a record supplies is the misdirection channel.
+*/
+function refuseDivergentRecordRegionForRollback(state, stackName, keyRegion, divergentBodyRegion) {
+	if (divergentBodyRegion === void 0) return;
+	const resourceCount = isReadableBag(state.resources) ? Object.keys(state.resources).length : void 0;
+	if (resourceCount === 0) return;
+	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
+	throw markNonRetryable(new CdkdError(`cdkd will not roll back '${safeStack(stackName)}' (${safe(keyRegion)}): the state record read from that region's key carries a 'region' of its own (${describeRegionValueKind(divergentBodyRegion)}) that is not the key's, and ${lists} — so cdkd cannot tell which region they are in. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. The replay would issue every delete and revert against the key's region; if the record's own region is the honest half, each delete comes back not-found, which the replay reads as ALREADY DELETED — it would report the resource rolled back, drop it from the record, and leave it standing in the other region. Nothing was changed. Re-run with --verbose to see what the record's region field holds, repair that field to match the key it is stored under, and run the rollback again.`, STATE_REGION_DIVERGED));
+}
+/**
+* Why the retry SAVE declined to write over a record that was rewritten mid-run
+* with a divergent body region (go-to-k/cdkd#3370) — rendered in that save's
+* warn and again in the run's partial-failure exit. Names no stack — both are
+* about the current run's stack already — and
+* prints the value's KIND only, for the reason
+* {@link refuseDivergentRecordRegionForRollback} gives.
+*/
+function divergedDuringRollbackMessage(divergentBodyRegion) {
+	return `the state record was rewritten during this rollback, and the rewrite carries a 'region' of its own (${describeRegionValueKind(divergentBodyRegion)}) that is not the region of its key, so cdkd did not write over it`;
+}
+/**
 * Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
 * is threaded in because the classifier is pure (it cannot see CLI flags) and
 * the Snapshot label would otherwise promise a final snapshot the run is about
@@ -84272,6 +84115,8 @@ async function rollbackCommand(stackArg, options) {
 		registerAllProviders(providerRegistry);
 		providerRegistry.setCustomResourceResponseBucket(setup.bucket);
 		let interrupted = false;
+		let declinedDivergentRewrite = false;
+		let declinedDivergentReason = "";
 		const sigintHandler = () => {
 			process.stderr.write("\nInterrupted — stopping rollback after the current operation...\n");
 			interrupted = true;
@@ -84294,6 +84139,7 @@ async function rollbackCommand(stackArg, options) {
 			refuseMalformedState(baseState, stackName, region);
 			refuseMalformedOrphans(baseState, stackName, region);
 			refuseMalformedOrphanRecords(baseState, stackName, region);
+			refuseDivergentRecordRegionForRollback(baseState, stackName, region, stateData.divergentBodyRegion);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -84339,6 +84185,7 @@ async function rollbackCommand(stackArg, options) {
 			};
 			let currentEtag = stateData.etag;
 			const saveState = async () => {
+				if (declinedDivergentRewrite) return;
 				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 				const next = () => ({
 					...carriedState,
@@ -84353,8 +84200,17 @@ async function rollbackCommand(stackArg, options) {
 				} catch {
 					try {
 						const fresh = await setup.stateBackend.getState(stackName, region);
+						if (fresh?.divergentBodyRegion !== void 0) {
+							declinedDivergentRewrite = true;
+							declinedDivergentReason = divergedDuringRollbackMessage(fresh.divergentBodyRegion);
+							throw new Error(declinedDivergentReason);
+						}
 						currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
 					} catch (retryError) {
+						if (declinedDivergentRewrite) {
+							logger.warn(`Did not persist state after a rollback operation: ${declinedDivergentReason}. The resource was reverted in AWS. Repair the record's region field to match the key it is stored under, then run the rollback again to reconcile state.`);
+							return;
+						}
 						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run the rollback to reconcile state.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
 							value: stackName,
 							hole: "stack"
@@ -84396,7 +84252,7 @@ async function rollbackCommand(stackArg, options) {
 							failedOpFailures = failedResult.failures;
 							failedOpWarnings = failedResult.warnings;
 							const remaining = failedResult.remainingFailedOps;
-							if (remaining.length !== segment.failedOperations.length) try {
+							if (!declinedDivergentRewrite && remaining.length !== segment.failedOperations.length) try {
 								await setup.stateBackend.setRollbackJournalFailedOperations(stackName, region, remaining);
 								if (remaining.length === 0) delete segment.failedOperations;
 								else segment.failedOperations = remaining;
@@ -84423,6 +84279,7 @@ async function rollbackCommand(stackArg, options) {
 					}));
 					totalFailures += result.failures;
 					totalWarnings += result.warnings;
+					if (declinedDivergentRewrite) break;
 					if (result.interrupted) {
 						interrupted = true;
 						break;
@@ -84432,13 +84289,14 @@ async function rollbackCommand(stackArg, options) {
 					journal.segments.pop();
 				}
 			} finally {
-				await eventRecorder.finalize(totalFailures > 0 || interrupted ? "FAILED" : "SUCCEEDED");
+				await eventRecorder.finalize(totalFailures > 0 || interrupted || declinedDivergentRewrite ? "FAILED" : "SUCCEEDED");
 			}
 			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
 			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
 				await setup.stateBackend.deleteState(stackName, region);
 				logger.info(`State for '${safeStack(stackName)}' (${safe(region)}) removed (stack fully rolled back).`);
 			}
+			if (declinedDivergentRewrite) throw new PartialFailureError(`Rollback stopped: ${declinedDivergentReason}.` + (totalFailures > 0 ? ` ${totalFailures} operation(s) also failed.` : "") + " Journal preserved (this segment, any older ones, and their failed operations) — re-run the rollback once the record's region field matches its key.");
 			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run the rollback to finish.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
 				value: stackName,
 				hole: "stack"
@@ -91935,16 +91793,21 @@ function parseEcrUri(imageUri) {
 	};
 }
 /**
-* Module-level cache for STS-issued AssumeRole credentials, keyed by
-* `(ecrRoleArn, callerRegion)`. Closes the reviewer's MAJOR finding: ECS
+* Module-level cache for STS-issued AssumeRole credentials, per SOURCE credential
+* identity and then per `(ecrRoleArn, callerRegion)`. Closes the reviewer's MAJOR finding: ECS
 * run-task with N containers under one `--ecr-role-arn` would otherwise issue
 * N× `AssumeRole` and N× `GetCallerIdentity` for identical credentials valid
 * for 3600s. The cache keeps a 5-minute safety margin against the recorded
 * `Expiration` so STS-side / local-clock skew never lets a stale entry through.
 *
-* Cache key is intentionally `(roleArn, region)` rather than full caller
-* identity — STS issues per-region session creds, and a switch of `--region`
-* between two `local invoke` calls in the same process must re-issue.
+* The inner key is `(roleArn, region)`: STS issues per-region session creds,
+* so a switch of `--region` between two `local invoke` calls in the same
+* process must re-issue. The OUTER key is the source identity (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588), as in `role-arn.ts`),
+* so a library caller that installs `AwsClients` with other explicit
+* credentials is never handed credentials the first identity obtained. It is
+* {@link credentialFingerprint} — profile plus access key id, never a secret —
+* and neither key is ever rendered.
 *
 * NOT cleared on process exit — Node's module scope evaporates with the
 * process, and no inter-process sharing is desired (each `cdkd local invoke`
@@ -91952,12 +91815,15 @@ function parseEcrUri(imageUri) {
 */
 const ASSUMED_ROLE_CACHE = /* @__PURE__ */ new Map();
 /**
-* Module-level cache for `STS:GetCallerIdentity`. The result is identity-only
-* (`Account`) and invariant for the lifetime of the process under one set of
-* default credentials. Keyed by `callerRegion` to avoid a cross-region leak
-* when the caller flips `AWS_REGION` mid-process (STS is global but the SDK
-* uses regional endpoints; the result is invariant in practice, but we key
-* on region for safety).
+* Module-level cache for `STS:GetCallerIdentity`, keyed by
+* `(credential identity, callerRegion)`. The account is a function of the
+* identity that asked, so the identity is part of the key (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)): a library caller that
+* installs `AwsClients` with other explicit credentials must not be told the
+* first identity's account. The region half avoids a cross-region leak when the
+* caller flips `AWS_REGION` mid-process (STS is global but the SDK uses
+* regional endpoints; the result is invariant in practice, but we key on region
+* for safety). Never rendered.
 */
 const CALLER_IDENTITY_CACHE = /* @__PURE__ */ new Map();
 /** 5-minute safety margin against the recorded STS expiration timestamp. */
@@ -91988,11 +91854,13 @@ async function pullEcrImage(imageUri, options) {
 		await verifyImageInLocalCache(canonicalUri);
 		return canonicalUri;
 	}
-	const callerIdentityKey = callerRegion ?? "_unset";
+	const credentialConfig = ambientCredentialConfig();
+	const identityFingerprint = credentialFingerprint(credentialConfig);
+	const callerIdentityKey = injectiveKey(identityFingerprint, callerRegion ?? "_unset");
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
 	if (callerAccount === void 0) {
 		const sts = new STSClient({
-			...awsClientDefaults(),
+			...clientDefaultsFor(credentialConfig),
 			...callerRegion && { region: callerRegion }
 		});
 		try {
@@ -92009,19 +91877,24 @@ async function pullEcrImage(imageUri, options) {
 	let assumed;
 	if (options.ecrRoleArn) {
 		const cacheKey = `${options.ecrRoleArn}|${callerRegion ?? "_unset"}`;
-		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
+		let roleCache = ASSUMED_ROLE_CACHE.get(identityFingerprint);
+		if (roleCache === void 0) {
+			roleCache = /* @__PURE__ */ new Map();
+			ASSUMED_ROLE_CACHE.set(identityFingerprint, roleCache);
+		}
+		const cached = roleCache.get(cacheKey);
 		if (cached && isCredentialFresh(cached)) {
 			assumed = cached;
 			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 613 })}`);
 		} else {
-			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, logger);
-			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
+			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, credentialConfig, logger);
+			roleCache.set(cacheKey, assumed);
 			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 613 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
 		}
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
 	const ecr = new ECRClient({
-		...awsClientDefaults(),
+		...clientDefaultsFor(credentialConfig),
 		region: parsed.region,
 		...assumed && { credentials: assumed }
 	});
@@ -92044,16 +91917,17 @@ async function pullEcrImage(imageUri, options) {
 	return canonicalUri;
 }
 /**
-* Assume the supplied role via the SDK default credential chain and
+* Assume the supplied role as the caller's active credential configuration
+* (`credentialConfig`, the same reading `pullEcrImage` keys its caches on) and
 * return the resulting temporary credentials. The STS client is built
 * with the caller's profile region (or unset) — STS is a global
 * service so the region is informational, but threading it through
 * mirrors the convention used by `src/utils/role-arn.ts`.
 */
-async function assumeRoleForEcr(roleArn, callerRegion, logger) {
+async function assumeRoleForEcr(roleArn, callerRegion, credentialConfig, logger) {
 	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 613 })} for ECR pull...`);
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...clientDefaultsFor(credentialConfig),
 		...callerRegion && { region: callerRegion }
 	});
 	try {
@@ -99166,4 +99040,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BKAJWkPf.js.map
+//# sourceMappingURL=program-CQ_Y14q1.js.map