@go-to-k/cdkd 0.291.23 → 0.291.24

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $a as DependencyError, Ga as getAwsClients, Ha as clearBucketRegionCache, Ja as setAwsClients, Ka as resetAwsClients, Kr as LockManager, Tr as TemplateParser, Ua as resolveBucketRegion, Wa as AwsClients, Xa as CdkdError, Xi as Synthesizer, Ya as AssetError, Za as ConfigError, _o as isCdkdError, ao as LockError, ct as IAMRoleProvider, dt as ProviderRegistry, fi as AssetPublisher, go as formatError, ho as SynthesisError, ka as AssemblyReader, lo as ProvisioningError, mo as StateError, qr as S3StateBackend, r as DeployEngine, vo as normalizeAwsError, vt as CloudControlProvider, wr as DagBuilder, xn as DiffCalculator } from "./deploy-engine-CCvNP_dA.js";
+import { $a as ConfigError, Er as TemplateParser, Ga as resolveBucketRegion, Ja as resetAwsClients, Jr as S3StateBackend, Ka as AwsClients, Qa as CdkdError, Qi as Synthesizer, Tr as DagBuilder, Wa as clearBucketRegionCache, Xa as setAwsClients, Za as AssetError, _o as SynthesisError, bo as normalizeAwsError, ct as IAMRoleProvider, do as ProvisioningError, dt as ProviderRegistry, go as StateError, ja as AssemblyReader, mi as AssetPublisher, qa as getAwsClients, qr as LockManager, r as DeployEngine, so as LockError, to as DependencyError, vo as formatError, vt as CloudControlProvider, xn as DiffCalculator, yo as isCdkdError } from "./deploy-engine-Czuf7jgT.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Bt0RGDfb.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-nxeZp1Qs.js → program-CQ_Y14q1.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as getLegacyStateBucketName, $n as refuseMalformedOrphans, $r as formatLockExpiry, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as failedStageNote, Ai as buildDockerImage, An as hasReadableResources, Ao as safeStringify, Ar as carriesSecretMask, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as renderAssemblyPathEscape, Bi as isMalformedEnvKey, Bn as malformedOrphansWarning, Br as pathCrossesDottedKey, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as canonicalizeRegion, Ci as getBootstrapMarkerKey, Cn as STATE_RESOURCES_MALFORMED, Co as isRetryableTransientError, Cr as withRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as clientDefaultsFor, Di as validateAssetBucketName, Dn as displayLogicalId, Do as markRedactedCause, Dr as STATE_SOURCED_CROSS_GENERATION_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as ambientCredentialConfig, Ei as readBootstrapMarkerBody, En as deployRefusesOrphanRowsReason, Eo as markNonRetryable, Er as STATE_SOURCED_BASELINE_RULES, Et as maskDeep, F as extractDeploymentEventError, Fa as hasPlainPrototype, Fi as dockerSpawnEnvWithSensitive, Fn as malformedLocalOutputsWarning, Fr as isSingleDynamicReferenceToken, Ft as carriesDynamicReference, G as toCfnInteger, Ga as getAwsClients, Gi as warnFinchArgvExposure, Gn as malformedResourcePropertiesWarning, Gr as scrubResourceRecord, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Hi as redactDockerArgvValues, Hn as malformedOutputsWarning, Hr as recordMaskOnlyValuesIn, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as nullPrototypeRecord, Ii as finchSecretArgvRefusal, In as malformedOrphanRecordsRefusalMessage, Ir as isUncertifiedBaselineMaskPosition, It as carriesFetchableDynamicReference, J as bold, Ja as setAwsClients, Ji as AssetManifestLoader, Jn as previewableOrphanRecords, Jr as rebuildClientForBucketRegion, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as resetAwsClients, Ki as escapeRegExp, Kn as malformedResourcesWarning, Kr as LockManager, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as ownValue, Li as formatDockerLoginError, Ln as malformedOrphanRecordsWarning, Lr as markSameGenerationBag, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as processStackMessages, Mi as describeDockerCapturedOutput, Mn as isReadableResourceEntry, Mr as dynamicReferenceTokens, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as defineOwnKey, Ni as describeDockerExecFailure, Nn as malformedExportNamesWarning, Nr as errorCauseChain, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as credentialFingerprint, Oi as validateContainerRepoName, On as hasReadableOrphans, Oo as retryClassificationText, Or as STATE_SOURCED_READBACK_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as hasOwnKey, Pi as describeDockerFailure, Pn as malformedExportSourceWarning, Pr as identityKeyFor, Pt as IntrinsicFunctionResolver, Q as red, Qa as CrossAccountSecretRefusalError, Qi as getDefaultStateBucketName, Qn as refuseMalformedOrphanRecordsForDestroy, Qr as forceQuitRecoveryClause, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as absoluteAssemblyPathEscape, Ri as getDockerCmd, Rn as malformedOrphanRowsKeptWarning, Rr as maskSecretsInError, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as PARTITION_TABLE, Si as ensureAssetStorage, Sn as INTRINSIC_KEYS, So as isMarkedNonRetryable, Sr as describeTypeWithThrottleRetry, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as ambientClientDefaults, Ti as parseBootstrapMarker, Tn as UNREADABLE_RESOURCES_MAP_ROW, To as isTransientServerError, Tr as TemplateParser, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as resolveBucketRegion, Ui as runDockerForeground, Un as malformedRenderedContainersWarning, Ur as recoverMaskedOutput, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as resolveAssemblyPath, Vi as partitionSensitiveEnv, Vn as malformedOutputsRefusalMessage, Vr as recordMaskOnlyValue, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wa as AwsClients, Wi as runDockerStreaming, Wn as malformedResourceEntriesWarning, Wr as redactSecretsForState, Wt as refStateLookupFromResource, X as gray, Xa as CdkdError, Xi as Synthesizer, Xn as refuseMalformedNestedChildOutputs, Xr as buildForceUnlockCommand, Xt as coerceCfnBoolean, Y as cyan, Yi as getDockerImageBySourceHash, Yn as refuseDivergentRecordRegionForDestroy, Yr as UNREPRODUCIBLE_LOCK_CLAUSE, Yt as assertRegionMatch, Z as green, Zi as synthesisStatusMessage, Zn as refuseMalformedOrphanRecords, Zr as buildLockContentionMessage, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as injectiveKeyPrefix, _i as loadPublishableAssetManifest, _n as AWS_CREDENTIAL_ENV_KEYS, _r as safeStackName, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveStateBucketWithDefaultAndSource, ai as hasUnverifiableParameterRefusal, an as requireConfigString, ar as refuseMalformedResourceEntries, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as decodeListingKey, bi as BOOTSTRAP_MARKER_PREFIX, bn as envCredentialsAreAssumedRole, bo as pasteableCommand, br as findActionableSilentDrops, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as warnDeprecatedNoPrefixCliFlag, ci as isReadableBag, cn as classifyReplaySecretRegion, co as PartialFailureError, cr as refuseMalformedResourcesForDestroy, ct as IAMRoleProvider, d as updatePartialMessage, da as CFN_TEMPLATE_URL_LIMIT, di as shouldRetainResource, dn as s3BucketArn, do as ResourceUpdateNotSupportedError, dr as repairMalformedOrphansForReadOnly, dt as ProviderRegistry, ea as resolveApp, ei as CUSTOM_RESOURCE_RESPONSE_PREFIX, en as configStringRefusal, eo as DeployCancelledError, er as refuseMalformedOrphansForDestroy, et as collectDeclaredOutputNames, f as updatePartialReason, fa as MIGRATE_TMP_PREFIX, fi as AssetPublisher, fn as s3BucketDomainName, fo as StackHasActiveImportsError, fr as repairMalformedOutputsForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as injectiveKey, gi as createAssetRedirectResolver, gn as applyRoleArnIfSet, gr as safeRegion, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, hi as buildAssetRedirectMap, hn as s3BucketWebsiteUrl, ho as SynthesisError, hr as repairMalformedResourcesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveStateBucketWithDefault, ii as hasReasonlessBaselineRefusal, in as requireConfigObject, io as LocalStartServiceError, ir as refuseMalformedResourceAttributesForOrphan, it as secretBearing, j as isFinalSnapshotError, ja as globMatches, ji as resolveDockerContextDirectory, jn as isReadableOrphanRecord, jr as createSecretMasker, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as AssemblyReader, ki as buildDenyExternalAccessPolicy, kn as hasReadableOutputs, ko as describeAwsFailure, kr as TEMPLATE_SOURCED_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as ssmResolvedValueType, li as orphansAfterRollback, ln as producerRegionsFromState, lo as ProvisioningError, lr as refuseMalformedState, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as uploadCfnTemplate, mi as WorkGraph, mn as s3BucketRegionalDomainName, mr as repairMalformedResourcePropertiesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveCaptureObservedState, ni as exportNamesCarriedFrom, nn as replayWarn, no as IntrinsicResolutionRefusalError, nr as refuseMalformedOutputs, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveUseCdkBootstrapAssets, oi as importableOutputKeys, on as definedAttributes, oo as MalformedProducerRecordRefusalError, or as refuseMalformedResourceEntriesForOrphan, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as findLargeInlineResources, pi as stringifyValue, pn as s3BucketDualStackDomainName, po as StackTerminationProtectionError, pr as repairMalformedResourceEntriesForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as runWithStackAwsClients, qi as stripControlChars, qn as malformedStateRefusalMessage, qr as S3StateBackend, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveSkipPrefix, ri as hasReadableExportSet, rn as requireConfigArray, ro as LocalInvokeBuildError$1, rr as refuseMalformedOutputsForDestroy, rt as isExportAliasCollision, s as planRollback, sa as stateBucketExistenceConfirmed, si as importableOutputs, sn as stringifyIfAssigned, so as NestedStackChildDirectDestroyError, sr as refuseMalformedResourcePropertiesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveAutoAssetStorage, ti as DEFAULT_STATE_PREFIX, tn as readConfigString, to as DynamicReferenceRegionAmbiguousError, tr as refuseMalformedOrphansForOrphan, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as CFN_TEMPLATE_BODY_LIMIT, ui as orphansCarriedFrom, un as withSharedDrainBudget, uo as ResourceTimeoutError, ur as repairMalformedOrphanRecordsForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as producerCoordinateKey, vi as rewriteTemplateAssetReferences, vn as applyCallerIdentityCredentials, vo as normalizeAwsError, vr as unpreviewableOrphanRecords, vt as CloudControlProvider, w as reachableDivergentParameters, wa as derivePartitionAndUrlSuffix, wi as isCrossRegionRedirect, wn as UNREADABLE_ORPHANS_CONTAINER_ROW, wo as isThrottlingError, wr as DagBuilder, wt as packCompositeId, x as bindingSkippedOutputs, xa as expectedOwnerParam, xi as assertAssetBucketRegion, xn as DiffCalculator, xo as shellQuote, xr as findSilentDropProperties, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as producerRecordKey, yi as AssetModeResolver, yn as callerEnvCredentials, yo as withErrorHandling, yr as unreadableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as displayAssemblyPath, zi as isDockerClientEnvKey, zn as malformedOrphansRefusalMessage, zr as maskSecretsInText, zt as getAccountInfo } from "./deploy-engine-CCvNP_dA.js";
+import { $ as yellow, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as retryClassificationText, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as shellQuote, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isTransientServerError, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as isThrottlingError, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Ga as resolveBucketRegion, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as renderAssemblyPathEscape, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as resetAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as AwsClients, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as safeStringify, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as markNonRetryable, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qa as CdkdError, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as pasteableCommand, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as isRetryableTransientError, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as resolveAssemblyPath, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as displayAssemblyPath, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as setAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as runWithStackAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _o as SynthesisError, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as LocalInvokeBuildError$1, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, bo as normalizeAwsError, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, co as MalformedProducerRecordRefusalError, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as ProvisioningError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, eo as CrossAccountSecretRefusalError, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ResourceTimeoutError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackTerminationProtectionError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as IntrinsicResolutionRefusalError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as describeAwsFailure, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as markRedactedCause, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as NestedStackChildDirectDestroyError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as StackHasActiveImportsError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, no as DeployCancelledError, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalStartServiceError, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceUpdateNotSupportedError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as getAwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DynamicReferenceRegionAmbiguousError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as PartialFailureError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as isMarkedNonRetryable, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as withErrorHandling, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-Czuf7jgT.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-BLo_Pzd-.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-ChgXLoRA.js";
+import { t as getCdkdVersion } from "./version-BI33Emlj.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CXNAEgyw.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -83959,6 +83959,53 @@ function safeRoleArn(value) {
 	return displayIdent(value, { maxCodePoints: 613 });
 }
 /**
+* Refuse a rollback over a record whose body `region` disagreed with the key it
+* was read from, while it still lists resources (go-to-k/cdkd#3370) — the
+* rollback half of `refuseDivergentRecordRegionForDestroy` (go-to-k/cdkd#3328).
+*
+* The replay acts in the KEY's region (`RollbackExecutorContext.region`) and
+* reads a `*NotFound` delete as "already gone", exactly as the destroy does: if
+* the record's own region is the honest half, a rolled-back CREATE's delete
+* comes back not-found, the replay drops the row and saves, and the resource is
+* left live in the other region with nothing naming it.
+*
+* ONE refusal for the whole command rather than one per replay arm, because the
+* trigger already partitions the arms exactly. Every arm that calls AWS — the
+* CREATE delete, the in-place `revert`, BOTH reverse-replacement arms (whose
+* re-CREATE writes as well as deletes), and `--revert-failed`'s delete and
+* forced update — requires a CURRENT state row for the op's logical id
+* (`classifyRollbackOp` / `classifyFailedOp`); a completed DELETE is
+* `unrecoverable-delete` and calls nothing. So a record listing no resources can
+* replay nothing against AWS, and is let through for the reason the destroy
+* gives: it is the recovery path, not the hazard. A record listing any can
+* reach every arm, so every arm is refused.
+*
+* Its own message rather than the destroy's builder, whose opening, consequence
+* and remedy all speak about a DESTROY. This one offers no command at all — the
+* remedy is a repair — so it needs none of that builder's exact-rendering gate,
+* and it names the stack the way every other message in this file does. The
+* body's value is withheld and its KIND printed, the rule `getState`'s warn
+* takes: a region a record supplies is the misdirection channel.
+*/
+function refuseDivergentRecordRegionForRollback(state, stackName, keyRegion, divergentBodyRegion) {
+	if (divergentBodyRegion === void 0) return;
+	const resourceCount = isReadableBag(state.resources) ? Object.keys(state.resources).length : void 0;
+	if (resourceCount === 0) return;
+	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
+	throw markNonRetryable(new CdkdError(`cdkd will not roll back '${safeStack(stackName)}' (${safe(keyRegion)}): the state record read from that region's key carries a 'region' of its own (${describeRegionValueKind(divergentBodyRegion)}) that is not the key's, and ${lists} — so cdkd cannot tell which region they are in. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. The replay would issue every delete and revert against the key's region; if the record's own region is the honest half, each delete comes back not-found, which the replay reads as ALREADY DELETED — it would report the resource rolled back, drop it from the record, and leave it standing in the other region. Nothing was changed. Re-run with --verbose to see what the record's region field holds, repair that field to match the key it is stored under, and run the rollback again.`, STATE_REGION_DIVERGED));
+}
+/**
+* Why the retry SAVE declined to write over a record that was rewritten mid-run
+* with a divergent body region (go-to-k/cdkd#3370) — rendered in that save's
+* warn and again in the run's partial-failure exit. Names no stack — both are
+* about the current run's stack already — and
+* prints the value's KIND only, for the reason
+* {@link refuseDivergentRecordRegionForRollback} gives.
+*/
+function divergedDuringRollbackMessage(divergentBodyRegion) {
+	return `the state record was rewritten during this rollback, and the rewrite carries a 'region' of its own (${describeRegionValueKind(divergentBodyRegion)}) that is not the region of its key, so cdkd did not write over it`;
+}
+/**
 * Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
 * is threaded in because the classifier is pure (it cannot see CLI flags) and
 * the Snapshot label would otherwise promise a final snapshot the run is about
@@ -84068,6 +84115,8 @@ async function rollbackCommand(stackArg, options) {
 		registerAllProviders(providerRegistry);
 		providerRegistry.setCustomResourceResponseBucket(setup.bucket);
 		let interrupted = false;
+		let declinedDivergentRewrite = false;
+		let declinedDivergentReason = "";
 		const sigintHandler = () => {
 			process.stderr.write("\nInterrupted — stopping rollback after the current operation...\n");
 			interrupted = true;
@@ -84090,6 +84139,7 @@ async function rollbackCommand(stackArg, options) {
 			refuseMalformedState(baseState, stackName, region);
 			refuseMalformedOrphans(baseState, stackName, region);
 			refuseMalformedOrphanRecords(baseState, stackName, region);
+			refuseDivergentRecordRegionForRollback(baseState, stackName, region, stateData.divergentBodyRegion);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -84135,6 +84185,7 @@ async function rollbackCommand(stackArg, options) {
 			};
 			let currentEtag = stateData.etag;
 			const saveState = async () => {
+				if (declinedDivergentRewrite) return;
 				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 				const next = () => ({
 					...carriedState,
@@ -84149,8 +84200,17 @@ async function rollbackCommand(stackArg, options) {
 				} catch {
 					try {
 						const fresh = await setup.stateBackend.getState(stackName, region);
+						if (fresh?.divergentBodyRegion !== void 0) {
+							declinedDivergentRewrite = true;
+							declinedDivergentReason = divergedDuringRollbackMessage(fresh.divergentBodyRegion);
+							throw new Error(declinedDivergentReason);
+						}
 						currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
 					} catch (retryError) {
+						if (declinedDivergentRewrite) {
+							logger.warn(`Did not persist state after a rollback operation: ${declinedDivergentReason}. The resource was reverted in AWS. Repair the record's region field to match the key it is stored under, then run the rollback again to reconcile state.`);
+							return;
+						}
 						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run the rollback to reconcile state.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
 							value: stackName,
 							hole: "stack"
@@ -84192,7 +84252,7 @@ async function rollbackCommand(stackArg, options) {
 							failedOpFailures = failedResult.failures;
 							failedOpWarnings = failedResult.warnings;
 							const remaining = failedResult.remainingFailedOps;
-							if (remaining.length !== segment.failedOperations.length) try {
+							if (!declinedDivergentRewrite && remaining.length !== segment.failedOperations.length) try {
 								await setup.stateBackend.setRollbackJournalFailedOperations(stackName, region, remaining);
 								if (remaining.length === 0) delete segment.failedOperations;
 								else segment.failedOperations = remaining;
@@ -84219,6 +84279,7 @@ async function rollbackCommand(stackArg, options) {
 					}));
 					totalFailures += result.failures;
 					totalWarnings += result.warnings;
+					if (declinedDivergentRewrite) break;
 					if (result.interrupted) {
 						interrupted = true;
 						break;
@@ -84228,13 +84289,14 @@ async function rollbackCommand(stackArg, options) {
 					journal.segments.pop();
 				}
 			} finally {
-				await eventRecorder.finalize(totalFailures > 0 || interrupted ? "FAILED" : "SUCCEEDED");
+				await eventRecorder.finalize(totalFailures > 0 || interrupted || declinedDivergentRewrite ? "FAILED" : "SUCCEEDED");
 			}
 			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
 			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
 				await setup.stateBackend.deleteState(stackName, region);
 				logger.info(`State for '${safeStack(stackName)}' (${safe(region)}) removed (stack fully rolled back).`);
 			}
+			if (declinedDivergentRewrite) throw new PartialFailureError(`Rollback stopped: ${declinedDivergentReason}.` + (totalFailures > 0 ? ` ${totalFailures} operation(s) also failed.` : "") + " Journal preserved (this segment, any older ones, and their failed operations) — re-run the rollback once the record's region field matches its key.");
 			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run the rollback to finish.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
 				value: stackName,
 				hole: "stack"
@@ -98978,4 +99040,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-nxeZp1Qs.js.map
+//# sourceMappingURL=program-CQ_Y14q1.js.map