@go-to-k/cdkd 0.291.6 → 0.291.7

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ca as CdkdError, Dr as S3StateBackend, Ea as DependencyError, Er as LockManager, Ga as normalizeAwsError, Ha as SynthesisError, Ia as ProvisioningError, Ma as LockError, Oi as Synthesizer, Sa as AssetError, Ua as formatError, Va as StateError, Wa as isCdkdError, _a as AwsClients, cr as TemplateParser, ct as IAMRoleProvider, dt as ProviderRegistry, ga as resolveBucketRegion, ha as clearBucketRegionCache, mn as DiffCalculator, qr as AssetPublisher, r as DeployEngine, ra as AssemblyReader, sr as DagBuilder, va as getAwsClients, wa as ConfigError, xa as setAwsClients, xt as CloudControlProvider, ya as resetAwsClients } from "./deploy-engine-BrGb93QQ.js";
+import { Ca as CdkdError, Dr as S3StateBackend, Ea as DependencyError, Er as LockManager, Ga as normalizeAwsError, Ha as SynthesisError, Ia as ProvisioningError, Ma as LockError, Oi as Synthesizer, Sa as AssetError, Ua as formatError, Va as StateError, Wa as isCdkdError, _a as AwsClients, cr as TemplateParser, ct as IAMRoleProvider, dt as ProviderRegistry, ga as resolveBucketRegion, ha as clearBucketRegionCache, mn as DiffCalculator, qr as AssetPublisher, r as DeployEngine, ra as AssemblyReader, sr as DagBuilder, va as getAwsClients, wa as ConfigError, xa as setAwsClients, xt as CloudControlProvider, ya as resetAwsClients } from "./deploy-engine-Gl-b_bNn.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-GASr9bAF.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CGPchKa2.js → program-Cy-pVgf_.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as retryClassificationText, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalInvokeBuildError$1, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as StackTerminationProtectionError, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as CdkdError, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DeployCancelledError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as PartialFailureError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as normalizeAwsError, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as SynthesisError, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ProvisioningError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isRetryableTransientError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as withErrorHandling, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceTimeoutError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as MalformedProducerRecordRefusalError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as DynamicReferenceRegionAmbiguousError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as NestedStackChildDirectDestroyError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as markRedactedCause, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as ResourceUpdateNotSupportedError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as CrossAccountSecretRefusalError, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as isTransientServerError, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isThrottlingError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markNonRetryable, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as runWithStackAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as describeAwsFailure, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as LocalStartServiceError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as IntrinsicResolutionRefusalError, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isMarkedNonRetryable, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, to as safeStringify, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as setAwsClients, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackHasActiveImportsError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-BrGb93QQ.js";
+import { $ as yellow, $a as retryClassificationText, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalInvokeBuildError$1, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as StackTerminationProtectionError, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as CdkdError, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DeployCancelledError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as PartialFailureError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as normalizeAwsError, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as SynthesisError, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ProvisioningError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isRetryableTransientError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as withErrorHandling, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceTimeoutError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as MalformedProducerRecordRefusalError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as DynamicReferenceRegionAmbiguousError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as NestedStackChildDirectDestroyError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as markRedactedCause, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as ResourceUpdateNotSupportedError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as CrossAccountSecretRefusalError, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as isTransientServerError, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isThrottlingError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markNonRetryable, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as runWithStackAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as describeAwsFailure, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as LocalStartServiceError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as IntrinsicResolutionRefusalError, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isMarkedNonRetryable, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, to as safeStringify, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as setAwsClients, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackHasActiveImportsError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-Gl-b_bNn.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-DQAkja2a.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B1pinTYm.js";
+import { t as getCdkdVersion } from "./version-oHfbqdBD.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DqAx9B6g.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -73790,7 +73790,11 @@ async function driftCommand(stacks, options) {
 		const targetRefs = resolveTargetRefs(stacks, await stateBackend.listStacks(), options);
 		const reports = [];
 		for (const ref of targetRefs) {
-			if (!ref.region) throw new Error(`Stack '${ref.stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${ref.stackName}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run drift detection.`);
+			if (!ref.region) {
+				const migrate = stackCommandFor("cdkd deploy", ref.stackName, { patternMatched: true });
+				const identity = stackIdentityLine(ref.stackName);
+				throw new Error("A state record for this stack is a legacy one with no region, which drift cannot read. A cdkd write migrates it to the region-scoped layout; re-run drift detection after it." + (identity === void 0 ? "\nThe stack name is not printed here: a name is printed only when it renders exactly, is non-empty and fits the reference cap — this one fails at least one of those." : `\n${identity}`) + (migrate === void 0 ? `\nThe migrate command is not printed here: ${WITHHELD_COMMAND_REASON} List records as stored with 'cdkd state list --json' and migrate the one whose key matches.` : `\nMigrate with: ${migrate}`));
+			}
 			const report = await runDriftForStack(ref.stackName, ref.region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair");
 			reports.push(report);
 		}
@@ -74890,7 +74894,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 				for (const change of outcome.changes) {
 					const refusal = acceptRefusalReason(change, outcome.maskedPaths);
 					if (refusal !== void 0) {
-						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to state. Run 'cdkd drift ${report.stackName} --revert' to push the referenced value back to AWS, or re-deploy if the reference changed.`);
+						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to state. Run 'cdkd drift --revert' for this stack to push the referenced value back to AWS, or re-deploy if the reference changed.`);
 						continue;
 					}
 					setAtPath(newBaseline, change.path, change.awsValue);
@@ -76187,7 +76191,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
 					logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded the value the provider actually applied on ${recordedCount} resource(s).`);
 				} catch (err) {
-					logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — re-run 'cdkd drift ${report.stackName} --revert' once the state write can succeed.`);
+					logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — re-run 'cdkd drift --revert' for this stack once the state write can succeed.`);
 				}
 			}
 		} finally {
@@ -76298,7 +76302,7 @@ function printRevertPlan(reports, out) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					out.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
 					for (const path of unbaselined) out.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
-					out.write(`      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed ${report.stackName}' (or re-deploy) to populate observedProperties if you want them reverted too.\n`);
+					out.write("      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed' for this stack (or re-deploy) to populate observedProperties if you want them reverted too.\n");
 				}
 			}
 		}
@@ -76467,6 +76471,134 @@ function formatScalar(value) {
 	return JSON.stringify(value);
 }
 /**
+* Why a command is not printed, phrased as the RULE rather than as a claim
+* about the name (m19 of the go-to-k/cdkd#3486 review). This SUPERSEDES the
+* m4 / m10 wording, which said the constant should name every reason the gate
+* has "since naming one tells the operator something false about the others" —
+* the enumeration is what round 4 measured as the defect.
+*
+* The earlier wording was a four-way disjunction — "does not render exactly, is
+* empty, is too long, or ... an option or a pattern" — which is true, but three
+* of the four disjuncts are visibly FALSE of a name printed on the `Stack:`
+* line right above it: `--all` renders exactly, is non-empty and is short. A
+* reader checking the sentence against what they can see concludes the tool is
+* guessing.
+*
+* The leading-`-` clause is stated as the GATE rather than as a parse, because
+* the gate is wider than Commander: `--all` really is parsed as the flag, while
+* a BARE `-` Commander takes positionally (measured) and this refuses it
+* anyway. Writing "would be read as an option" would be false of that one name.
+*
+* Naming the ACTUAL reason needs the gate to return it, and deriving it here
+* from a second copy of the predicates is the exact defect go-to-k/cdkd#3499
+* closed one file over. So this states the rule and leaves the reason to the
+* go-to-k/cdkd#3436 fold-in, where `pasteableCommand` supplies it.
+*/
+const WITHHELD_COMMAND_REASON = "a name is printed in a command only when it renders exactly, is non-empty, fits the reference cap, does not begin with '-', and is not a 'cdkd deploy' pattern — this one fails at least one of those.";
+/**
+* Does `value` reach the terminal as itself — sanitizing changes nothing, and
+* the state-reference cap does not cut it?
+*
+* Module-private and shared by {@link stackCommandFor} and
+* {@link stackIdentityLine}: the identity line and the command it sits above
+* must agree about which names are safe to print, and two spellings of this
+* predicate is how they would come to disagree.
+*/
+function rendersExactly(value) {
+	if (value === "") return false;
+	const safe = displaySafe(value, { asciiOnly: true });
+	return safe === value && !truncateCodePoints(safe, 1152).truncated;
+}
+/**
+* The `Stack: '<name>'` line that carries a record's identity NEXT TO a
+* pasteable command, or `undefined` when the name cannot be printed at all.
+*
+* A labelled command line is a trusted-looking shape, and a stack name is an
+* S3 key segment `listStacks` validates only for non-emptiness — so a name
+* carrying a newline printed ABOVE one forges a second labelled line that the
+* operator has every reason to trust. The same gate as the command, on its own
+* line, shell-quoted: inside a sentence a `$(...)` name executes when the
+* phrase is pasted, and `displayIdent`'s JSON quotes would not stop that —
+* double quotes do not close command substitution.
+*
+* USED BY SITE 1 ALONE, deliberately. A labelled command line is only safe in
+* a block whose OTHER values are gated too, and site 1's block carries exactly
+* two: this identity and the command beside it. The blocks that also carry a
+* property path, a resource type, a state-write error message or an AWS
+* readback value cannot meet that bar
+* by sanitizing — an arbitrary value cannot be gated for exactness and still
+* printed — so they keep their command in prose and the whole class is
+* [#3436](https://github.com/go-to-k/cdkd/issues/3436)'s.
+*/
+function stackIdentityLine(stackName, indent = "") {
+	return rendersExactly(stackName) ? `${indent}Stack: ${shellQuote(stackName)}` : void 0;
+}
+/**
+* A pasteable `cdkd ...` command addressing ONE state record, or `undefined`
+* when this stack name cannot be named safely — in which case the caller names
+* the command in prose and leaves the operator to supply the name.
+*
+* Every name these messages carry comes out of an S3 KEY (`listStacks`, and the
+* `report.stackName` derived from it), so it is as untrusted as a state record's
+* body (issue [#3307](https://github.com/go-to-k/cdkd/issues/3307)). Four gates,
+* and each closes a different failure:
+*
+* - SANITIZE, then compare against the RAW value. `displaySafe` drops the
+*   forgery class (C0 + DEL, `U+0085` and C1, `U+2028`/`U+2029`, the bidi
+*   overrides), so a name carrying one is never NAMED IN A COMMAND; and a name
+*   it ALTERED addresses a DIFFERENT record, the misdirection
+*   `malformedDestroyResourcesRefusalMessage` and `orphanCommandFor` already
+*   gate for. `asciiOnly` here rather than the denylist, because a stack name's
+*   charset is the S3 key's. What this does NOT do is sanitize the identity the
+*   surrounding prose prints: `report.stackName` reaches ~20 message sites in
+*   this file raw, which is the DISPLAY class go-to-k/cdkd#3232 records, not
+*   this gate's.
+* - CAP at `STACK_REF_MAX_CODE_POINTS`, the state-reference grammar, so a
+*   multi-kilobyte planted name cannot grow the pasted payload without bound,
+*   while a legitimate multi-level nested child (`Parent~Child~...`) still
+*   renders. It bounds the PAYLOAD and nothing more — a name at the cap still
+*   wraps across a terminal, which is `display-safe.ts`'s own caveat on the
+*   constant (go-to-k/cdkd#3179).
+* - SHELL-QUOTE, and print the command LAST and UNWRAPPED on its own labelled
+*   line. `shellQuote` is only as good as the quote context around it: inside
+*   prose `'...'` a quoted value turns the quoting inside out and a pasted span
+*   RUNS (measured in go-to-k/cdkd#3363; the class is go-to-k/cdkd#3436).
+* - REFUSE a name the COMMAND would read as something other than a name. A
+*   leading `-` is refused CONSERVATIVELY: `--all` survives sanitizing, the cap
+*   and quoting and is then parsed by Commander as the flag, addressing every
+*   stack. (A BARE `-` Commander takes positionally, so the refusal is wider
+*   than the parse — the gate is "starts with `-`", not "parses as an option".)
+*   And `cdkd deploy` matches its argument as a PATTERN
+*   (`src/cli/stack-matcher.ts`), where `*` is a wildcard and `/` selects by
+*   display path. `patternMatched` asks for the last two; `/` cannot arrive
+*   through a key (`listStacks` splits keys on it), so that half is defensive.
+*
+* **`region` and `flags` have NO production caller today, and neither does
+* `stackIdentityLine`'s `indent`** (M16 / m17 of the go-to-k/cdkd#3486 review;
+* the one call site is the legacy region-less refusal, which has no region by
+* definition and passes only `patternMatched`). They are kept, with their
+* cases, as the landing place for the three `cdkd drift` sites
+* go-to-k/cdkd#3436 owns — the `--stack-region` requirement go-to-k/cdkd#3307
+* states for `:6139` is exactly what `region` exists to satisfy. Read their
+* hazard-matrix cases as a SPECIFICATION for that landing, not as coverage of
+* a live path. `region` takes the same gates as the NAME — sanitize,
+* exactness, the cap, emptiness and the leading `-` — because a region is a
+* key SEGMENT, no more trusted than the name.
+*
+* Exported for `tests/unit/cli/drift.test.ts`, which drives the hazard matrix
+* through it directly; the one call site is driven through the CLI separately,
+* since what a site PASSES is not something a helper test can see.
+*/
+function stackCommandFor(command, stackName, opts = {}) {
+	if (!rendersExactly(stackName) || stackName.startsWith("-")) return void 0;
+	if (opts.patternMatched && (stackName.includes("*") || stackName.includes("/"))) return void 0;
+	if (opts.region !== void 0 && (!rendersExactly(opts.region) || opts.region.startsWith("-"))) return;
+	const parts = [command, shellQuote(stackName)];
+	if (opts.flags !== void 0) parts.push(opts.flags);
+	if (opts.region !== void 0) parts.push(`--stack-region ${shellQuote(opts.region)}`);
+	return parts.join(" ");
+}
+/**
 * Reusable `--stack-region <region>` option (mirrors `state show`).
 */
 function stackRegionOption$2() {
@@ -98140,4 +98272,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CGPchKa2.js.map
+//# sourceMappingURL=program-Cy-pVgf_.js.map