@go-to-k/cdkd 0.291.9 → 0.291.11

package/dist/{program-CY92mXcX.js → program-Buh8Yn40.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as markRedactedCause, $i as PARTITION_TABLE, $n as repairMalformedResourcePropertiesForReadOnly, $r as AssetModeResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalStartServiceError, Ai as getLegacyStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as ssmResolvedValueType, Bn as refuseMalformedOrphansForDestroy, Br as importableOutputKeys, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as escapeRegExp, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DynamicReferenceRegionAmbiguousError, Di as Synthesizer, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as DeployCancelledError, Ei as getDockerImageBySourceHash, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as ProvisioningError, Fi as resolveStateBucketWithDefault, Fn as malformedResourcesWarning, Fr as DEFAULT_STATE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as withErrorHandling, Gi as uploadCfnTemplate, Gn as refuseMalformedResourceEntries, Gr as shouldRetainResource, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as CFN_TEMPLATE_URL_LIMIT, Hn as refuseMalformedOutputs, Hr as isReadableBag, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ResourceTimeoutError, Ii as resolveStateBucketWithDefaultAndSource, In as malformedStateRefusalMessage, Ir as exportNamesCarriedFrom, It as isNamelessDynamicReferenceError, J as bold, Ja as isMarkedNonRetryable, Ji as injectiveKeyPrefix, Jn as refuseMalformedResourcesForDestroy, Jr as WorkGraph, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as pasteableCommand, Ki as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Kn as refuseMalformedResourceEntriesForOrphan, Kr as AssetPublisher, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceUpdateNotSupportedError, Li as resolveUseCdkBootstrapAssets, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasReadableExportSet, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as MalformedProducerRecordRefusalError, Mi as resolveAutoAssetStorage, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as NestedStackChildDirectDestroyError, Ni as resolveCaptureObservedState, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as IntrinsicResolutionRefusalError, Oi as synthesisStatusMessage, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as PartialFailureError, Pi as resolveSkipPrefix, Pn as malformedResourcePropertiesWarning, Pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Pt as getAccountInfo, Q as red, Qa as markNonRetryable, Qi as expectedOwnerParam, Qn as repairMalformedResourceEntriesForReadOnly, Qr as rewriteTemplateAssetReferences, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as StackHasActiveImportsError, Ri as stateBucketExistenceConfirmed, Rn as refuseMalformedNestedChildOutputs, Rr as hasReasonlessBaselineRefusal, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as CdkdError, Si as runDockerStreaming, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as AssetManifestLoader, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as MIGRATE_TMP_PREFIX, Un as refuseMalformedOutputsForDestroy, Ur as orphansAfterRollback, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as SynthesisError, Vi as CFN_TEMPLATE_BODY_LIMIT, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputs, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as normalizeAwsError, Wi as findLargeInlineResources, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansCarriedFrom, Wt as assertRegionMatch, X as gray, Xa as isThrottlingError, Xi as producerRecordKey, Xn as repairMalformedOrphansForReadOnly, Xr as createAssetRedirectResolver, Xt as readConfigString, Y as cyan, Ya as isRetryableTransientError, Yi as producerCoordinateKey, Yn as refuseMalformedState, Yr as buildAssetRedirectMap, Yt as configStringRefusal, Z as green, Za as isTransientServerError, Zi as decodeListingKey, Zn as repairMalformedOutputsForReadOnly, Zr as loadPublishableAssetManifest, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as getAwsClients, _i as formatDockerLoginError, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as processStackMessages, ai as parseBootstrapMarker, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as setAwsClients, bi as redactDockerArgvValues, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasPlainPrototype, ci as validateContainerRepoName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as absoluteAssemblyPathEscape, di as resolveDockerContextDirectory, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as canonicalizeRegion, ei as BOOTSTRAP_MARKER_PREFIX, en as requireConfigString, eo as retryClassificationText, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as renderAssemblyPathEscape, fi as warnManifestExecutable, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as AwsClients, gi as dockerSpawnEnvWithSensitive, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resolveBucketRegion, hi as describeDockerFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as globMatches, ii as isCrossRegionRedirect, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ji as resolveApp, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as LocalInvokeBuildError$1, ki as getDefaultStateBucketName, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as nullPrototypeRecord, li as buildDenyExternalAccessPolicy, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, mi as describeDockerExecFailure, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as AssemblyReader, ni as ensureAssetStorage, nn as producerRegionsFromState, no as safeStringify, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as defineOwnKey, oi as readBootstrapMarkerBody, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as resolveAssemblyPath, pi as describeDockerCapturedOutput, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as shellQuote, qi as injectiveKey, qn as refuseMalformedResourcePropertiesForOrphan, qr as stringifyValue, qt as configBooleanRefusal, r as DeployEngine, ra as failedStageNote, ri as getBootstrapMarkerKey, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as hasOwnKey, si as validateAssetBucketName, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as derivePartitionAndUrlSuffix, ti as assertAssetBucketRegion, tn as classifyReplaySecretRegion, to as describeAwsFailure, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as ownValue, ui as buildDockerImage, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as resetAwsClients, vi as getDockerCmd, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as CrossAccountSecretRefusalError, wi as stripControlChars, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as runDockerForeground, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as runWithStackAwsClients, yi as partitionSensitiveEnv, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackTerminationProtectionError, zi as warnDeprecatedNoPrefixCliFlag, zn as refuseMalformedOrphans, zr as hasUnverifiableParameterRefusal, zt as refStateLookupFromResource } from "./deploy-engine-TkL9nyq8.js";
+import { $ as yellow, $a as isMarkedNonRetryable, $i as injectiveKeyPrefix, $n as repairMalformedResourcePropertiesForReadOnly, $r as AssetModeResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as AssetManifestLoader, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as ProvisioningError, Bi as resolveStateBucketWithDefault, Bn as refuseMalformedOrphansForDestroy, Br as importableOutputKeys, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as resetAwsClients, Ci as partitionSensitiveEnv, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as UNSPECIFIED_SKIP_REASON, D as PRE_DELETE_SNAPSHOT_TYPES, Da as CdkdError, Di as warnFinchArgvExposure, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as runDockerStreaming, En as malformedLocalOutputsWarning, Er as LockManager, Et as isWaitAbandonedError, F as extractDeploymentEventError, Fa as LocalStartServiceError, Fi as getLegacyStateBucketName, Fn as malformedResourcesWarning, Fr as DEFAULT_STATE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as ssmResolvedValueType, Gn as refuseMalformedResourceEntries, Gr as shouldRetainResource, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as ResourceUpdateNotSupportedError, Hi as resolveUseCdkBootstrapAssets, Hn as refuseMalformedOutputs, Hr as isReadableBag, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as resolveApp, In as malformedStateRefusalMessage, Ir as exportNamesCarriedFrom, It as isNamelessDynamicReferenceError, J as bold, Ji as MIGRATE_TMP_PREFIX, Jn as refuseMalformedResourcesForDestroy, Jr as WorkGraph, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as SynthesisError, Ki as CFN_TEMPLATE_BODY_LIMIT, Kn as refuseMalformedResourceEntriesForOrphan, Kr as AssetPublisher, Kt as coerceCfnInteger, L as planOrphanAdoption, La as MalformedProducerRecordRefusalError, Li as resolveAutoAssetStorage, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasReadableExportSet, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as DynamicReferenceRegionAmbiguousError, Mi as Synthesizer, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as IntrinsicResolutionRefusalError, Ni as synthesisStatusMessage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oi as escapeRegExp, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as LocalInvokeBuildError$1, Pi as getDefaultStateBucketName, Pn as malformedResourcePropertiesWarning, Pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Pt as getAccountInfo, Q as red, Qa as shellQuote, Qi as injectiveKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as rewriteTemplateAssetReferences, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as NestedStackChildDirectDestroyError, Ri as resolveCaptureObservedState, Rn as refuseMalformedNestedChildOutputs, Rr as hasReasonlessBaselineRefusal, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as getAwsClients, Si as isMalformedEnvKey, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as setAwsClients, Ti as runDockerForeground, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteSkipReason, U as coerceWarmThroughput$1, Ua as StackHasActiveImportsError, Ui as stateBucketExistenceConfirmed, Un as refuseMalformedOutputsForDestroy, Ur as orphansAfterRollback, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as ResourceTimeoutError, Vi as resolveStateBucketWithDefaultAndSource, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputs, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as StackTerminationProtectionError, Wi as warnDeprecatedNoPrefixCliFlag, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansCarriedFrom, Wt as assertRegionMatch, X as gray, Xa as withErrorHandling, Xi as uploadCfnTemplate, Xn as repairMalformedOrphansForReadOnly, Xr as createAssetRedirectResolver, Xt as readConfigString, Y as cyan, Ya as normalizeAwsError, Yi as findLargeInlineResources, Yn as refuseMalformedState, Yr as buildAssetRedirectMap, Yt as configStringRefusal, Z as green, Za as pasteableCommand, Zi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Zn as repairMalformedOutputsForReadOnly, Zr as loadPublishableAssetManifest, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as renderAssemblyPathEscape, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as canonicalizeRegion, ai as parseBootstrapMarker, an as s3BucketDomainName, ao as retryClassificationText, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as resolveBucketRegion, bi as getDockerCmd, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as failedStageNote, ci as validateContainerRepoName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as defineOwnKey, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as producerCoordinateKey, ei as BOOTSTRAP_MARKER_PREFIX, en as requireConfigString, eo as isRetryableTransientError, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as hasOwnKey, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as absoluteAssemblyPathEscape, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as ownValue, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as PARTITION_TABLE, ii as isCrossRegionRedirect, in as s3BucketArn, io as markRedactedCause, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as DeployCancelledError, ji as getDockerImageBySourceHash, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as CrossAccountSecretRefusalError, ki as stripControlChars, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as globMatches, li as buildDenyExternalAccessPolicy, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as nullPrototypeRecord, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as decodeListingKey, ni as ensureAssetStorage, nn as producerRegionsFromState, no as isTransientServerError, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as derivePartitionAndUrlSuffix, oi as readBootstrapMarkerBody, on as s3BucketDualStackDomainName, oo as describeAwsFailure, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as hasPlainPrototype, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qi as CFN_TEMPLATE_URL_LIMIT, qn as refuseMalformedResourcePropertiesForOrphan, qr as stringifyValue, qt as configBooleanRefusal, r as DeployEngine, ra as expectedOwnerParam, ri as getBootstrapMarkerKey, rn as withSharedDrainBudget, ro as markNonRetryable, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as AssemblyReader, si as validateAssetBucketName, sn as s3BucketRegionalDomainName, so as safeStringify, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as producerRecordKey, ti as assertAssetBucketRegion, tn as classifyReplaySecretRegion, to as isThrottlingError, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as processStackMessages, ui as assertCdkLocalDockerContextContained, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as resolveAssemblyPath, vi as finchSecretArgvRefusal, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as runWithStackAwsClients, wi as redactDockerArgvValues, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as deleteIndeterminateGuards, x as bindingSkippedOutputs, xa as AwsClients, xi as isDockerClientEnvKey, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, yi as formatDockerLoginError, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as PartialFailureError, zi as resolveSkipPrefix, zn as refuseMalformedOrphans, zr as hasUnverifiableParameterRefusal, zt as refStateLookupFromResource } from "./deploy-engine-D4svwrnK.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-RzKz4JAW.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-D9EJApN9.js";
+import { t as getCdkdVersion } from "./version-CuVd0lOr.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BDhrXE5Y.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7363,86 +7363,41 @@ function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
-* Is this `Destination` block written in the CFn FLATTENED form
-* (`{ BucketArn, Format, ... }`) rather than the SDK NESTED one
-* (`{ S3BucketDestination: { ... } }`)?
-*
-* ONE predicate, called from both `resolveS3BucketDestination` (which picks the
-* bag) and `s3BucketDestinationPath` (which names it). They were written out
-* twice and a reviewer rightly pointed out that two copies of a branch
-* condition must be edited together or a refusal starts naming the wrong key.
-*
-* `Bucket` is probed alongside `BucketArn` because the readers accept it
-* (`s3Dest['BucketArn'] ?? s3Dest['Bucket']`); omitting it made a
-* `{ Bucket }`-only block take the nested branch, find nothing, and drop — the
-* same silent drop one shape over.
-*/
-function isFlattenedDestination(dest) {
-	return Boolean(dest["BucketArn"] || dest["Bucket"] || dest["BucketAccountId"] || dest["Format"]);
-}
-/**
-* The CFn path of the destination bag `resolveS3BucketDestination` will pick —
-* issue #1493 item 3, which is a MESSAGE concern, not a value one.
-*
-* Kept separate from the resolver rather than returned alongside the bag:
-* `gen-nested-key-coverage`'s write-evidence walk follows a plain
-* `const x = this.helper(...)` binding to the members written beneath it, and
-* a DESTRUCTURED `const { bag, path } = ...` is a shape it cannot follow — so
-* pairing the two silently withdrew the write evidence for
-* `Destination.BucketArn` / `.BucketAccountId` and turned an opted-in target
-* red with no behavior change at all. Measured against the pre-change provider
-* via the critic's `--providers-dir=` seam.
-*/
-function s3BucketDestinationPath(dest, destinationPath) {
-	return isPlainObject$2(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
-}
-/**
-* The FLATTENED CFn `Destination` block cdkd actually SENDS for `declared`
-* (issue #1707) — the shared fold behind BOTH halves of the #1633 pair: the
-* per-item `effectiveProperties` record and
+* The CFn `Destination` block cdkd actually SENDS for `declared` (issue #1707) —
+* the shared fold behind BOTH halves of the #1633 pair: the per-item
+* `effectiveProperties` record and
 * {@link S3BucketProvider.canonicalizeDesiredProperties}.
 *
-* The desired side accepts TWO spellings (`resolveS3BucketDestination` picks
-* either the flattened CFn block or the nested SDK `S3BucketDestination` one)
-* plus a `Bucket` / `BucketArn` alias inside either, while the readback
-* (`inventorySdkToCfn` / `analyticsSdkToCfn`) emits ONLY the flattened form with
-* `BucketArn`. So a record written in any other spelling can never match what
-* `readCurrentState` returns: `cdkd drift` re-reports it forever and `--revert`
-* re-issues the same Put — the never-emitted-KEY class of issue #1686, reached
-* through the SHAPE rather than through a value. The live CFn registry schema
-* agrees the flattened form is the only CFn spelling (`Destination` is
-* `{BucketArn, BucketAccountId, Format, Prefix}` with `additionalProperties:
-* false`), so `S3BucketDestination` and `Bucket` are cdkd-only tolerances.
-*
-* This NORMALIZES rather than retracting the tolerance, per the #1686 rule:
-* refusing the SDK spelling would break templates that deploy today. It also
-* supersedes #1670's write-back-at-the-DECLARED-branch decision, whose whole
-* reason was that writing at a hardcoded branch would leave the malformed value
-* alive at the other key and add a stray one — there is no other key left once
-* the block is normalized wholesale.
+* The readback (`inventorySdkToCfn` / `analyticsSdkToCfn`) emits only
+* `{BucketArn, BucketAccountId, Format, Prefix}`, the members the live CFn
+* registry schema declares (`additionalProperties: false`). The block is rebuilt
+* from exactly those members so a record never carries a key the readback cannot
+* report.
+*
+* The SDK spellings this once also folded (the nested
+* `{ S3BucketDestination: { ... } }` shape and a `Bucket` alias for
+* `BucketArn`) are gone: `BucketArn` and `Format` are schema-required here and
+* `AWS::S3::Bucket` is in `CFN_ENFORCED_TYPES`, so a template using either is
+* refused pre-flight by `nested-required.ts` (issue #3602).
 *
 * `Format` is the one member a caller can override: the applier passes the
 * value it SENT, which differs from the declared one when the warn-and-
-* SUBSTITUTE read replaced it (#1670). Absent on BOTH sides it defaults to the
-* `'CSV'` the appliers send, so the record carries what AWS will report back
-* rather than one key fewer.
+* SUBSTITUTE read replaced a malformed value (#1670). Absent on BOTH sides it
+* defaults to the `'CSV'` the appliers send, so the record carries what AWS
+* will report back rather than one key fewer.
 *
-* @returns the flattened block, or `declared` BY IDENTITY when it already is
-*   one (so an ordinary template records byte-for-byte what it declared) or is
-*   not a shape this can fold at all (absent / malformed — left for the
-*   resolver's own refusal to report).
+* @returns the rebuilt block, or `declared` BY IDENTITY when it already is one
+*   (so an ordinary template records byte-for-byte what it declared) or is not
+*   a shape this can fold at all (absent / malformed / no `BucketArn` — left for
+*   the resolver's own refusal to report).
 */
 function effectiveS3BucketDestination(declared, sentFormat) {
 	if (!isPlainObject$2(declared)) return declared;
-	const bag = isFlattenedDestination(declared) ? declared : declared["S3BucketDestination"];
-	if (!isPlainObject$2(bag)) return declared;
-	if (!bag["BucketArn"] && !bag["Bucket"]) return declared;
-	const out = {};
-	const bucketArn = bag["BucketArn"] ?? bag["Bucket"];
-	if (bucketArn !== void 0) out["BucketArn"] = bucketArn;
-	if (bag["BucketAccountId"] !== void 0) out["BucketAccountId"] = bag["BucketAccountId"];
-	out["Format"] = sentFormat ?? declaredOrDefault(bag, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT);
-	if (bag["Prefix"] !== void 0) out["Prefix"] = bag["Prefix"];
+	if (!declared["BucketArn"]) return declared;
+	const out = { BucketArn: declared["BucketArn"] };
+	if (declared["BucketAccountId"] !== void 0) out["BucketAccountId"] = declared["BucketAccountId"];
+	out["Format"] = sentFormat ?? declaredOrDefault(declared, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT);
+	if (declared["Prefix"] !== void 0) out["Prefix"] = declared["Prefix"];
 	return sameScalarRecord(out, declared) ? declared : out;
 }
 /**
@@ -7450,14 +7405,6 @@ function effectiveS3BucketDestination(declared, sentFormat) {
 * NEVER `??`, and that distinction is the whole guard against issue #1670's
 * finding 3.
 *
-* The ONE licensed `??` in these folds is the ALIAS read
-* `bag['BucketArn'] ?? bag['Bucket']`, and it is not an exception to this rule —
-* it supplies no DEFAULT. It picks between two spellings of the same declared
-* value, exactly as the applier's own read does, so a nullish `BucketArn`
-* correctly falls through to the alias the wire would have used. When neither is
-* declared the key is simply absent from the fold's output, which is what makes
-* a bucket-less block identity-return rather than gain a phantom key.
-*
 * The default belongs to a key the template OMITTED: there the provider sends
 * it, the readback reports it, and folding both sides is what makes them agree.
 * A key DECLARED with a malformed value is a different case entirely — the
@@ -7679,10 +7626,14 @@ function foldToleratedAliases(bag, aliases) {
 }
 /** The transition date member, held in a CONST so the fold writes it COMPUTED. */
 const TRANSITION_DATE_KEY = "TransitionDate";
-/** The lifecycle `Transitions[]` aliases the applier accepts (issue #1748). */
+/**
+* The lifecycle `Transitions[]` aliases the applier accepts (issue #1748).
+*
+* `NoncurrentVersionTransitions[]` has none: its `TransitionInDays` is a
+* schema-required member, so a template spelling it `NoncurrentDays` is refused
+* pre-flight by `nested-required.ts` and the alias was dropped (issue #3585).
+*/
 const TRANSITION_ALIASES = [["TransitionInDays", "Days"], ["TransitionDate", "Date"]];
-/** The lifecycle `NoncurrentVersionTransitions[]` alias (issue #1748). */
-const NONCURRENT_VERSION_TRANSITION_ALIASES = [["TransitionInDays", "NoncurrentDays"]];
 /** The refusal path for the notification EventBridge boolean (issue #1759). */
 const EVENTBRIDGE_CONFIG_PATH = "AWS::S3::Bucket NotificationConfiguration.EventBridgeConfiguration";
 /**
@@ -7753,27 +7704,25 @@ function dropEmptyNotificationFamilies(config) {
 	}
 	return out ?? config;
 }
-/** The `NotificationConfiguration` ARN aliases, per family (issue #1748). */
-const NOTIFICATION_ARN_ALIASES = [
-	["TopicConfigurations", [["Topic", "TopicArn"]]],
-	["QueueConfigurations", [["Queue", "QueueArn"]]],
-	["LambdaConfigurations", [["Function", "LambdaFunctionArn"]]]
-];
 /**
-* The `Event` / `Events` half of the same item (issue #1748).
+* The `Event` / `Events` spelling on a notification item (issue #1748).
 *
-* The ARN alias is not the only never-emitted spelling on a notification item,
-* and this one is the WIDER of the two: `TopicArn` is a cdkd-only tolerance
-* almost no template uses, while `Event` is the member the CFn registry schema
-* declares (`TopicConfiguration` is `{Event, Filter, Topic}` — there is no
-* `Events`) and therefore the one EVERY template carries. The applier accepts
-* both (`t['Event'] !== undefined ? [t['Event']] : t['Events']`).
+* `Event` is the member the CFn registry schema declares (`TopicConfiguration`
+* is `{Event, Filter, Topic}` — there is no `Events`) and therefore the one
+* EVERY template carries. The applier accepts both
+* (`t['Event'] !== undefined ? [t['Event']] : t['Events']`), because the
+* readback emits `Events` for a multi-event live configuration and
+* `drift --revert` sends a readback-shaped bag.
 *
-* Unlike the ARN pair this is not a pure rename — the SDK member is a LIST — so
-* it folds by ARITY: a single-element list is the CFn `Event`, and a longer one
-* has no CFn spelling at all and is left as `Events`, which is what the readback
-* emits for it. That asymmetry is why it is a separate step rather than another
-* {@link foldToleratedAliases} entry.
+* This is not a pure rename — the SDK member is a LIST — so it folds by ARITY:
+* a single-element list is the CFn `Event`, and a longer one has no CFn
+* spelling at all and is left as `Events`, which is what the readback emits for
+* it.
+*
+* The destination ARN has no alias: `Topic` / `Queue` / `Function` are
+* schema-required members, so the SDK spellings (`TopicArn`, …) are refused
+* pre-flight by `nested-required.ts` and the applier no longer reads them
+* (issue #3585).
 *
 * `readNotification` was emitting `Events` unconditionally, so the record and
 * the readback disagreed on every notification-configured bucket; it now
@@ -7798,20 +7747,12 @@ function foldNotificationEvents(item) {
 * `readNotification` emits (issue #1748) — the never-emitted-KEY class of issue
 * #1686 reached through the SHAPE rather than through a value.
 *
-* `applyNotificationConfiguration` accepts the SDK spelling of each destination
-* ARN alongside the CFn one (`t['Topic'] ?? t['TopicArn']`, and the two
-* siblings), while `readNotification` emits only `Topic` / `Queue` /
-* `Function` — the spellings the live CFn registry schema declares
-* (`TopicConfiguration` is `{Event, Filter, Topic}`, with no `TopicArn`
-* member at all, so the SDK spellings are cdkd-only tolerances). A record
-* written in the tolerated spelling therefore can never match the readback:
-* `cdkd drift` re-reports it forever and `--revert` re-issues the same Put,
-* with NO warning anywhere, because nothing is malformed and nothing is
-* substituted.
-*
-* This NORMALIZES rather than retracting the tolerance, per #1686's third
-* generalization: refusing the SDK spelling would break templates that deploy
-* today, and buys nothing the normalization does not.
+* `applyNotificationConfiguration` accepts a single-element `Events` list
+* alongside the CFn scalar `Event` ({@link foldNotificationEvents}), while
+* `readNotification` emits `Event` for it. A record written in the list
+* spelling therefore can never match the readback: `cdkd drift` re-reports it
+* forever and `--revert` re-issues the same Put, with NO warning anywhere,
+* because nothing is malformed and nothing is substituted.
 *
 * The Put is a FULL REPLACE with no skip arm, so there is no
 * previous-value-retained case to distinguish — whenever it succeeds, this is
@@ -7824,7 +7765,7 @@ function foldNotificationEvents(item) {
 function effectiveNotificationConfiguration(config) {
 	if (!isPlainObject$2(config)) return config;
 	let out = config;
-	for (const [listKey, aliases] of NOTIFICATION_ARN_ALIASES) out = canonicalizeItemList(out, listKey, (item) => foldNotificationEvents(foldToleratedAliases(item, aliases)));
+	for (const listKey of NOTIFICATION_LIST_KEYS) out = canonicalizeItemList(out, listKey, foldNotificationEvents);
 	out = dropEmptyNotificationFamilies(out);
 	return foldEventBridgeConfiguration(out);
 }
@@ -8265,18 +8206,13 @@ function foldLifecycleScope(rule, useFilterForm) {
 * `readLifecycle` emits (issue #1748) — the lifecycle half of the same class.
 *
 * `applyLifecycleConfiguration` accepts the SDK day/date spellings alongside the
-* CFn ones on both transition families (`t['TransitionInDays'] ?? t['Days']`,
-* `t['TransitionDate'] ?? t['Date']`, `nvt['TransitionInDays'] ??
-* nvt['NoncurrentDays']`) while `readLifecycle` emits only `TransitionInDays` /
-* `TransitionDate` — again the only spellings the registry schema declares
-* (`Transition` is `{StorageClass, TransitionDate, TransitionInDays}`,
-* `NoncurrentVersionTransition` is `{StorageClass, TransitionInDays,
-* NewerNoncurrentVersions}`).
-*
-* The issue named the `Date` alias; the mechanical audit it asks for (match the
-* `(a['X'] ?? a['Y'])` ALIAS form, not a plain bracket read) found all THREE in
-* the same two item shapes, so fixing only the reported one would have left its
-* siblings broken — the "diff the WHOLE blob, not the reported key" rule.
+* CFn ones on `Transitions` (`t['TransitionInDays'] ?? t['Days']`,
+* `t['TransitionDate'] ?? t['Date']`) while `readLifecycle` emits only
+* `TransitionInDays` / `TransitionDate` — again the only spellings the registry
+* schema declares (`Transition` is `{StorageClass, TransitionDate,
+* TransitionInDays}`). `NoncurrentVersionTransitions` has no alias to fold: its
+* `TransitionInDays` is schema-required, so the `NoncurrentDays` spelling is
+* refused pre-flight and the applier no longer reads it (issue #3585).
 *
 * Issues #1754 / #1755 finished the block, so the "still differs on those keys"
 * caveat this doc carried is gone: the legacy SINGULAR `Transition` /
@@ -8326,7 +8262,6 @@ function effectiveLifecycleConfiguration(config) {
 function effectiveLifecycleRule(rule, useFilterForm) {
 	let out = foldLegacySingularTransitions(rule);
 	out = canonicalizeItemList(out, "Transitions", (t) => foldTransitionDate(foldToleratedAliases(t, TRANSITION_ALIASES)));
-	out = canonicalizeItemList(out, "NoncurrentVersionTransitions", (nvt) => foldToleratedAliases(nvt, NONCURRENT_VERSION_TRANSITION_ALIASES));
 	out = dropEmptyTransitionLists(out);
 	out = foldLifecycleExpiration(out);
 	out = foldNoncurrentVersionExpiration(out);
@@ -8393,8 +8328,8 @@ function canonicalizeItemList(properties, key, fold) {
 /**
 * Name a malformed value in a refusal message, the way `config-shape.ts`'s
 * private `describe` does for the string-reading guards. Kept local rather than
-* exported from there because `resolveS3BucketDestination` is S3-specific
-* branch selection, not a shared shape guard — the two only share the wording.
+* exported from there because `resolveS3BucketDestination` is an S3-specific
+* refusal, not a shared shape guard — the two only share the wording.
 */
 function describeValue$1(value, maskSecrets = (text) => text) {
 	if (value === null) return "null";
@@ -8932,7 +8867,7 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 			else if (coerceCfnNumber(legacyNveDays) !== void 0) sdkRule.NoncurrentVersionExpiration = { NoncurrentDays: coerceCfnNumber(legacyNveDays) };
 			const toSdkNvt = (nvt) => ({
-				NoncurrentDays: nvt["TransitionInDays"] ?? nvt["NoncurrentDays"],
+				NoncurrentDays: nvt["TransitionInDays"],
 				StorageClass: nvt["StorageClass"],
 				NewerNoncurrentVersions: nvt["NewerNoncurrentVersions"]
 			});
@@ -9143,21 +9078,21 @@ var S3BucketProvider = class S3BucketProvider {
 			const topics = notifConfig["TopicConfigurations"];
 			if (topics && Array.isArray(topics) && topics.length > 0) cfg.TopicConfigurations = topics.map((t) => ({
 				Id: t["Id"],
-				TopicArn: t["Topic"] ?? t["TopicArn"],
+				TopicArn: t["Topic"],
 				Events: t["Event"] !== void 0 ? [t["Event"]] : t["Events"],
 				Filter: this.cfnNotifFilterToSdk(t["Filter"])
 			}));
 			const queues = notifConfig["QueueConfigurations"];
 			if (queues && Array.isArray(queues) && queues.length > 0) cfg.QueueConfigurations = queues.map((q) => ({
 				Id: q["Id"],
-				QueueArn: q["Queue"] ?? q["QueueArn"],
+				QueueArn: q["Queue"],
 				Events: q["Event"] !== void 0 ? [q["Event"]] : q["Events"],
 				Filter: this.cfnNotifFilterToSdk(q["Filter"])
 			}));
 			const lambdas = notifConfig["LambdaConfigurations"];
 			if (lambdas && Array.isArray(lambdas) && lambdas.length > 0) cfg.LambdaFunctionConfigurations = lambdas.map((l) => ({
 				Id: l["Id"],
-				LambdaFunctionArn: l["Function"] ?? l["LambdaFunctionArn"],
+				LambdaFunctionArn: l["Function"],
 				Events: l["Event"] !== void 0 ? [l["Event"]] : l["Events"],
 				Filter: this.cfnNotifFilterToSdk(l["Filter"])
 			}));
@@ -9242,39 +9177,32 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 	}
 	/**
-	* Pick the `S3BucketDestination` bag out of an analytics / inventory
-	* `Destination` block, refusing a shape that would otherwise be dropped.
-	*
-	* Two shapes are legitimate and both must keep working: the CFn FLATTENED
-	* form (`Destination: { BucketArn, Format, ... }`, what the schema declares)
-	* and the SDK NESTED form (`Destination: { S3BucketDestination: { ... } }`,
-	* accepted because state records and hand-written templates carry it).
-	*
-	* Issue #1493 item 2: the branch was picked by probing member presence
-	* (`dest?.['BucketAccountId'] || dest?.['BucketArn'] || dest?.['Format']`),
-	* so a `Destination` that is a STRING / array / unresolved intrinsic indexed
-	* every probe to `undefined`, fell through to an equally-`undefined`
-	* `S3BucketDestination`, and the caller's `s3Dest ? … : undefined` omitted
-	* the whole block from the Put — a configuration silently deployed without
-	* the destination it declared. Unlike the sibling defaulting class this is a
-	* DROP, not a substituted default, so `readConfigString` does not cover it:
-	* it needs its own decision, and per issue #1513's precedent that decision is
-	* REFUSE on the template-borne create path, WARN on the replay-reachable
-	* update path (`onUnusable`), where the desired bag can be a historical cdkd
-	* state record with no template-side remedy.
-	*
-	* Also returns the CFn path of the bag it picked (issue #1493 item 3): the
-	* callers used to hardcode `…Destination.S3BucketDestination` in the
-	* `containerPath` they pass to `readConfigString`, so a refusal on the
-	* FLATTENED branch — where the bag IS `dest` itself — named a key the user's
-	* template does not contain.
-	*
-	* @returns the picked bag, or `undefined` when the block was ABSENT or was
-	*   refused on a warn-only path. The caller distinguishes the two by testing
-	*   its own `Destination` value — see the `continue` at each call site.
+	* Validate an analytics / inventory `Destination` block, refusing a shape
+	* that would otherwise be dropped.
+	*
+	* The block is the CFn form the schema declares (`Destination: { BucketArn,
+	* Format, ... }`). The SDK NESTED form (`{ S3BucketDestination: { ... } }`)
+	* and a `Bucket` alias for `BucketArn` are no longer read: `BucketArn` and
+	* `Format` are schema-required, so a template using either is refused
+	* pre-flight by `nested-required.ts` (issue #3602). What still reaches this
+	* guard with such a shape (an unresolved intrinsic on the path, or a replayed
+	* pre-#1707 state record) is refused here like any other bucket-less block.
+	*
+	* Issue #1493 item 2: a `Destination` that is a STRING / array / unresolved
+	* intrinsic used to index every probe to `undefined`, and the caller's
+	* `s3Dest ? … : undefined` omitted the whole block from the Put — a
+	* configuration silently deployed without the destination it declared. Unlike
+	* the sibling defaulting class this is a DROP, not a substituted default, so
+	* `readConfigString` does not cover it: per issue #1513's precedent the
+	* decision is REFUSE on the template-borne create path, WARN on the
+	* replay-reachable update path (`onUnusable`), where the desired bag can be a
+	* historical cdkd state record with no template-side remedy.
+	*
+	* @returns the block, or `undefined` when it was ABSENT or was refused on a
+	*   warn-only path. The caller distinguishes the two by testing its own
+	*   `Destination` value — see the `continue` at each call site.
 	*/
 	resolveS3BucketDestination(dest, destinationPath, onUnusable, maskSecrets = (text) => text) {
-		const nestedPath = `${destinationPath}.S3BucketDestination`;
 		const drop = (message) => {
 			if (onUnusable) {
 				onUnusable(`${message}. Leaving this configuration unchanged; the same value is REFUSED on a template-path create`);
@@ -9284,11 +9212,8 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 		if (dest === void 0 || dest === null) return;
 		if (!isPlainObject$2(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
-		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
-		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue$1(dest, maskSecrets)}) — the destination would otherwise be dropped from the request with no error`);
-		if (!isPlainObject$2(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
-		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue$1(bag, maskSecrets)}) — the request would be rejected by S3, or silently carry no destination`);
-		return bag;
+		if (!dest["BucketArn"]) return drop(`${destinationPath} has no destination bucket (BucketArn) (got ${describeValue$1(dest, maskSecrets)}) — the request would be rejected by S3, or silently carry no destination`);
+		return dest;
 	}
 	/**
 	* Apply analytics configurations
@@ -9349,13 +9274,12 @@ var S3BucketProvider = class S3BucketProvider {
 					skipped.push(index);
 					continue;
 				}
-				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
 					OutputSchemaVersion: sentOutputSchemaVersion = this.readSubstitutedConfigString(dataExport, "OutputSchemaVersion", ANALYTICS_DEFAULT_OUTPUT_SCHEMA_VERSION, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }),
 					Destination: s3Dest ? { S3BucketDestination: {
-						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
+						Bucket: s3Dest["BucketArn"],
 						BucketAccountId: s3Dest["BucketAccountId"],
-						Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, destPath, { ...onUnusable ? { onUnusable } : {} }),
+						Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, analyticsDestPath, { ...onUnusable ? { onUnusable } : {} }),
 						Prefix: s3Dest["Prefix"]
 					} } : void 0
 				} };
@@ -9479,7 +9403,6 @@ var S3BucketProvider = class S3BucketProvider {
 				skipped.push(index);
 				continue;
 			}
-			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
 			let sentFormat;
 			const scheduleFrequencyRefusal = onUnusable ? configStringRefusal(config, "ScheduleFrequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[]") : void 0;
 			if (scheduleFrequencyRefusal !== void 0 && config["Schedule"] == null) {
@@ -9500,9 +9423,9 @@ var S3BucketProvider = class S3BucketProvider {
 				IncludedObjectVersions: readConfigString(config, "IncludedObjectVersions", INVENTORY_DEFAULT_INCLUDED_OBJECT_VERSIONS, "AWS::S3::Bucket InventoryConfigurations[]"),
 				Schedule: { Frequency: frequency },
 				Destination: { S3BucketDestination: s3Dest ? {
-					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
+					Bucket: s3Dest["BucketArn"],
 					AccountId: s3Dest["BucketAccountId"],
-					Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, destPath, { ...onUnusable ? { onUnusable } : {} }),
+					Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, inventoryDestPath, { ...onUnusable ? { onUnusable } : {} }),
 					Prefix: s3Dest["Prefix"]
 				} : void 0 },
 				OptionalFields: config["OptionalFields"],
@@ -89582,7 +89505,9 @@ function resolveAssetCodeDirectory(opts) {
 * `process.cwd()` survives only for a `StackInfo` carrying NEITHER field, where
 * base and bound coincide again.
 *
-* Exported for `local-start-api.ts`'s copy of the caller, and for unit testing.
+* Exported for `local-start-api.ts`'s copy of the caller, for the Docker
+* context check the ECS emulator commands run over cdk-local's `StackInfo`
+* (which is why it takes only the two fields it reads), and for unit testing.
 */
 function assetPathDirs(stack) {
 	const manifestDir = stack.assetManifestPath ? dirname(stack.assetManifestPath) : stack.assetOutdir ?? process.cwd();
@@ -91087,6 +91012,10 @@ async function runDetached(opts) {
 	const logger = getLogger().child("docker");
 	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(args).join(" ")}`);
 	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
+	const forwardedKeys = Object.keys(passthroughEnv);
+	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), `Container for image ${displayIdent(opts.image)}`);
+	if (refusal !== void 0) throw new DockerRunnerError(refusal);
+	warnFinchArgvExposure(forwardedKeys);
 	try {
 		const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
 			maxBuffer: 10485760,
@@ -91218,13 +91147,25 @@ const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 * wrapper translates cdk-local's thrown error back to cdkd's class at the shim
 * boundary, so a local-invoke build failure still surfaces with cdkd's exit code
 * / branding. `architectureToPlatform` is a pure helper (re-exported directly).
+*
+* It is also where the build context is CONTAINED: cdk-local joins
+* `source.directory` onto `cdkOutDir` with no check, so the shim refuses an
+* escaping value before delegating, against a REQUIRED `assetOutdir` bound
+* (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
 * See cdk-local's `src/local/docker-image-builder.ts`.
 */
-async function buildContainerImage$1(...args) {
-	const executable = args[0]?.source?.executable;
+async function buildContainerImage$1(asset, cdkOutDir, options) {
+	const executable = asset?.source?.executable;
 	if (executable && executable.length > 0) warnManifestExecutable(executable);
+	const { assetOutdir, ...implOptions } = options;
+	assertCdkLocalDockerContextContained({
+		manifestDir: cdkOutDir,
+		source: asset.source,
+		assetOutdir,
+		wrapError: (message) => new LocalInvokeBuildError$1(`Refusing to build the container image: ${message}`)
+	});
 	try {
-		return await buildContainerImage(...args);
+		return await buildContainerImage(asset, cdkOutDir, implOptions);
 	} catch (e) {
 		if (e instanceof LocalInvokeBuildError) throw new LocalInvokeBuildError$1(e.message);
 		throw e;
@@ -93456,7 +93397,10 @@ async function buildContainerSpec(args) {
 async function resolveContainerImageForStartApi(lambda, skipPull) {
 	const logger = getLogger();
 	const localBuild = await resolveLocalBuildPlan$1(lambda);
-	if (localBuild) return { imageRef: await buildContainerImage$1(localBuild.asset, localBuild.cdkOutDir, { architecture: lambda.architecture }) };
+	if (localBuild) return { imageRef: await buildContainerImage$1(localBuild.asset, localBuild.cdkOutDir, {
+		assetOutdir: localBuild.assetOutdir,
+		architecture: lambda.architecture
+	}) };
 	if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI cdkd can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
 	logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull (uses your own credentials — this command has no --ecr-role-arn, so a cross-account image needs cross-account ECR permissions)...`);
 	return { imageRef: await pullEcrImage(lambda.imageUri, { skipPull }) };
@@ -93470,16 +93414,16 @@ async function resolveContainerImageForStartApi(lambda, skipPull) {
 * the two commands evolve their asset-lookup heuristics independently.
 */
 async function resolveLocalBuildPlan$1(lambda) {
-	const manifestPath = lambda.stack.assetManifestPath;
-	if (!manifestPath) return void 0;
-	const cdkOutDir = path.dirname(manifestPath);
+	if (!lambda.stack.assetManifestPath) return void 0;
+	const { manifestDir: cdkOutDir, assetOutdir } = assetPathDirs(lambda.stack);
 	const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
 	if (!manifest) return void 0;
 	const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
 	if (!entry) return void 0;
 	return {
 		asset: entry.asset,
-		cdkOutDir
+		cdkOutDir,
+		assetOutdir
 	};
 }
 /**
@@ -94341,6 +94285,7 @@ async function createNetworkAndSidecar(args) {
 	sidecarArgs.push(...sidecarFlags);
 	if (sidecarCollisions.length > 0) logger.warn(`Sidecar env var(s) ${sidecarCollisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) and were NOT passed to the sidecar at all (they would hijack that client).`);
 	sidecarArgs.push(METADATA_ENDPOINT_IMAGE);
+	warnFinchArgvExposure(Object.keys(sidecarSensitiveEnv));
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
 		const { stdout } = await execFileAsync$2(getDockerCmd(), sidecarArgs, {
@@ -94655,6 +94600,12 @@ async function runEcsTask(task, options, state) {
 	if (task.containers.length === 0) throw new EcsTaskRunnerError(`Task '${task.taskDefinitionLogicalId}' has no containers — nothing to run.`);
 	for (const w of task.warnings) logger.warn(w);
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
+	const finchRefusals = [];
+	for (const c of task.containers) {
+		const refusal = finchSecretArgvRefusal(c.secrets.map((s) => s.name).filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), `Container ${displayIdent(c.name)}`);
+		if (refusal !== void 0) finchRefusals.push(refusal);
+	}
+	if (finchRefusals.length > 0) throw new EcsTaskRunnerError(finchRefusals.join("\n"));
 	const imagePlan = options.imagePlanByContainer ?? /* @__PURE__ */ new Map();
 	if (!options.imagePlanByContainer) await prepareImages(task, imagePlan, options);
 	const allSecrets = [];
@@ -94714,8 +94665,9 @@ async function runEcsTask(task, options, state) {
 		const args = dockerCmds.get(container.name);
 		logger.info(`Starting container '${container.name}' (image=${imagePlan.get(container.name)})`);
 		let id;
+		const sensitiveEnv = dockerEnvs.get(container.name);
+		warnFinchArgvExposure(Object.keys(sensitiveEnv));
 		try {
-			const sensitiveEnv = dockerEnvs.get(container.name);
 			const { stdout } = await execFileAsync$1(getDockerCmd(), args, {
 				maxBuffer: 10485760,
 				env: dockerSpawnEnvWithSensitive(sensitiveEnv)
@@ -95604,6 +95556,130 @@ function createLocalRunTaskCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/emulator-docker-context.ts
+/**
+* Decorate an `EmulatorStrategy` so every Docker image asset the bundled
+* engine could build for this run is containment-checked BEFORE it builds one
+* (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
+*
+* `cdkd local start-service` / `start-alb` hand the whole run to cdk-local's
+* `runEcsServiceEmulator`, which reads each stack's asset manifest itself and
+* joins `source.directory` onto the manifest directory raw — for an ECS
+* container image and for an ALB Lambda target's container image alike. No
+* argument reaches that join, so cdkd judges the manifests here instead.
+*
+* `resolveBoots` is the seam because the engine calls it after every synth —
+* at boot, and again on every `--watch` reload — and before any image is
+* built on either path. A refusal at boot fails the command; on a reload the
+* engine logs it and keeps the previous replicas serving, which is the
+* fail-closed outcome.
+*
+* Every stack with a manifest is checked, not only the booted targets' stacks:
+* which stack a target resolves to is decided inside the engine, and the ALB
+* front door builds Lambda images from stacks no ECS boot names. An escaping
+* `source.directory` is never something a real `cdk synth` writes, so
+* refusing one anywhere in the assembly costs a legitimate run nothing, and
+* `cdkd deploy` refuses the same assembly.
+*/
+function containEmulatorDockerContexts(strategy) {
+	return {
+		...strategy,
+		resolveBoots: (stacks, chosenTargets) => {
+			assertEmulatorDockerContextsContained(stacks);
+			return strategy.resolveBoots(stacks, chosenTargets);
+		}
+	};
+}
+/**
+* The check itself, over the manifests the engine will read. Exported for
+* unit testing.
+*
+* It reads the SAME file the engine does — `<manifest dir>/<stackName>.assets.json`,
+* not `assetManifestPath` verbatim — and refuses a `stackName` that would
+* carry that filename out of the manifest directory, as cdkd's own
+* `AssetManifestLoader.loadManifest` does.
+*
+* A manifest that is absent, unreadable or not JSON is skipped: the engine
+* reads it again and reports that failure itself, before building anything.
+*/
+function assertEmulatorDockerContextsContained(stacks) {
+	for (const stack of stacks) {
+		if (!stack.assetManifestPath) continue;
+		const dirs = assetPathDirs(stack);
+		const { manifestDir } = dirs;
+		const assetOutdir = stack.assetOutdir === void 0 || stack.assetOutdir === "" ? dirs.assetOutdir : engineAssemblyRoot(stack.assetOutdir);
+		const manifestFile = resolveAssemblyPath(manifestDir, `${stack.stackName}.assets.json`);
+		if (!manifestFile.contained) throw new LocalInvokeBuildError$1(`Refusing to build container images: the asset manifest for stack '${displaySafe(stack.stackName)}' ${renderAssemblyPathEscape(manifestFile, manifestDir)}`);
+		const dockerImages = readDockerImages(manifestFile.path);
+		for (const [assetId, asset] of Object.entries(dockerImages)) {
+			const source = asset?.source;
+			if (source === null || typeof source !== "object") continue;
+			const { directory } = source;
+			if (typeof directory !== "string") continue;
+			assertCdkLocalDockerContextContained({
+				manifestDir,
+				source,
+				assetOutdir,
+				wrapError: (message) => new LocalInvokeBuildError$1(`Refusing to build container image asset '${displaySafe(assetId)}' of stack '${displaySafe(stack.stackName)}': ${message}`)
+			});
+		}
+	}
+}
+/**
+* The containment bound the ENGINE itself uses for a stack it synthesized: its
+* `assetOutdir`, climbed to the parent assembly when `--app` names a
+* `cdk.Stage` sub-assembly. cdk-local enumerates no Stage stacks from an app
+* root, so `--app cdk.out/assembly-<Stage>` is the only way these commands run
+* a Stage, and its assets are staged one level up as `../asset.<hash>`.
+*
+* A copy of cdk-local's `assemblyRootOf` (not exported by the package): climb
+* only while the directory is named `assembly-*` AND its parent's
+* `manifest.json` declares it as a `cdk:cloud-assembly` artifact, and WARN
+* whenever a climb happens, since the predicate is read from the tree being
+* judged. Replace with the upstream export once one exists (go-to-k/cdkd#3597).
+*/
+function engineAssemblyRoot(outdir) {
+	let dir = resolve(outdir);
+	let climbed = false;
+	for (;;) {
+		if (!basename(dir).startsWith("assembly-")) break;
+		const parent = dirname(dir);
+		if (parent === dir || !parentDeclaresNestedAssembly(parent, basename(dir))) break;
+		dir = parent;
+		climbed = true;
+	}
+	if (!climbed) return outdir;
+	if (!warnedDerivedRoots.has(dir)) {
+		warnedDerivedRoots.add(dir);
+		getLogger().warn(`'${displaySafe(outdir)}' is a cdk.Stage sub-assembly, so cdkd is treating its parent '${displaySafe(dir)}' as the assembly root when it checks Docker build contexts — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named.`);
+	}
+	return dir;
+}
+const warnedDerivedRoots = /* @__PURE__ */ new Set();
+function parentDeclaresNestedAssembly(parent, child) {
+	try {
+		const artifacts = JSON.parse(readFileSync(join(parent, "manifest.json"), "utf-8")).artifacts;
+		if (artifacts === null || typeof artifacts !== "object") return false;
+		return Object.values(artifacts).some((a) => {
+			const art = a;
+			return art?.type === "cdk:cloud-assembly" && art.properties?.directoryName === child;
+		});
+	} catch {
+		return false;
+	}
+}
+function readDockerImages(manifestPath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(manifestPath, "utf-8"));
+	} catch {
+		return {};
+	}
+	const dockerImages = parsed?.dockerImages;
+	return dockerImages !== null && typeof dockerImages === "object" ? dockerImages : {};
+}
+
 //#endregion
 //#region src/cli/commands/local-start-service.ts
 /**
@@ -95631,6 +95707,17 @@ function serviceStrategy() {
 	};
 }
 /**
+* The `EmulatorStrategy` `cdkd local start-service` runs with:
+* {@link serviceStrategy}, decorated by `containEmulatorDockerContexts` so the
+* engine's own Docker builds are containment-checked (issue
+* [#3503](https://github.com/go-to-k/cdkd/issues/3503)). A NAMED seam for the
+* same reason `buildAlbEmulatorStrategy` is one: inline in the action, the
+* decorator was deletable at its only call site.
+*/
+function buildServiceEmulatorStrategy() {
+	return containEmulatorDockerContexts(serviceStrategy());
+}
+/**
 * `cdkl start-service <Stack/Service>...` — run one or more `AWS::ECS::Service`
 * resources locally as a long-running emulator. Spins up DesiredCount task
 * replicas per service (clamped by --max-tasks) using the same per-task
@@ -95643,7 +95730,7 @@ function serviceStrategy() {
 */
 function createLocalStartServiceCommand() {
 	const cmd = new Command("start-service").description("Run one or more AWS::ECS::Service resources locally as a long-running emulator. Spins up DesiredCount task replicas per service (clamped by --max-tasks) using the same per-task docker network + metadata sidecar pattern as `cdkd local run-task`, then keeps each replica running and restarts it on exit per --restart-policy. ^C tears every replica + sidecar + network down. Each <target> accepts a CDK display path (MyStack/MyService) or stack-qualified logical ID (MyStack:MyServiceXYZ); single-stack apps may omit the stack prefix. When two or more <target>s are supplied, every service is booted into a shared Cloud Map / Service Connect registry so peer services discover each other via docker --add-host overlay (Issue #460). Omit <targets> in an interactive terminal to multi-select the ECS services from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ECS::Service resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders);
+		await runEcsServiceEmulator(targets, options, buildServiceEmulatorStrategy(), cdkdExtraStateProviders);
 	}));
 	addStartServiceSpecificOptions(cmd);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
@@ -96539,6 +96626,7 @@ async function resolveAgentCoreImage(resolved, options, assemblyDir, loaded) {
 		if (manifest) {
 			const entry = getDockerImageBySourceHash(manifest, containerUri);
 			if (entry) return buildContainerImage$1(entry.asset, cdkOutDir, {
+				assetOutdir: assemblyDir,
 				architecture,
 				noBuild: options.build === false
 			});
@@ -97331,7 +97419,8 @@ function warnUnresolvedLambdaTargetEnv(strategy, options) {
 }
 /**
 * The `EmulatorStrategy` `cdkd local start-alb` runs with: cdk-local's ALB
-* strategy, decorated by {@link warnUnresolvedLambdaTargetEnv}.
+* strategy, decorated by {@link warnUnresolvedLambdaTargetEnv} and then by
+* `containEmulatorDockerContexts` (issue go-to-k/cdkd#3503).
 *
 * Extracted from the command's action for ONE reason, and it is the finding
 * that produced it: with the composition written inline in the `.action(...)`
@@ -97351,7 +97440,7 @@ function warnUnresolvedLambdaTargetEnv(strategy, options) {
 * can satisfy reads as coverage while providing none.
 */
 function buildAlbEmulatorStrategy(options) {
-	return warnUnresolvedLambdaTargetEnv(albStrategy(options), options);
+	return containEmulatorDockerContexts(warnUnresolvedLambdaTargetEnv(albStrategy(options), options));
 }
 /**
 * `cdkl start-alb <Stack/Alb>` — Issue #86 v1. Names an
@@ -97909,6 +97998,7 @@ async function resolveContainerImagePlan(lambda, options) {
 	const localBuild = await resolveLocalBuildPlan(lambda);
 	let imageRef;
 	if (localBuild) imageRef = await buildContainerImage$1(localBuild.asset, localBuild.cdkOutDir, {
+		assetOutdir: localBuild.assetOutdir,
 		architecture: lambda.architecture,
 		noBuild: options.build === false
 	});
@@ -97940,16 +98030,16 @@ async function resolveContainerImagePlan(lambda, options) {
 * apply either) — the caller falls back to the ECR-pull path.
 */
 async function resolveLocalBuildPlan(lambda) {
-	const manifestPath = lambda.stack.assetManifestPath;
-	if (!manifestPath) return void 0;
-	const cdkOutDir = dirname(manifestPath);
+	if (!lambda.stack.assetManifestPath) return void 0;
+	const { manifestDir: cdkOutDir, assetOutdir } = assetPathDirs(lambda.stack);
 	const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
 	if (!manifest) return void 0;
 	const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
 	if (!entry) return void 0;
 	return {
 		asset: entry.asset,
-		cdkOutDir
+		cdkOutDir,
+		assetOutdir
 	};
 }
 /**
@@ -98488,4 +98578,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CY92mXcX.js.map
+//# sourceMappingURL=program-Buh8Yn40.js.map