@go-to-k/cdkd 0.299.1 → 0.299.3

package/dist/{program-w-kAH85e.js → program-B4pWdUfl.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, xn as StateError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
 import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as NO_CC_HANDLERS_REASON, $c as resolveApp, $i as malformedLocalResourceEntriesWarning, $n as ledgerForStack, $o as shareLogOnlyValues, $r as sendableAssumeRoleCommand, $s as hasUnverifiableParameterRefusal, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourceEntriesForOrphan, Ac as dockerSpawnEnvWithSensitive, Ai as refStateLookupFromResource, Al as displayAssemblyPath, An as journaledOrphanPrintingBag, Ao as TemplateParser, Ar as deleteIndeterminateGuards, As as wholeStringLeavesOf, At as dropFailedHint, Ba as repairMalformedOrphansForReadOnly, Bc as runDockerForeground, Bi as UNREADABLE_RESOURCES_MAP_ROW, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bs as rebuildClientForBucketRegion, C as recordRetainedForReadoption, Ca as refuseMalformedOutputsForDestroy, Cc as validateContainerRepoName, Ci as carriesDynamicReference, Cl as defineOwnKey, Cn as collectDeclaredOutputNames, Co as templateResourceTypes, Cr as applyCustomResourceResponseExpiration, Cs as carriesSecretMask, D as withResourceDeadline, Da as refuseMalformedResourceEntriesForDestroy, Dc as describeDockerCapturedOutput, Di as AWS_NO_VALUE, Dl as ownValue, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Ds as recordNoEchoAttributeValues, E as serviceTokenBlockingReason, Ea as refuseMalformedResourceEntriesForDeploy, Ec as resolveDockerContextDirectory, Ei as keepsSecretReferenceToken, El as nullPrototypeRecord, En as bindingSkippedOutputs, Er as slowCcOperationTimeoutMs, Es as recordMaskOnlyValuesIn, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as refuseMalformedResourcesForDeploy, Fc as isMalformedEnvKey, Fi as declaresNoEcho, Fn as secretNamedRecordNeedles, Fo as maskWholeValue, Fs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ft as sameJournaledOrphans, Ga as unpreviewableOrphanRecords, Gc as stripForDisplay, Gi as hasReadableOutputs, Gn as isFinalSnapshotError, Go as carryLogOnlyValues, Gr as poisonRenderedSpellingsCollidingIn, Gs as isAccessDenied, Gt as isJournaledOrphan, Ha as repairMalformedResourceEntriesForReadOnly, Hc as warnFinchArgvExposure, Hi as deployRefusesOrphanRowsReason, Hn as ccRoutedFinalSnapshotError, Ho as readsNoEchoSource, Hr as DiffCalculator, Hs as CrossPrefixScanCache, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as refuseMalformedResourcesForDestroy, Ic as partitionSensitiveEnv, Ii as JSON_LISTING_HOLE_VALUE, Il as resolveBucketRegion, In as stateSecretNameNeedles, Io as maskedLeafCoordinatesOf, Is as isSingleDynamicReferenceToken, It as replayFailedOperations, Ja as withheldAccountClause, Jc as Synthesizer, Ji as isReadableResourceEntry, Jn as maskingRetryLogger, Jo as literalSplitDelimitersOf, Jr as applyRoleArnIfSet, Js as acceptedCreateOnlyDropsOf, Jt as planRollback, Ka as unreadableOrphanRecords, Kc as AssetManifestLoader, Ki as hasReadableResources, Kn as refusesFinalSnapshot, Ko as createUnionSecretMasker, Kr as producerLookupOver, Ks as isNotImplemented, Kt as isReplacementOrphan, L as perType, La as refuseMalformedResourcesForExport, Lc as redactDockerArgvValues, Li as STATE_REGION_DIVERGED, Ln as storedSecretNameNeedles, Lo as noEchoCoordinatesOf, Ls as LockManager, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcePropertiesForDrift, Mc as formatDockerLoginError, Mi as withSharedDrainBudget, Ml as resolveAssemblyPath, Mn as orphanRecordsPrintingBag, Mo as isMarkedCoordinate, Mr as deleteSkipReason, Ms as STATE_SOURCED_CROSS_GENERATION_RULES, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedResourcePropertiesForExport, Nc as getDockerCmd, Ni as parameterInputsFor, Nl as injectAwsRegion, Nn as secretNamePrintingBag, No as maskAtCoordinates, Ns as STATE_SOURCED_READBACK_RULES, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourceEntriesForImport, Oc as describeDockerExecFailure, Oi as cfnRefValueFromPhysicalId, Ol as absoluteAssemblyPathEscape, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Or as RollbackInlinePolicyWriters, Os as recordNoEchoParameterFreshValue, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as refuseMalformedResourcePropertiesForOrphan, Pc as isDockerClientEnvKey, Pl as injectedAwsRegionValue, Pn as secretNamePrintingBags, Po as maskReadbackAtCoordinates, Pr as isWaitAbandonedError, Ps as TEMPLATE_SOURCED_RULES, Pt as makeForeignHolderScan, Qc as loadCdkJson, Qi as malformedLocalOutputsWarning, Qo as recordLogOnlyValue, Qr as isIamRoleArn, Qs as hasReasonlessBaselineRefusal, Qt as resolveReplacementOldType, R as readProtection, Ra as refuseMalformedState, Rc as redactedCause, Ri as STATE_RESOURCES_MALFORMED, Rn as extractDeploymentEventError, Ro as noEchoLeavesOf, Rs as isLockInfoExpired, S as keptForReadoption, Sa as refuseMalformedOutputs, Sc as validateAssetBucketName, Si as isImpossibleEmptyStoredAttribute, Sl as processStackMessages, Sn as noEchoParameterValueSeed, So as prefetchCreateOnlyPropertyPaths, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as splitGetAttStringForm, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntries, Tc as buildDockerImage, Ti as isNamelessDynamicReferenceError, Tl as hasPlainPrototype, Tn as isExportAliasCollision, To as withRetry, Tr as CloudControlProvider, Ts as recordMaskOnlyValue, Tt as withNestedRevertRun, Ua as repairMalformedResourcePropertiesForReadOnly, Uc as escapeRegExp, Ui as displayLogicalId, Un as createPreDeleteFinalSnapshot, Uo as valueAtCoordinate, Ur as INTRINSIC_KEYS, Us as applyCrossPrefixScan, Ut as recordAfterRollbackUpdate, Va as repairMalformedOutputsForReadOnly, Vc as runDockerStreaming, Vi as accountArgs, Vn as buildFinalSnapshotIdentifier, Vo as readbackPathFor, Vs as CrossPrefixReadError, Vt as withStackRecords, Wa as repairMalformedResourcesForReadOnly, Wc as stripControlChars, Wi as hasReadableOrphans, Wn as effectiveDeletionPolicy, Wo as liveMatchesUnresolvedTokenFrame, Wr as IntrinsicFunctionResolver, Ws as crossPrefixDeniedWarning, Wt as demoteSupersededOrphans, Xc as getDefaultStateBucketName, Xi as malformedExportNamesWarning, Xn as findDestructiveChanges, Xo as printingCorpusOf, Xr as assertSendableRoleArn, Xs as exportNamesCarriedFrom, Xt as recordUnderIdIsNotOwn, Ya as findActionableSilentDrops, Yc as synthesisStatusMessage, Yi as malformedDriftResourcePropertiesWarning, Yn as constructPathOf, Yo as logOnlyValueCount, Yr as assertFlagRoleArn, Ys as describeRegionValueKind, Yt as recheckFailedPlan, Za as unwrittenCreateOnlyReplacement, Zc as getLegacyStateBucketName, Zi as malformedExportSourceWarning, Zn as formatDestructiveChange, Zo as recordLogOnlyParameterValue, Zr as explicitRoleArnOrThrow, Zs as hasReadableExportSet, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOrphanRecords, _c as ensureAssetStorage, _i as regionLessSecretName, _l as PARTITION_TABLE, _n as secretSafeKeyDisplay, _r as TemplateNoEchoReresolver, _s as recordNestedStackParameterExpressions, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedOrphansWarning, ac as shouldRetainResource, ai as keepHeldTokenProvenance, al as resolveUseCdkBootstrapAssets, ao as isStatefulRecreateTargetSync, at as cyan, ba as refuseMalformedOrphansForDestroy, bc as parseBootstrapMarker, bi as parameterTypeMayLoseSecretIdentity, bl as AssemblyReader, bn as exportNameSecretExposure, c as renderNestedTemplateTreeDefect, ca as malformedRenderedContainersWarning, cc as stringifyValue, ci as recordedReferenceRegions, cl as ssmResolvedValueType, cn as updatePartialMessage, cs as scrubResourceRecord, ct as red, d as conditionInputsFrom, da as malformedResourcesWarning, dc as createAssetRedirectResolver, dl as MIGRATE_TMP_PREFIX, dn as DeploymentEventsStore, ds as DYNAMIC_REFERENCE_TOKEN_SCAN, dt as namesAnyDeclaredParameter, ea as malformedLocalResourcesWarning, ec as importableOutputKeys, ei as AWS_CREDENTIAL_ENV_KEYS, el as resolveAutoAssetStorage, en as orphanDeleteNeedsIdentity, eo as hasNoCloudControlHandlers, es as createSecretMasker, f as parentSuppliedValues, fa as malformedScrubResourceEntriesRefusalMessage, fc as loadPublishableAssetManifest, fl as findLargeInlineResources, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as dynamicReferenceTokens, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, gc as assertAssetBucketRegion, gi as producerRegionsFromState, gl as expectedOwnerParam, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as inheritNestedStackParameterAssociations, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseDivergentRecordRegionForDestroy, hc as BOOTSTRAP_MARKER_PREFIX, hi as classifyReplaySecretRegion, hl as decodeListingKey, hn as secretBearing, hr as isCustomResource, hs as identityKeyFor, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedOrphansRefusalMessage, ic as orphansCarriedFrom, il as resolveStateBucketWithDefaultAndSource, io as isStatefulRecreateTargetForReplace, is as markSameGenerationBag, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcePropertiesForDestroy, jc as finchSecretArgvRefusal, jl as renderAssemblyPathEscape, jn as maskEventTextWithBoundBags, jo as canonicalCoordinates, jr as deleteLeftInPlace, js as STATE_SOURCED_BASELINE_RULES, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourceEntriesForImportSave, kc as describeDockerFailure, ki as isStalePlaceholderArnAttribute, kl as describeFileReadFailure, kn as completedReplayEntries, ko as DagBuilder, kr as UNSPECIFIED_SKIP_REASON, ks as recordProvenPublicExpression, kt as deleteJournaledOrphans, l as templateIdentity, la as malformedResourceEntriesWarning, lc as WorkGraph, ll as CFN_TEMPLATE_BODY_LIMIT, ln as updatePartialReason, ls as withPhysicalNameCopies, lt as yellow, m as isSecretBearingReferenceString, ma as previewableOrphanRecords, mc as AssetModeResolver, mi as classifyRecordedSecretRegion, ml as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as pathCrossesDottedKey, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOrphanRecordsWarning, nc as isReadableBag, ni as callerEnvCredentials, nl as resolveSkipPrefix, no as shownType, ns as maskSecretsInError, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedOutputsRefusalMessage, oc as AssetPublisher, ol as stateBucketExistenceConfirmed, oo as renderStatefulReason, ot as gray, p as readRecordedConditionVerdicts, pa as malformedStateRefusalMessage, pc as rewriteTemplateAssetReferences, pl as uploadCfnTemplate, pn as displayTextOrWithheld, pr as ProviderRegistry, ps as isUncertifiedBaselineMaskPosition, pt as resourcesNamingDeclaredParameter, qa as unreadableResourceEntries, qc as getDockerImageBySourceHash, qi as isReadableOrphanRecord, qn as unsupportedFinalSnapshotError, qo as hasMaskableValues, qr as refuseUnreadableCdkCrossAccountRefs, qs as splitImportedOps, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedOrphanRowsKeptWarning, rc as orphansAfterRollback, ri as envCredentialsAreAssumedRole, rl as resolveStateBucketWithDefault, rn as inheritProducerRegions, ro as MULTI_REGION_RECREATE_BLOCKED_TYPES, rs as maskSecretsInText, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedOutputsWarning, sc as isSensitiveAttributeName, si as recordedOutputReferenceRegions, sl as warnDeprecatedNoPrefixCliFlag, ss as redactSecretsForState, st as green, t as DeployEngine, ta as malformedOrphanRecordsRefusalMessage, tc as importableOutputs, ti as applyCallerIdentityCredentials, tl as resolveCaptureObservedState, tn as findNestedStackTypeChanges, to as findReplacedReadersOfRecreateTargets, tr as withCreateTokenLedger, ts as errorCauseChain, u as conditionFingerprint, ua as malformedResourcePropertiesWarning, uc as buildAssetRedirectMap, ul as CFN_TEMPLATE_URL_LIMIT, un as DeploymentEventsReader, ut as computeParameterTaint, va as refuseMalformedOrphanRecordsForDestroy, vc as getBootstrapMarkerKey, vi as coerceParameterTypedValue, vl as canonicalizeRegion, vn as carriedExportAliasExposure, vr as readsNoEchoDeleteValues, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceAttributesForOrphan, wc as buildDenyExternalAccessPolicy, wi as carriesFetchableDynamicReference, wl as hasOwnKey, wn as collectPublishedOutputNames, wo as describeTypeWithThrottleRetry, wr as customResourceResponseExpirationWarning, ws as provenPublicValue, wt as revertedNestedRowIds, xa as refuseMalformedOrphansForOrphan, xc as readBootstrapMarkerBody, xi as getAccountInfo, xl as StageLoadError, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordPhysicalNameCopy, xt as nestedChildStackName$1, ya as refuseMalformedOrphans, yc as isCrossRegionRedirect, yi as isUnboundTemplateParameter, yl as derivePartitionAndUrlSuffix, yn as exportNameNoEchoParameters, yr as isCustomResourceType$1, ys as physicalNameCopiesOf, yt as dropSettledNestedJournals, za as repairMalformedOrphanRecordsForReadOnly, zc as redactedDockerCause, zi as UNREADABLE_ORPHANS_CONTAINER_ROW, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as noEchoOutputsComparison, zs as S3StateBackend, zt as destroyStackRecordsView } from "./deploy-engine-CZUhJ1IZ.js";
-import { t as getCdkdVersion } from "./version-DMqEiJIt.js";
+import { $a as NO_CC_HANDLERS_REASON, $c as resolveApp, $i as malformedLocalResourceEntriesWarning, $n as ledgerForStack, $o as shareLogOnlyValues, $r as sendableAssumeRoleCommand, $s as hasUnverifiableParameterRefusal, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourceEntriesForOrphan, Ac as dockerSpawnEnvWithSensitive, Ai as refStateLookupFromResource, Al as displayAssemblyPath, An as journaledOrphanPrintingBag, Ao as TemplateParser, Ar as deleteIndeterminateGuards, As as wholeStringLeavesOf, At as dropFailedHint, Ba as repairMalformedOrphansForReadOnly, Bc as runDockerForeground, Bi as UNREADABLE_RESOURCES_MAP_ROW, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bs as rebuildClientForBucketRegion, C as recordRetainedForReadoption, Ca as refuseMalformedOutputsForDestroy, Cc as validateContainerRepoName, Ci as carriesDynamicReference, Cl as defineOwnKey, Cn as collectDeclaredOutputNames, Co as templateResourceTypes, Cr as applyCustomResourceResponseExpiration, Cs as carriesSecretMask, D as withResourceDeadline, Da as refuseMalformedResourceEntriesForDestroy, Dc as describeDockerCapturedOutput, Di as AWS_NO_VALUE, Dl as ownValue, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Ds as recordNoEchoAttributeValues, E as serviceTokenBlockingReason, Ea as refuseMalformedResourceEntriesForDeploy, Ec as resolveDockerContextDirectory, Ei as keepsSecretReferenceToken, El as nullPrototypeRecord, En as bindingSkippedOutputs, Er as slowCcOperationTimeoutMs, Es as recordMaskOnlyValuesIn, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as refuseMalformedResourcesForDeploy, Fc as isMalformedEnvKey, Fi as declaresNoEcho, Fn as secretNamedRecordNeedles, Fo as maskWholeValue, Fs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ft as sameJournaledOrphans, Ga as unpreviewableOrphanRecords, Gc as stripForDisplay, Gi as hasReadableOutputs, Gn as isFinalSnapshotError, Go as carryLogOnlyValues, Gr as poisonRenderedSpellingsCollidingIn, Gs as isAccessDenied, Gt as isJournaledOrphan, Ha as repairMalformedResourceEntriesForReadOnly, Hc as warnFinchArgvExposure, Hi as deployRefusesOrphanRowsReason, Hn as ccRoutedFinalSnapshotError, Ho as readsNoEchoSource, Hr as DiffCalculator, Hs as CrossPrefixScanCache, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as refuseMalformedResourcesForDestroy, Ic as partitionSensitiveEnv, Ii as JSON_LISTING_HOLE_VALUE, Il as resolveBucketRegion, In as stateSecretNameNeedles, Io as maskedLeafCoordinatesOf, Is as isSingleDynamicReferenceToken, It as replayFailedOperations, Ja as withheldAccountClause, Jc as Synthesizer, Ji as isReadableResourceEntry, Jn as maskingRetryLogger, Jo as literalSplitDelimitersOf, Jr as applyRoleArnIfSet, Js as acceptedCreateOnlyDropsOf, Jt as planRollback, Ka as unreadableOrphanRecords, Kc as AssetManifestLoader, Ki as hasReadableResources, Kn as refusesFinalSnapshot, Ko as createUnionSecretMasker, Kr as producerLookupOver, Ks as isNotImplemented, Kt as isReplacementOrphan, L as perType, La as refuseMalformedResourcesForExport, Lc as redactDockerArgvValues, Li as STATE_REGION_DIVERGED, Ln as storedSecretNameNeedles, Lo as noEchoCoordinatesOf, Ls as LockManager, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcePropertiesForDrift, Mc as formatDockerLoginError, Mi as withSharedDrainBudget, Ml as resolveAssemblyPath, Mn as orphanRecordsPrintingBag, Mo as isMarkedCoordinate, Mr as deleteSkipReason, Ms as STATE_SOURCED_CROSS_GENERATION_RULES, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedResourcePropertiesForExport, Nc as getDockerCmd, Ni as parameterInputsFor, Nl as injectAwsRegion, Nn as secretNamePrintingBag, No as maskAtCoordinates, Ns as STATE_SOURCED_READBACK_RULES, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourceEntriesForImport, Oc as describeDockerExecFailure, Oi as cfnRefValueFromPhysicalId, Ol as absoluteAssemblyPathEscape, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Or as RollbackInlinePolicyWriters, Os as recordNoEchoParameterFreshValue, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as refuseMalformedResourcePropertiesForOrphan, Pc as isDockerClientEnvKey, Pl as injectedAwsRegionValue, Pn as secretNamePrintingBags, Po as maskReadbackAtCoordinates, Pr as isWaitAbandonedError, Ps as TEMPLATE_SOURCED_RULES, Pt as makeForeignHolderScan, Qc as loadCdkJson, Qi as malformedLocalOutputsWarning, Qo as recordLogOnlyValue, Qr as isIamRoleArn, Qs as hasReasonlessBaselineRefusal, Qt as resolveReplacementOldType, R as readProtection, Ra as refuseMalformedState, Rc as redactedCause, Ri as STATE_RESOURCES_MALFORMED, Rn as extractDeploymentEventError, Ro as noEchoLeavesOf, Rs as isLockInfoExpired, S as keptForReadoption, Sa as refuseMalformedOutputs, Sc as validateAssetBucketName, Si as isImpossibleEmptyStoredAttribute, Sl as processStackMessages, Sn as noEchoParameterValueSeed, So as prefetchCreateOnlyPropertyPaths, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as splitGetAttStringForm, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntries, Tc as buildDockerImage, Ti as isNamelessDynamicReferenceError, Tl as hasPlainPrototype, Tn as isExportAliasCollision, To as withRetry, Tr as CloudControlProvider, Ts as recordMaskOnlyValue, Tt as withNestedRevertRun, Ua as repairMalformedResourcePropertiesForReadOnly, Uc as escapeRegExp, Ui as displayLogicalId, Un as createPreDeleteFinalSnapshot, Uo as valueAtCoordinate, Ur as INTRINSIC_KEYS, Us as applyCrossPrefixScan, Ut as recordAfterRollbackUpdate, Va as repairMalformedOutputsForReadOnly, Vc as runDockerStreaming, Vi as accountArgs, Vn as buildFinalSnapshotIdentifier, Vo as readbackPathFor, Vs as CrossPrefixReadError, Vt as withStackRecords, Wa as repairMalformedResourcesForReadOnly, Wc as stripControlChars, Wi as hasReadableOrphans, Wn as effectiveDeletionPolicy, Wo as liveMatchesUnresolvedTokenFrame, Wr as IntrinsicFunctionResolver, Ws as crossPrefixDeniedWarning, Wt as demoteSupersededOrphans, Xc as getDefaultStateBucketName, Xi as malformedExportNamesWarning, Xn as findDestructiveChanges, Xo as printingCorpusOf, Xr as assertSendableRoleArn, Xs as exportNamesCarriedFrom, Xt as recordUnderIdIsNotOwn, Ya as findActionableSilentDrops, Yc as synthesisStatusMessage, Yi as malformedDriftResourcePropertiesWarning, Yn as constructPathOf, Yo as logOnlyValueCount, Yr as assertFlagRoleArn, Ys as describeRegionValueKind, Yt as recheckFailedPlan, Za as unwrittenCreateOnlyReplacement, Zc as getLegacyStateBucketName, Zi as malformedExportSourceWarning, Zn as formatDestructiveChange, Zo as recordLogOnlyParameterValue, Zr as explicitRoleArnOrThrow, Zs as hasReadableExportSet, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOrphanRecords, _c as ensureAssetStorage, _i as regionLessSecretName, _l as PARTITION_TABLE, _n as secretSafeKeyDisplay, _r as TemplateNoEchoReresolver, _s as recordNestedStackParameterExpressions, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedOrphansWarning, ac as shouldRetainResource, ai as keepHeldTokenProvenance, al as resolveUseCdkBootstrapAssets, ao as isStatefulRecreateTargetSync, at as cyan, ba as refuseMalformedOrphansForDestroy, bc as parseBootstrapMarker, bi as parameterTypeMayLoseSecretIdentity, bl as AssemblyReader, bn as exportNameSecretExposure, c as renderNestedTemplateTreeDefect, ca as malformedRenderedContainersWarning, cc as stringifyValue, ci as recordedReferenceRegions, cl as ssmResolvedValueType, cn as updatePartialMessage, cs as scrubResourceRecord, ct as red, d as conditionInputsFrom, da as malformedResourcesWarning, dc as createAssetRedirectResolver, dl as MIGRATE_TMP_PREFIX, dn as DeploymentEventsStore, ds as DYNAMIC_REFERENCE_TOKEN_SCAN, dt as namesAnyDeclaredParameter, ea as malformedLocalResourcesWarning, ec as importableOutputKeys, ei as AWS_CREDENTIAL_ENV_KEYS, el as resolveAutoAssetStorage, en as orphanDeleteNeedsIdentity, eo as hasNoCloudControlHandlers, es as createSecretMasker, f as parentSuppliedValues, fa as malformedScrubResourceEntriesRefusalMessage, fc as loadPublishableAssetManifest, fl as findLargeInlineResources, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as dynamicReferenceTokens, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, gc as assertAssetBucketRegion, gi as producerRegionsFromState, gl as expectedOwnerParam, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as inheritNestedStackParameterAssociations, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseDivergentRecordRegionForDestroy, hc as BOOTSTRAP_MARKER_PREFIX, hi as classifyReplaySecretRegion, hl as decodeListingKey, hn as secretBearing, hr as isCustomResource, hs as identityKeyFor, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedOrphansRefusalMessage, ic as orphansCarriedFrom, il as resolveStateBucketWithDefaultAndSource, io as isStatefulRecreateTargetForReplace, is as markSameGenerationBag, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcePropertiesForDestroy, jc as finchSecretArgvRefusal, jl as renderAssemblyPathEscape, jn as maskEventTextWithBoundBags, jo as canonicalCoordinates, jr as deleteLeftInPlace, js as STATE_SOURCED_BASELINE_RULES, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourceEntriesForImportSave, kc as describeDockerFailure, ki as isStalePlaceholderArnAttribute, kl as describeFileReadFailure, kn as completedReplayEntries, ko as DagBuilder, kr as UNSPECIFIED_SKIP_REASON, ks as recordProvenPublicExpression, kt as deleteJournaledOrphans, l as templateIdentity, la as malformedResourceEntriesWarning, lc as WorkGraph, ll as CFN_TEMPLATE_BODY_LIMIT, ln as updatePartialReason, ls as withPhysicalNameCopies, lt as yellow, m as isSecretBearingReferenceString, ma as previewableOrphanRecords, mc as AssetModeResolver, mi as classifyRecordedSecretRegion, ml as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as pathCrossesDottedKey, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOrphanRecordsWarning, nc as isReadableBag, ni as callerEnvCredentials, nl as resolveSkipPrefix, no as shownType, ns as maskSecretsInError, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedOutputsRefusalMessage, oc as AssetPublisher, ol as stateBucketExistenceConfirmed, oo as renderStatefulReason, ot as gray, p as readRecordedConditionVerdicts, pa as malformedStateRefusalMessage, pc as rewriteTemplateAssetReferences, pl as uploadCfnTemplate, pn as displayTextOrWithheld, pr as ProviderRegistry, ps as isUncertifiedBaselineMaskPosition, pt as resourcesNamingDeclaredParameter, qa as unreadableResourceEntries, qc as getDockerImageBySourceHash, qi as isReadableOrphanRecord, qn as unsupportedFinalSnapshotError, qo as hasMaskableValues, qr as refuseUnreadableCdkCrossAccountRefs, qs as splitImportedOps, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedOrphanRowsKeptWarning, rc as orphansAfterRollback, ri as envCredentialsAreAssumedRole, rl as resolveStateBucketWithDefault, rn as inheritProducerRegions, ro as MULTI_REGION_RECREATE_BLOCKED_TYPES, rs as maskSecretsInText, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedOutputsWarning, sc as isSensitiveAttributeName, si as recordedOutputReferenceRegions, sl as warnDeprecatedNoPrefixCliFlag, ss as redactSecretsForState, st as green, t as DeployEngine, ta as malformedOrphanRecordsRefusalMessage, tc as importableOutputs, ti as applyCallerIdentityCredentials, tl as resolveCaptureObservedState, tn as findNestedStackTypeChanges, to as findReplacedReadersOfRecreateTargets, tr as withCreateTokenLedger, ts as errorCauseChain, u as conditionFingerprint, ua as malformedResourcePropertiesWarning, uc as buildAssetRedirectMap, ul as CFN_TEMPLATE_URL_LIMIT, un as DeploymentEventsReader, ut as computeParameterTaint, va as refuseMalformedOrphanRecordsForDestroy, vc as getBootstrapMarkerKey, vi as coerceParameterTypedValue, vl as canonicalizeRegion, vn as carriedExportAliasExposure, vr as readsNoEchoDeleteValues, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceAttributesForOrphan, wc as buildDenyExternalAccessPolicy, wi as carriesFetchableDynamicReference, wl as hasOwnKey, wn as collectPublishedOutputNames, wo as describeTypeWithThrottleRetry, wr as customResourceResponseExpirationWarning, ws as provenPublicValue, wt as revertedNestedRowIds, xa as refuseMalformedOrphansForOrphan, xc as readBootstrapMarkerBody, xi as getAccountInfo, xl as StageLoadError, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordPhysicalNameCopy, xt as nestedChildStackName$1, ya as refuseMalformedOrphans, yc as isCrossRegionRedirect, yi as isUnboundTemplateParameter, yl as derivePartitionAndUrlSuffix, yn as exportNameNoEchoParameters, yr as isCustomResourceType$1, ys as physicalNameCopiesOf, yt as dropSettledNestedJournals, za as repairMalformedOrphanRecordsForReadOnly, zc as redactedDockerCause, zi as UNREADABLE_ORPHANS_CONTAINER_ROW, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as noEchoOutputsComparison, zs as S3StateBackend, zt as destroyStackRecordsView } from "./deploy-engine-DEBgHf6Z.js";
+import { t as getCdkdVersion } from "./version-B7Gzz6TR.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2561,7 +2561,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-Xrt4DIC7.js");
+	providerClasses ??= import("./provider-classes-BFHOZwKd.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -10924,6 +10924,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 					try {
 						const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, {
 							desiredFromAwsReadback: true,
+							declaredEmptyProperties: declaredEmptyProperties(stateResource.properties),
 							maskSecrets: createSecretMasker(secrets),
 							expectedRegion: report.region,
 							recordedAttributes: stateResource.attributes,
@@ -11407,6 +11408,21 @@ function otherPhysicalIds(resources, logicalId) {
 	for (const [id, record] of Object.entries(resources ?? {})) if (id !== logicalId && typeof record?.physicalId === "string") ids.push(record.physicalId);
 	return ids;
 }
+function declaredEmptyProperties(properties) {
+	const out = /* @__PURE__ */ new Set();
+	if (typeof properties !== "object" || properties === null || Array.isArray(properties)) return out;
+	const isEmpty = (v) => Array.isArray(v) && v.length === 0 || typeof v === "object" && v !== null && !Array.isArray(v) && Object.keys(v).length === 0;
+	for (const [key, value] of Object.entries(properties)) if (typeof value === "string") {
+		if (value.trim() === "") {
+			out.add(key);
+			continue;
+		}
+		try {
+			if (isEmpty(JSON.parse(value))) out.add(key);
+		} catch {}
+	} else if (isEmpty(value)) out.add(key);
+	return out;
+}
 
 //#endregion
 //#region src/cli/commands/stack-lock-guard.ts
@@ -11493,12 +11509,17 @@ async function acquireStackLock(opts) {
 //#endregion
 //#region src/provisioning/secret-principal-resolution.ts
 const TRANSIENT_RESOLUTION_MESSAGE = "Resolving a secret-derived IAM principal list was throttled or hit a server error";
-async function resolveSecretDerivedPrincipals(values, region, importedProducerRegions, makeResolver = (r) => new IntrinsicFunctionResolver(r)) {
+function resolvableVerdict(verdict) {
+	return verdict.kind === "local" || verdict.kind === "recorded-region";
+}
+async function resolveSecretDerivedPrincipals(values, region, importedProducerRegions, recordedRegions, makeResolver = (r) => new IntrinsicFunctionResolver(r)) {
 	if (!region) return void 0;
+	const stackRegion = region;
+	const verdictOf = (token) => classifyRecordedSecretRegion(token, stackRegion, importedProducerRegions, recordedRegions);
 	const entries = {};
 	for (const key of Object.keys(values)) {
 		const value = values[key];
-		if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && !entry.includes("***") && (!entry.includes("{{resolve:") || dynamicReferenceTokens(entry).length > 0 && dynamicReferenceTokens(entry).every((t) => classifyReplaySecretRegion(t, region, importedProducerRegions).kind === "local")))) return;
+		if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && !entry.includes("***") && (!entry.includes("{{resolve:") || dynamicReferenceTokens(entry).length > 0 && dynamicReferenceTokens(entry).every((t) => resolvableVerdict(verdictOf(t)))))) return;
 		entries[key] = value;
 	}
 	const secrets = /* @__PURE__ */ new Map();
@@ -11521,7 +11542,7 @@ async function resolveSecretDerivedPrincipals(values, region, importedProducerRe
 			let resolved;
 			try {
 				resolver ??= makeResolver(region);
-				resolved = await resolver.resolveDynamicReferences(entry, context);
+				resolved = await resolveEntry(entry, resolver, verdictOf, context);
 			} catch (error) {
 				if (isThrottlingError(error) || isTransientServerError(error)) throw new Error(TRANSIENT_RESOLUTION_MESSAGE, { cause: maskSecretsInError(error, secrets) });
 				return;
@@ -11541,6 +11562,21 @@ async function resolveSecretDerivedPrincipals(values, region, importedProducerRe
 		resolvedNames
 	};
 }
+async function resolveEntry(entry, primary, verdictOf, context) {
+	const tokens = dynamicReferenceTokens(entry).map((t) => [t, verdictOf(t)]);
+	if (!tokens.some(([, v]) => v.kind === "recorded-region")) return await primary.resolveDynamicReferences(entry, context);
+	let out = "";
+	let cursor = 0;
+	for (const [token, verdict] of tokens) {
+		const at = entry.indexOf(token, cursor);
+		if (at < 0) throw new Error("A scanned dynamic reference is not in the entry it was scanned from");
+		out += entry.slice(cursor, at);
+		const resolver = verdict.kind === "recorded-region" ? primary.resolverForRecordedRegion(verdict.region) : primary;
+		out += await resolver.resolveDynamicReferences(token, context);
+		cursor = at + token.length;
+	}
+	return out + entry.slice(cursor);
+}
 function isResolvableSecretPrincipalList(value) {
 	if (!Array.isArray(value) || !value.every((e) => typeof e === "string")) return false;
 	const entries = value;
@@ -12044,9 +12080,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, slowTypeMinTimeoutMs, globalTimeoutMs);
 					let deleteResult;
 					let childLeftInAws = 0;
+					const recordedRegions = secretPrincipalRegions !== void 0 ? recordedReferenceRegions(resource) : void 0;
 					const secretPrincipalOptIn = secretPrincipalRegions !== void 0 ? {
 						importedProducerRegions: secretPrincipalRegions,
-						retryMemo: { detached: /* @__PURE__ */ new Set() }
+						retryMemo: { detached: /* @__PURE__ */ new Set() },
+						...recordedRegions !== void 0 && { recordedRegions }
 					} : void 0;
 					await withResourceDeadline(async () => {
 						const maxAttempts = provider.disableOuterRetry ? 0 : 3;
@@ -29368,4 +29406,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-w-kAH85e.js.map
+//# sourceMappingURL=program-B4pWdUfl.js.map