@go-to-k/cdkd 0.300.0 → 0.300.2

package/dist/{program-BHjdsRtD.js → program-BDm58Wc8.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, xn as StateError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-BxP3yqlr.js";
+import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DFk7zr0Q.js";
 import { a as setAssumedRoleCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $c as synthesisStatusMessage, $i as malformedExportNamesWarning, $n as findDestructiveChanges, $o as printingCorpusOf, $r as assertSendableRoleArn, $s as describeRegionValueKind, $t as recordUnderIdIsNotOwn, A as diffSecurity, Aa as refuseMalformedResourceEntriesForDestroy, Ac as resolveDockerContextDirectory, Ai as AWS_NO_VALUE, Al as nullPrototypeRecord, An as DEFAULT_RESOURCE_TIMEOUT_MS, As as recordMaskOnlyValuesIn, At as withNestedStackContext, B as readProtection, Ba as refuseMalformedResourcesForExport, Bc as partitionSensitiveEnv, Bi as STATE_REGION_DIVERGED, Bl as resolveBucketRegion, Bn as storedSecretNameNeedles, Bo as noEchoCoordinatesOf, Bs as isSingleDynamicReferenceToken, Ca as refuseMalformedOrphansForDestroy, Cc as isCrossRegionRedirect, Ci as parameterTypeMayLoseSecretIdentity, Cl as derivePartitionAndUrlSuffix, Cn as exportNameSecretExposure, Cs as physicalNameCopiesOf, Ct as nestedChildStackName$1, D as findServiceTokenRefusals, Da as refuseMalformedResourceAttributesForOrphan, Dc as validateContainerRepoName, Di as carriesFetchableDynamicReference, Dl as defineOwnKey, Dn as collectPublishedOutputNames, Do as describeTypeWithThrottleRetry, Dr as customResourceResponseExpirationWarning, Ds as carriesSecretMask, Dt as withNestedRevertRun, E as deferredServiceTokenWarning, Ea as refuseMalformedOutputsForDestroy, Ec as validateAssetBucketName, Ei as carriesDynamicReference, El as processStackMessages, En as collectDeclaredOutputNames, Eo as templateResourceTypes, Er as applyCustomResourceResponseExpiration, Es as splitGetAttStringForm, Et as revertedNestedRowIds, F as recordedProtectionEvidence, Fa as refuseMalformedResourcePropertiesForDrift, Fc as finchSecretArgvRefusal, Fi as withSharedDrainBudget, Fl as renderAssemblyPathEscape, Fn as orphanRecordsPrintingBag, Fo as isMarkedCoordinate, Fr as deleteSkipReason, Fs as STATE_SOURCED_BASELINE_RULES, Ft as loadJournaledOrphans, Ga as repairMalformedResourceEntriesForReadOnly, Gc as runDockerStreaming, Gi as deployRefusesOrphanRowsReason, Gn as ccRoutedFinalSnapshotError, Go as readsNoEchoSource, Gr as DiffCalculator, Gs as CrossPrefixReadError, Ha as repairMalformedOrphanRecordsForReadOnly, Hc as redactedCause, Hi as UNREADABLE_ORPHANS_CONTAINER_ROW, Hn as ATOMIC_FINAL_SNAPSHOT_TYPES, Ho as noEchoOutputsComparison, Hs as isLockInfoExpired, I as recordedProtectionNote, Ia as refuseMalformedResourcePropertiesForExport, Ic as formatDockerLoginError, Ii as parameterInputsFor, Il as resolveAssemblyPath, In as secretNamePrintingBag, Io as maskAtCoordinates, Is as STATE_SOURCED_CROSS_GENERATION_RULES, It as makeForeignHolderScan, Ja as unpreviewableOrphanRecords, Jc as stripControlChars, Ji as hasReadableOutputs, Jn as isFinalSnapshotError, Jo as carryLogOnlyValues, Jr as poisonRenderedSpellingsCollidingIn, Js as crossPrefixDeniedWarning, Jt as isJournaledOrphan, Ka as repairMalformedResourcePropertiesForReadOnly, Kc as warnFinchArgvExposure, Ki as displayLogicalId, Kn as createPreDeleteFinalSnapshot, Ko as valueAtCoordinate, Kr as INTRINSIC_KEYS, Ks as CrossPrefixScanCache, Kt as recordAfterRollbackUpdate, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourcePropertiesForOrphan, Lc as getDockerCmd, Ll as injectAwsRegion, Ln as secretNamePrintingBags, Lo as maskReadbackAtCoordinates, Lr as isWaitAbandonedError, Ls as STATE_SOURCED_READBACK_RULES, Lt as sameJournaledOrphans, M as noEchoComparisonForTemplate, Ma as refuseMalformedResourceEntriesForImportSave, Mc as describeDockerExecFailure, Mi as isStalePlaceholderArnAttribute, Ml as absoluteAssemblyPathEscape, Mn as completedReplayEntries, Mo as DagBuilder, Mr as UNSPECIFIED_SKIP_REASON, Ms as recordNoEchoParameterFreshValue, Mt as dropFailedHint, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourceEntriesForOrphan, Nc as describeDockerFailure, Ni as refStateLookupFromResource, Nl as describeFileReadFailure, Nn as journaledOrphanPrintingBag, No as TemplateParser, Nr as deleteIndeterminateGuards, Ns as recordProvenPublicExpression, Nt as isHandledOrphan, O as serviceTokenBlockingReason, Oa as refuseMalformedResourceEntries, Oc as buildDenyExternalAccessPolicy, Oi as isNamelessDynamicReferenceError, Ol as hasOwnKey, On as isExportAliasCollision, Oo as withRetry, Or as CloudControlProvider, Os as provenPublicValue, Ot as collectNestedChildUnaddressed, P as noEchoParameterNamesOf, Pa as refuseMalformedResourcePropertiesForDestroy, Pc as dockerSpawnEnvWithSensitive, Pl as displayAssemblyPath, Pn as maskEventTextWithBoundBags, Po as canonicalCoordinates, Pr as deleteLeftInPlace, Ps as wholeStringLeavesOf, Pt as journaledOrphanLines, Qa as findActionableSilentDrops, Qc as Synthesizer, Qi as malformedDriftResourcePropertiesWarning, Qn as constructPathOf, Qo as logOnlyValueCount, Qr as assertFlagRoleArn, Qs as acceptedCreateOnlyDropsOf, Qt as recheckFailedPlan, R as isProtectionValueActive, Ra as refuseMalformedResourcesForDeploy, Rc as isDockerClientEnvKey, Ri as declaresNoEcho, Rl as injectedAwsRegionValue, Rn as secretNamedRecordNeedles, Ro as maskWholeValue, Rs as TEMPLATE_SOURCED_RULES, Rt as replayFailedOperations, Sa as refuseMalformedOrphans, Sc as getBootstrapMarkerKey, Si as isUnboundTemplateParameter, Sl as canonicalizeRegion, Sn as exportNameNoEchoParameters, Sr as isCustomResourceType$1, T as recordRetainedForReadoption, Ta as refuseMalformedOutputs, Tc as readBootstrapMarkerBody, Ti as isImpossibleEmptyStoredAttribute, Tl as StageLoadError, Tn as noEchoParameterValueSeed, To as prefetchCreateOnlyPropertyPaths, Tr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ts as recordPhysicalNameCopy, Ua as repairMalformedOrphansForReadOnly, Uc as redactedDockerCause, Ui as UNREADABLE_RESOURCES_MAP_ROW, Un as PRE_DELETE_SNAPSHOT_TYPES, Us as S3StateBackend, Ut as withStackRecords, Va as refuseMalformedState, Vc as redactDockerArgvValues, Vi as STATE_RESOURCES_MALFORMED, Vn as extractDeploymentEventError, Vo as noEchoLeavesOf, Vs as LockManager, Vt as destroyStackRecordsView, Wa as repairMalformedOutputsForReadOnly, Wc as runDockerForeground, Wi as accountArgs, Wn as buildFinalSnapshotIdentifier, Wo as readbackPathFor, Ws as rebuildClientForBucketRegion, Wt as removeProtectionTypeList, Xa as unreadableResourceEntries, Xc as AssetManifestLoader, Xi as isReadableOrphanRecord, Xn as unsupportedFinalSnapshotError, Xo as hasMaskableValues, Xr as refuseUnreadableCdkCrossAccountRefs, Xs as isNotImplemented, Xt as planFailedOps, Ya as unreadableOrphanRecords, Yc as stripForDisplay, Yi as hasReadableResources, Yn as refusesFinalSnapshot, Yo as createUnionSecretMasker, Yr as producerLookupOver, Ys as isAccessDenied, Yt as isReplacementOrphan, Za as withheldAccountClause, Zc as getDockerImageBySourceHash, Zi as isReadableResourceEntry, Zn as maskingRetryLogger, Zo as literalSplitDelimitersOf, Zr as applyRoleArnIfSet, Zs as splitImportedOps, Zt as planRollback, _ as keptWholeReasonText, _a as previewableOrphanRecords, _c as rewriteTemplateAssetReferences, _i as classifyRecordedSecretRegion, _l as uploadCfnTemplate, _n as exportAliasCollisionScrubWarning, _r as ccBrokenReason, _s as isUncertifiedBaselineMaskPosition, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedOrphanRecordsWarning, ac as importableOutputs, ai as callerEnvCredentials, al as resolveCaptureObservedState, ao as shownType, as as errorCauseChain, at as createReadOnlyAttributeHealerFactory, ba as refuseMalformedOrphanRecords, bc as assertAssetBucketRegion, bi as regionLessSecretName, bl as expectedOwnerParam, bn as secretSafeKeyDisplay, br as TemplateNoEchoReresolver, bs as inheritNestedStackParameterAssociations, bt as displacedPhysicalIdShown, c as isAbsoluteAssetPath, ca as malformedOrphansWarning, cc as orphansCarriedFrom, ci as keepHeldTokenProvenance, cl as resolveStateBucketWithDefaultAndSource, co as isStatefulRecreateTargetSync, cs as markSameGenerationBag, ct as gray, d as templateIdentity, da as malformedRenderedContainersWarning, dc as isSensitiveAttributeName, di as recordedReferenceRegions, dl as warnDeprecatedNoPrefixCliFlag, dn as updatePartialMessage, ds as redactSecretsForState, dt as yellow, ea as malformedExportSourceWarning, ec as exportNamesCarriedFrom, ei as explicitRoleArnOrThrow, el as getDefaultStateBucketName, en as replacementNeverSwapped, eo as unwrittenCreateOnlyReplacement, er as formatDestructiveChange, es as recordLogOnlyParameterValue, f as conditionFingerprint, fa as malformedResourceEntriesWarning, fc as stringifyValue, fl as ssmResolvedValueType, fn as updatePartialReason, fs as scrubResourceRecord, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as malformedStateRefusalMessage, gc as loadPublishableAssetManifest, gl as findLargeInlineResources, gn as displayTextOrWithheld, gr as ProviderRegistry, gs as dynamicReferenceTokens, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedScrubResourceEntriesRefusalMessage, hc as createAssetRedirectResolver, hl as MIGRATE_TMP_PREFIX, hn as WITHHELD_NAME_DISPLAY, hr as CC_BROKEN_REASON, hs as DYNAMIC_REFERENCE_TOKEN_SCAN, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedOrphanRecordsRefusalMessage, ic as importableOutputKeys, ii as applyCallerIdentityCredentials, il as resolveAutoAssetStorage, in as findNestedStackTypeChanges, io as findReplacedReadersOfRecreateTargets, ir as withCreateTokenLedger, is as createSecretMasker, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedResourceEntriesForImport, jc as describeDockerCapturedOutput, ji as cfnRefValueFromPhysicalId, jl as ownValue, jn as DEFAULT_RESOURCE_WARN_AFTER_MS, jr as RollbackInlinePolicyWriters, js as recordNoEchoAttributeValues, jt as deleteJournaledOrphans, k as withResourceDeadline, ka as refuseMalformedResourceEntriesForDeploy, kc as buildDockerImage, ki as keepsSecretReferenceToken, kl as hasPlainPrototype, kn as bindingSkippedOutputs, kr as slowCcOperationTimeoutMs, ks as recordMaskOnlyValue, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, la as malformedOutputsRefusalMessage, lc as shouldRetainResource, ll as resolveUseCdkBootstrapAssets, lo as renderStatefulReason, lt as green, m as parentSuppliedValues, ma as malformedResourcesWarning, mc as buildAssetRedirectMap, ml as CFN_TEMPLATE_URL_LIMIT, mn as DeploymentEventsStore, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedLocalResourceEntriesWarning, nc as hasReasonlessBaselineRefusal, ni as sendableAssumeRoleCommand, nl as loadCdkJson, nn as seedsDeleteFirstGuard, no as NO_CC_HANDLERS_REASON, nr as ledgerForStack, ns as shareLogOnlyValues, o as childTemplateLoader, oa as malformedOrphanRowsKeptWarning, oc as isReadableBag, oi as envCredentialsAreAssumedRole, ol as resolveSkipPrefix, on as inheritProducerRegions, oo as MULTI_REGION_RECREATE_BLOCKED_TYPES, os as maskSecretsInError, ot as bold, p as conditionInputsFrom, pa as malformedResourcePropertiesWarning, pc as WorkGraph, pl as CFN_TEMPLATE_BODY_LIMIT, pn as DeploymentEventsReader, ps as withPhysicalNameCopies, pt as namesAnyDeclaredParameter, qa as repairMalformedResourcesForReadOnly, qc as escapeRegExp, qi as hasReadableOrphans, qn as effectiveDeletionPolicy, qo as liveMatchesUnresolvedTokenFrame, qr as IntrinsicFunctionResolver, qs as applyCrossPrefixScan, qt as demoteSupersededOrphans, r as computeImplicitDeleteEdges, ra as malformedLocalResourcesWarning, rc as hasUnverifiableParameterRefusal, ri as AWS_CREDENTIAL_ENV_KEYS, rl as resolveApp, rn as orphanDeleteNeedsIdentity, ro as hasNoCloudControlHandlers, rs as unionOfSecretBags, s as findNestedTemplateTreeDefect, sa as malformedOrphansRefusalMessage, sc as orphansAfterRollback, sl as resolveStateBucketWithDefault, so as isStatefulRecreateTargetForReplace, ss as maskSecretsInText, st as cyan, t as DeployEngine, ta as malformedLocalOutputsWarning, tc as hasReadableExportSet, ti as isIamRoleArn, tl as getLegacyStateBucketName, tn as resolveReplacementOldType, ts as recordLogOnlyValue, u as renderNestedTemplateTreeDefect, ua as malformedOutputsWarning, uc as AssetPublisher, ui as recordedOutputReferenceRegions, ul as stateBucketExistenceConfirmed, ut as red, v as mergeNoChangeOutputs, va as refuseDivergentRecordRegionForDestroy, vc as AssetModeResolver, vi as classifyReplaySecretRegion, vl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vn as secretBearing, vr as isCustomResource, vs as pathCrossesDottedKey, vt as NESTED_PENDING_PARENT_REASON, w as keptForReadoption, wa as refuseMalformedOrphansForOrphan, wc as parseBootstrapMarker, wi as getAccountInfo, wl as AssemblyReader, wn as isWholeDynamicReferenceValue, wr as withPrintingSecrets, wt as recordDisplacedSkips, xa as refuseMalformedOrphanRecordsForDestroy, xc as ensureAssetStorage, xi as coerceParameterTypedValue, xl as PARTITION_TABLE, xn as carriedExportAliasExposure, xr as readsNoEchoDeleteValues, xs as recordNestedStackParameterExpressions, xt as dropSettledNestedJournals, y as makeCanonicalizePropertiesFn, yc as BOOTSTRAP_MARKER_PREFIX, yi as producerRegionsFromState, yl as decodeListingKey, yn as secretBearingStateKeyWarning, yr as wouldReturnToSdkProvider, ys as identityKeyFor, yt as displacedOpClause, z as perType, za as refuseMalformedResourcesForDestroy, zc as isMalformedEnvKey, zi as JSON_LISTING_HOLE_VALUE, zn as stateSecretNameNeedles, zo as maskedLeafCoordinatesOf, zs as WHOLE_DYNAMIC_REFERENCE_PATTERN, zt as replayRollback } from "./deploy-engine-C-4ho8TJ.js";
-import { t as getCdkdVersion } from "./version-CXGQKplb.js";
+import { $a as withheldAccountClause, $c as getDockerImageBySourceHash, $i as isReadableResourceEntry, $n as findDestructiveChanges, $o as literalSplitDelimitersOf, $r as applyRoleArnIfSet, $s as splitImportedOps, $t as recordUnderIdIsNotOwn, A as diffSecurity, Aa as refuseMalformedResourceEntries, Ac as buildDenyExternalAccessPolicy, Ai as isNamelessDynamicReferenceError, Al as hasOwnKey, An as DEFAULT_RESOURCE_TIMEOUT_MS, Ao as withRetry, Ar as CloudControlProvider, As as provenPublicValue, At as withNestedStackContext, B as readProtection, Ba as refuseMalformedResourcesForDeploy, Bc as isDockerClientEnvKey, Bi as declaresNoEcho, Bl as injectedAwsRegionValue, Bn as storedSecretNameNeedles, Bo as maskWholeValue, Bs as TEMPLATE_SOURCED_RULES, Ca as refuseMalformedOrphanRecordsForDestroy, Cc as ensureAssetStorage, Ci as coerceParameterTypedValue, Cl as PARTITION_TABLE, Cn as exportNameSecretExposure, Cr as readsNoEchoDeleteValues, Cs as recordNestedStackParameterExpressions, Ct as nestedChildStackName$1, D as findServiceTokenRefusals, Da as refuseMalformedOutputs, Dc as readBootstrapMarkerBody, Di as isImpossibleEmptyStoredAttribute, Dl as StageLoadError, Dn as collectPublishedOutputNames, Do as prefetchCreateOnlyPropertyPaths, Dr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ds as recordPhysicalNameCopy, Dt as withNestedRevertRun, E as deferredServiceTokenWarning, Ea as refuseMalformedOrphansForOrphan, Ec as parseBootstrapMarker, Ei as getAccountInfo, El as AssemblyReader, En as collectDeclaredOutputNames, Er as withPrintingSecrets, Et as revertedNestedRowIds, F as recordedProtectionEvidence, Fa as refuseMalformedResourceEntriesForOrphan, Fc as describeDockerFailure, Fi as refStateLookupFromResource, Fl as describeFileReadFailure, Fn as orphanRecordsPrintingBag, Fo as TemplateParser, Fr as deleteIndeterminateGuards, Fs as recordProvenPublicExpression, Ft as loadJournaledOrphans, Ga as repairMalformedOrphansForReadOnly, Gc as redactedDockerCause, Gi as UNREADABLE_RESOURCES_MAP_ROW, Gn as ccRoutedFinalSnapshotError, Gs as S3StateBackend, Ha as refuseMalformedResourcesForExport, Hc as partitionSensitiveEnv, Hi as STATE_REGION_DIVERGED, Hl as resolveBucketRegion, Hn as ATOMIC_FINAL_SNAPSHOT_TYPES, Ho as noEchoCoordinatesOf, Hs as isSingleDynamicReferenceToken, I as recordedProtectionNote, Ia as refuseMalformedResourcePropertiesForDestroy, Ic as dockerSpawnEnvWithSensitive, Il as displayAssemblyPath, In as secretNamePrintingBag, Io as canonicalCoordinates, Ir as deleteLeftInPlace, Is as wholeStringLeavesOf, It as makeForeignHolderScan, Ja as repairMalformedResourcePropertiesForReadOnly, Jc as warnFinchArgvExposure, Ji as displayLogicalId, Jn as isFinalSnapshotError, Jo as valueAtCoordinate, Jr as INTRINSIC_KEYS, Js as CrossPrefixScanCache, Jt as isJournaledOrphan, Ka as repairMalformedOutputsForReadOnly, Kc as runDockerForeground, Ki as accountArgs, Kn as createPreDeleteFinalSnapshot, Ko as readbackPathFor, Ks as rebuildClientForBucketRegion, Kt as recordAfterRollbackUpdate, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourcePropertiesForDrift, Lc as finchSecretArgvRefusal, Li as withSharedDrainBudget, Ll as renderAssemblyPathEscape, Ln as secretNamePrintingBags, Lo as isMarkedCoordinate, Lr as deleteSkipReason, Ls as STATE_SOURCED_BASELINE_RULES, Lt as sameJournaledOrphans, M as noEchoComparisonForTemplate, Ma as refuseMalformedResourceEntriesForDestroy, Mc as resolveDockerContextDirectory, Mi as AWS_NO_VALUE, Ml as nullPrototypeRecord, Mn as completedReplayEntries, Ms as recordMaskOnlyValuesIn, Mt as dropFailedHint, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourceEntriesForImport, Nc as describeDockerCapturedOutput, Ni as cfnRefValueFromPhysicalId, Nl as ownValue, Nn as journaledOrphanPrintingBag, Nr as RollbackInlinePolicyWriters, Ns as recordNoEchoAttributeValues, Nt as isHandledOrphan, O as serviceTokenBlockingReason, Oa as refuseMalformedOutputsForDestroy, Oc as validateAssetBucketName, Oi as carriesDynamicReference, Ol as processStackMessages, On as isExportAliasCollision, Oo as templateResourceTypes, Or as applyCustomResourceResponseExpiration, Os as splitGetAttStringForm, Ot as collectNestedChildUnaddressed, P as noEchoParameterNamesOf, Pa as refuseMalformedResourceEntriesForImportSave, Pc as describeDockerExecFailure, Pi as isStalePlaceholderArnAttribute, Pl as absoluteAssemblyPathEscape, Pn as maskEventTextWithBoundBags, Po as DagBuilder, Pr as UNSPECIFIED_SKIP_REASON, Ps as recordNoEchoParameterFreshValue, Pt as journaledOrphanLines, Qa as unreadableResourceEntries, Qc as AssetManifestLoader, Qi as isReadableOrphanRecord, Qn as constructPathOf, Qo as hasMaskableValues, Qr as refuseUnreadableCdkCrossAccountRefs, Qs as isNotImplemented, Qt as recheckFailedPlan, R as isProtectionValueActive, Ra as refuseMalformedResourcePropertiesForExport, Rc as formatDockerLoginError, Ri as parameterInputsFor, Rl as resolveAssemblyPath, Rn as secretNamedRecordNeedles, Ro as maskAtCoordinates, Rs as STATE_SOURCED_CROSS_GENERATION_RULES, Rt as replayFailedOperations, Sa as refuseMalformedOrphanRecords, Sc as assertAssetBucketRegion, Si as regionLessSecretName, Sl as expectedOwnerParam, Sn as exportNameNoEchoParameters, Sr as TemplateNoEchoReresolver, Ss as inheritNestedStackParameterAssociations, T as recordRetainedForReadoption, Ta as refuseMalformedOrphansForDestroy, Tc as isCrossRegionRedirect, Ti as parameterTypeMayLoseSecretIdentity, Tl as derivePartitionAndUrlSuffix, Tn as noEchoParameterValueSeed, Ts as physicalNameCopiesOf, Ua as refuseMalformedState, Uc as redactDockerArgvValues, Ui as STATE_RESOURCES_MALFORMED, Un as PRE_DELETE_SNAPSHOT_TYPES, Uo as noEchoLeavesOf, Us as LockManager, Ut as withStackRecords, Va as refuseMalformedResourcesForDestroy, Vc as isMalformedEnvKey, Vi as JSON_LISTING_HOLE_VALUE, Vn as extractDeploymentEventError, Vo as maskedLeafCoordinatesOf, Vs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Vt as destroyStackRecordsView, Wa as repairMalformedOrphanRecordsForReadOnly, Wc as redactedCause, Wi as UNREADABLE_ORPHANS_CONTAINER_ROW, Wn as buildFinalSnapshotIdentifier, Wo as noEchoOutputsComparison, Ws as isLockInfoExpired, Wt as removeProtectionTypeList, Xa as unpreviewableOrphanRecords, Xc as stripControlChars, Xi as hasReadableOutputs, Xn as unsupportedFinalSnapshotError, Xo as carryLogOnlyValues, Xr as poisonRenderedSpellingsCollidingIn, Xs as crossPrefixDeniedWarning, Xt as planFailedOps, Ya as repairMalformedResourcesForReadOnly, Yc as escapeRegExp, Yi as hasReadableOrphans, Yn as refusesFinalSnapshot, Yo as liveMatchesUnresolvedTokenFrame, Yr as IntrinsicFunctionResolver, Ys as applyCrossPrefixScan, Yt as isReplacementOrphan, Za as unreadableOrphanRecords, Zc as stripForDisplay, Zi as hasReadableResources, Zn as maskingRetryLogger, Zo as createUnionSecretMasker, Zr as producerLookupOver, Zs as isAccessDenied, Zt as planRollback, _ as keptWholeReasonText, _a as malformedScrubResourceEntriesRefusalMessage, _c as createAssetRedirectResolver, _l as MIGRATE_TMP_PREFIX, _n as exportAliasCollisionScrubWarning, _r as CC_BROKEN_REASON, _s as DYNAMIC_REFERENCE_TOKEN_SCAN, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedLocalResourcesWarning, ac as hasUnverifiableParameterRefusal, ai as AWS_CREDENTIAL_ENV_KEYS, al as resolveApp, ao as hasNoCloudControlHandlers, as as unionOfSecretBags, at as createReadOnlyAttributeHealerFactory, ba as refuseDivergentRecordRegionForDestroy, bc as AssetModeResolver, bi as classifyReplaySecretRegion, bl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, bn as secretSafeKeyDisplay, br as isCustomResource, bs as pathCrossesDottedKey, bt as displacedPhysicalIdShown, c as isAbsoluteAssetPath, ca as malformedOrphanRowsKeptWarning, cc as isReadableBag, ci as envCredentialsAreAssumedRole, cl as resolveSkipPrefix, co as MULTI_REGION_RECREATE_BLOCKED_TYPES, cs as maskSecretsInError, ct as gray, d as templateIdentity, da as malformedOutputsRefusalMessage, dc as shouldRetainResource, dl as resolveUseCdkBootstrapAssets, dn as updatePartialMessage, do as renderStatefulReason, dt as yellow, ea as malformedDriftResourcePropertiesWarning, ec as acceptedCreateOnlyDropsOf, ei as assertFlagRoleArn, el as Synthesizer, en as replacementNeverSwapped, eo as findActionableSilentDrops, er as formatDestructiveChange, es as logOnlyValueCount, f as conditionFingerprint, fa as malformedOutputsWarning, fc as AssetPublisher, fi as recordedOutputReferenceRegions, fl as stateBucketExistenceConfirmed, fn as updatePartialReason, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as malformedResourcesWarning, gc as buildAssetRedirectMap, gl as CFN_TEMPLATE_URL_LIMIT, gn as displayTextOrWithheld, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedResourcePropertiesWarning, hc as WorkGraph, hl as CFN_TEMPLATE_BODY_LIMIT, hn as WITHHELD_NAME_DISPLAY, hs as withPhysicalNameCopies, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedLocalResourceEntriesWarning, ic as hasReasonlessBaselineRefusal, ii as sendableAssumeRoleCommand, il as loadCdkJson, in as findNestedStackTypeChanges, io as NO_CC_HANDLERS_REASON, ir as withCreateTokenLedger, is as shareLogOnlyValues, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedResourceEntriesForDeploy, jc as buildDockerImage, ji as keepsSecretReferenceToken, jl as hasPlainPrototype, jn as DEFAULT_RESOURCE_WARN_AFTER_MS, jr as slowCcOperationTimeoutMs, js as recordMaskOnlyValue, jt as deleteJournaledOrphans, k as withResourceDeadline, ka as refuseMalformedResourceAttributesForOrphan, kc as validateContainerRepoName, ki as carriesFetchableDynamicReference, kl as defineOwnKey, kn as bindingSkippedOutputs, ko as describeTypeWithThrottleRetry, kr as customResourceResponseExpirationWarning, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, la as malformedOrphansRefusalMessage, lc as orphansAfterRollback, ll as resolveStateBucketWithDefault, lo as isStatefulRecreateTargetForReplace, ls as maskSecretsInText, lt as green, m as parentSuppliedValues, ma as malformedResourceEntriesWarning, mc as stringifyValue, ml as ssmResolvedValueType, mn as DeploymentEventsStore, ms as scrubResourceRecord, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedExportSourceWarning, nc as exportNamesCarriedFrom, ni as explicitRoleArnOrThrow, nl as getDefaultStateBucketName, nn as seedsDeleteFirstGuard, no as unwrittenCreateOnlyReplacement, nr as ledgerForStack, ns as recordLogOnlyParameterValue, o as childTemplateLoader, oa as malformedOrphanRecordsRefusalMessage, oc as importableOutputKeys, oi as applyCallerIdentityCredentials, ol as resolveAutoAssetStorage, on as inheritProducerRegions, oo as findReplacedReadersOfRecreateTargets, os as createSecretMasker, ot as bold, p as conditionInputsFrom, pa as malformedRenderedContainersWarning, pc as isSensitiveAttributeName, pi as recordedReferenceRegions, pl as warnDeprecatedNoPrefixCliFlag, pn as DeploymentEventsReader, ps as redactSecretsForState, pt as namesAnyDeclaredParameter, qa as repairMalformedResourceEntriesForReadOnly, qc as runDockerStreaming, qi as deployRefusesOrphanRowsReason, qn as effectiveDeletionPolicy, qo as readsNoEchoSource, qr as DiffCalculator, qs as CrossPrefixReadError, qt as demoteSupersededOrphans, r as computeImplicitDeleteEdges, ra as malformedLocalOutputsWarning, rc as hasReadableExportSet, ri as isIamRoleArn, rl as getLegacyStateBucketName, rn as orphanDeleteNeedsIdentity, rs as recordLogOnlyValue, s as findNestedTemplateTreeDefect, sa as malformedOrphanRecordsWarning, sc as importableOutputs, si as callerEnvCredentials, sl as resolveCaptureObservedState, so as shownType, ss as errorCauseChain, st as cyan, t as DeployEngine, ta as malformedExportNamesWarning, tc as describeRegionValueKind, ti as assertSendableRoleArn, tl as synthesisStatusMessage, tn as resolveReplacementOldType, ts as printingCorpusOf, u as renderNestedTemplateTreeDefect, ua as malformedOrphansWarning, uc as orphansCarriedFrom, ui as keepHeldTokenProvenance, ul as resolveStateBucketWithDefaultAndSource, uo as isStatefulRecreateTargetSync, us as markSameGenerationBag, ut as red, v as mergeNoChangeOutputs, va as malformedStateRefusalMessage, vc as loadPublishableAssetManifest, vl as findLargeInlineResources, vn as secretBearing, vr as ProviderRegistry, vs as dynamicReferenceTokens, vt as NESTED_PENDING_PARENT_REASON, w as keptForReadoption, wa as refuseMalformedOrphans, wc as getBootstrapMarkerKey, wi as isUnboundTemplateParameter, wl as canonicalizeRegion, wn as isWholeDynamicReferenceValue, wr as isCustomResourceType$1, wt as recordDisplacedSkips, xc as BOOTSTRAP_MARKER_PREFIX, xi as producerRegionsFromState, xl as decodeListingKey, xn as carriedExportAliasExposure, xr as wouldReturnToSdkProvider, xs as identityKeyFor, xt as dropSettledNestedJournals, y as makeCanonicalizePropertiesFn, ya as previewableOrphanRecords, yc as rewriteTemplateAssetReferences, yi as classifyRecordedSecretRegion, yl as uploadCfnTemplate, yn as secretBearingStateKeyWarning, yr as ccBrokenReason, ys as isUncertifiedBaselineMaskPosition, yt as displacedOpClause, z as perType, za as refuseMalformedResourcePropertiesForOrphan, zc as getDockerCmd, zl as injectAwsRegion, zn as stateSecretNameNeedles, zo as maskReadbackAtCoordinates, zr as isWaitAbandonedError, zs as STATE_SOURCED_READBACK_RULES, zt as replayRollback } from "./deploy-engine-DOBzE5TD.js";
+import { t as getCdkdVersion } from "./version-CZbKGFSS.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2561,7 +2561,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CVC9_-km.js");
+	providerClasses ??= import("./provider-classes-DzoIZFZK.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -19118,7 +19118,7 @@ function actionLabel(item, skipFinalSnapshot) {
 		case "orphan-flag": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [--orphan]`;
 		case "revert": return `  - revert   ${safe(op.logicalId)} (${safe(op.resourceType)})${rep}`;
 		case "reverse-replacement":
-			if (op.oldResourceMaySurvive !== void 0) return `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [the deploy did not confirm deleting the old resource: re-create it if AWS reports it gone, ` + (op.oldResourceMaySurvive === "kept" ? `re-adopt it if AWS still has it (its delete was refused or never sent), ` : `REFUSED if AWS still has it (its delete may still be running), `) + `REFUSED if cdkd cannot tell; ` + (item.retainsNewResource ? `new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `delete new]`);
+			if (op.oldResourceMaySurvive !== void 0) return `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [the deploy did not confirm deleting the old resource: re-create it if AWS reports it gone, ` + (op.oldResourceMaySurvive === "kept" ? `re-adopt it if AWS still has it (its delete was refused or never sent), ` : `REFUSED if AWS still has it (its delete may still be running, or only partly ran), `) + `REFUSED if cdkd cannot tell; ` + (item.retainsNewResource ? `new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `delete new]`);
 			return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource, delete new]`;
 		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [delete new, re-adopt retained old resource]`;
 		case "unrecoverable-delete": return `  - (cannot restore) ${safe(op.logicalId)} (${safe(op.resourceType)}) — was DELETED, unrecoverable`;
@@ -23809,7 +23809,7 @@ async function runDetached(opts) {
 		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
 	}
 	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
-	const { flags, sensitiveEnv: passthroughEnv, collisions } = partitionSensitiveEnv(opts.env, sensitiveKeys);
+	const { flags, sensitiveEnv: passthroughEnv, collisions } = partitionSensitiveEnv(opts.env, sensitiveKeys, { ...opts.name !== void 0 && { subject: `Container '${opts.name}'` } });
 	args.push(...flags);
 	if (opts.tmpfs) args.push("--tmpfs", `${opts.tmpfs.target}:rw,size=${opts.tmpfs.sizeMb}m`);
 	if (opts.workingDir) args.push("--workdir", opts.workingDir);
@@ -26292,7 +26292,7 @@ async function createNetworkAndSidecar(args) {
 		if (credentials.sessionToken) sidecarEnv["AWS_SESSION_TOKEN"] = credentials.sessionToken;
 	}
 	if (cluster) sidecarEnv["CLUSTER"] = cluster;
-	const { flags: sidecarFlags, sensitiveEnv: sidecarSensitiveEnv, collisions: sidecarCollisions } = partitionSensitiveEnv(sidecarEnv, SENSITIVE_ENV_KEYS);
+	const { flags: sidecarFlags, sensitiveEnv: sidecarSensitiveEnv, collisions: sidecarCollisions } = partitionSensitiveEnv(sidecarEnv, SENSITIVE_ENV_KEYS, { subject: `Sidecar '${taskSidecarName(networkName)}'` });
 	sidecarArgs.push(...sidecarFlags);
 	if (sidecarCollisions.length > 0) logger.warn(`Sidecar env var(s) ${sidecarCollisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) and were NOT passed to the sidecar at all (they would hijack that client).`);
 	sidecarArgs.push(METADATA_ENDPOINT_IMAGE);
@@ -27116,7 +27116,7 @@ function buildDockerRunArgs(opts) {
 		...secrets.map((s) => s.name),
 		...opts.plaintextEnvKeys ?? []
 	]);
-	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, sensitiveKeys);
+	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, sensitiveKeys, { subject: `Container '${container.name}'` });
 	args.push(...flags);
 	if (container.user) args.push("--user", container.user);
 	if (container.privileged) args.push("--privileged");
@@ -29605,4 +29605,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-BHjdsRtD.js.map
+//# sourceMappingURL=program-BDm58Wc8.js.map