@go-to-k/cdkd 0.300.2 → 0.301.1

package/dist/{program-BDm58Wc8.js → program-Djx1RrEU.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-B_CEQGE1.js";
-import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
+import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DFk7zr0Q.js";
 import { a as setAssumedRoleCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as withheldAccountClause, $c as getDockerImageBySourceHash, $i as isReadableResourceEntry, $n as findDestructiveChanges, $o as literalSplitDelimitersOf, $r as applyRoleArnIfSet, $s as splitImportedOps, $t as recordUnderIdIsNotOwn, A as diffSecurity, Aa as refuseMalformedResourceEntries, Ac as buildDenyExternalAccessPolicy, Ai as isNamelessDynamicReferenceError, Al as hasOwnKey, An as DEFAULT_RESOURCE_TIMEOUT_MS, Ao as withRetry, Ar as CloudControlProvider, As as provenPublicValue, At as withNestedStackContext, B as readProtection, Ba as refuseMalformedResourcesForDeploy, Bc as isDockerClientEnvKey, Bi as declaresNoEcho, Bl as injectedAwsRegionValue, Bn as storedSecretNameNeedles, Bo as maskWholeValue, Bs as TEMPLATE_SOURCED_RULES, Ca as refuseMalformedOrphanRecordsForDestroy, Cc as ensureAssetStorage, Ci as coerceParameterTypedValue, Cl as PARTITION_TABLE, Cn as exportNameSecretExposure, Cr as readsNoEchoDeleteValues, Cs as recordNestedStackParameterExpressions, Ct as nestedChildStackName$1, D as findServiceTokenRefusals, Da as refuseMalformedOutputs, Dc as readBootstrapMarkerBody, Di as isImpossibleEmptyStoredAttribute, Dl as StageLoadError, Dn as collectPublishedOutputNames, Do as prefetchCreateOnlyPropertyPaths, Dr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ds as recordPhysicalNameCopy, Dt as withNestedRevertRun, E as deferredServiceTokenWarning, Ea as refuseMalformedOrphansForOrphan, Ec as parseBootstrapMarker, Ei as getAccountInfo, El as AssemblyReader, En as collectDeclaredOutputNames, Er as withPrintingSecrets, Et as revertedNestedRowIds, F as recordedProtectionEvidence, Fa as refuseMalformedResourceEntriesForOrphan, Fc as describeDockerFailure, Fi as refStateLookupFromResource, Fl as describeFileReadFailure, Fn as orphanRecordsPrintingBag, Fo as TemplateParser, Fr as deleteIndeterminateGuards, Fs as recordProvenPublicExpression, Ft as loadJournaledOrphans, Ga as repairMalformedOrphansForReadOnly, Gc as redactedDockerCause, Gi as UNREADABLE_RESOURCES_MAP_ROW, Gn as ccRoutedFinalSnapshotError, Gs as S3StateBackend, Ha as refuseMalformedResourcesForExport, Hc as partitionSensitiveEnv, Hi as STATE_REGION_DIVERGED, Hl as resolveBucketRegion, Hn as ATOMIC_FINAL_SNAPSHOT_TYPES, Ho as noEchoCoordinatesOf, Hs as isSingleDynamicReferenceToken, I as recordedProtectionNote, Ia as refuseMalformedResourcePropertiesForDestroy, Ic as dockerSpawnEnvWithSensitive, Il as displayAssemblyPath, In as secretNamePrintingBag, Io as canonicalCoordinates, Ir as deleteLeftInPlace, Is as wholeStringLeavesOf, It as makeForeignHolderScan, Ja as repairMalformedResourcePropertiesForReadOnly, Jc as warnFinchArgvExposure, Ji as displayLogicalId, Jn as isFinalSnapshotError, Jo as valueAtCoordinate, Jr as INTRINSIC_KEYS, Js as CrossPrefixScanCache, Jt as isJournaledOrphan, Ka as repairMalformedOutputsForReadOnly, Kc as runDockerForeground, Ki as accountArgs, Kn as createPreDeleteFinalSnapshot, Ko as readbackPathFor, Ks as rebuildClientForBucketRegion, Kt as recordAfterRollbackUpdate, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourcePropertiesForDrift, Lc as finchSecretArgvRefusal, Li as withSharedDrainBudget, Ll as renderAssemblyPathEscape, Ln as secretNamePrintingBags, Lo as isMarkedCoordinate, Lr as deleteSkipReason, Ls as STATE_SOURCED_BASELINE_RULES, Lt as sameJournaledOrphans, M as noEchoComparisonForTemplate, Ma as refuseMalformedResourceEntriesForDestroy, Mc as resolveDockerContextDirectory, Mi as AWS_NO_VALUE, Ml as nullPrototypeRecord, Mn as completedReplayEntries, Ms as recordMaskOnlyValuesIn, Mt as dropFailedHint, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourceEntriesForImport, Nc as describeDockerCapturedOutput, Ni as cfnRefValueFromPhysicalId, Nl as ownValue, Nn as journaledOrphanPrintingBag, Nr as RollbackInlinePolicyWriters, Ns as recordNoEchoAttributeValues, Nt as isHandledOrphan, O as serviceTokenBlockingReason, Oa as refuseMalformedOutputsForDestroy, Oc as validateAssetBucketName, Oi as carriesDynamicReference, Ol as processStackMessages, On as isExportAliasCollision, Oo as templateResourceTypes, Or as applyCustomResourceResponseExpiration, Os as splitGetAttStringForm, Ot as collectNestedChildUnaddressed, P as noEchoParameterNamesOf, Pa as refuseMalformedResourceEntriesForImportSave, Pc as describeDockerExecFailure, Pi as isStalePlaceholderArnAttribute, Pl as absoluteAssemblyPathEscape, Pn as maskEventTextWithBoundBags, Po as DagBuilder, Pr as UNSPECIFIED_SKIP_REASON, Ps as recordNoEchoParameterFreshValue, Pt as journaledOrphanLines, Qa as unreadableResourceEntries, Qc as AssetManifestLoader, Qi as isReadableOrphanRecord, Qn as constructPathOf, Qo as hasMaskableValues, Qr as refuseUnreadableCdkCrossAccountRefs, Qs as isNotImplemented, Qt as recheckFailedPlan, R as isProtectionValueActive, Ra as refuseMalformedResourcePropertiesForExport, Rc as formatDockerLoginError, Ri as parameterInputsFor, Rl as resolveAssemblyPath, Rn as secretNamedRecordNeedles, Ro as maskAtCoordinates, Rs as STATE_SOURCED_CROSS_GENERATION_RULES, Rt as replayFailedOperations, Sa as refuseMalformedOrphanRecords, Sc as assertAssetBucketRegion, Si as regionLessSecretName, Sl as expectedOwnerParam, Sn as exportNameNoEchoParameters, Sr as TemplateNoEchoReresolver, Ss as inheritNestedStackParameterAssociations, T as recordRetainedForReadoption, Ta as refuseMalformedOrphansForDestroy, Tc as isCrossRegionRedirect, Ti as parameterTypeMayLoseSecretIdentity, Tl as derivePartitionAndUrlSuffix, Tn as noEchoParameterValueSeed, Ts as physicalNameCopiesOf, Ua as refuseMalformedState, Uc as redactDockerArgvValues, Ui as STATE_RESOURCES_MALFORMED, Un as PRE_DELETE_SNAPSHOT_TYPES, Uo as noEchoLeavesOf, Us as LockManager, Ut as withStackRecords, Va as refuseMalformedResourcesForDestroy, Vc as isMalformedEnvKey, Vi as JSON_LISTING_HOLE_VALUE, Vn as extractDeploymentEventError, Vo as maskedLeafCoordinatesOf, Vs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Vt as destroyStackRecordsView, Wa as repairMalformedOrphanRecordsForReadOnly, Wc as redactedCause, Wi as UNREADABLE_ORPHANS_CONTAINER_ROW, Wn as buildFinalSnapshotIdentifier, Wo as noEchoOutputsComparison, Ws as isLockInfoExpired, Wt as removeProtectionTypeList, Xa as unpreviewableOrphanRecords, Xc as stripControlChars, Xi as hasReadableOutputs, Xn as unsupportedFinalSnapshotError, Xo as carryLogOnlyValues, Xr as poisonRenderedSpellingsCollidingIn, Xs as crossPrefixDeniedWarning, Xt as planFailedOps, Ya as repairMalformedResourcesForReadOnly, Yc as escapeRegExp, Yi as hasReadableOrphans, Yn as refusesFinalSnapshot, Yo as liveMatchesUnresolvedTokenFrame, Yr as IntrinsicFunctionResolver, Ys as applyCrossPrefixScan, Yt as isReplacementOrphan, Za as unreadableOrphanRecords, Zc as stripForDisplay, Zi as hasReadableResources, Zn as maskingRetryLogger, Zo as createUnionSecretMasker, Zr as producerLookupOver, Zs as isAccessDenied, Zt as planRollback, _ as keptWholeReasonText, _a as malformedScrubResourceEntriesRefusalMessage, _c as createAssetRedirectResolver, _l as MIGRATE_TMP_PREFIX, _n as exportAliasCollisionScrubWarning, _r as CC_BROKEN_REASON, _s as DYNAMIC_REFERENCE_TOKEN_SCAN, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedLocalResourcesWarning, ac as hasUnverifiableParameterRefusal, ai as AWS_CREDENTIAL_ENV_KEYS, al as resolveApp, ao as hasNoCloudControlHandlers, as as unionOfSecretBags, at as createReadOnlyAttributeHealerFactory, ba as refuseDivergentRecordRegionForDestroy, bc as AssetModeResolver, bi as classifyReplaySecretRegion, bl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, bn as secretSafeKeyDisplay, br as isCustomResource, bs as pathCrossesDottedKey, bt as displacedPhysicalIdShown, c as isAbsoluteAssetPath, ca as malformedOrphanRowsKeptWarning, cc as isReadableBag, ci as envCredentialsAreAssumedRole, cl as resolveSkipPrefix, co as MULTI_REGION_RECREATE_BLOCKED_TYPES, cs as maskSecretsInError, ct as gray, d as templateIdentity, da as malformedOutputsRefusalMessage, dc as shouldRetainResource, dl as resolveUseCdkBootstrapAssets, dn as updatePartialMessage, do as renderStatefulReason, dt as yellow, ea as malformedDriftResourcePropertiesWarning, ec as acceptedCreateOnlyDropsOf, ei as assertFlagRoleArn, el as Synthesizer, en as replacementNeverSwapped, eo as findActionableSilentDrops, er as formatDestructiveChange, es as logOnlyValueCount, f as conditionFingerprint, fa as malformedOutputsWarning, fc as AssetPublisher, fi as recordedOutputReferenceRegions, fl as stateBucketExistenceConfirmed, fn as updatePartialReason, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as malformedResourcesWarning, gc as buildAssetRedirectMap, gl as CFN_TEMPLATE_URL_LIMIT, gn as displayTextOrWithheld, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedResourcePropertiesWarning, hc as WorkGraph, hl as CFN_TEMPLATE_BODY_LIMIT, hn as WITHHELD_NAME_DISPLAY, hs as withPhysicalNameCopies, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedLocalResourceEntriesWarning, ic as hasReasonlessBaselineRefusal, ii as sendableAssumeRoleCommand, il as loadCdkJson, in as findNestedStackTypeChanges, io as NO_CC_HANDLERS_REASON, ir as withCreateTokenLedger, is as shareLogOnlyValues, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedResourceEntriesForDeploy, jc as buildDockerImage, ji as keepsSecretReferenceToken, jl as hasPlainPrototype, jn as DEFAULT_RESOURCE_WARN_AFTER_MS, jr as slowCcOperationTimeoutMs, js as recordMaskOnlyValue, jt as deleteJournaledOrphans, k as withResourceDeadline, ka as refuseMalformedResourceAttributesForOrphan, kc as validateContainerRepoName, ki as carriesFetchableDynamicReference, kl as defineOwnKey, kn as bindingSkippedOutputs, ko as describeTypeWithThrottleRetry, kr as customResourceResponseExpirationWarning, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, la as malformedOrphansRefusalMessage, lc as orphansAfterRollback, ll as resolveStateBucketWithDefault, lo as isStatefulRecreateTargetForReplace, ls as maskSecretsInText, lt as green, m as parentSuppliedValues, ma as malformedResourceEntriesWarning, mc as stringifyValue, ml as ssmResolvedValueType, mn as DeploymentEventsStore, ms as scrubResourceRecord, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedExportSourceWarning, nc as exportNamesCarriedFrom, ni as explicitRoleArnOrThrow, nl as getDefaultStateBucketName, nn as seedsDeleteFirstGuard, no as unwrittenCreateOnlyReplacement, nr as ledgerForStack, ns as recordLogOnlyParameterValue, o as childTemplateLoader, oa as malformedOrphanRecordsRefusalMessage, oc as importableOutputKeys, oi as applyCallerIdentityCredentials, ol as resolveAutoAssetStorage, on as inheritProducerRegions, oo as findReplacedReadersOfRecreateTargets, os as createSecretMasker, ot as bold, p as conditionInputsFrom, pa as malformedRenderedContainersWarning, pc as isSensitiveAttributeName, pi as recordedReferenceRegions, pl as warnDeprecatedNoPrefixCliFlag, pn as DeploymentEventsReader, ps as redactSecretsForState, pt as namesAnyDeclaredParameter, qa as repairMalformedResourceEntriesForReadOnly, qc as runDockerStreaming, qi as deployRefusesOrphanRowsReason, qn as effectiveDeletionPolicy, qo as readsNoEchoSource, qr as DiffCalculator, qs as CrossPrefixReadError, qt as demoteSupersededOrphans, r as computeImplicitDeleteEdges, ra as malformedLocalOutputsWarning, rc as hasReadableExportSet, ri as isIamRoleArn, rl as getLegacyStateBucketName, rn as orphanDeleteNeedsIdentity, rs as recordLogOnlyValue, s as findNestedTemplateTreeDefect, sa as malformedOrphanRecordsWarning, sc as importableOutputs, si as callerEnvCredentials, sl as resolveCaptureObservedState, so as shownType, ss as errorCauseChain, st as cyan, t as DeployEngine, ta as malformedExportNamesWarning, tc as describeRegionValueKind, ti as assertSendableRoleArn, tl as synthesisStatusMessage, tn as resolveReplacementOldType, ts as printingCorpusOf, u as renderNestedTemplateTreeDefect, ua as malformedOrphansWarning, uc as orphansCarriedFrom, ui as keepHeldTokenProvenance, ul as resolveStateBucketWithDefaultAndSource, uo as isStatefulRecreateTargetSync, us as markSameGenerationBag, ut as red, v as mergeNoChangeOutputs, va as malformedStateRefusalMessage, vc as loadPublishableAssetManifest, vl as findLargeInlineResources, vn as secretBearing, vr as ProviderRegistry, vs as dynamicReferenceTokens, vt as NESTED_PENDING_PARENT_REASON, w as keptForReadoption, wa as refuseMalformedOrphans, wc as getBootstrapMarkerKey, wi as isUnboundTemplateParameter, wl as canonicalizeRegion, wn as isWholeDynamicReferenceValue, wr as isCustomResourceType$1, wt as recordDisplacedSkips, xc as BOOTSTRAP_MARKER_PREFIX, xi as producerRegionsFromState, xl as decodeListingKey, xn as carriedExportAliasExposure, xr as wouldReturnToSdkProvider, xs as identityKeyFor, xt as dropSettledNestedJournals, y as makeCanonicalizePropertiesFn, ya as previewableOrphanRecords, yc as rewriteTemplateAssetReferences, yi as classifyRecordedSecretRegion, yl as uploadCfnTemplate, yn as secretBearingStateKeyWarning, yr as ccBrokenReason, ys as isUncertifiedBaselineMaskPosition, yt as displacedOpClause, z as perType, za as refuseMalformedResourcePropertiesForOrphan, zc as getDockerCmd, zl as injectAwsRegion, zn as stateSecretNameNeedles, zo as maskReadbackAtCoordinates, zr as isWaitAbandonedError, zs as STATE_SOURCED_READBACK_RULES, zt as replayRollback } from "./deploy-engine-DOBzE5TD.js";
-import { t as getCdkdVersion } from "./version-CZbKGFSS.js";
+import { $a as unpreviewableOrphanRecords, $c as stripControlChars, $i as hasReadableOutputs, $n as unsupportedFinalSnapshotError, $o as carryLogOnlyValues, $r as poisonRenderedSpellingsCollidingIn, $s as crossPrefixDeniedWarning, $t as isJournaledOrphan, A as diffSecurity, Aa as refuseMalformedOutputs, Ac as readBootstrapMarkerBody, Ai as isImpossibleEmptyStoredAttribute, Al as StageLoadError, An as collectPublishedOutputNames, Ao as prefetchCreateOnlyPropertyPaths, Ar as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, As as recordPhysicalNameCopy, At as NESTED_PENDING_PARENT_REASON, B as readProtection, Ba as refuseMalformedResourcePropertiesForDrift, Bc as finchSecretArgvRefusal, Bi as withSharedDrainBudget, Bl as renderAssemblyPathEscape, Bn as secretNamePrintingBags, Bo as isMarkedCoordinate, Br as deleteSkipReason, Bs as STATE_SOURCED_BASELINE_RULES, Bt as collectNestedChildUnaddressed, Ca as refuseDivergentRecordRegionForDestroy, Cc as AssetModeResolver, Ci as classifyReplaySecretRegion, Cl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Cn as secretSafeKeyDisplay, Cr as isCustomResource, Cs as pathCrossesDottedKey, Ct as dropFailedCommands, D as findServiceTokenRefusals, Da as refuseMalformedOrphans, Dc as getBootstrapMarkerKey, Di as isUnboundTemplateParameter, Dl as canonicalizeRegion, Dn as isWholeDynamicReferenceValue, Dr as isCustomResourceType$1, Dt as loadJournaledOrphans, E as deferredServiceTokenWarning, Ea as refuseMalformedOrphanRecordsForDestroy, Ec as ensureAssetStorage, Ei as coerceParameterTypedValue, El as PARTITION_TABLE, En as exportNameSecretExposure, Er as readsNoEchoDeleteValues, Es as recordNestedStackParameterExpressions, Et as journaledOrphanLines, F as recordedProtectionEvidence, Fa as refuseMalformedResourceEntriesForDestroy, Fc as resolveDockerContextDirectory, Fi as AWS_NO_VALUE, Fl as nullPrototypeRecord, Fn as completedReplayEntries, Fs as recordMaskOnlyValuesIn, Ft as nestedChildStackName$1, Ga as refuseMalformedResourcesForExport, Gc as partitionSensitiveEnv, Gi as STATE_REGION_DIVERGED, Gl as resolveBucketRegion, Gn as ATOMIC_FINAL_SNAPSHOT_TYPES, Go as noEchoCoordinatesOf, Gs as isSingleDynamicReferenceToken, Ha as refuseMalformedResourcePropertiesForOrphan, Hc as getDockerCmd, Hl as injectAwsRegion, Hn as stateSecretNameNeedles, Ho as maskReadbackAtCoordinates, Hr as isWaitAbandonedError, Hs as STATE_SOURCED_READBACK_RULES, Ht as withNestedStackContext, I as recordedProtectionNote, Ia as refuseMalformedResourceEntriesForImport, Ic as describeDockerCapturedOutput, Ii as cfnRefValueFromPhysicalId, Il as ownValue, In as journaledOrphanPrintingBag, Ir as RollbackInlinePolicyWriters, Is as recordNoEchoAttributeValues, It as recordDisplacedSkips, Ja as repairMalformedOrphansForReadOnly, Jc as redactedDockerCause, Ji as UNREADABLE_RESOURCES_MAP_ROW, Jn as ccRoutedFinalSnapshotError, Js as S3StateBackend, Jt as withStackRecords, Ka as refuseMalformedState, Kc as redactDockerArgvValues, Ki as STATE_RESOURCES_MALFORMED, Kn as PRE_DELETE_SNAPSHOT_TYPES, Ko as noEchoLeavesOf, Ks as LockManager, Kt as destroyStackRecordsView, L as PROTECTION_PROPERTY_BY_TYPE, La as refuseMalformedResourceEntriesForImportSave, Lc as describeDockerExecFailure, Li as isStalePlaceholderArnAttribute, Ll as absoluteAssemblyPathEscape, Ln as maskEventTextWithBoundBags, Lo as DagBuilder, Lr as UNSPECIFIED_SKIP_REASON, Ls as recordNoEchoParameterFreshValue, M as noEchoComparisonForTemplate, Ma as refuseMalformedResourceAttributesForOrphan, Mc as validateContainerRepoName, Mi as carriesFetchableDynamicReference, Ml as defineOwnKey, Mn as bindingSkippedOutputs, Mo as describeTypeWithThrottleRetry, Mr as customResourceResponseExpirationWarning, Ms as carriesSecretMask, Mt as displacedPhysicalIdShown, N as noEchoExactEchoLeavesOf, Na as refuseMalformedResourceEntries, Nc as buildDenyExternalAccessPolicy, Ni as isNamelessDynamicReferenceError, Nl as hasOwnKey, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as withRetry, Nr as CloudControlProvider, Ns as provenPublicValue, Nt as dropSettledNestedJournals, O as serviceTokenBlockingReason, Oa as refuseMalformedOrphansForDestroy, Oc as isCrossRegionRedirect, Oi as parameterTypeMayLoseSecretIdentity, Ol as derivePartitionAndUrlSuffix, On as noEchoParameterValueSeed, Os as physicalNameCopiesOf, Ot as makeForeignHolderScan, P as noEchoParameterNamesOf, Pa as refuseMalformedResourceEntriesForDeploy, Pc as buildDockerImage, Pi as keepsSecretReferenceToken, Pl as hasPlainPrototype, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Pr as slowCcOperationTimeoutMs, Ps as recordMaskOnlyValue, Qa as repairMalformedResourcesForReadOnly, Qc as escapeRegExp, Qi as hasReadableOrphans, Qn as refusesFinalSnapshot, Qo as liveMatchesUnresolvedTokenFrame, Qr as IntrinsicFunctionResolver, Qs as applyCrossPrefixScan, Qt as demoteSupersededOrphans, R as isProtectionValueActive, Ra as refuseMalformedResourceEntriesForOrphan, Rc as describeDockerFailure, Ri as refStateLookupFromResource, Rl as describeFileReadFailure, Rn as orphanRecordsPrintingBag, Ro as TemplateParser, Rr as deleteIndeterminateGuards, Rs as recordProvenPublicExpression, Rt as revertedNestedRowIds, Sa as previewableOrphanRecords, Sc as rewriteTemplateAssetReferences, Si as classifyRecordedSecretRegion, Sl as uploadCfnTemplate, Sn as secretBearingStateKeyWarning, Sr as ccBrokenReason, Ss as isUncertifiedBaselineMaskPosition, St as deleteJournaledOrphans, T as recordRetainedForReadoption, Ta as refuseMalformedOrphanRecords, Tc as assertAssetBucketRegion, Ti as regionLessSecretName, Tl as expectedOwnerParam, Tn as exportNameNoEchoParameters, Tr as TemplateNoEchoReresolver, Ts as inheritNestedStackParameterAssociations, Tt as isHandledOrphan, Ua as refuseMalformedResourcesForDeploy, Uc as isDockerClientEnvKey, Ui as declaresNoEcho, Ul as injectedAwsRegionValue, Un as storedSecretNameNeedles, Uo as maskWholeValue, Us as TEMPLATE_SOURCED_RULES, Ut as replayFailedOperations, Va as refuseMalformedResourcePropertiesForExport, Vc as formatDockerLoginError, Vi as parameterInputsFor, Vl as resolveAssemblyPath, Vn as secretNamedRecordNeedles, Vo as maskAtCoordinates, Vs as STATE_SOURCED_CROSS_GENERATION_RULES, Vt as getCurrentNestedStackContext, Wa as refuseMalformedResourcesForDestroy, Wc as isMalformedEnvKey, Wi as JSON_LISTING_HOLE_VALUE, Wn as extractDeploymentEventError, Wo as maskedLeafCoordinatesOf, Ws as WHOLE_DYNAMIC_REFERENCE_PATTERN, Wt as replayRollback, Xa as repairMalformedResourceEntriesForReadOnly, Xc as runDockerStreaming, Xi as deployRefusesOrphanRowsReason, Xn as effectiveDeletionPolicy, Xo as readsNoEchoSource, Xr as DiffCalculator, Xs as CrossPrefixReadError, Ya as repairMalformedOutputsForReadOnly, Yc as runDockerForeground, Yi as accountArgs, Yn as createPreDeleteFinalSnapshot, Yo as readbackPathFor, Ys as rebuildClientForBucketRegion, Yt as removeProtectionTypeList, Za as repairMalformedResourcePropertiesForReadOnly, Zc as warnFinchArgvExposure, Zi as displayLogicalId, Zn as isFinalSnapshotError, Zo as valueAtCoordinate, Zr as INTRINSIC_KEYS, Zs as CrossPrefixScanCache, Zt as recordAfterRollbackUpdate, _ as keptWholeReasonText, _a as malformedResourceEntriesWarning, _c as stringifyValue, _l as ssmResolvedValueType, _n as orphanNeedsIdentity, _s as scrubResourceRecord, _t as planOrphanAdoption, a as inheritedProvenanceForChildDiff, aa as malformedExportSourceWarning, ac as exportNamesCarriedFrom, ai as explicitRoleArnOrThrow, al as getDefaultStateBucketName, an as replacementNeverSwapped, ao as unwrittenCreateOnlyReplacement, ar as ledgerForStack, as as recordLogOnlyParameterValue, at as createReadOnlyAttributeHealerFactory, ba as malformedScrubResourceEntriesRefusalMessage, bc as createAssetRedirectResolver, bl as MIGRATE_TMP_PREFIX, bn as exportAliasCollisionScrubWarning, br as CC_BROKEN_REASON, bs as DYNAMIC_REFERENCE_TOKEN_SCAN, bt as pendingRequestCount, c as isAbsoluteAssetPath, ca as malformedLocalResourcesWarning, cc as hasUnverifiableParameterRefusal, ci as AWS_CREDENTIAL_ENV_KEYS, cl as resolveApp, cn as findNestedStackTypeChanges, co as hasNoCloudControlHandlers, cs as unionOfSecretBags, ct as gray, d as templateIdentity, da as malformedOrphanRowsKeptWarning, dc as isReadableBag, di as envCredentialsAreAssumedRole, dl as resolveSkipPrefix, do as MULTI_REGION_RECREATE_BLOCKED_TYPES, ds as maskSecretsInError, dt as yellow, ea as hasReadableResources, ec as isAccessDenied, ei as producerLookupOver, el as stripForDisplay, en as isReplacementOrphan, eo as unreadableOrphanRecords, er as maskingRetryLogger, es as createUnionSecretMasker, f as conditionFingerprint, fa as malformedOrphansRefusalMessage, fc as orphansAfterRollback, fl as resolveStateBucketWithDefault, fo as isStatefulRecreateTargetForReplace, fs as maskSecretsInText, ft as computeParameterTaint, g as isSecretBearingReferenceString, ga as malformedRenderedContainersWarning, gc as isSensitiveAttributeName, gi as recordedReferenceRegions, gl as warnDeprecatedNoPrefixCliFlag, gn as updatePartialReason, gs as redactSecretsForState, gt as makeSiblingClaimReader, h as readRecordedConditionVerdicts, ha as malformedOutputsWarning, hc as AssetPublisher, hi as recordedOutputReferenceRegions, hl as stateBucketExistenceConfirmed, hn as updatePartialMessage, ht as resourcesNamingDeclaredParameter, i as crossStackOutputProvenanceSource, ia as malformedExportNamesWarning, ic as describeRegionValueKind, ii as assertSendableRoleArn, il as synthesisStatusMessage, in as recordUnderIdIsNotOwn, is as printingCorpusOf, it as formatResourceLine, j as noEchoAttributeNamesOf, ja as refuseMalformedOutputsForDestroy, jc as validateAssetBucketName, ji as carriesDynamicReference, jl as processStackMessages, jn as isExportAliasCollision, jo as templateResourceTypes, jr as applyCustomResourceResponseExpiration, js as splitGetAttStringForm, jt as displacedOpClause, k as withResourceDeadline, ka as refuseMalformedOrphansForOrphan, kc as parseBootstrapMarker, ki as getAccountInfo, kl as AssemblyReader, kn as collectDeclaredOutputNames, kr as withPrintingSecrets, kt as sameJournaledOrphans, l as listNestedTemplateRows, la as malformedOrphanRecordsRefusalMessage, lc as importableOutputKeys, li as applyCallerIdentityCredentials, ll as resolveAutoAssetStorage, lo as findReplacedReadersOfRecreateTargets, ls as createSecretMasker, lt as green, m as parentSuppliedValues, ma as malformedOutputsRefusalMessage, mc as shouldRetainResource, ml as resolveUseCdkBootstrapAssets, mo as renderStatefulReason, mt as reachableDivergentParameters, n as IMPLICIT_DELETE_DEPENDENCIES, na as isReadableResourceEntry, nc as splitImportedOps, ni as applyRoleArnIfSet, nl as getDockerImageBySourceHash, nn as planRollback, no as withheldAccountClause, nr as findDestructiveChanges, ns as literalSplitDelimitersOf, o as childTemplateLoader, oa as malformedLocalOutputsWarning, oc as hasReadableExportSet, oi as isIamRoleArn, ol as getLegacyStateBucketName, on as resolveReplacementOldType, os as recordLogOnlyValue, ot as bold, p as conditionInputsFrom, pa as malformedOrphansWarning, pc as orphansCarriedFrom, pi as keepHeldTokenProvenance, pl as resolveStateBucketWithDefaultAndSource, po as isStatefulRecreateTargetSync, ps as markSameGenerationBag, pt as namesAnyDeclaredParameter, qa as repairMalformedOrphanRecordsForReadOnly, qc as redactedCause, qi as UNREADABLE_ORPHANS_CONTAINER_ROW, qn as buildFinalSnapshotIdentifier, qo as noEchoOutputsComparison, qs as isLockInfoExpired, r as computeImplicitDeleteEdges, ra as malformedDriftResourcePropertiesWarning, rc as acceptedCreateOnlyDropsOf, ri as assertFlagRoleArn, rl as Synthesizer, rn as recheckFailedPlan, ro as findActionableSilentDrops, rr as formatDestructiveChange, rs as logOnlyValueCount, s as findNestedTemplateTreeDefect, sa as malformedLocalResourceEntriesWarning, sc as hasReasonlessBaselineRefusal, si as sendableAssumeRoleCommand, sl as loadCdkJson, sn as seedsDeleteFirstGuard, so as NO_CC_HANDLERS_REASON, sr as withCreateTokenLedger, ss as shareLogOnlyValues, st as cyan, t as DeployEngine, ta as isReadableOrphanRecord, tc as isNotImplemented, ti as refuseUnreadableCdkCrossAccountRefs, tl as AssetManifestLoader, tn as planFailedOps, to as unreadableResourceEntries, tr as constructPathOf, ts as hasMaskableValues, u as renderNestedTemplateTreeDefect, ua as malformedOrphanRecordsWarning, uc as importableOutputs, ui as callerEnvCredentials, ul as resolveCaptureObservedState, un as inheritProducerRegions, uo as shownType, us as errorCauseChain, ut as red, v as mergeNoChangeOutputs, va as malformedResourcePropertiesWarning, vc as WorkGraph, vl as CFN_TEMPLATE_BODY_LIMIT, vn as WITHHELD_NAME_DISPLAY, vs as withPhysicalNameCopies, vt as DeploymentEventsReader, w as keptForReadoption, wc as BOOTSTRAP_MARKER_PREFIX, wi as producerRegionsFromState, wl as decodeListingKey, wn as carriedExportAliasExposure, wr as wouldReturnToSdkProvider, ws as identityKeyFor, wt as dropFailedHint, xa as malformedStateRefusalMessage, xc as loadPublishableAssetManifest, xl as findLargeInlineResources, xn as secretBearing, xr as ProviderRegistry, xs as dynamicReferenceTokens, xt as resolvePendingCloudControlRequests, y as makeCanonicalizePropertiesFn, ya as malformedResourcesWarning, yc as buildAssetRedirectMap, yl as CFN_TEMPLATE_URL_LIMIT, yn as displayTextOrWithheld, yt as DeploymentEventsStore, z as perType, za as refuseMalformedResourcePropertiesForDestroy, zc as dockerSpawnEnvWithSensitive, zl as displayAssemblyPath, zn as secretNamePrintingBag, zo as canonicalCoordinates, zr as deleteLeftInPlace, zs as wholeStringLeavesOf, zt as withNestedRevertRun } from "./deploy-engine-BYgrFxwH.js";
+import { t as getCdkdVersion } from "./version-Q15RJPDm.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -28,7 +28,7 @@ import { Command, InvalidArgumentError, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
-import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, describeCredentialLoadFailure, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
+import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, DynamicReferenceResolver, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, containsDynamicReference, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, firstUsableRegion, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, keysNotFromTemplate, keysOverriddenBy, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveDynamicReferencesInEnv, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing, withoutKeys } from "cdk-local/internal";
 import { CfnLocalStateProvider, createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, isCfnFlagPresent as isCfnFlagPresent$1, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { createServer } from "node:net";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -2561,7 +2561,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DzoIZFZK.js");
+	providerClasses ??= import("./provider-classes-gt8C7wFO.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -11749,7 +11749,7 @@ function countProtectedJournaledOrphans(orphans, region) {
 	let count = 0;
 	for (const { ops } of orphans.segments) for (const op of ops) {
 		if (op.physicalIdRecoveredFromError !== true || op.deletionPolicy === "Retain") continue;
-		if (orphanDeleteNeedsIdentity(op.resourceType) && !op.createdResourceIdentity) continue;
+		if (orphanNeedsIdentity(op) && !op.createdResourceIdentity) continue;
 		const locator = perType(PROTECTION_PROPERTY_BY_TYPE, op.resourceType);
 		if (locator && isProtectionValueActive(op.resourceType, readProtection(op.attemptedProperties, locator, region))) count++;
 	}
@@ -11834,7 +11834,42 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 	refuseMalformedResourcePropertiesForDestroy(state, stackName, regionForState, refusalRecovery);
 	refuseMalformedOrphansForDestroy(state, stackName, regionForState, refusalRecovery);
 	refuseMalformedOrphanRecordsForDestroy(state, stackName, regionForState, refusalRecovery);
-	const journaledOrphans = await loadJournaledOrphans(ctx.stateBackend, stackName, regionForState, state.orphans, logger);
+	let journalAtEntry;
+	try {
+		journalAtEntry = { journal: await ctx.stateBackend.loadRollbackJournal(stackName, regionForState) };
+	} catch (error) {
+		journalAtEntry = { error };
+	}
+	if (ctx.divergentBodyRegion !== void 0 && "journal" in journalAtEntry && pendingRequestCount(journalAtEntry.journal) > 0) {
+		const ids = (journalAtEntry.journal?.segments ?? []).flatMap((segment) => segment.failedOperations ?? []).filter((op) => op.pendingCloudControlRequest !== void 0).map((op) => op.logicalId);
+		const drop = dropFailedCommands(stackName, regionForState, ids);
+		throw new CdkdError(`Stack ${displayStackName(stackName)}'s state record names another region than its key, and its rollback journal records a Cloud Control CREATE a failed deploy stopped waiting for. cdkd cannot tell which region to check it in. Nothing was deleted. Check the request in each region with aws cloudcontrol get-resource-request-status --request-token <token> --region <region> (the token is in the stack's rollback-journal.json), reconcile what it made by hand, then drop the entry and re-run:` + (drop === void 0 ? "" : drop.commands.map((c) => `\n  ${c}`).join("")), "DESTROY_CC_PENDING_REQUEST_DIVERGENT_REGION");
+	}
+	const journalRewritten = await resolvePendingCloudControlRequests({
+		journal: ctx.stateBackend,
+		loaded: "journal" in journalAtEntry ? journalAtEntry.journal : null,
+		reader: () => new CloudControlProvider(),
+		stackName,
+		region: regionForState,
+		command: "destroy",
+		logger,
+		stateResources: state.resources,
+		underLock: async (settle) => {
+			const held = await acquireStackLock({
+				...stackLockBase,
+				onFirstSignal: () => {
+					process.stderr.write(`\nInterrupt received - finishing the Cloud Control request check for ${displayStackName(stackName)} (press Ctrl-C again to force-quit)\n`);
+				}
+			});
+			try {
+				return await settle();
+			} finally {
+				await held.release({ failureMessage: "Failed to release lock after settling an abandoned Cloud Control request" });
+			}
+		}
+	});
+	const entryRead = journalAtEntry;
+	const journaledOrphans = await loadJournaledOrphans(journalRewritten ? ctx.stateBackend : { loadRollbackJournal: () => "journal" in entryRead ? Promise.resolve(entryRead.journal) : Promise.reject(entryRead.error) }, stackName, regionForState, state.orphans, logger);
 	refuseDivergentRecordRegionForDestroy(state, stackName, regionForState, ctx.divergentBodyRegion, refusalRecovery, journaledOrphans.segments.flatMap((g) => g.ops).filter((op) => op.physicalIdRecoveredFromError === true).length);
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
@@ -11866,7 +11901,9 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 			}
 			const recheckResources = recheck ? Object.keys(recheck.state.resources).length : 0;
 			const recheckOrphans = recheck ? (recheck.state.orphans ?? []).length : 0;
-			const recheckJournaled = (await loadJournaledOrphans(ctx.stateBackend, stackName, regionForState, recheck?.state.orphans, journaledOrphans.unreadable === true ? { warn: () => void 0 } : logger)).count;
+			const recheckRead = await loadJournaledOrphans(ctx.stateBackend, stackName, regionForState, recheck?.state.orphans, journaledOrphans.unreadable === true ? { warn: () => void 0 } : logger);
+			const recheckJournaled = recheckRead.count;
+			refuseNewPendingRequests(recheckRead, stackName, regionForState);
 			if (recheckJournaled > 0) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but its rollback journal now records ${recheckJournaled} resource(s) a failed deploy created — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			await ctx.stateBackend.deleteState(stackName, regionForState);
@@ -12061,6 +12098,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		stackNoEchoValues();
 		const journaledUnderLock = await loadJournaledOrphans(ctx.stateBackend, stackName, regionForState, state.orphans, journaledOrphans.unreadable === true ? { warn: () => void 0 } : logger);
 		if (journaledUnderLock.unreadable === true && journaledOrphans.unreadable !== true) throw new Error(`The rollback journal of stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was readable when this run started and cannot be read now (see the warning above). Nothing was deleted; re-run the destroy once it can be read.`);
+		refuseNewPendingRequests(journaledUnderLock, stackName, regionForState);
 		if (!sameJournaledOrphans(journaledUnderLock, journaledOrphans)) throw new Error(`The rollback journal of stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) recorded ${journaledOrphans.count} resource(s) a failed deploy created when this run started and ${journaledUnderLock.count} now, not the same ones — another cdkd process wrote to it. Nothing was deleted; re-run the destroy to act on the current journal.`);
 		const noEchoValues = await stackNoEchoValues();
 		if (journaledUnderLock.count > 0) {
@@ -12504,6 +12542,10 @@ async function scanActiveConsumers(producerStack, producerRegion, ctx) {
 		}
 	}))).filter((r) => r !== null).flat();
 }
+function refuseNewPendingRequests(read, stackName, region) {
+	if ((read.pendingRequests ?? 0) === 0) return;
+	throw new Error(`The rollback journal of stack ${displayStackName(stackName)} (${displaySafe(region, { asciiOnly: true })}) now records a Cloud Control CREATE a failed deploy stopped waiting for — another cdkd process wrote to it. Nothing was deleted; re-run the destroy, which checks how that CREATE ended first.`);
+}
 
 //#endregion
 //#region src/cli/commands/destroy-skip-message.ts
@@ -13004,7 +13046,7 @@ function selectDropTarget(segments, logicalId, stackShown) {
 	throw new CdkdError(`The rollback journal of ${stackShown} has no entry for ${named}. Nothing was changed. ` + (ids.length === 0 ? "It holds no entry --drop-failed can drop." : `Entries --drop-failed can drop: ${ids.join(", ")}.`), "ROLLBACK_DROP_FAILED_UNKNOWN");
 }
 function isDroppable(op) {
-	return isJournaledOrphan(op) && op.physicalIdRecoveredFromError === true;
+	return isJournaledOrphan(op) && op.physicalIdRecoveredFromError === true || op.changeType === "CREATE" && op.pendingCloudControlRequest !== void 0;
 }
 const POLICY_TARGETS = {
 	"AWS::SQS::QueuePolicy": "Queues",
@@ -13012,7 +13054,7 @@ const POLICY_TARGETS = {
 };
 function dropTargetLines(target, segmentCount, logger) {
 	const { op } = target;
-	const lines = [`  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${displacedPhysicalIdShown(op, logger) ?? "a physical id"}  [failed CREATE, segment ${target.segmentNumber}/${segmentCount}]`];
+	const lines = [`  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${op.pendingCloudControlRequest !== void 0 ? "an abandoned Cloud Control request" : displacedPhysicalIdShown(op, logger) ?? "a physical id"}  [failed CREATE, segment ${target.segmentNumber}/${segmentCount}]`];
 	const targetsKey = Object.hasOwn(POLICY_TARGETS, op.resourceType) ? POLICY_TARGETS[op.resourceType] : void 0;
 	const targets = targetsKey === void 0 ? void 0 : op.attemptedProperties?.[targetsKey];
 	if (Array.isArray(targets) && targets.length > 0) {
@@ -19243,6 +19285,16 @@ async function rollbackCommand(stackArg, options) {
 			try {
 				const stateData = await setup.stateBackend.getState(stackName, region);
 				let journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
+				if (await resolvePendingCloudControlRequests({
+					journal: setup.stateBackend,
+					loaded: journal,
+					reader: () => providerRegistry.getCloudControlProvider(),
+					stackName,
+					region,
+					command: "rollback",
+					logger,
+					stateResources: stateData?.state.resources
+				})) journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
 				const orphanedPending = journal ? await judgeNestedPendingRecords(setup, stackName, region, journal.segments) : 0;
 				if (journal && orphanedPending > 0) journal = {
 					...journal,
@@ -22094,7 +22146,6 @@ function constructPathField(path) {
 function describeLocalAwsFailureForWarn(err, operation) {
 	if (err instanceof CdkdError) return withoutTrailingPeriod(displaySafe(err.message));
 	const rendered = describeAwsFailureForWarn(err, operation);
-	if (rendered === describeCredentialLoadFailure(err)) getLogger().debug(safeMsg`${operation}: the AWS SDK's own failure message was: ${thrownText(err)}`);
 	return withoutTrailingPeriod(displaySafe(rendered));
 }
 function withoutTrailingPeriod(text) {
@@ -22109,13 +22160,6 @@ function redactedAwsCause(err, message) {
 function hasSdkMetadata(error) {
 	return error.$metadata !== void 0;
 }
-function thrownText(err) {
-	try {
-		return err instanceof Error ? String(err.message) : String(err);
-	} catch {
-		return "[unstringifiable throw]";
-	}
-}
 
 //#endregion
 //#region src/cli/commands/local-state-loader.ts
@@ -22586,11 +22630,17 @@ function engineFromCfnStackChannel(alsoReads) {
 		flagOnly: false
 	};
 }
+function engineFromStateChannel(reads) {
+	return {
+		what: `--from-state makes the engine read ${reads}`,
+		flagOnly: false
+	};
+}
 const ENGINE_ACCOUNT_ID_CHANNEL = {
 	what: "${AWS::AccountId} resolves to the role's account in the container's environment, secret references and image URIs",
 	flagOnly: false
 };
-function warnEngineRoleExposure(cmd, commandName, channels, fromCfnStackChannel = engineFromCfnStackChannel()) {
+function warnEngineRoleExposure(cmd, commandName, channels, fromCfnStackChannel = engineFromCfnStackChannel(), fromStateChannel) {
 	cmd.hook("preAction", (_thisCommand, actionCommand) => {
 		const options = actionCommand.optsWithGlobals();
 		const message = engineRoleExposureWarning(commandName, channels, fromCfnStackChannel, {
@@ -22598,8 +22648,9 @@ function warnEngineRoleExposure(cmd, commandName, channels, fromCfnStackChannel
 			profileFlag: options.profile,
 			envProfile: process.env["AWS_PROFILE"],
 			fromCfnStack: isCfnFlagPresent(options),
-			assumesForWorkload: isAssumeRequested(options.assumeRole) || isAssumeRequested(options.assumeTaskRole)
-		});
+			assumesForWorkload: isAssumeRequested(options.assumeRole) || isAssumeRequested(options.assumeTaskRole),
+			fromState: options.fromState === true
+		}, fromStateChannel);
 		if (message !== void 0) getLogger().warn(message);
 	});
 	return cmd;
@@ -22609,12 +22660,13 @@ function isAssumeRequested(value) {
 	if (value !== null && typeof value === "object") return Object.keys(value).length > 0;
 	return value === true;
 }
-function engineRoleExposureWarning(commandName, channels, fromCfnStackChannel, input) {
+function engineRoleExposureWarning(commandName, channels, fromCfnStackChannel, input, fromStateChannel) {
 	if (!input.roleArn || !isIamRoleArn(input.roleArn) || input.profileFlag) return void 0;
 	const all = [
 		...channels,
 		...input.assumesForWorkload ? [ENGINE_ASSUME_ROLE_CHANNEL] : [],
-		...input.fromCfnStack ? [fromCfnStackChannel] : []
+		...input.fromCfnStack ? [fromCfnStackChannel] : [],
+		...input.fromState && fromStateChannel ? [fromStateChannel] : []
 	];
 	const envProfileSet = !!input.envProfile;
 	const open = envProfileSet ? all.filter((c) => c.flagOnly) : all;
@@ -28802,41 +28854,9 @@ function createLocalStartAgentCoreCommand$1() {
 
 //#endregion
 //#region src/cli/commands/local-start-alb.ts
-function collectLambdaTargetLogicalIds(frontDoor) {
-	if (!frontDoor) return [];
-	const ids = /* @__PURE__ */ new Set();
-	const fromAction = (action) => {
-		if (action?.kind !== "forward") return;
-		for (const target of action.targets) if (target.kind === "lambda") ids.add(target.lambda.logicalId);
-	};
-	for (const listener of frontDoor.listeners) {
-		fromAction(listener.defaultAction);
-		for (const rule of listener.rules) fromAction(rule.action);
-	}
-	return [...ids].sort();
-}
-function warnUnresolvedLambdaTargetEnv(strategy, options) {
-	if (options.fromState !== true) return strategy;
-	return {
-		...strategy,
-		resolveBoots: (stacks, chosenTargets) => {
-			const resolved = strategy.resolveBoots(stacks, chosenTargets);
-			const lambdaIds = collectLambdaTargetLogicalIds(resolved.frontDoor);
-			if (lambdaIds.length === 0) return resolved;
-			const ecsNote = resolved.boots.length > 0 ? "The ECS service targets behind this ALB DO honor --from-state. " : "";
-			return {
-				...resolved,
-				warnings: [...resolved.warnings, `--from-state does not reach the container environment of this ALB's Lambda target group(s): ${lambdaIds.map((id) => plainOrDescribed(id, "logical id")).join(", ")}. Their Environment.Variables keep any Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue intrinsics unresolved, and each is then dropped with its own warning. ` + ecsNote + "The only state source the Lambda path reads is --from-cfn-stack '<name>', which REPLACES --from-state (the two are mutually exclusive) and reaches both target kinds on a CloudFormation-deployed stack; otherwise override the affected variables with --env-vars."]
-			};
-		}
-	};
-}
-function buildAlbEmulatorStrategy(options) {
-	return warnUnresolvedLambdaTargetEnv(albStrategy(options), options);
-}
 function createLocalStartAlbCommand() {
-	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token '<jwt>' to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes of the ECS services behind the ALB. Does NOT reach a Lambda target group's container environment (a boot warning names the affected functions) — use --from-cfn-stack for those. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, buildAlbEmulatorStrategy(options), cdkdExtraStateProviders, cdkdHostSynthesizer(() => options));
+	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token '<jwt>' to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes of the ECS services behind the ALB, and in the environment variables of its Lambda target groups' functions. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
+		await runEcsServiceEmulator(targets, options, albStrategy(options), cdkdExtraStateProviders, cdkdHostSynthesizer(() => options));
 	}));
 	addAlbSpecificOptions(cmd);
 	warnEngineRoleExposure(cmd, "start-alb", [
@@ -28850,40 +28870,37 @@ function createLocalStartAlbCommand() {
 
 //#endregion
 //#region src/cli/commands/local-start-cloudfront.ts
+const STATE_SOURCE_ENGINE_READS = "a deployed S3 origin's objects and distribution config and the KeyValueStore entries, and the ${AWS::AccountId} in the Function URL / Lambda@Edge environment resolves to the role's account";
 function createLocalStartCloudFrontCommand$1() {
 	const cmd = createLocalStartCloudFrontCommand({
 		embedConfig: getEmbedConfig(),
 		extraStateProviders: cdkdExtraStateProviders,
-		synthesizer: cdkdHostSynthesizer(() => {
-			const { verbose, roleArn } = cmd.opts();
-			return {
-				verbose,
-				roleArn
-			};
-		})
+		synthesizer: cdkdHostSynthesizer(() => cmd.opts())
 	});
-	cmd.addOption(new Option("--from-state", "[not supported on start-cloudfront] Read cdkd's S3 state for the target stack. Refused at startup: the CloudFront emulator consults a state source only under --from-cfn-stack. Use --from-cfn-stack instead.").default(false));
-	cmd.addOption(new Option("--state-bucket <bucket>", "[not supported on start-cloudfront] S3 bucket for --from-state. Refused at startup with --from-state."));
-	cmd.addOption(new Option("--state-prefix <prefix>", "[not supported on start-cloudfront] S3 key prefix for --from-state state files. Refused at startup with --from-state.").default("cdkd"));
+	cmd.addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack: resolve a deployed S3 origin's bucket and the KeyValueStores cf.kvs() reads, and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in the Function URL origin and Lambda@Edge environment variables. Mutually exclusive with --from-cfn-stack.").default(false));
+	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline."));
+	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
-	refuseUnwiredCdkdStateFlags(cmd);
-	warnEngineRoleExposure(cmd, "start-cloudfront", [engineCredentialTripleChannel("the Function URL and Lambda@Edge containers"), ENGINE_DYNAMIC_REFERENCE_CHANNEL], engineFromCfnStackChannel("a deployed S3 origin's objects and KeyValueStore entries"));
+	warnEngineRoleExposure(cmd, "start-cloudfront", [engineCredentialTripleChannel("the Function URL and Lambda@Edge containers"), ENGINE_DYNAMIC_REFERENCE_CHANNEL], engineFromCfnStackChannel(STATE_SOURCE_ENGINE_READS), engineFromStateChannel(STATE_SOURCE_ENGINE_READS));
 	return adoptDeprecatedRegionFlag(cmd);
 }
-function refuseUnwiredCdkdStateFlags(cmd) {
-	cmd.hook("preAction", (_thisCommand, actionCommand) => {
-		const options = actionCommand.opts();
-		const passed = [];
-		if (options.fromState === true) passed.push("--from-state");
-		if (options.stateBucket !== void 0) passed.push("--state-bucket");
-		if (actionCommand.getOptionValueSource("statePrefix") === "cli") passed.push("--state-prefix");
-		if (passed.length === 0) return;
-		actionCommand.error(`error: ${passed.join(" / ")} ${passed.length === 1 ? "is" : "are"} not supported by \`cdkd local start-cloudfront\`. The CloudFront emulator resolves its deployed-S3 origins, its cf.kvs() bindings and its Function URL / Lambda@Edge containers' environment through cdk-local, which consults a state source only under --from-cfn-stack. DROP the flag(s) above, then use --from-cfn-stack '<name>' for a CloudFormation-deployed stack, or --origin '<originId>'='<dir>' to serve an origin from a local directory. Adding --from-cfn-stack while leaving these on hits this same refusal.`, { code: "cdkd.startCloudFrontStateFlagUnsupported" });
-	});
-}
 
 //#endregion
 //#region src/cli/commands/local-invoke.ts
+let hostLoggerForwarding = false;
+function forwardToCdkdLogger(level, message, args) {
+	if (!hostLoggerForwarding) {
+		hostLoggerForwarding = true;
+		try {
+			getLogger()[level](message, ...args);
+			return;
+		} catch {} finally {
+			hostLoggerForwarding = false;
+		}
+	}
+	if (level === "debug" && getLogger().getLevel() !== "debug") return;
+	console.error(terminalSafe(String(message)));
+}
 const CDKD_EMBED_CONFIG = {
 	cliName: "cdkd local",
 	binaryName: "cdkd",
@@ -28892,7 +28909,15 @@ const CDKD_EMBED_CONFIG = {
 	awsBindMountPath: "/cdkd-aws",
 	envPrefix: "CDKD",
 	sigV4StrictByDefault: false,
-	sigV4OptFlag: "--strict-sigv4"
+	sigV4OptFlag: "--strict-sigv4",
+	logger: {
+		debug: (message, ...args) => forwardToCdkdLogger("debug", message, args),
+		info: (message, ...args) => forwardToCdkdLogger("info", message, args),
+		warn: (message, ...args) => forwardToCdkdLogger("warn", message, args),
+		error: (message, ...args) => forwardToCdkdLogger("error", message, args),
+		setLevel: (level) => getLogger().setLevel(level),
+		getLevel: () => getLogger().getLevel()
+	}
 };
 async function localInvokeCommand(target, options) {
 	const logger = getLogger();
@@ -29605,4 +29630,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-BDm58Wc8.js.map
+//# sourceMappingURL=program-Djx1RrEU.js.map