@go-to-k/cdkd 0.301.4 → 0.301.5

package/dist/{program-DYfZCsxM.js → program-DmPDfDhE.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as repairMalformedResourceEntriesForReadOnly, $c as runDockerForeground, $i as deployRefusesOrphanRowsReason, $n as isFinalSnapshotError, $o as readsNoEchoSource, $r as DiffCalculator, $s as rebuildClientForBucketRegion, $t as isJournaledOrphan, A as diffSecurity, Aa as refuseMalformedOrphans, Ac as ensureAssetStorage, Ai as isUnboundTemplateParameter, Al as PARTITION_TABLE, An as collectPublishedOutputNames, Ar as isCustomResourceType$1, As as recordNestedStackParameterExpressions, At as NESTED_PENDING_PARENT_REASON, Ba as refuseMalformedResourceEntriesForImportSave, Bc as describeDockerCapturedOutput, Bi as isStalePlaceholderArnAttribute, Bl as ownValue, Bn as secretNamePrintingBag, Bo as DagBuilder, Br as UNSPECIFIED_SKIP_REASON, Bs as recordNoEchoAttributeValues, Bt as collectNestedChildUnaddressed, C as computeImplicitDeleteEdges, Ca as malformedScrubResourceEntriesRefusalMessage, Cc as buildAssetRedirectMap, Cl as CFN_TEMPLATE_URL_LIMIT, Cn as secretSafeKeyDisplay, Cr as ProviderRegistry, Ct as dropFailedCommands, D as findServiceTokenRefusals, Dc as AssetModeResolver, Di as producerRegionsFromState, Dl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dn as isWholeDynamicReferenceValue, Ds as pathCrossesDottedKey, Dt as loadJournaledOrphans, E as deferredServiceTokenWarning, Ea as refuseDivergentRecordRegionForDestroy, Ec as rewriteTemplateAssetReferences, Ei as classifyReplaySecretRegion, El as uploadCfnTemplate, En as exportNameSecretExposure, Er as wouldReturnToSdkProvider, Es as isUncertifiedBaselineMaskPosition, Et as journaledOrphanLines, F as perType, Fa as refuseMalformedResourceAttributesForOrphan, Fc as validateAssetBucketName, Fi as carriesFetchableDynamicReference, Fl as processStackMessages, Fn as completedReplayEntries, Fo as describeTypeWithThrottleRetry, Fr as customResourceResponseExpirationWarning, Fs as splitGetAttStringForm, Ft as nestedChildStackName$1, Ga as refuseMalformedResourcePropertiesForOrphan, Gc as formatDockerLoginError, Gl as resolveAssemblyPath, Gn as storedSecretNameNeedles, Go as maskReadbackAtCoordinates, Gr as isWaitAbandonedError, Gs as STATE_SOURCED_CROSS_GENERATION_RULES, Ha as refuseMalformedResourcePropertiesForDestroy, Hc as describeDockerFailure, Hl as describeFileReadFailure, Ho as canonicalCoordinates, Hr as deleteLeftInPlace, Hs as recordProvenPublicExpression, Ht as withNestedStackContext, I as readProtection, Ia as refuseMalformedResourceEntries, Ic as validateContainerRepoName, Ii as isNamelessDynamicReferenceError, Il as defineOwnKey, In as journaledOrphanPrintingBag, Io as withRetry, Ir as CloudControlProvider, Is as carriesSecretMask, It as recordDisplacedSkips, Ja as refuseMalformedResourcesForExport, Jc as isMalformedEnvKey, Ji as STATE_REGION_DIVERGED, Jn as PRE_DELETE_SNAPSHOT_TYPES, Jo as noEchoCoordinatesOf, Js as WHOLE_DYNAMIC_REFERENCE_PATTERN, Jt as withStackRecords, Ka as refuseMalformedResourcesForDeploy, Kc as getDockerCmd, Ki as declaresNoEcho, Kl as injectAwsRegion, Kn as extractDeploymentEventError, Ko as maskWholeValue, Ks as STATE_SOURCED_READBACK_RULES, Kt as destroyStackRecordsView, La as refuseMalformedResourceEntriesForDeploy, Lc as buildDenyExternalAccessPolicy, Li as keepsSecretReferenceToken, Ll as hasOwnKey, Ln as maskEventTextWithBoundBags, Lr as slowCcOperationTimeoutMs, Ls as provenPublicValue, M as recordedProtectionNote, Ma as refuseMalformedOrphansForOrphan, Mc as isCrossRegionRedirect, Mi as getAccountInfo, Ml as derivePartitionAndUrlSuffix, Mn as bindingSkippedOutputs, Mr as withPrintingSecrets, Ms as physicalNameCopiesOf, Mt as displacedPhysicalIdShown, N as PROTECTION_PROPERTY_BY_TYPE, Na as refuseMalformedOutputs, Nc as parseBootstrapMarker, Ni as isImpossibleEmptyStoredAttribute, Nl as AssemblyReader, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as prefetchCreateOnlyPropertyPaths, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Nt as dropSettledNestedJournals, O as serviceTokenBlockingReason, Oa as refuseMalformedOrphanRecords, Oc as BOOTSTRAP_MARKER_PREFIX, Oi as regionLessSecretName, Ol as decodeListingKey, On as noEchoParameterValueSeed, Or as TemplateNoEchoReresolver, Os as identityKeyFor, Ot as makeForeignHolderScan, P as isProtectionValueActive, Pa as refuseMalformedOutputsForDestroy, Pc as readBootstrapMarkerBody, Pi as carriesDynamicReference, Pl as StageLoadError, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Po as templateResourceTypes, Pr as applyCustomResourceResponseExpiration, Ps as recordPhysicalNameCopy, Qa as repairMalformedOutputsForReadOnly, Qc as redactedDockerCause, Qi as accountArgs, Qn as effectiveDeletionPolicy, Qo as readbackPathFor, Qs as S3StateBackend, Qt as demoteSupersededOrphans, Ra as refuseMalformedResourceEntriesForDestroy, Rc as buildDockerImage, Ri as AWS_NO_VALUE, Rl as hasPlainPrototype, Rn as namingSecretsWithRecordedNoEcho, Rs as recordMaskOnlyValue, Rt as revertedNestedRowIds, S as IMPLICIT_DELETE_DEPENDENCIES, Sa as malformedResourcesWarning, Sc as WorkGraph, Sl as CFN_TEMPLATE_BODY_LIMIT, Sn as secretBearingStateKeyWarning, Sr as CC_BROKEN_REASON, Ss as withPhysicalNameCopies, St as deleteJournaledOrphans, T as recordRetainedForReadoption, Ta as previewableOrphanRecords, Tc as loadPublishableAssetManifest, Ti as classifyRecordedSecretRegion, Tl as findLargeInlineResources, Tn as exportNameNoEchoParameters, Tr as isCustomResource, Ts as dynamicReferenceTokens, Tt as isHandledOrphan, Ua as refuseMalformedResourcePropertiesForDrift, Uc as dockerSpawnEnvWithSensitive, Ui as withSharedDrainBudget, Ul as displayAssemblyPath, Un as secretNamedRecordNeedles, Uo as isMarkedCoordinate, Ur as deleteSkipReason, Us as wholeStringLeavesOf, Ut as replayFailedOperations, Va as refuseMalformedResourceEntriesForOrphan, Vc as describeDockerExecFailure, Vi as refStateLookupFromResource, Vl as absoluteAssemblyPathEscape, Vn as secretNamePrintingBags, Vo as TemplateParser, Vr as deleteIndeterminateGuards, Vs as recordNoEchoParameterFreshValue, Vt as getCurrentNestedStackContext, Wa as refuseMalformedResourcePropertiesForExport, Wc as finchSecretArgvRefusal, Wi as parameterInputsFor, Wl as renderAssemblyPathEscape, Wn as stateSecretNameNeedles, Wo as maskAtCoordinates, Ws as STATE_SOURCED_BASELINE_RULES, Wt as replayRollback, Xa as repairMalformedOrphanRecordsForReadOnly, Xc as redactDockerArgvValues, Xi as UNREADABLE_ORPHANS_CONTAINER_ROW, Xn as ccRoutedFinalSnapshotError, Xo as noEchoOutputsComparison, Xs as LockManager, Ya as refuseMalformedState, Yc as partitionSensitiveEnv, Yi as STATE_RESOURCES_MALFORMED, Yl as resolveBucketRegion, Yn as buildFinalSnapshotIdentifier, Yo as noEchoLeavesOf, Ys as isSingleDynamicReferenceToken, Yt as removeProtectionTypeList, Za as repairMalformedOrphansForReadOnly, Zc as redactedCause, Zi as UNREADABLE_RESOURCES_MAP_ROW, Zn as createPreDeleteFinalSnapshot, Zs as isLockInfoExpired, Zt as recordAfterRollbackUpdate, _ as makeCanonicalizePropertiesFn, _a as malformedOutputsRefusalMessage, _c as orphansCarriedFrom, _l as resolveStateBucketWithDefaultAndSource, _n as orphanNeedsIdentity, _o as renderStatefulReason, _s as markSameGenerationBag, _t as planOrphanAdoption, a as findNestedTemplateTreeDefect, aa as isReadableResourceEntry, ac as isNotImplemented, ai as applyRoleArnIfSet, al as AssetManifestLoader, an as replacementNeverSwapped, ao as withheldAccountClause, ar as formatDestructiveChange, as as hasMaskableValues, at as red, ba as malformedResourceEntriesWarning, bc as isSensitiveAttributeName, bl as warnDeprecatedNoPrefixCliFlag, bn as exportAliasCollisionScrubWarning, bs as redactSecretsForState, bt as pendingRequestCount, c as renderNestedTemplateTreeDefect, ca as malformedExportSourceWarning, cc as describeRegionValueKind, ci as explicitRoleArnOrThrow, cl as synthesisStatusMessage, cn as findNestedStackTypeChanges, co as unwrittenCreateOnlyReplacement, cs as printingCorpusOf, ct as namesAnyDeclaredParameter, d as conditionInputsFrom, da as malformedLocalResourcesWarning, dc as hasReasonlessBaselineRefusal, di as AWS_CREDENTIAL_ENV_KEYS, dl as loadCdkJson, do as hasNoCloudControlHandlers, ds as shareLogOnlyValues, dt as noEchoAttributeNamesOf, ea as displayLogicalId, ec as CrossPrefixReadError, ei as INTRINSIC_KEYS, el as runDockerStreaming, en as isReplacementOrphan, eo as repairMalformedResourcePropertiesForReadOnly, er as refusesFinalSnapshot, es as recordedNoEchoValuesOf, et as formatResourceLine, f as parentSuppliedValues, fa as malformedOrphanRecordsRefusalMessage, fc as hasUnverifiableParameterRefusal, fi as applyCallerIdentityCredentials, fl as resolveApp, fo as findReplacedReadersOfRecreateTargets, fs as unionOfSecretBags, ft as noEchoComparisonForTemplate, g as mergeNoChangeOutputs, ga as malformedOrphansWarning, gc as orphansAfterRollback, gi as keepHeldTokenProvenance, gl as resolveStateBucketWithDefault, gn as updatePartialReason, go as isStatefulRecreateTargetSync, gs as maskSecretsInText, gt as makeSiblingClaimReader, h as keptWholeReasonText, ha as malformedOrphansRefusalMessage, hc as isReadableBag, hl as resolveSkipPrefix, hn as updatePartialMessage, ho as isStatefulRecreateTargetForReplace, hs as maskSecretsInError, ht as createReadOnlyAttributeHealerFactory, i as childTemplateLoader, ia as isReadableOrphanRecord, ic as isAccessDenied, ii as refuseUnreadableCdkCrossAccountRefs, il as stripForDisplay, in as recordUnderIdIsNotOwn, io as unreadableResourceEntries, ir as findDestructiveChanges, is as createUnionSecretMasker, it as green, j as recordedProtectionEvidence, ja as refuseMalformedOrphansForDestroy, jc as getBootstrapMarkerKey, ji as parameterTypeMayLoseSecretIdentity, jl as canonicalizeRegion, jn as isExportAliasCollision, jt as displacedOpClause, k as withResourceDeadline, ka as refuseMalformedOrphanRecordsForDestroy, kc as assertAssetBucketRegion, ki as coerceParameterTypedValue, kl as expectedOwnerParam, kn as collectDeclaredOutputNames, kr as readsNoEchoDeleteValues, ks as inheritNestedStackParameterAssociations, kt as sameJournaledOrphans, l as templateIdentity, la as malformedLocalOutputsWarning, lc as exportNamesCarriedFrom, li as isIamRoleArn, ll as getDefaultStateBucketName, lr as withCreateTokenLedger, ls as recordLogOnlyParameterValue, lt as reachableDivergentParameters, m as isSecretBearingReferenceString, ma as malformedOrphanRowsKeptWarning, mc as importableOutputs, mi as envCredentialsAreAssumedRole, ml as resolveCaptureObservedState, mo as MULTI_REGION_RECREATE_BLOCKED_TYPES, ms as errorCauseChain, mt as noEchoParameterNamesOf, n as crossStackOutputProvenanceSource, na as hasReadableOutputs, nc as applyCrossPrefixScan, ni as poisonRenderedSpellingsCollidingIn, nl as escapeRegExp, nn as planRollback, no as unpreviewableOrphanRecords, nr as maskingRetryLogger, ns as liveMatchesUnresolvedTokenFrame, nt as cyan, o as isAbsoluteAssetPath, oa as malformedDriftResourcePropertiesWarning, oc as splitImportedOps, oi as assertFlagRoleArn, ol as getDockerImageBySourceHash, on as resolveReplacementOldType, oo as findActionableSilentDrops, os as literalSplitDelimitersOf, ot as yellow, p as readRecordedConditionVerdicts, pa as malformedOrphanRecordsWarning, pc as importableOutputKeys, pi as callerEnvCredentials, pl as resolveAutoAssetStorage, po as shownType, ps as createSecretMasker, pt as noEchoExactEchoLeavesOf, qa as refuseMalformedResourcesForDestroy, qc as isDockerClientEnvKey, qi as JSON_LISTING_HOLE_VALUE, ql as injectedAwsRegionValue, qn as ATOMIC_FINAL_SNAPSHOT_TYPES, qo as maskedLeafCoordinatesOf, qs as TEMPLATE_SOURCED_RULES, r as inheritedProvenanceForChildDiff, ra as hasReadableResources, rc as crossPrefixDeniedWarning, ri as producerLookupOver, rl as stripControlChars, rn as recheckFailedPlan, ro as unreadableOrphanRecords, rr as constructPathOf, rs as carryLogOnlyValues, rt as gray, s as listNestedTemplateRows, sa as malformedExportNamesWarning, sc as acceptedCreateOnlyDropsOf, si as assertSendableRoleArn, sl as Synthesizer, sn as seedsDeleteFirstGuard, sr as ledgerForStack, ss as logOnlyValueCount, st as computeParameterTaint, t as DeployEngine, ta as hasReadableOrphans, tc as CrossPrefixScanCache, ti as IntrinsicFunctionResolver, tl as warnFinchArgvExposure, tn as planFailedOps, to as repairMalformedResourcesForReadOnly, tr as unsupportedFinalSnapshotError, ts as valueAtCoordinate, tt as bold, u as conditionFingerprint, ua as malformedLocalResourceEntriesWarning, uc as hasReadableExportSet, ui as sendableAssumeRoleCommand, ul as getLegacyStateBucketName, un as inheritProducerRegions, uo as NO_CC_HANDLERS_REASON, us as recordLogOnlyValue, ut as resourcesNamingDeclaredParameter, va as malformedOutputsWarning, vc as shouldRetainResource, vi as recordedOutputReferenceRegions, vl as resolveUseCdkBootstrapAssets, vn as WITHHELD_NAME_DISPLAY, vt as DeploymentEventsReader, w as keptForReadoption, wa as malformedStateRefusalMessage, wc as createAssetRedirectResolver, wl as MIGRATE_TMP_PREFIX, wn as carriedExportAliasExposure, wr as ccBrokenReason, ws as DYNAMIC_REFERENCE_TOKEN_SCAN, wt as dropFailedHint, xa as malformedResourcePropertiesWarning, xc as stringifyValue, xl as ssmResolvedValueType, xn as secretBearing, xs as scrubResourceRecord, xt as resolvePendingCloudControlRequests, ya as malformedRenderedContainersWarning, yc as AssetPublisher, yi as recordedReferenceRegions, yl as stateBucketExistenceConfirmed, yn as displayTextOrWithheld, yt as DeploymentEventsStore, za as refuseMalformedResourceEntriesForImport, zc as resolveDockerContextDirectory, zi as cfnRefValueFromPhysicalId, zl as nullPrototypeRecord, zn as orphanRecordsPrintingBag, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValuesIn, zt as withNestedRevertRun } from "./deploy-engine-BIPU9Xdh.js";
-import { t as getCdkdVersion } from "./version-Bft5jrTk.js";
+import { $ as resolvePendingCloudControlRequests, $a as repairMalformedOutputsForReadOnly, $c as redactedDockerCause, $i as accountArgs, $n as buildFinalSnapshotIdentifier, $o as readbackPathFor, $r as DiffCalculator, $s as S3StateBackend, $t as namesAnyDeclaredParameter, A as findServiceTokenRefusals, Aa as refuseMalformedOrphanRecordsForDestroy, Ac as assertAssetBucketRegion, Ai as coerceParameterTypedValue, Al as expectedOwnerParam, An as gray, Ar as isCustomResourceType$1, As as inheritNestedStackParameterAssociations, At as removeProtectionTypeList, B as parentSuppliedValues, Ba as refuseMalformedResourceEntriesForImport, Bc as resolveDockerContextDirectory, Bi as cfnRefValueFromPhysicalId, Bl as nullPrototypeRecord, Bn as journaledOrphanPrintingBag, Br as UNSPECIFIED_SKIP_REASON, Bs as recordMaskOnlyValuesIn, Bt as resolveReplacementOldType, Ca as malformedResourcesWarning, Cc as WorkGraph, Ci as applyCallerIdentityCredentials, Cl as CFN_TEMPLATE_BODY_LIMIT, Cr as ProviderRegistry, Cs as withPhysicalNameCopies, Ct as formatResourceLine, D as crossStackOutputProvenanceSource, Da as refuseDivergentRecordRegionForDestroy, Dc as rewriteTemplateAssetReferences, Di as classifyReplaySecretRegion, Dl as uploadCfnTemplate, Ds as isUncertifiedBaselineMaskPosition, E as computeImplicitDeleteEdges, Ea as previewableOrphanRecords, Ec as loadPublishableAssetManifest, Ei as classifyRecordedSecretRegion, El as findLargeInlineResources, En as withStackRecords, Er as wouldReturnToSdkProvider, Es as dynamicReferenceTokens, F as listNestedTemplateRows, Fa as refuseMalformedOutputsForDestroy, Fc as readBootstrapMarkerBody, Fi as carriesDynamicReference, Fl as StageLoadError, Fn as noEchoComparisonForTemplate, Fo as templateResourceTypes, Fr as customResourceResponseExpirationWarning, Fs as recordPhysicalNameCopy, Ft as planFailedOps, G as keptWholeReasonText, Ga as refuseMalformedResourcePropertiesForExport, Gc as finchSecretArgvRefusal, Gi as parameterInputsFor, Gl as renderAssemblyPathEscape, Gn as secretNamePrintingBags, Go as maskAtCoordinates, Gr as isWaitAbandonedError, Gs as STATE_SOURCED_BASELINE_RULES, Gt as inheritProducerRegions, H as withResourceDeadline, Ha as refuseMalformedResourceEntriesForOrphan, Hc as describeDockerExecFailure, Hi as refStateLookupFromResource, Hl as absoluteAssemblyPathEscape, Hn as namingSecretsWithRecordedNoEcho, Ho as TemplateParser, Hr as deleteLeftInPlace, Hs as recordNoEchoParameterFreshValue, Ht as orphanNeedsIdentity, I as renderNestedTemplateTreeDefect, Ia as refuseMalformedResourceAttributesForOrphan, Ic as validateAssetBucketName, Ii as carriesFetchableDynamicReference, Il as processStackMessages, In as noEchoExactEchoLeavesOf, Io as describeTypeWithThrottleRetry, Ir as CloudControlProvider, Is as splitGetAttStringForm, It as planRollback, J as makeSiblingClaimReader, Ja as refuseMalformedResourcesForDestroy, Jc as isDockerClientEnvKey, Ji as JSON_LISTING_HOLE_VALUE, Jl as injectedAwsRegionValue, Jn as stateSecretNameNeedles, Jo as maskedLeafCoordinatesOf, Js as TEMPLATE_SOURCED_RULES, K as mergeNoChangeOutputs, Ka as refuseMalformedResourcePropertiesForOrphan, Kc as formatDockerLoginError, Kl as resolveAssemblyPath, Ko as maskReadbackAtCoordinates, Ks as STATE_SOURCED_CROSS_GENERATION_RULES, L as templateIdentity, La as refuseMalformedResourceEntries, Lc as validateContainerRepoName, Li as isNamelessDynamicReferenceError, Ll as defineOwnKey, Ln as noEchoParameterNamesOf, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Lt as recheckFailedPlan, M as childTemplateLoader, Ma as refuseMalformedOrphansForDestroy, Mc as getBootstrapMarkerKey, Mi as parameterTypeMayLoseSecretIdentity, Ml as canonicalizeRegion, Mn as red, Mr as withPrintingSecrets, Mt as demoteSupersededOrphans, N as findNestedTemplateTreeDefect, Na as refuseMalformedOrphansForOrphan, Nc as isCrossRegionRedirect, Ni as getAccountInfo, Nl as derivePartitionAndUrlSuffix, Nn as yellow, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ns as physicalNameCopiesOf, Nt as isJournaledOrphan, O as inheritedProvenanceForChildDiff, Oc as AssetModeResolver, Oi as producerRegionsFromState, Ol as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, On as bold, Or as TemplateNoEchoReresolver, Os as pathCrossesDottedKey, Ot as replayFailedOperations, P as isAbsoluteAssetPath, Pa as refuseMalformedOutputs, Pc as parseBootstrapMarker, Pi as isImpossibleEmptyStoredAttribute, Pl as AssemblyReader, Pn as noEchoAttributeNamesOf, Po as prefetchCreateOnlyPropertyPaths, Pr as applyCustomResourceResponseExpiration, Pt as isReplacementOrphan, Q as pendingRequestCount, Qa as repairMalformedOrphansForReadOnly, Qc as redactedCause, Qi as UNREADABLE_RESOURCES_MAP_ROW, Qn as PRE_DELETE_SNAPSHOT_TYPES, Qs as isLockInfoExpired, Qt as computeParameterTaint, R as conditionFingerprint, Ra as refuseMalformedResourceEntriesForDeploy, Rc as buildDenyExternalAccessPolicy, Ri as keepsSecretReferenceToken, Rl as hasOwnKey, Rn as createReadOnlyAttributeHealerFactory, Rs as provenPublicValue, Rt as recordUnderIdIsNotOwn, Sa as malformedResourcePropertiesWarning, Sc as stringifyValue, Si as AWS_CREDENTIAL_ENV_KEYS, Sl as ssmResolvedValueType, Sn as formatDestructiveChange, Sr as CC_BROKEN_REASON, Ss as scrubResourceRecord, St as sameJournaledOrphans, T as IMPLICIT_DELETE_DEPENDENCIES, Ta as malformedStateRefusalMessage, Tc as createAssetRedirectResolver, Ti as envCredentialsAreAssumedRole, Tl as MIGRATE_TMP_PREFIX, Tr as isCustomResource, Ts as DYNAMIC_REFERENCE_TOKEN_SCAN, U as diffSecurity, Ua as refuseMalformedResourcePropertiesForDestroy, Uc as describeDockerFailure, Ul as describeFileReadFailure, Un as orphanRecordsPrintingBag, Uo as canonicalCoordinates, Ur as deleteSkipReason, Us as recordProvenPublicExpression, Ut as findNestedStackTypeChanges, V as readRecordedConditionVerdicts, Va as refuseMalformedResourceEntriesForImportSave, Vc as describeDockerCapturedOutput, Vi as isStalePlaceholderArnAttribute, Vl as ownValue, Vn as maskEventTextWithBoundBags, Vo as DagBuilder, Vr as deleteIndeterminateGuards, Vs as recordNoEchoAttributeValues, Vt as seedsDeleteFirstGuard, W as isSecretBearingReferenceString, Wa as refuseMalformedResourcePropertiesForDrift, Wc as dockerSpawnEnvWithSensitive, Wi as withSharedDrainBudget, Wl as displayAssemblyPath, Wn as secretNamePrintingBag, Wo as isMarkedCoordinate, Ws as wholeStringLeavesOf, X as DeploymentEventsReader, Xa as refuseMalformedState, Xc as partitionSensitiveEnv, Xi as STATE_RESOURCES_MALFORMED, Xl as resolveBucketRegion, Xn as extractDeploymentEventError, Xo as noEchoLeavesOf, Xs as isSingleDynamicReferenceToken, Xt as updatePartialMessage, Y as planOrphanAdoption, Ya as refuseMalformedResourcesForExport, Yc as isMalformedEnvKey, Yi as STATE_REGION_DIVERGED, Yn as storedSecretNameNeedles, Yo as noEchoCoordinatesOf, Ys as WHOLE_DYNAMIC_REFERENCE_PATTERN, Z as DeploymentEventsStore, Za as repairMalformedOrphanRecordsForReadOnly, Zc as redactDockerArgvValues, Zi as UNREADABLE_ORPHANS_CONTAINER_ROW, Zn as ATOMIC_FINAL_SNAPSHOT_TYPES, Zo as noEchoOutputsComparison, Zs as LockManager, Zt as updatePartialReason, _a as malformedOrphansWarning, _c as orphansAfterRollback, _i as assertFlagRoleArn, _l as resolveStateBucketWithDefault, _n as DEFAULT_RESOURCE_TIMEOUT_MS, _o as isStatefulRecreateTargetSync, _s as maskSecretsInText, _t as dropFailedHint, a as isProtectionValueActive, aa as isReadableOrphanRecord, ac as isAccessDenied, al as stripForDisplay, an as secretBearing, ao as unreadableResourceEntries, ar as unsupportedFinalSnapshotError, as as createUnionSecretMasker, at as dropSettledNestedJournals, ba as malformedRenderedContainersWarning, bc as AssetPublisher, bi as isIamRoleArn, bl as stateBucketExistenceConfirmed, bn as constructPathOf, bt as loadJournaledOrphans, ca as malformedExportNamesWarning, cc as acceptedCreateOnlyDropsOf, cl as Synthesizer, cn as carriedExportAliasExposure, cs as logOnlyValueCount, ct as recordDisplacedSkips, da as malformedLocalResourceEntriesWarning, dc as hasReadableExportSet, di as refuseUnreadableCdkCrossAccountRefs, dl as getLegacyStateBucketName, dn as isWholeDynamicReferenceValue, do as NO_CC_HANDLERS_REASON, ds as recordLogOnlyValue, dt as withNestedRevertRun, ea as deployRefusesOrphanRowsReason, ec as rebuildClientForBucketRegion, ei as INTRINSIC_KEYS, el as runDockerForeground, en as reachableDivergentParameters, eo as repairMalformedResourceEntriesForReadOnly, er as ccRoutedFinalSnapshotError, es as readsNoEchoSource, et as keptForReadoption, fa as malformedLocalResourcesWarning, fc as hasReasonlessBaselineRefusal, fi as keepHeldTokenProvenance, fl as loadCdkJson, fn as noEchoParameterValueSeed, fo as hasNoCloudControlHandlers, fs as shareLogOnlyValues, ft as collectNestedChildUnaddressed, ga as malformedOrphansRefusalMessage, gc as isReadableBag, gi as applyRoleArnIfSet, gl as resolveSkipPrefix, gn as bindingSkippedOutputs, go as isStatefulRecreateTargetForReplace, gs as maskSecretsInError, gt as dropFailedCommands, ha as malformedOrphanRowsKeptWarning, hc as importableOutputs, hi as recordedReferenceRegions, hl as resolveCaptureObservedState, hn as isExportAliasCollision, ho as MULTI_REGION_RECREATE_BLOCKED_TYPES, hs as errorCauseChain, ht as deleteJournaledOrphans, i as PROTECTION_PROPERTY_BY_TYPE, ia as hasReadableResources, ic as crossPrefixDeniedWarning, il as stripControlChars, in as exportAliasCollisionScrubWarning, io as unreadableOrphanRecords, ir as refusesFinalSnapshot, is as carryLogOnlyValues, it as displacedPhysicalIdShown, j as serviceTokenBlockingReason, ja as refuseMalformedOrphans, jc as ensureAssetStorage, ji as isUnboundTemplateParameter, jl as PARTITION_TABLE, jn as green, js as recordNestedStackParameterExpressions, jt as recordAfterRollbackUpdate, k as deferredServiceTokenWarning, ka as refuseMalformedOrphanRecords, kc as BOOTSTRAP_MARKER_PREFIX, ki as regionLessSecretName, kl as decodeListingKey, kn as cyan, kr as readsNoEchoDeleteValues, ks as identityKeyFor, kt as replayRollback, la as malformedExportSourceWarning, lc as describeRegionValueKind, li as resolveDynamicReferences, ll as synthesisStatusMessage, ln as exportNameNoEchoParameters, lo as unwrittenCreateOnlyReplacement, lr as withCreateTokenLedger, ls as printingCorpusOf, ma as malformedOrphanRecordsWarning, mc as importableOutputKeys, mi as recordedOutputReferenceRegions, ml as resolveAutoAssetStorage, mn as collectPublishedOutputNames, mo as shownType, ms as createSecretMasker, mt as withNestedStackContext, n as recordedProtectionEvidence, na as hasReadableOrphans, nc as CrossPrefixScanCache, ni as poisonRenderedSpellingsCollidingIn, nl as warnFinchArgvExposure, nn as WITHHELD_NAME_DISPLAY, no as repairMalformedResourcesForReadOnly, nr as effectiveDeletionPolicy, ns as valueAtCoordinate, nt as NESTED_PENDING_PARENT_REASON, o as perType, oa as isReadableResourceEntry, oc as isNotImplemented, ol as AssetManifestLoader, on as secretBearingStateKeyWarning, oo as withheldAccountClause, os as hasMaskableValues, pa as malformedOrphanRecordsRefusalMessage, pc as hasUnverifiableParameterRefusal, pl as resolveApp, pn as collectDeclaredOutputNames, po as findReplacedReadersOfRecreateTargets, ps as unionOfSecretBags, pt as getCurrentNestedStackContext, q as makeCanonicalizePropertiesFn, qa as refuseMalformedResourcesForDeploy, qc as getDockerCmd, qi as declaresNoEcho, ql as injectAwsRegion, qn as secretNamedRecordNeedles, qo as maskWholeValue, qs as STATE_SOURCED_READBACK_RULES, r as recordedProtectionNote, ra as hasReadableOutputs, rc as applyCrossPrefixScan, rl as escapeRegExp, rn as displayTextOrWithheld, ro as unpreviewableOrphanRecords, rr as isFinalSnapshotError, rs as liveMatchesUnresolvedTokenFrame, rt as displacedOpClause, s as readProtection, sa as malformedDriftResourcePropertiesWarning, sc as splitImportedOps, sl as getDockerImageBySourceHash, sn as secretSafeKeyDisplay, so as findActionableSilentDrops, sr as ledgerForStack, ss as literalSplitDelimitersOf, st as nestedChildStackName$1, t as DeployEngine, ta as displayLogicalId, tc as CrossPrefixReadError, ti as IntrinsicFunctionResolver, tl as runDockerStreaming, tn as resourcesNamingDeclaredParameter, to as repairMalformedResourcePropertiesForReadOnly, tr as createPreDeleteFinalSnapshot, ts as recordedNoEchoValuesOf, tt as recordRetainedForReadoption, ua as malformedLocalOutputsWarning, uc as exportNamesCarriedFrom, ui as producerLookupOver, ul as getDefaultStateBucketName, un as exportNameSecretExposure, us as recordLogOnlyParameterValue, ut as revertedNestedRowIds, va as malformedOutputsRefusalMessage, vc as orphansCarriedFrom, vi as assertSendableRoleArn, vl as resolveStateBucketWithDefaultAndSource, vn as DEFAULT_RESOURCE_WARN_AFTER_MS, vo as renderStatefulReason, vs as markSameGenerationBag, vt as isHandledOrphan, wa as malformedScrubResourceEntriesRefusalMessage, wc as buildAssetRedirectMap, wi as callerEnvCredentials, wl as CFN_TEMPLATE_URL_LIMIT, wn as destroyStackRecordsView, wr as ccBrokenReason, xa as malformedResourceEntriesWarning, xc as isSensitiveAttributeName, xi as sendableAssumeRoleCommand, xl as warnDeprecatedNoPrefixCliFlag, xn as findDestructiveChanges, xs as redactSecretsForState, xt as makeForeignHolderScan, ya as malformedOutputsWarning, yc as shouldRetainResource, yi as explicitRoleArnOrThrow, yl as resolveUseCdkBootstrapAssets, yn as maskingRetryLogger, yt as journaledOrphanLines, z as conditionInputsFrom, za as refuseMalformedResourceEntriesForDestroy, zc as buildDockerImage, zi as AWS_NO_VALUE, zl as hasPlainPrototype, zn as completedReplayEntries, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValue, zt as replacementNeverSwapped } from "./deploy-engine-HAvm8vSI.js";
+import { t as getCdkdVersion } from "./version-2jeKJQlt.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2559,7 +2559,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-BSUoljqw.js");
+	providerClasses ??= import("./provider-classes-DPwEHVDJ.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -7230,7 +7230,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 		if (verdict.kind === "named-region") {
 			const resolver = "recorded" in verdict ? ctx.resolvers.forRecordedRegion(verdict.region) : ctx.resolvers.forRegion(verdict.region);
 			try {
-				out += await resolver.resolveDynamicReferences(token, {
+				out += await resolveDynamicReferences(resolver, token, {
 					template: { Resources: {} },
 					resources: {},
 					recordedSecretValues: ctx.recordedSecretValues
@@ -9863,7 +9863,7 @@ async function driftProducerRegionEvidence(state, stackName, region, stateBacken
 async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx, recordedRegions) {
 	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyRecordedSecretRegion(token, consumerRegion, producerRegions, recordedRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousDriftSecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, consumerRegion);
-	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolveDynamicReferences(resolvers.primary, leaf, ctx);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
@@ -9871,7 +9871,7 @@ async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerR
 		if (at < 0) throw new DriftSecretRefusalError(`${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`}: could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${consumerRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "DRIFT_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
 		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? resolvers.forRecordedRegion(verdict.region) : resolvers.primary;
-		out += await resolver.resolveDynamicReferences(token, ctx);
+		out += await resolveDynamicReferences(resolver, token, ctx);
 		cursor = at + token.length;
 	}
 	return out + leaf.slice(cursor);
@@ -11705,7 +11705,7 @@ async function resolveSecretDerivedPrincipals(values, region, producerRegions, r
 }
 async function resolveEntry(entry, primary, verdictOf, context) {
 	const tokens = dynamicReferenceTokens(entry).map((t) => [t, verdictOf(t)]);
-	if (!tokens.some(([, v]) => v.kind === "recorded-region")) return await primary.resolveDynamicReferences(entry, context);
+	if (!tokens.some(([, v]) => v.kind === "recorded-region")) return await resolveDynamicReferences(primary, entry, context);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of tokens) {
@@ -11713,7 +11713,7 @@ async function resolveEntry(entry, primary, verdictOf, context) {
 		if (at < 0) throw new Error("A scanned dynamic reference is not in the entry it was scanned from");
 		out += entry.slice(cursor, at);
 		const resolver = verdict.kind === "recorded-region" ? primary.resolverForRecordedRegion(verdict.region) : primary;
-		out += await resolver.resolveDynamicReferences(token, context);
+		out += await resolveDynamicReferences(resolver, token, context);
 		cursor = at + token.length;
 	}
 	return out + entry.slice(cursor);
@@ -13230,7 +13230,7 @@ var PublicSsmProver = class {
 			skipDynamicReferences: true
 		};
 		try {
-			await this.resolver.resolveDynamicReferences(token, context);
+			await resolveDynamicReferences(this.resolver, token, context);
 		} catch (err) {
 			const name = err instanceof Error ? err.name : typeof err;
 			this.logger.debug(safeMsg`Could not prove an ssm dynamic reference public (${name}); a leaf embedding it ` + `keeps its {{resolve:...}} expression in observedProperties.`);
@@ -13409,7 +13409,7 @@ var AttributeFetcher = class {
 		} catch (err) {
 			return {
 				ok: false,
-				reason: `no provider available for ${orphan.resourceType}: ${err instanceof Error ? err.message : String(err)}`
+				reason: `no provider available for ${orphan.resourceType}: ${describeAwsFailure(err).detail}`
 			};
 		}
 		if (!provider.getAttribute) return this.cacheFallback(orphanLogicalId, attribute, `provider for ${orphan.resourceType} does not implement getAttribute`);
@@ -14777,7 +14777,7 @@ const securityGroupRuleLookupRetryDelays = {};
 const MAX_SG_RULE_THROTTLE_RETRIES = 4;
 function isAuthorizationShapedError(err) {
 	const errName = err instanceof Error ? err.name : "";
-	const message = err instanceof Error ? err.message : String(err);
+	const message = describeAwsFailure(err).detail;
 	return /AccessDenied|UnauthorizedOperation|AuthFailure|not authorized to perform/i.test(`${errName} ${message}`);
 }
 async function describeAllSecurityGroupRules(groupId, ec2Client) {
@@ -14805,7 +14805,7 @@ async function describeAllSecurityGroupRules(groupId, ec2Client) {
 				...securityGroupRuleLookupRetryDelays.sleep ? { sleep: securityGroupRuleLookupRetryDelays.sleep } : {}
 			});
 		} catch (err) {
-			const detail = err instanceof Error ? err.message : String(err);
+			const detail = describeAwsFailure(err).detail;
 			return {
 				ok: false,
 				kind: isAuthorizationShapedError(err) ? "auth" : isThrottlingError(err) ? "throttled" : "failed",
@@ -15198,7 +15198,7 @@ async function exportCommand(stackArg, options) {
 					await handler(entry);
 					logger.info(`  ${preDeletedLine(entry.physicalId)}`);
 				} catch (err) {
-					const msg = err instanceof Error ? err.message : String(err);
+					const msg = describeAwsFailure(err).detail;
 					const orphan = orphanCommandFor(resolvedStackName, targetRegion, lockRecovery);
 					throw new Error(`Phase 1 (IMPORT) succeeded; pre-delete of ${plainOrNotShown(entry.logicalId)} (${plainOrNotShown(entry.resourceType)}, physicalId: ${recordValueOrNotShown(entry.physicalId)}) failed: ${displayAwsMessage(msg)}\n\nThe CloudFormation stack ${quotedOrNotShown(cfnStackName)} contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work — the existing-stack check rejects it. To recover manually:\n  1. Fix the failure cause (typically IAM permissions for the underlying AWS API — iam:Delete{Role,User,Group}Policy for an inline policy).\n  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:\n` + preDeleteManualCommands(recreateBeforePhase2).map((line) => `       ${line}\n`).join("") + `     (one per entry in the pre-delete list logged above).
   3. Run the phase-2 UPDATE manually with the full synth template:
@@ -15217,7 +15217,7 @@ async function exportCommand(stackArg, options) {
 				if (recreateBeforePhase2.length > 0) parts.push(`${recreateBeforePhase2.length} IMPORT-unsupported resource(s) re-CREATEd`);
 				logger.info(`✓ Phase 2: ${parts.join("; ")}.`);
 			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
+				const msg = describeAwsFailure(err).detail;
 				const recreateNote = recreateBeforePhase2.length > 0 ? `  - cdkd deleted ${recreateBeforePhase2.length} AWS resource(s) before phase 2 (Stage etc.). They are gone in AWS but absent from the CFn stack. Running phase 2 UPDATE manually will CFn-CREATE them fresh.\n` : "";
 				const orphan = orphanCommandFor(resolvedStackName, targetRegion, lockRecovery);
 				throw new Error(`Phase 1 (IMPORT) succeeded; phase 2 (UPDATE) failed: ${displayAwsMessage(msg)}\n\nThe CloudFormation stack ${quotedOrNotShown(cfnStackName)} now contains the imported resources but is missing ${phase2Count} resource(s) (${phase2Creates.length} Custom Resource(s) + ${recreateBeforePhase2.length} IMPORT-unsupported). cdkd state is UNCHANGED so you can inspect what's in it, but DO NOT run \`cdkd deploy\` against this stack (the imported resources are now CFn-managed). To recover:\n` + recreateNote + `  1. Fix the failure cause (typically an onCreate Lambda error).
@@ -15233,7 +15233,7 @@ async function exportCommand(stackArg, options) {
 			});
 		} finally {
 			if (!options.dryRun) await lockManager.releaseLock(resolvedStackName, targetRegion).catch((err) => {
-				logger.warn(`Failed to release lock: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`Failed to release lock: ${describeAwsFailure(err).detail}`);
 			});
 		}
 	} finally {
@@ -15304,7 +15304,7 @@ async function assertCfnStackAbsent(cfnClient, stackName) {
 		if (!stack) return;
 		throw new Error(`CloudFormation stack ${quotedOrNotShown(stackName)} already exists (status: ${stack.StackStatus ?? "unknown"}). cdkd export only creates new stacks via IMPORT — delete or rename the existing stack first, or pass --cfn-stack-name to choose a different name.`);
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		if (/does not exist/i.test(msg)) return;
 		throw err;
 	}
@@ -15856,7 +15856,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: "could not resolve resource identifier: " + (err instanceof Error ? err.message : String(err)),
+				reason: "could not resolve resource identifier: " + describeAwsFailure(err).detail,
 				...err instanceof RepairableRefusal ? { repair: err.repair } : {}
 			});
 			continue;
@@ -16045,7 +16045,7 @@ async function resolveResourceIdentifier(resourceType, logicalId, physicalId, pr
 	try {
 		result = splitter(physicalId, properties);
 	} catch (err) {
-		throw new Error(`composite-id splitter for ${resourceType} failed: ` + (err instanceof Error ? err.message : String(err)));
+		throw new Error(`composite-id splitter for ${resourceType} failed: ` + describeAwsFailure(err).detail);
 	}
 	for (const f of entry.fields) if (!(f in result.resourceIdentifier)) throw new Error(`composite-id splitter for ${resourceType} did not produce field '${f}' (produced: ${Object.keys(result.resourceIdentifier).join(", ")})`);
 	return result;
@@ -16084,7 +16084,7 @@ async function fetchPrimaryIdentifier(resourceType, cfnClient) {
 			}
 		}
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		getLogger().debug(`DescribeType failed for ${quotedOrNotShown(resourceType)}: ${safeDetail(msg)} — using fallback`);
 	}
 	const fallback = PRIMARY_IDENTIFIER_FALLBACK[resourceType];
@@ -16496,7 +16496,7 @@ async function runTemplateUploadCleanup(cleanup, bucket) {
 	try {
 		await cleanup();
 	} catch (cleanupErr) {
-		const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+		const msg = describeAwsFailure(cleanupErr).detail;
 		logger.warn(`Failed to delete temporary template upload from ${quotedOrNotShown(bucket)}. Clean up manually under prefix 'cdkd-migrate-tmp/'. Cause: ${safeDetail(msg)}`);
 	}
 }
@@ -16529,7 +16529,7 @@ async function submitImportChangeSet(cfnClient, stackName, template, resourcesTo
 				]
 			}));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
+			const msg = describeAwsFailure(err).detail;
 			throw new Error(`Failed to create IMPORT changeset: ${displayAwsMessage(msg)}`);
 		}
 		try {
@@ -16870,7 +16870,7 @@ async function runPerStackImportLoop(args) {
 	try {
 		resolved = await resolveAll();
 	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
+		const message = describeAwsFailure(err).detail;
 		const plannable = message.startsWith("buildResolvedParametersPerStack:") || err instanceof SsmChildParameterRefusalError;
 		if (!options.dryRun || !plannable) throw err;
 		logger.warn(safeMsg`${message} --dry-run plans without the nested stacks' Parameter values; a real run ` + `refuses here.`);
@@ -17005,7 +17005,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						return await step();
 					} catch (err) {
-						throw new Error(`${what} failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}), after its Phase 1A IMPORT succeeded. Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, stage), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`${what} failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}), after its Phase 1A IMPORT succeeded. Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, stage), { cause: err instanceof Error ? err : void 0 });
 					}
 				};
 				const phase1ATemplate = filterTemplateForImport(plan.template, plan.phase1Imports);
@@ -17019,7 +17019,7 @@ async function runPerStackImportLoop(args) {
 				try {
 					await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1ATemplate, phase1AResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 				} catch (err) {
-					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, "phase1"), { cause: err instanceof Error ? err : void 0 });
+					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, "phase1"), { cause: err instanceof Error ? err : void 0 });
 				}
 				const cfnArn = await afterImport("Reading its CloudFormation stack", "imported", async () => {
 					const arn = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: plan.cfnName }))).Stacks?.[0]?.StackId;
@@ -17072,7 +17072,7 @@ async function runPerStackImportLoop(args) {
 						await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1BTemplate, phase1BResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 					} catch (err) {
 						const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${quotedOrNotShown(s.cdkdStackName)} → ${quotedOrNotShown(s.cfnStackName)}`).join(", ") : "(none)";
-						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each a CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover, fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"), then re-attempt the parent-side nested adoption by hand via the AWS console or CLI, per the AWS docs "Nest an existing stack" procedure. Do NOT run cdkd destroy on the tree: that would tear down the live AWS resources. Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, "imported"), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each a CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover, fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"), then re-attempt the parent-side nested adoption by hand via the AWS console or CLI, per the AWS docs "Nest an existing stack" procedure. Do NOT run cdkd destroy on the tree: that would tear down the live AWS resources. Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, "imported"), { cause: err instanceof Error ? err : void 0 });
 					}
 					logger.info(`  ✓ Phase 1B: parent ${quotedOrNotShown(plan.cfnName)} adopted ${plan.nestedStackRows.length} nested child(ren) via UPDATE-IMPORT.`);
 					if (plan.cdkdName !== rootStackName) {
@@ -17087,7 +17087,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						await handler(entry);
 					} catch (err) {
-						const msg = err instanceof Error ? err.message : String(err);
+						const msg = describeAwsFailure(err).detail;
 						const importedSummary = importedStacks.map((s) => `${quotedOrNotShown(s.cdkdStackName)} → ${quotedOrNotShown(s.cfnStackName)}`).join(", ");
 						throw new Error(`Phase 1 (IMPORT) succeeded for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}); pre-delete of ${plainOrNotShown(entry.logicalId)} (${plainOrNotShown(entry.resourceType)}, physicalId: ${recordValueOrNotShown(entry.physicalId)}) failed: ${displayAwsMessage(msg)}\n\nStacks IMPORTed so far (each CFn-managed): ${importedSummary}. cdkd state for every stack in the tree is preserved. This stack's IMPORT-unsupported resources may still exist in AWS unmanaged. To recover: fix the failure cause, delete the remaining pre-delete resources of this stack by hand:\n` + preDeleteManualCommands(plan.recreateBeforePhase2).map((line) => `  ${line}\n`).join("") + `then run the phase-2 UPDATE for ${quotedOrNotShown(plan.cfnName)} by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
 					}
@@ -17103,7 +17103,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						await executeUpdateChangeSet(deps.cfnClient, plan.cfnName, phase2Template, stackParameters, plan.templateFormat, deps.uploadOpts);
 					} catch (err) {
-						throw new Error(`Phase 2 (UPDATE) failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}): ${displayAwsMessage(err instanceof Error ? err.message : String(err))}. Its phase-1 IMPORT succeeded and cdkd state is preserved; fix the cause and run the phase-2 UPDATE by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`Phase 2 (UPDATE) failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}): ${displayAwsMessage(describeAwsFailure(err).detail)}. Its phase-1 IMPORT succeeded and cdkd state is preserved; fix the cause and run the phase-2 UPDATE by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
 					}
 					logger.info(`  ✓ Phase 2: stack ${quotedOrNotShown(plan.cfnName)} updated (${plan.phase2Creates.length} non-importable CREATE, ${plan.recreateBeforePhase2.length} re-CREATE).`);
 				}
@@ -17116,7 +17116,7 @@ async function runPerStackImportLoop(args) {
 				stateDeletionFailures.push({
 					stackName: node.stackName,
 					region: node.region,
-					reason: err instanceof Error ? err.message : String(err)
+					reason: describeAwsFailure(err).detail
 				});
 				const orphan = orphanCommandFor(node.stackName, node.region, args.lockRecovery);
 				logger.warn(`Failed to delete cdkd state for ${quotedOrNotShown(node.stackName)} (${quotedRegion(node.region)}): ${safeDetail(err)}. The stack IS CFn-managed; clean up its state record.${orphan.note}\nClean up with: ${orphan.command}`);
@@ -17196,7 +17196,7 @@ async function executeUpdateChangeSet(cfnClient, stackName, template, parameters
 				]
 			}));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
+			const msg = describeAwsFailure(err).detail;
 			throw new Error(`Failed to create UPDATE changeset: ${displayAwsMessage(msg)}`);
 		}
 		try {
@@ -21483,7 +21483,7 @@ function parseResourceOverrides(flags, mappingFile, mappingInline) {
 		try {
 			raw = readFileSync(mappingFile, "utf-8");
 		} catch (err) {
-			throw new Error(`Failed to read --resource-mapping file '${mappingFile}': ` + (err instanceof Error ? err.message : String(err)));
+			throw new Error(`Failed to read --resource-mapping file '${mappingFile}': ` + describeAwsFailure(err).detail);
 		}
 		const parsed = parseMappingJson(raw, `--resource-mapping file '${mappingFile}'`);
 		for (const [key, value] of Object.entries(parsed)) map.set(key, value);
@@ -21504,7 +21504,7 @@ function parseMappingJson(raw, source) {
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse ${source} as JSON: ` + (err instanceof Error ? err.message : String(err)));
+		throw new Error(`Failed to parse ${source} as JSON: ` + describeAwsFailure(err).detail);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${source} must be a JSON object {logicalId: physicalId}`);
 	const out = {};
@@ -21523,7 +21523,7 @@ function writeRecordedMapping(filePath, rows) {
 		writeFileSync(filePath, body, "utf-8");
 		logger.info(`Wrote resolved mapping to ${filePath} (${Object.keys(map).length} entry(ies))`);
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		logger.error(`Failed to write --record-resource-mapping file '${filePath}': ${msg}. Continuing — the import already resolved every physical id in memory.`);
 	}
 }
@@ -22154,12 +22154,12 @@ function readNestedChildTemplate(templatePath, childLogicalId) {
 	try {
 		raw = readFileSync(templatePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read nested-stack template for '${childLogicalId}' at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read nested-stack template for '${childLogicalId}' at ${templatePath}: ${describeAwsFailure(err).detail}`);
 	}
 	try {
 		return JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse nested-stack template for '${childLogicalId}' at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to parse nested-stack template for '${childLogicalId}' at ${templatePath}: ${describeAwsFailure(err).detail}`);
 	}
 }
 function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
@@ -25151,7 +25151,7 @@ async function localStartApiCommand(target, options) {
 			logger.info(`Pre-warming ${groupSpecs.size} container(s) for ${group.displayName}...`);
 			const handles = await Promise.allSettled([...groupSpecs.keys()].map((id) => groupPool.acquire(id)));
 			for (const result of handles) if (result.status === "fulfilled") groupPool.release(result.value);
-			else logger.warn(`Pre-warm failed for one Lambda in ${group.displayName} (cold start cost will apply on first request): ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
+			else logger.warn(`Pre-warm failed for one Lambda in ${group.displayName} (cold start cost will apply on first request): ${describeAwsFailure(result.reason).detail}`);
 		}
 		const defaultRegion = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? void 0);
 		const started = await startApiServer({
@@ -25301,34 +25301,34 @@ async function localStartApiCommand(target, options) {
 		if (watcher) try {
 			await watcher.close();
 		} catch (err) {
-			logger.warn(`watcher.close() failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`watcher.close() failed: ${describeAwsFailure(err).detail}`);
 		}
 		await Promise.allSettled(wsServers.map(async (ws) => {
 			try {
 				await ws.attached.close();
 			} catch (err) {
-				logger.warn(`WebSocket close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket close() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(servers.map(async ({ server, group }) => {
 			try {
 				await server.close();
 			} catch (err) {
-				logger.warn(`server.close() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`server.close() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(wsServers.map(async (ws) => {
 			try {
 				await ws.server.close();
 			} catch (err) {
-				logger.warn(`WebSocket server.close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket server.close() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(servers.map(async ({ server, group }) => {
 			try {
 				await server.getServerState().pool.dispose();
 			} catch (err) {
-				logger.warn(`pool.dispose() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`pool.dispose() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		if (retiredPoolDisposals.size > 0) {
@@ -25339,7 +25339,7 @@ async function localStartApiCommand(target, options) {
 			try {
 				await ws.server.getServerState().pool.dispose();
 			} catch (err) {
-				logger.warn(`WebSocket pool.dispose() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket pool.dispose() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		for (const dir of inlineTmpDirs) try {
@@ -25348,7 +25348,7 @@ async function localStartApiCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			logger.warn(`Failed to remove inline-code tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove inline-code tmpdir ${dir}: ${describeAwsFailure(err).detail}`);
 		}
 		for (const dir of layerTmpDirs) try {
 			rmSync(dir, {
@@ -25356,12 +25356,12 @@ async function localStartApiCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			logger.warn(`Failed to remove merged-layers tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove merged-layers tmpdir ${dir}: ${describeAwsFailure(err).detail}`);
 		}
 		if (profileCredsFile) try {
 			await profileCredsFile.dispose();
 		} catch (err) {
-			logger.warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${describeAwsFailure(err).detail}`);
 		}
 	});
 	const shutdown = async (signal, exitCode) => {
@@ -25865,13 +25865,13 @@ function readEnvOverridesFile$3(filePath) {
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read --env-vars file '${filePath}': ${describeAwsFailure(err).detail}`);
 	}
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${describeAwsFailure(err).detail}`);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
 	return parsed;
@@ -26033,7 +26033,7 @@ async function reloadAllServers(args) {
 		const previousState = booted.server.setServerState(newState);
 		booted.group = group;
 		const disposal = previousState.pool.dispose().catch((err) => {
-			logger.debug(`Previous pool dispose() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`Previous pool dispose() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 		});
 		retiredPoolDisposals?.add(disposal);
 		disposal.then(() => retiredPoolDisposals?.delete(disposal));
@@ -29501,4 +29501,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DYfZCsxM.js.map
+//# sourceMappingURL=program-DmPDfDhE.js.map