@cdkd/cli 0.0.1 → 0.324.0

package/dist/index.d.ts

@@ -0,0 +1,1630 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { S3Client } from "@aws-sdk/client-s3";
+import { CloudControlClient } from "@aws-sdk/client-cloudcontrol";
+import { IAMClient } from "@aws-sdk/client-iam";
+import { SQSClient } from "@aws-sdk/client-sqs";
+import { SNSClient } from "@aws-sdk/client-sns";
+import { LambdaClient } from "@aws-sdk/client-lambda";
+import { STSClient } from "@aws-sdk/client-sts";
+import { EC2Client } from "@aws-sdk/client-ec2";
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { CloudFormationClient } from "@aws-sdk/client-cloudformation";
+import { APIGatewayClient } from "@aws-sdk/client-api-gateway";
+import { EventBridgeClient } from "@aws-sdk/client-eventbridge";
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { SSMClient } from "@aws-sdk/client-ssm";
+import { CloudFrontClient } from "@aws-sdk/client-cloudfront";
+import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
+import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
+import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore-control";
+import { RedshiftClient } from "@aws-sdk/client-redshift";
+import { ElastiCacheClient } from "@aws-sdk/client-elasticache";
+import { ACMClient } from "@aws-sdk/client-acm";
+import { Route53Client } from "@aws-sdk/client-route-53";
+import { LambdaMicrovmsClient } from "@aws-sdk/client-lambda-microvms";
+import { LambdaWebClient } from "@aws-sdk/client-lambda-web";
+import { LambdaCoreClient } from "@aws-sdk/client-lambda-core";
+import { defaultProvider } from "@aws-sdk/credential-provider-node";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+import { ECRClient } from "@aws-sdk/client-ecr";
+import graphlib from "graphlib";
+type StateSchemaVersion = 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15;
+interface StateImportEntry {
+  sourceStack: string;
+  sourceRegion: string;
+  exportName: string;
+}
+interface StateOutputReadEntry {
+  sourceStack: string;
+  sourceRegion: string;
+  outputName: string;
+}
+interface StackState {
+  version: StateSchemaVersion;
+  stackName: string;
+  region?: string;
+  resources: Record<string, ResourceState>;
+  outputs: Record<string, unknown>;
+  imports?: StateImportEntry[];
+  outputReads?: StateOutputReadEntry[];
+  exportNames?: string[];
+  skippedOutputs?: Record<string, string>;
+  parentStack?: string;
+  parentLogicalId?: string;
+  parentRegion?: string;
+  orphans?: StackOrphanRecord[];
+  supersededResources?: SupersededResourceRecord[];
+  conditionVerdicts?: Record<string, RecordedConditionVerdict>;
+  outputReferenceProvenance?: Record<string, Record<string, ReferenceProvenance>>;
+  stackInstanceId?: string;
+  retiredNameGenerations?: Record<string, number>;
+  pendingMovesOut?: PendingMoveOut[];
+  terminationProtection?: true;
+  lastModified: number;
+}
+interface ReferenceProvenance {
+  region?: string;
+  versions?: string[];
+  readVersions?: string[];
+}
+interface PendingMoveOut {
+  from: string;
+  toStack: string;
+  toRegion: string;
+  to: string;
+  startedAt: number;
+}
+interface RecordedConditionVerdict {
+  verdict: boolean;
+  fingerprint: string;
+}
+interface StackOrphanRecord {
+  logicalId: string;
+  orphanedAt: number;
+  state: ResourceState;
+}
+interface SupersededResourceRecord {
+  logicalId: string;
+  supersededAt: number;
+  state: ResourceState;
+  updateReplacePolicy?: 'Delete' | 'Retain' | 'Snapshot' | 'RetainExceptOnCreate';
+  finalSnapshotIdentifier?: string;
+  forceDataDelete?: true;
+  skipFinalSnapshot?: true;
+}
+interface ResourceState {
+  physicalId: string;
+  nameGeneration?: number;
+  nameGenerationHigh?: number;
+  unsettledProperties?: string[];
+  unsettledItems?: Record<string, string[]>;
+  resourceType: string;
+  properties: Record<string, unknown>;
+  observedProperties?: Record<string, unknown>;
+  attributes?: Record<string, unknown>;
+  dependencies?: string[];
+  metadata?: Record<string, unknown>;
+  constructPath?: string;
+  deletionPolicy?: 'Delete' | 'Retain' | 'Snapshot' | 'RetainExceptOnCreate' | undefined;
+  updateReplacePolicy?: 'Delete' | 'Retain' | 'Snapshot' | 'RetainExceptOnCreate' | undefined;
+  provisionedBy?: 'sdk' | 'cc-api' | undefined;
+  observedBaselineRefused?: true | undefined;
+  observedBaselineRefusalReason?: 'unverifiable-parameter' | 'incomplete-resolution' | undefined;
+  noEchoLeaves?: (string | number)[][] | undefined;
+  noEchoExactEchoLeaves?: string[][] | undefined;
+  secretNamedAttributes?: string[] | undefined;
+  noEchoAttributeNames?: string[] | undefined;
+  referenceProvenance?: Record<string, ReferenceProvenance> | undefined;
+  acceptedCreateOnlyDrops?: string[] | undefined;
+  maskedPropertyFingerprints?: Record<string, string> | undefined;
+  maskedPropertyInputFingerprints?: Record<string, string> | undefined;
+}
+interface LockInfo {
+  owner: string;
+  timestamp: number;
+  expiresAt: number;
+  operation?: string;
+}
+type ChangeType = 'CREATE' | 'UPDATE' | 'DELETE' | 'NO_CHANGE';
+interface ResourceChange {
+  logicalId: string;
+  changeType: ChangeType;
+  resourceType: string;
+  currentProperties?: Record<string, unknown>;
+  desiredProperties?: Record<string, unknown>;
+  propertyChanges?: PropertyChange[];
+  attributeChanges?: AttributeChange[];
+}
+interface AttributeChange {
+  attribute: 'DeletionPolicy' | 'UpdateReplacePolicy';
+  oldValue: string | undefined;
+  newValue: string | undefined;
+}
+interface PropertyChange {
+  path: string;
+  oldValue: unknown;
+  newValue: unknown;
+  requiresReplacement: boolean;
+  replacementPropagated?: boolean;
+  inPlacePropagated?: boolean;
+  noEchoPromoted?: true;
+  maskedExpressionChanged?: true;
+  unsettled?: true;
+  readProvenancePromoted?: true;
+}
+type RecordedSecretValues = Map<string, string>;
+type SecretMasker = (text: string) => string;
+type NoEchoCoordinate = readonly (string | number)[];
+interface CdkdConfig {
+  app: string;
+  stateBucket: string;
+  statePrefix?: string;
+  stack?: string;
+  region?: string;
+  profile?: string;
+  concurrency?: number;
+  verbose?: boolean;
+  dryRun?: boolean;
+  output?: string;
+}
+interface DeployOptions {
+  stackName: string;
+  template: string;
+  stateBackend: StateBackendConfig;
+  concurrency: number;
+  dryRun: boolean;
+  skipAssets?: boolean;
+}
+interface StateBackendConfig {
+  bucket: string;
+  prefix: string;
+}
+type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+interface Logger {
+  debug(message: string, ...args: unknown[]): void;
+  info(message: string, ...args: unknown[]): void;
+  warn(message: string, ...args: unknown[]): void;
+  error(message: string, ...args: unknown[]): void;
+}
+type ForeignHolding = {
+  kind: 'held';
+  by: string;
+} | {
+  kind: 'unreadable';
+  what: string;
+  retryable?: true;
+} | undefined;
+type DeploymentRunCommand = 'deploy' | 'destroy' | 'rollback';
+type DeploymentRunResult = 'SUCCEEDED' | 'FAILED';
+type DeploymentResourceOperation = 'CREATE' | 'UPDATE' | 'DELETE';
+type DeploymentEventType = 'RUN_STARTED' | 'RUN_FINISHED' | 'RESOURCE_STARTED' | 'RESOURCE_SUCCEEDED' | 'RESOURCE_FAILED' | 'RESOURCE_RETAINED' | 'RESOURCE_SKIPPED' | 'RESOURCE_GUARD_INDETERMINATE' | 'ROLLBACK_STARTED' | 'ROLLBACK_RESOURCE_SUCCEEDED' | 'ROLLBACK_RESOURCE_FAILED' | 'ROLLBACK_RESOURCE_SKIPPED' | 'ROLLBACK_FINISHED';
+interface DeploymentEventError {
+  name: string;
+  message: string;
+  awsErrorCode?: string;
+  requestId?: string;
+  ownLines?: boolean;
+}
+interface DeploymentEvent {
+  timestamp: string;
+  eventType: DeploymentEventType;
+  stackName: string;
+  command?: DeploymentRunCommand;
+  region?: string;
+  cdkdVersion?: string;
+  result?: DeploymentRunResult;
+  operation?: DeploymentResourceOperation;
+  logicalId?: string;
+  resourceType?: string;
+  physicalId?: string;
+  provisionedBy?: 'sdk' | 'cc-api';
+  durationMs?: number;
+  counts?: {
+    created: number;
+    updated: number;
+    deleted: number;
+    failed?: number;
+    skipped?: number;
+  };
+  guard?: string;
+  reason?: string;
+  error?: DeploymentEventError;
+}
+interface DeploymentEventRecorder {
+  record(event: Omit<DeploymentEvent, 'timestamp'>): void;
+  readonly runId?: string;
+}
+export declare class CdkdError extends Error {
+  readonly code: string;
+  readonly cause: Error | undefined;
+  constructor(message: string, code: string, cause?: Error);
+}
+export declare class StateError extends CdkdError {
+  constructor(message: string, cause?: Error);
+}
+export declare class LockError extends CdkdError {
+  constructor(message: string, cause?: Error);
+}
+export declare class SynthesisError extends CdkdError {
+  constructor(message: string, cause?: Error);
+}
+export declare class AssetError extends CdkdError {
+  constructor(message: string, cause?: Error);
+}
+export declare class ProvisioningError extends CdkdError {
+  readonly resourceType: string;
+  readonly logicalId: string;
+  readonly physicalId: string | undefined;
+  constructor(message: string, resourceType: string, logicalId: string, physicalId?: string, cause?: Error);
+}
+export declare class DependencyError extends CdkdError {
+  constructor(message: string, cause?: Error);
+}
+export declare class ConfigError extends CdkdError {
+  constructor(message: string, cause?: Error);
+}
+export declare function isCdkdError(error: unknown): error is CdkdError;
+export declare function formatError(error: unknown): string;
+interface NormalizeAwsErrorContext {
+  bucket?: string;
+  operation?: string;
+}
+export declare function normalizeAwsError(err: unknown, context?: NormalizeAwsErrorContext): Error;
+type AbandonedRequestOutcome = {
+  status: 'succeeded';
+  identifier: string;
+} | {
+  status: 'failed';
+  remnant?: string;
+} | {
+  status: 'cancelled';
+  remnant?: string;
+} | {
+  status: 'not-found';
+} | {
+  status: 'unresolved';
+  error: unknown;
+};
+export declare class CloudControlProvider implements ResourceProvider {
+  private cloudControlClient;
+  private readonly baseLogger;
+  private get logger();
+  private patchGenerator;
+  private readonly warnedUnresolvableSchemaTypes;
+  private readonly protectionFlips;
+  private readonly MAX_WAIT_TIME_MS;
+  private readonly INITIAL_POLL_INTERVAL_MS;
+  private readonly MAX_POLL_INTERVAL_MS;
+  private readonly POLL_TRANSIENT_GRACE_MS;
+  private readonly PROTECTION_FLIP_TRANSIENT_GRACE_MS;
+  private readonly sdkDeleteDelegates;
+  private readonly asgDeleteDelegates;
+  constructor();
+  create(logicalId: string, resourceType: string, properties: Record<string, unknown>, context?: CreateContext): Promise<ResourceCreateResult>;
+  private createInIdLogScope;
+  private cleanupFailedCreateRemnant;
+  update(logicalId: string, physicalId: string, resourceType: string, properties: Record<string, unknown>, previousProperties: Record<string, unknown>, context?: UpdateContext): Promise<ResourceUpdateResult>;
+  private updateInIdLogScope;
+  private reimportApiGatewayV2;
+  private readApiGatewayV2DefinitionObject;
+  delete(logicalId: string, physicalId: string, resourceType: string, properties?: Record<string, unknown>, context?: DeleteContext): Promise<void | ResourceDeleteResult>;
+  private deleteInIdLogScope;
+  private deleteThroughCloudControl;
+  private sdkDeleteDelegateInCcRegion;
+  private ec2ClientInCcRegion;
+  private assertRecordedRegionAgainstClient;
+  private confirmDeleteTargetIdentity;
+  private disableCcProtection;
+  private observeThenDisableCcProtection;
+  private reEnableCcProtection;
+  private warnGuardLeftOff;
+  private ccClientRegion;
+  getResourceState(resourceType: string, physicalId: string): Promise<Record<string, unknown> | null>;
+  private waitForOperation;
+  resumeCreatedResource(logicalId: string, resourceType: string, identifier: string, properties: Record<string, unknown>, context?: CreateContext): Promise<ResourceCreateResult>;
+  resumeAbandonedRequest(requestToken: string, logicalId: string, resourceType: string): Promise<AbandonedRequestOutcome>;
+  private abandonWait;
+  buildResumeCommand(requestToken: string): Promise<string>;
+  private parseResourceModel;
+  private accountInfoForSynthesizedArn;
+  private enrichResourceAttributes;
+  private mergeSparseModelReadback;
+  private isSparseAttributeMap;
+  private readCcResourceModel;
+  private handleError;
+  private sleep;
+  static isSupportedResourceType(resourceType: string): boolean;
+  readCurrentState(physicalId: string, _logicalId: string, resourceType: string, _properties?: Record<string, unknown>): Promise<Record<string, unknown> | ResourceNotFound | undefined>;
+  private maskDeployedNonAttributeKeys;
+  import(input: ResourceImportInput): Promise<ResourceImportResult | null>;
+  private maskUncertifiedModelValues;
+}
+type ProvisionedBy = 'sdk' | 'cc-api';
+interface ProviderRoutingDecision {
+  provider: ResourceProvider;
+  provisionedBy: ProvisionedBy;
+  ccRouteReason?: {
+    properties: string[];
+  };
+  sdkMigration?: true;
+}
+interface GetProviderForInput {
+  resourceType: string;
+  properties?: Record<string, unknown> | undefined;
+  provisionedBy?: ProvisionedBy | undefined;
+  previousProperties?: Record<string, unknown> | undefined;
+  quiet?: boolean;
+  forceCcApi?: boolean | undefined;
+}
+interface AutoRouteHit {
+  logicalId: string;
+  resourceType: string;
+  properties: string[];
+}
+export declare class ProviderRegistry {
+  private logger;
+  private providers;
+  private cloudControlProvider;
+  private customResourceProvider;
+  private skipResourceTypes;
+  private allowedUnsupportedTypes;
+  private allowedUnsupportedProperties;
+  constructor();
+  allowUnsupportedTypes(resourceTypes: Iterable<string>): void;
+  allowUnsupportedProperties(entries: Iterable<string>): void;
+  getAllowedUnsupportedProperties(): ReadonlySet<string>;
+  setCustomResourceResponseBucket(bucket: string): void;
+  skipResourceType(resourceType: string): void;
+  register(resourceType: string, provider: ResourceProvider): void;
+  unregister(resourceType: string): void;
+  getProviderFor(input: GetProviderForInput): ProviderRoutingDecision;
+  ccRouteUnavailableReason(resourceType: string): string | undefined;
+  private buildUnroutableSdkUnwiredMessage;
+  getProvider(resourceType: string): ResourceProvider;
+  shouldSkipResource(resourceType: string): boolean;
+  hasProvider(resourceType: string): boolean;
+  getCloudControlProvider(): CloudControlProvider;
+  getRegisteredTypes(): string[];
+  getProviderType(resourceType: string): 'sdk' | 'cloud-control' | null;
+  validateResourceTypes(resourceTypes: Set<string>): void;
+  validateResourceProperties(resources: Iterable<{
+    logicalId: string;
+    resourceType: string;
+    properties: Record<string, unknown> | undefined;
+    provisionedBy?: 'sdk' | 'cc-api' | undefined;
+    previousProperties?: Record<string, unknown> | undefined;
+  }>): void;
+  validateMutuallyExclusiveProperties(resources: Iterable<{
+    logicalId: string;
+    resourceType: string;
+    properties: Record<string, unknown> | undefined;
+  }>): void;
+  validateNestedRequiredProperties(resources: Iterable<{
+    logicalId: string;
+    resourceType: string;
+    properties: Record<string, unknown> | undefined;
+  }>): void;
+  validateCustomResourceSecureReferences(resources: Iterable<{
+    logicalId: string;
+    resourceType: string;
+    properties: Record<string, unknown> | undefined;
+  }>): void;
+  reportSdkUnwiredDecisions(resources: Iterable<{
+    logicalId: string;
+    resourceType: string;
+    properties: Record<string, unknown> | undefined;
+    provisionedBy?: 'sdk' | 'cc-api' | undefined;
+    previousProperties?: Record<string, unknown> | undefined;
+  }>): void;
+  private reportUnrecognizedProperties;
+  findAutoRouteHits(resources: Iterable<{
+    logicalId: string;
+    resourceType: string;
+    properties: Record<string, unknown> | undefined;
+    previousProperties?: Record<string, unknown> | undefined;
+  }>): AutoRouteHit[];
+}
+interface PreDeleteSnapshotClients {
+  ec2: EC2Client;
+  redshift: RedshiftClient;
+  elastiCache: ElastiCacheClient;
+}
+interface CompletedOperation {
+  logicalId: string;
+  changeType: 'CREATE' | 'UPDATE' | 'DELETE';
+  resourceType: string;
+  provisionedBy?: 'sdk' | 'cc-api' | undefined;
+  previousState?: ResourceState | undefined;
+  physicalId?: string | undefined;
+  properties?: Record<string, unknown> | undefined;
+  oldResourceRetained?: boolean | undefined;
+  oldResourceMaySurvive?: 'kept' | 'unconfirmed' | undefined;
+  previousResourceType?: string | undefined;
+  wasReplaced?: boolean | undefined;
+  oldDeletedBeforeCreate?: boolean | undefined;
+  nameGeneration?: number | undefined;
+}
+interface PendingCloudControlRequest {
+  requestToken: string;
+  abandonedAt: number;
+}
+interface FailedOperation {
+  logicalId: string;
+  changeType: 'CREATE' | 'UPDATE' | 'DELETE';
+  resourceType: string;
+  provisionedBy?: 'sdk' | 'cc-api' | undefined;
+  previousState?: ResourceState | undefined;
+  physicalId?: string | undefined;
+  physicalIdRecoveredFromError?: boolean | undefined;
+  createdResourceIdentity?: string | undefined;
+  deletionPolicy?: 'Delete' | 'Retain' | 'Snapshot' | 'RetainExceptOnCreate' | undefined;
+  pendingCloudControlRequest?: PendingCloudControlRequest | undefined;
+  createdIdentifierUnique?: boolean | undefined;
+  replacedPhysicalId?: string | undefined;
+  replacedResourceType?: string | undefined;
+  replacedResourceDeleted?: boolean | undefined;
+  replacementOrphaned?: 'create-first' | 'delete-first' | undefined;
+  oldDeletedBeforeCreate?: boolean | undefined;
+  nameGeneration?: number | undefined;
+  attemptedProperties?: Record<string, unknown> | undefined;
+}
+type MaskerFn = (text: string) => string;
+interface ProducerRegionEvidence {
+  readonly regions: readonly string[];
+  readonly complete: boolean;
+}
+type RollbackSegmentReason = 'no-rollback-failure' | 'interrupted' | 'auto-rollback-started' | 'auto-rollback-clean' | 'nested-pending-parent';
+interface RollbackJournalSegment {
+  runId?: string;
+  timestamp: number;
+  reason: RollbackSegmentReason;
+  initialDeploy: boolean;
+  roleArn?: string;
+  cdkdVersion?: string;
+  skipPrefix?: boolean;
+  operations: CompletedOperation[];
+  failedOperations?: FailedOperation[];
+  previousOutputs?: {
+    outputs: Record<string, unknown>;
+    exportNames?: string[];
+  };
+  previousCrossStackReads?: Pick<StackState, 'imports' | 'outputReads'>;
+  supersededLogicalIds?: string[];
+  importedResources?: ImportedResourceMark[];
+}
+interface ImportedResourceMark {
+  logicalId: string;
+  physicalId: string;
+  resourceType: string;
+}
+interface RollbackJournal {
+  journalVersion: number;
+  stackName: string;
+  region: string;
+  segments: RollbackJournalSegment[];
+}
+interface SentCreateToken {
+  base: string;
+  token: string;
+  firstSentAt: number;
+  failedAt?: number;
+}
+interface CreateTokenLedgerDoc {
+  ledgerVersion: number;
+  nonce: string;
+  sent: Record<string, SentCreateToken>;
+  stateRecorded?: boolean;
+  abandonedAt?: number;
+}
+interface LockManagerOptions {
+  ttlMinutes?: number;
+  disableRenewal?: boolean;
+  deferReleasePurge?: boolean;
+}
+export declare class LockManager {
+  private logger;
+  private wrapS3Failure;
+  private s3Client;
+  private config;
+  private readonly ttlMs;
+  private readonly renewalIntervalMs;
+  private readonly renewalDisabled;
+  private readonly heldLocks;
+  private readonly abandonedLocks;
+  private clientResolved;
+  private resolveInFlight;
+  private readonly deferReleasePurge;
+  private readonly deferredPurges;
+  constructor(s3Client: S3Client, config: StateBackendConfig, options?: LockManagerOptions);
+  settleDeferredPurges(): Promise<void>;
+  private ownerParam;
+  private ensureClientForBucket;
+  private getLockKey;
+  private getDefaultOwner;
+  private isLockExpired;
+  private formatDuration;
+  acquireLock(stackName: string, region: string, owner?: string, operation?: string): Promise<boolean>;
+  private putLockObject;
+  getLockInfo(stackName: string, region: string | undefined): Promise<LockInfo | null>;
+  private getLockRecord;
+  isLocked(stackName: string, region: string | undefined): Promise<boolean>;
+  releaseLock(stackName: string, region: string): Promise<void>;
+  private doReleaseLock;
+  private stillOursByBody;
+  private sameLockIdentity;
+  abandonedRunEndedBy(stackName: string, region: string | undefined): number | undefined;
+  forceReleaseLock(stackName: string, region: string | undefined, beforeDelete?: (horizon: number) => Promise<void>): Promise<number | undefined>;
+  private deleteLock;
+  private purgeLockVersions;
+  private trackHeldLock;
+  private startRenewal;
+  private stopRenewal;
+  private renewLock;
+  private doRenewLock;
+  private adoptOwnWrite;
+  private isForeignLockError;
+  private isGoneError;
+  private isConditionUnsupportedError;
+  private isNotOursError;
+  acquireLockWithRetry(stackName: string, region: string, owner?: string, operation?: string, maxRetries?: number, retryDelay?: number): Promise<void>;
+}
+interface LockRecoveryContext {
+  profile?: string | undefined;
+  stateBucket?: string | undefined;
+  statePrefix?: string | undefined;
+}
+type RecordUnderPrefix = 'absent' | 'empty' | 'holder';
+interface EarlierStateRecord {
+  resources: Record<string, unknown>;
+  writtenAt?: number;
+}
+interface NoncurrentVersionPurgeOptions {
+  requestFields?: {
+    ExpectedBucketOwner?: string;
+  };
+  listPrefix?: string;
+  logger?: {
+    warn: (m: string) => void;
+    debug?: (m: string) => void;
+  };
+  objectDescription?: string;
+}
+interface PrefixPurgeResult {
+  deletedBodies: number;
+  complete: boolean;
+}
+interface StackStateRef {
+  stackName: string;
+  region?: string;
+}
+interface S3ClientOptions {
+  region?: string;
+  profile?: string;
+  credentials?: {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+  };
+}
+interface VerifyBucketExistsOptions {
+  existenceAlreadyProbed?: boolean;
+}
+export declare class S3StateBackend {
+  private logger;
+  private s3Client;
+  private config;
+  private clientOpts;
+  private clientResolved;
+  private scanClient;
+  private resolveInFlight;
+  private readonly journalsReadAbsent;
+  private readonly journalTouches;
+  private readonly pendingStackInstanceSiblings;
+  private readonly siblingPrefetches;
+  private readonly siblingVersionsWritten;
+  constructor(s3Client: S3Client, config: StateBackendConfig, clientOpts?: S3ClientOptions);
+  destroyClient(): void;
+  private clientForScan;
+  get prefix(): string;
+  private getStateKey;
+  private getLegacyStateKey;
+  private getRollbackJournalKey;
+  private rollbackJournalKey;
+  rollbackJournalReadAbsent(stackName: string, region: string): boolean;
+  warmConnections(stackName: string, region: string, count: number): Promise<void>;
+  purgeRollbackJournalVersions(stackName: string, region: string): Promise<void>;
+  private getStackInstanceKey;
+  private getCreateTokenLedgerKey;
+  private ensureClientForBucket;
+  private ownerParam;
+  verifyBucketExists(options?: VerifyBucketExistsOptions): Promise<void>;
+  stateExists(stackName: string, region: string): Promise<boolean>;
+  stateExistsOwnedBy(stackName: string, region: string, regionlessOwner: string): Promise<boolean>;
+  rawObjectExists(key: string): Promise<boolean>;
+  getState(stackName: string, region: string): Promise<{
+    state: StackState;
+    etag: string;
+    migrationPending?: boolean;
+    divergentBodyRegion?: unknown;
+  } | null>;
+  saveState(stackName: string, region: string, state: StackState, options?: {
+    expectedEtag?: string;
+    migrateLegacy?: boolean;
+    deferCleanup?: (cleanup: Promise<void>) => void;
+  }): Promise<string>;
+  deleteState(stackName: string, region: string): Promise<void>;
+  purgeDeletedStateHistory(stackName: string, region: string): Promise<void>;
+  private otherRegionHistoryState;
+  deleteLegacyState(stackName: string): Promise<void>;
+  listStacks(): Promise<StackStateRef[]>;
+  listTopLevelPrefixes(): Promise<string[]>;
+  recordUnderPrefix(prefix: string, stackName: string, region: string): Promise<RecordUnderPrefix>;
+  putRawObject(key: string, body: string, contentType?: string): Promise<void>;
+  earlierStateResources(stackName: string, region: string, max?: number): Promise<EarlierStateRecord[]>;
+  private getRetainedKey;
+  loadRetainedResources(stackName: string, region: string): Promise<RetainedResource[]>;
+  loadRetainedRecord(stackName: string, region: string): Promise<RetainedResource[] | null>;
+  ensureRetainedTombstone(stackName: string, region: string): Promise<void>;
+  saveRetainedResources(stackName: string, region: string, entries: readonly RetainedResource[]): Promise<void>;
+  refactorMarkerKey(): string;
+  getRefactorMarker(): Promise<{
+    body: unknown;
+    etag: string;
+  } | null>;
+  saveRefactorMarker(body: {
+    moves: unknown[];
+  }, etag: string | null): Promise<'saved' | 'conflict'>;
+  registryMarkerKey(stackName: string, region: string): string;
+  getRegistryMarker(stackName: string, region: string): Promise<{
+    prefix: string;
+    etag: string;
+  } | null>;
+  claimRegistryMarker(stackName: string, region: string, ifMatch?: string): Promise<'claimed' | 'conflict'>;
+  releaseRegistryMarker(stackName: string, region: string, known?: {
+    prefix: string;
+    etag: string;
+  } | null): Promise<'released' | 'absent' | 'elsewhere'>;
+  lockUnderPrefix(prefix: string, stackName: string, region: string): Promise<boolean>;
+  getRawObject(key: string): Promise<string | null>;
+  listRawKeys(keyPrefix: string): Promise<string[]>;
+  listRawObjects(keyPrefix: string): Promise<Array<{
+    key: string;
+    lastModified: Date;
+    size: number;
+  }>>;
+  deleteRawObjects(keys: string[]): Promise<void>;
+  purgeNoncurrentVersions(keys: string[], options?: Omit<NoncurrentVersionPurgeOptions, 'requestFields' | 'logger'>): Promise<void>;
+  purgeNoncurrentVersionsUnderPrefix(keyPrefix: string, options?: Pick<NoncurrentVersionPurgeOptions, 'objectDescription'>): Promise<PrefixPurgeResult>;
+  loadCreateTokenLedger(stackName: string, region: string): Promise<CreateTokenLedgerDoc | null>;
+  saveCreateTokenLedger(stackName: string, region: string, ledger: CreateTokenLedgerDoc): Promise<void>;
+  rotateCreateTokenNonce(stackName: string, region: string, logicalIds: readonly string[]): Promise<void>;
+  deleteCreateTokenLedger(stackName: string, region: string): Promise<void>;
+  stackInstanceIdForFirstWrite(stackName: string, region: string, options: {
+    writeAhead: boolean;
+  }): Promise<string>;
+  private stackInstanceSiblingError;
+  prefetchStackInstanceSibling(stackName: string, region: string): void;
+  private readSiblingId;
+  readStackInstanceSibling(stackName: string, region: string): Promise<string | undefined>;
+  deleteStackInstanceSibling(stackName: string, region: string): Promise<void>;
+  private dropStackInstanceSiblingAfterSave;
+  loadRollbackJournal(stackName: string, region: string): Promise<RollbackJournal | null>;
+  appendRollbackJournalSegment(stackName: string, region: string, segment: RollbackJournalSegment): Promise<void>;
+  setRollbackJournalFailedOperations(stackName: string, region: string, remaining: FailedOperation[]): Promise<void>;
+  dropRollbackJournalFailedOperations(stackName: string, region: string, drop: (op: FailedOperation, segment: RollbackJournalSegment) => boolean): Promise<number>;
+  rewriteRollbackJournalFailedOperations(stackName: string, region: string, rewrite: (op: FailedOperation, segment: RollbackJournalSegment) => FailedOperation | null): Promise<number>;
+  reduceRollbackJournalToFailedOperations(stackName: string, region: string, keep: (op: FailedOperation, segment: RollbackJournalSegment) => boolean, supersededLogicalIds?: readonly string[], demote?: (op: FailedOperation, segment: RollbackJournalSegment) => boolean): Promise<number>;
+  popRollbackJournalSegment(stackName: string, region: string): Promise<number>;
+  markRollbackJournalSuperseded(stackName: string, region: string, logicalIds: readonly string[]): Promise<void>;
+  markRollbackJournalImported(stackName: string, region: string, marks: readonly ImportedResourceMark[]): Promise<string[]>;
+  dropRollbackJournalSegments(stackName: string, region: string, drop: (segment: RollbackJournalSegment) => boolean): Promise<number>;
+  deleteRollbackJournal(stackName: string, region: string): Promise<boolean>;
+  private headObject;
+  private wrapS3Failure;
+  private displayName;
+  private stackRef;
+  private adoptKeyRegion;
+  private probeLegacyState;
+  private readLegacyRegion;
+  private legacyBelongsToRegion;
+  private tryGetLegacy;
+  private parseStateBody;
+}
+interface RetainedResource {
+  logicalId: string;
+  resourceType: string;
+  physicalId: string;
+  keptAt?: number;
+}
+interface ExportIndexEntry {
+  value: unknown;
+  producerStack: string;
+  producerRegion: string;
+}
+interface ExportIndexStoreOptions {
+  maxWriteRetries?: number;
+  initialBackoffMs?: number;
+  maxBackoffMs?: number;
+  profile?: string | undefined;
+}
+declare class ExportIndexStore {
+  private logger;
+  private s3Client;
+  private bucket;
+  private prefix;
+  private region;
+  private stateBackend;
+  private loadState;
+  private opts;
+  private profile;
+  private writeChain;
+  private clientResolved;
+  private resolveInFlight;
+  constructor(s3Client: S3Client, bucket: string, prefix: string, region: string, stateBackend: S3StateBackend, opts?: ExportIndexStoreOptions);
+  private indexKey;
+  private ownerParam;
+  private ensureClientForBucket;
+  lookup(exportName: string): Promise<ExportIndexEntry | undefined>;
+  prefetch(): Promise<void>;
+  updateForStack(stackName: string, producerRegion: string, outputs: Record<string, unknown>): Promise<void>;
+  readPersistedEntries(): Promise<ReadonlyMap<string, ExportIndexEntry> | undefined>;
+  patchEntry(exportName: string, entry: ExportIndexEntry, opts?: {
+    requireOwner?: {
+      producerStack: string;
+      producerRegion: string;
+    };
+  }): Promise<boolean>;
+  removeStack(stackName: string, producerRegion: string): Promise<void>;
+  removeStackIfPresent(stackName: string, producerRegion: string): Promise<void>;
+  private enqueueWrite;
+  rebuild(): Promise<void>;
+  private ensureLoaded;
+  private loadPersisted;
+  private doLoad;
+  private readIndexRaw;
+  private writeIndex;
+  private rebuildFromStateBackend;
+  private applyStackUpdate;
+  private warnOnForeignOverwrite;
+  private applyPatch;
+  private applyRemoveStack;
+  private persist;
+  private runWithRetry;
+  private isNoSuchKey;
+  private isPreconditionFailed;
+}
+interface AwsClientConfig {
+  region?: string;
+  profile?: string;
+  credentials?: {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+  };
+}
+export declare class AwsClients {
+  private s3Client?;
+  private cloudControlClient?;
+  private iamClient?;
+  private sqsClient?;
+  private snsClient?;
+  private lambdaClient?;
+  private stsClient?;
+  private ec2Client?;
+  private ec2SingleSendClient?;
+  private dynamoDBClient?;
+  private cloudFormationClient?;
+  private apiGatewayClient?;
+  private eventBridgeClient?;
+  private secretsManagerClient?;
+  private ssmClient?;
+  private cloudFrontClient?;
+  private cloudWatchClient?;
+  private cloudWatchLogsClient?;
+  private bedrockAgentCoreControlClient?;
+  private redshiftClient?;
+  private elastiCacheClient?;
+  private acmClient?;
+  private route53Client?;
+  private lambdaMicrovmsClient?;
+  private lambdaWebClient?;
+  private lambdaCoreClient?;
+  private config;
+  constructor(config?: AwsClientConfig);
+  private get clientOptions();
+  get configuredRegion(): string | undefined;
+  get credentialConfig(): Omit<AwsClientConfig, 'region'>;
+  withRegion(region: string): AwsClients;
+  getS3Client(): S3Client;
+  getCloudControlClient(): CloudControlClient;
+  getIAMClient(): IAMClient;
+  get s3(): S3Client;
+  get cloudControl(): CloudControlClient;
+  get iam(): IAMClient;
+  getSQSClient(): SQSClient;
+  get sqs(): SQSClient;
+  getSNSClient(): SNSClient;
+  get sns(): SNSClient;
+  getLambdaClient(): LambdaClient;
+  get lambda(): LambdaClient;
+  getEC2Client(): EC2Client;
+  get ec2(): EC2Client;
+  getEC2SingleSendClient(): EC2Client;
+  get ec2SingleSend(): EC2Client;
+  getSTSClient(): STSClient;
+  get sts(): STSClient;
+  getDynamoDBClient(): DynamoDBClient;
+  get dynamoDB(): DynamoDBClient;
+  getCloudFormationClient(): CloudFormationClient;
+  get cloudFormation(): CloudFormationClient;
+  getAPIGatewayClient(): APIGatewayClient;
+  get apiGateway(): APIGatewayClient;
+  getEventBridgeClient(): EventBridgeClient;
+  get eventBridge(): EventBridgeClient;
+  getSecretsManagerClient(): SecretsManagerClient;
+  get secretsManager(): SecretsManagerClient;
+  getSSMClient(): SSMClient;
+  get ssm(): SSMClient;
+  getCloudFrontClient(): CloudFrontClient;
+  get cloudFront(): CloudFrontClient;
+  getACMClient(): ACMClient;
+  get acm(): ACMClient;
+  getRoute53Client(): Route53Client;
+  get route53(): Route53Client;
+  getLambdaMicrovmsClient(): LambdaMicrovmsClient;
+  get lambdaMicrovms(): LambdaMicrovmsClient;
+  getLambdaWebClient(): LambdaWebClient;
+  get lambdaWeb(): LambdaWebClient;
+  getLambdaCoreClient(): LambdaCoreClient;
+  get lambdaCore(): LambdaCoreClient;
+  getCloudWatchClient(): CloudWatchClient;
+  get cloudWatch(): CloudWatchClient;
+  getCloudWatchLogsClient(): CloudWatchLogsClient;
+  get cloudWatchLogs(): CloudWatchLogsClient;
+  getBedrockAgentCoreControlClient(): BedrockAgentCoreControlClient;
+  get bedrockAgentCoreControl(): BedrockAgentCoreControlClient;
+  getRedshiftClient(): RedshiftClient;
+  get redshift(): RedshiftClient;
+  getElastiCacheClient(): ElastiCacheClient;
+  get elastiCache(): ElastiCacheClient;
+  destroy(): void;
+}
+export declare function getAwsClients(config?: AwsClientConfig): AwsClients;
+export declare function setAwsClients(clients: AwsClients): void;
+export declare function resetAwsClients(): void;
+interface ProducerArtifact {
+  readonly stackName: string;
+  readonly account?: string | undefined;
+  readonly region?: string | undefined;
+  readonly template: CloudFormationTemplate;
+  readonly lookupRoleArn?: string | undefined;
+}
+type ProducerLookup = (stackName: string, account: string, region: string) => ProducerArtifact | undefined;
+interface ResolvedSecretPrincipals<K extends string> {
+  lists: Record<K, string[]>;
+  mask: SecretMasker;
+  maskError: <T>(error: T) => T;
+  resolvedNames: Record<K, ReadonlySet<string>>;
+}
+interface SecretPrincipalRetryMemo {
+  resolved?: ResolvedSecretPrincipals<string>;
+  readonly detached: Set<string>;
+}
+type ParameterInput = {
+  kind: 'value';
+  value: unknown;
+} | {
+  kind: 'secret';
+} | {
+  kind: 'unknown';
+};
+interface MaskedInputSources {
+  template: CloudFormationTemplate;
+  parameterInput(name: string): ParameterInput;
+  conditions?: Readonly<Record<string, boolean>> | undefined;
+  resolve(node: unknown): Promise<{
+    value: unknown;
+    secrets?: RecordedSecretValues;
+    keepAsWritten?: boolean;
+  }>;
+  childTemplate?: ChildTemplateLoader | undefined;
+}
+interface NestedTemplate {
+  template: CloudFormationTemplate;
+  identity: string;
+  childTemplate: ChildTemplateLoader;
+}
+type ChildTemplateLoader = (logicalId: string) => NestedTemplate | undefined;
+type PassedParameterClass = 'clean' | 'secret' | 'unknown';
+interface NoEchoDeleteValues {
+  readonly leaves: readonly {
+    readonly coordinate: NoEchoCoordinate;
+    readonly value: unknown;
+  }[];
+  readonly maskSecrets: (text: string) => string;
+}
+interface TemplateNoEchoReresolverOptions {
+  template: CloudFormationTemplate;
+  stackName: string;
+  region: string;
+  nestedTemplates?: Readonly<Record<string, string>> | undefined;
+  parameters?: Record<string, string> | undefined;
+  inheritedNoEchoParameters?: ReadonlySet<string> | undefined;
+  maskedParameters?: ReadonlySet<string> | undefined;
+  inheritedSecrets?: RecordedSecretValues | undefined;
+  passedClasses?: ReadonlyMap<string, PassedParameterClass> | undefined;
+  printingSeed?: RecordedSecretValues | undefined;
+}
+declare class TemplateNoEchoReresolver {
+  private readonly logger;
+  private readonly resolver;
+  private parametersPromise;
+  private printingNoEchoPromise;
+  private readonly noEchoParameters;
+  private readonly options;
+  constructor(options: TemplateNoEchoReresolverOptions);
+  static usable(template: CloudFormationTemplate | undefined): template is CloudFormationTemplate;
+  private newBag;
+  private boundParameters;
+  private inputSources;
+  private noEchoNeedles;
+  printingNoEchoValues(): Promise<RecordedSecretValues | undefined>;
+  private printingNeedles;
+  recordedNoEchoValuesFor(logicalId: string, record: ResourceState | undefined): RecordedSecretValues;
+  valuesFor(logicalId: string, record: ResourceState): Promise<NoEchoDeleteValues | undefined>;
+  forNestedChild(logicalId: string, row: {
+    properties: Record<string, unknown> | undefined;
+    noEchoLeaves: readonly NoEchoCoordinate[] | undefined;
+    values: NoEchoDeleteValues | undefined;
+  }, childStackName: string, load: (templatePath: string) => {
+    template: CloudFormationTemplate;
+    nestedTemplates: Record<string, string>;
+  }, extractParameters: (properties: Record<string, unknown>) => Record<string, string>): Promise<TemplateNoEchoReresolver | undefined>;
+}
+interface DeleteContext extends SecretMaskingContext {
+  expectedRegion?: string | undefined;
+  removeProtection?: boolean;
+  forceDataDelete?: boolean;
+  inlinePolicyClaimed?: InlinePolicyClaimed | undefined;
+  finalSnapshotIdentifier?: string;
+  deletionPolicy?: string | undefined;
+  resolveSecretDerivedPrincipals?: {
+    importedProducerRegions: readonly string[];
+    producerRegionsIncomplete?: boolean;
+    retryMemo?: SecretPrincipalRetryMemo;
+    recordedRegions?: ReadonlyMap<string, string>;
+  } | undefined;
+  skipFinalSnapshot?: boolean | undefined;
+  recordedAttributes?: Readonly<Record<string, unknown>> | undefined;
+  recordedNoEchoLeaves?: readonly (readonly (string | number)[])[] | undefined;
+  noEchoDeleteValues?: NoEchoDeleteValues | undefined;
+  noEchoReresolver?: TemplateNoEchoReresolver | undefined;
+  stackDestroy?: boolean | undefined;
+  failedCreateOrphan?: boolean | undefined;
+  resolveAttemptedProperties?: (() => Promise<Record<string, unknown> | undefined>) | undefined;
+  writtenThisRun?: ReadonlyArray<{
+    resourceType?: unknown;
+    physicalId?: unknown;
+    attributes?: unknown;
+    properties?: unknown;
+  }> | undefined;
+}
+interface CloudFormationTemplate {
+  AWSTemplateFormatVersion?: string;
+  Description?: string;
+  Parameters?: Record<string, TemplateParameter>;
+  Resources: Record<string, TemplateResource>;
+  Outputs?: Record<string, TemplateOutput>;
+  Conditions?: Record<string, unknown>;
+  Mappings?: Record<string, unknown>;
+  Transform?: unknown;
+  Rules?: Record<string, unknown>;
+}
+interface TemplateParameter {
+  Type: string;
+  Default?: unknown;
+  Description?: string;
+  AllowedValues?: unknown[];
+  AllowedPattern?: string;
+  ConstraintDescription?: string;
+  NoEcho?: boolean | string;
+}
+interface TemplateResource {
+  Type: string;
+  Properties?: Record<string, unknown>;
+  DependsOn?: string | readonly string[];
+  Condition?: string;
+  Metadata?: Record<string, unknown>;
+  CreationPolicy?: Record<string, unknown>;
+  UpdatePolicy?: Record<string, unknown>;
+  DeletionPolicy?: 'Delete' | 'Retain' | 'Snapshot';
+  UpdateReplacePolicy?: 'Delete' | 'Retain' | 'Snapshot';
+}
+interface TemplateOutput {
+  Value: unknown;
+  Description?: string;
+  Condition?: string;
+  Export?: {
+    Name: string;
+  };
+}
+interface EffectivePropertiesResult {
+  effectiveProperties?: Record<string, unknown> | undefined;
+}
+interface NoEchoAttributesResult {
+  noEchoAttributes?: boolean;
+  noEchoAttributeNames?: readonly string[];
+  secretNamedAttributeNames?: readonly string[];
+}
+interface ResourceCreateResult extends EffectivePropertiesResult, NoEchoAttributesResult {
+  physicalId: string;
+  attributes?: Record<string, unknown>;
+}
+interface ResourceUpdateResultBase extends EffectivePropertiesResult, NoEchoAttributesResult {
+  physicalId: string;
+  wasReplaced: boolean;
+  attributes?: Record<string, unknown>;
+  sentNothing?: true;
+}
+type ResourceUpdateOutcome = {
+  readonly outcome?: 'updated';
+  readonly reason?: never;
+} | {
+  readonly outcome: 'partial';
+  readonly reason: string;
+  readonly oldResourceSurvivor?: 'kept' | 'unconfirmed';
+};
+type ResourceUpdateResult = ResourceUpdateResultBase & ResourceUpdateOutcome;
+interface IndeterminateGuard {
+  readonly guard: string;
+  readonly reason: string;
+}
+type ResourceDeleteResult = {
+  readonly outcome: 'deleted';
+  readonly leftInPlace?: string;
+  readonly indeterminateGuards?: readonly IndeterminateGuard[];
+} | {
+  readonly indeterminateGuards?: readonly IndeterminateGuard[];
+  readonly outcome: 'skipped';
+  readonly reason: string;
+};
+interface ResourceImportInput {
+  logicalId: string;
+  resourceType: string;
+  stackName: string;
+  region: string;
+  properties: Record<string, unknown>;
+  knownPhysicalId?: string;
+}
+interface ResourceImportResult {
+  physicalId: string;
+  attributes?: Record<string, unknown>;
+}
+interface SecretMaskingContext {
+  maskSecrets?: SecretMasker;
+}
+interface UpdateContext extends SecretMaskingContext {
+  desiredFromAwsReadback?: boolean;
+  declaredEmptyProperties?: ReadonlySet<string> | undefined;
+  declaredTrueProperties?: ReadonlySet<string> | undefined;
+  replayingState?: boolean;
+  expectedRegion?: string | undefined;
+  recordedAttributes?: Readonly<Record<string, unknown>> | undefined;
+  inlinePolicyClaimed?: InlinePolicyClaimed | undefined;
+  removedProperties?: ReadonlySet<string> | undefined;
+  changedProperties?: ReadonlySet<string> | undefined;
+  markUnsettled?: ((propertyName: string) => void) | undefined;
+  markAttempted?: ((path: string, items: readonly string[]) => void) | undefined;
+  unsettledItems?: ReadonlyMap<string, ReadonlySet<string>> | undefined;
+  unsettledProperties?: ReadonlySet<string> | undefined;
+}
+type InlinePolicyPrincipalKind = 'role' | 'group' | 'user';
+type InlinePolicyClaimed = (kind: InlinePolicyPrincipalKind, principal: string, policyName: string) => boolean;
+interface CreateContext extends SecretMaskingContext {
+  replayingState?: boolean;
+}
+declare const RESOURCE_NOT_FOUND: unique symbol;
+type ResourceNotFound = typeof RESOURCE_NOT_FOUND;
+type ResourceIdentityVerdict = 'same' | 'different' | 'unknown';
+interface ReadCurrentStateContext {
+  siblings?: Record<string, {
+    resourceType: string;
+    physicalId?: string;
+    properties: Record<string, unknown>;
+    attributes?: Record<string, unknown>;
+  }>;
+  afterOwnWrite?: boolean;
+  attributes?: Readonly<Record<string, unknown>>;
+}
+interface ResourceProvider {
+  handledProperties?: ReadonlyMap<string, ReadonlySet<string>>;
+  unhandledByDesign?: ReadonlyMap<string, ReadonlyMap<string, string>>;
+  removalDefaults?: ReadonlyMap<string, ReadonlyMap<string, unknown>>;
+  removalHandledInUpdate?: ReadonlyMap<string, ReadonlySet<string>>;
+  disableCcApiFallback?: boolean;
+  disableOuterRetry?: boolean;
+  waitForNameReleased?(logicalId: string, physicalId: string, resourceType: string, context: {
+    isInterrupted: () => boolean;
+    maskSecrets?: (text: string) => string;
+  }): Promise<void>;
+  getMinResourceTimeoutMs?(): number;
+  preparePropertiesForFallback?(logicalId: string, resourceType: string, properties: Record<string, unknown>): Record<string, unknown>;
+  create(logicalId: string, resourceType: string, properties: Record<string, unknown>, context?: CreateContext): Promise<ResourceCreateResult>;
+  update(logicalId: string, physicalId: string, resourceType: string, properties: Record<string, unknown>, previousProperties: Record<string, unknown>, context?: UpdateContext): Promise<ResourceUpdateResult>;
+  delete(logicalId: string, physicalId: string, resourceType: string, properties?: Record<string, unknown>, context?: DeleteContext): Promise<void | ResourceDeleteResult>;
+  getAttribute?(physicalId: string, resourceType: string, attributeName: string, logicalId: string): Promise<unknown>;
+  readCurrentState?(physicalId: string, logicalId: string, resourceType: string, properties?: Record<string, unknown>, context?: ReadCurrentStateContext): Promise<Record<string, unknown> | ResourceNotFound | undefined>;
+  readUnsettled?(physicalId: string, logicalId: string, resourceType: string, names: ReadonlySet<string>, recordedProperties?: Record<string, unknown>, desiredProperties?: Record<string, unknown>, attemptedItems?: ReadonlyMap<string, ReadonlySet<string>>): Promise<Record<string, unknown> | ResourceNotFound | undefined>;
+  canonicalizeUnsettledProperties?(resourceType: string, properties: Record<string, unknown>): Record<string, unknown>;
+  unsettledInTransition?(physicalId: string, logicalId: string, resourceType: string, names: ReadonlySet<string>, recordedProperties?: Record<string, unknown>, desiredProperties?: Record<string, unknown>): Promise<ReadonlySet<string>>;
+  isSameResource?(journaledPhysicalId: string, record: {
+    physicalId: string;
+    provisionedBy?: 'sdk' | 'cc-api' | undefined;
+  }, resourceType: string, context: {
+    expectedRegion: string;
+  }): Promise<ResourceIdentityVerdict>;
+  resourceIdentity?(physicalId: string, resourceType: string, context: {
+    expectedRegion: string;
+  }): Promise<string | ResourceNotFound | undefined>;
+  getDriftUnknownPaths?(resourceType: string, properties?: Record<string, unknown>): string[];
+  canonicalizeDesiredProperties?(resourceType: string, properties: Record<string, unknown>): Record<string, unknown>;
+  getDriftUnorderedPaths?(resourceType: string): string[];
+  canonicalizeDriftProperties?(resourceType: string, properties: Record<string, unknown>): Record<string, unknown>;
+  canonicalizeDriftPair?(resourceType: string, baseline: Record<string, unknown>, aws: Record<string, unknown>, properties?: Record<string, unknown>): Promise<{
+    baseline: Record<string, unknown>;
+    aws: Record<string, unknown>;
+  }>;
+  getDriftAbsentMeansDefaultKeys?(resourceType: string, properties: Record<string, unknown>): readonly string[];
+  getDriftSecretPathAliases?(resourceType: string, properties: Record<string, unknown>, secretPaths: ReadonlySet<string>): string[];
+  import?(input: ResourceImportInput): Promise<ResourceImportResult | null>;
+  generatedCreateName?(resourceType: string, logicalId: string, properties: Record<string, unknown>): string | undefined;
+  lookupNames?(resourceType: string, names: readonly string[], context: {
+    region: string;
+    stackName: string;
+    propertiesByName: ReadonlyMap<string, Record<string, unknown>>;
+  }): Promise<Map<string, string>>;
+  lookupNeedsResolvedProperties?(resourceType: string, properties: Record<string, unknown>): boolean;
+  holderCreatedAt?(resourceType: string, physicalId: string): Promise<number | undefined>;
+}
+export declare class ConsoleLogger implements Logger {
+  private level;
+  private useColors;
+  constructor(level?: LogLevel, useColors?: boolean);
+  private shouldLog;
+  private formatMessage;
+  private emit;
+  debug(message: string, ...args: unknown[]): void;
+  info(message: string, ...args: unknown[]): void;
+  warn(message: string, ...args: unknown[]): void;
+  error(message: string, ...args: unknown[]): void;
+  setLevel(level: LogLevel): void;
+  getLevel(): LogLevel;
+  child(prefix: string): ChildLogger;
+}
+declare class ChildLogger extends ConsoleLogger {
+  private readonly prefix;
+  constructor(prefix: string, useColors: boolean);
+  private syncLevel;
+  debug(message: string, ...args: unknown[]): void;
+  info(message: string, ...args: unknown[]): void;
+  warn(message: string, ...args: unknown[]): void;
+  error(message: string, ...args: unknown[]): void;
+}
+export declare function getLogger(): ConsoleLogger;
+export declare function setLogger(logger: ConsoleLogger): void;
+interface ResolveBucketRegionOptions {
+  profile?: string;
+  credentials?: {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+  };
+  fallbackRegion?: string;
+  region?: string;
+}
+export declare function resolveBucketRegion(bucketName: string, opts?: ResolveBucketRegionOptions): Promise<string>;
+export declare function clearBucketRegionCache(): void;
+interface AssemblyManifest {
+  version: string;
+  artifacts?: Record<string, ArtifactManifest>;
+  missing?: MissingContext[];
+  runtime?: RuntimeInfo;
+}
+interface ArtifactManifest {
+  type: ArtifactType;
+  environment?: string;
+  displayName?: string;
+  properties?: Record<string, unknown>;
+  dependencies?: string[];
+  metadata?: Record<string, MetadataEntry[]>;
+  additionalMetadataFile?: string;
+}
+type ArtifactType = 'aws:cloudformation:stack' | 'cdk:asset-manifest' | 'cdk:tree' | 'cdk:cloud-assembly' | 'cdk:feature-flag-report';
+interface MissingContext {
+  key: string;
+  provider: string;
+  props: ContextQueryProperties;
+}
+interface ContextQueryProperties {
+  account: string;
+  region: string;
+  lookupRoleArn?: string;
+  [key: string]: unknown;
+}
+interface MetadataEntry {
+  type: string;
+  data?: unknown;
+  trace?: string[];
+}
+interface RuntimeInfo {
+  libraries?: Record<string, string>;
+}
+type StackMessageLevel = 'error' | 'warning' | 'info';
+interface StackMessage {
+  level: StackMessageLevel;
+  path: string;
+  message: string;
+}
+interface StackInfo {
+  stackName: string;
+  displayName: string;
+  stagePath?: string | undefined;
+  artifactId: string;
+  template: CloudFormationTemplate;
+  assetManifestPath?: string | undefined;
+  assetOutdir?: string | undefined;
+  dependencyNames: string[];
+  region?: string | undefined;
+  account?: string | undefined;
+  terminationProtection?: boolean | undefined;
+  nestedTemplates?: Record<string, string> | undefined;
+  messages?: StackMessage[];
+  lookupRoleArn?: string | undefined;
+}
+interface AssemblyContents {
+  stacks: StackInfo[];
+}
+export declare class AssemblyReader {
+  private logger;
+  readManifest(assemblyDir: string): AssemblyManifest;
+  readAssembly(assemblyDir: string, manifest: AssemblyManifest, assetOutdir?: string): AssemblyContents;
+  getAllStacks(assemblyDir: string, manifest: AssemblyManifest, assetOutdir?: string): StackInfo[];
+  private collectStacks;
+  getStack(assemblyDir: string, manifest: AssemblyManifest, stackName: string): StackInfo;
+  getTemplate(assemblyDir: string, manifest: AssemblyManifest, stackName: string): CloudFormationTemplate;
+  private buildAssetManifestMap;
+  private extractStackInfo;
+  hasAssets(stackInfo: StackInfo): boolean;
+}
+interface CfnUploadS3ClientOpts {
+  profile?: string;
+  credentials?: {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+  };
+}
+interface ExpandMacrosOptions {
+  region: string;
+  stateBucket?: string;
+  cfnClient?: CloudFormationClient;
+  s3ClientOpts?: CfnUploadS3ClientOpts;
+  waiterMaxWaitSeconds?: number;
+}
+interface SynthesisOptions {
+  app: string;
+  output?: string;
+  profile?: string;
+  region?: string;
+  context?: Record<string, string>;
+  stateBucket?: string;
+  macroExpandS3ClientOpts?: ExpandMacrosOptions['s3ClientOpts'];
+  deferMacroExpansion?: boolean;
+}
+interface SynthesisResult {
+  manifest: AssemblyManifest;
+  assemblyDir: string;
+  stacks: StackInfo[];
+}
+export declare class Synthesizer {
+  private logger;
+  private appExecutor;
+  private assemblyReader;
+  private contextStore;
+  synthesize(options: SynthesisOptions): Promise<SynthesisResult>;
+  listStacks(options: SynthesisOptions): Promise<string[]>;
+  expandMacrosForStacks(stacks: StackInfo[], options: SynthesisOptions, resolved?: {
+    region: string | undefined;
+    accountId?: string | undefined;
+  }): Promise<void>;
+}
+interface AssetRedirectEntry {
+  source: string;
+  target: string;
+}
+interface AssetRedirectMap {
+  buckets: Map<string, string>;
+  repos: Map<string, string>;
+  entries: AssetRedirectEntry[];
+  accountId: string;
+  region: string;
+  partition: string;
+}
+type WorkNodeType = 'asset-build' | 'asset-publish' | 'stack';
+type NodeState = 'pending' | 'queued' | 'running' | 'completed' | 'failed' | 'skipped';
+interface WorkNode {
+  id: string;
+  type: WorkNodeType;
+  dependencies: Set<string>;
+  state: NodeState;
+  data: unknown;
+}
+interface WorkGraphConcurrency {
+  'asset-build': number;
+  'asset-publish': number;
+  stack: number;
+}
+declare class WorkGraph {
+  private nodes;
+  private logger;
+  addNode(node: WorkNode): void;
+  execute(concurrency: WorkGraphConcurrency, fn: (node: WorkNode) => Promise<void>): Promise<void>;
+  summary(): Record<WorkNodeType, number>;
+}
+interface AssetPublisherOptions {
+  profile?: string;
+  region?: string;
+  accountId?: string;
+  assetPublishConcurrency?: number;
+  imageBuildConcurrency?: number;
+  redirect?: AssetRedirectMap;
+}
+export declare class AssetPublisher {
+  private logger;
+  private filePublisher;
+  private dockerPublisher;
+  addAssetsToGraph(graph: WorkGraph, manifestPath: string, options: {
+    accountId: string;
+    region: string;
+    profile?: string;
+    nodePrefix?: string;
+    redirect?: AssetRedirectMap;
+    assetOutdir?: string;
+  }): string[];
+  executeNode(node: WorkNode): Promise<void>;
+  publishFromManifest(manifestPath: string, options?: AssetPublisherOptions): Promise<void>;
+  hasAssets(manifestPath: string): boolean;
+}
+export declare class TemplateParser {
+  private logger;
+  getResourceIds(template: CloudFormationTemplate): string[];
+  getResource(template: CloudFormationTemplate, logicalId: string): TemplateResource | undefined;
+  extractDependencies(resource: TemplateResource): Set<string>;
+  extractReferences(value: unknown): Set<string>;
+  private extractRefsFromValue;
+  hasProperty(resource: TemplateResource, propertyPath: string): boolean;
+  getProperty(resource: TemplateResource, propertyPath: string): unknown;
+  validateTemplate(template: unknown): template is CloudFormationTemplate;
+  getResourcesByType(template: CloudFormationTemplate, resourceType: string): Map<string, TemplateResource>;
+  countResources(template: CloudFormationTemplate): number;
+  filterResourcesByCondition(template: CloudFormationTemplate, conditions: Record<string, boolean>): CloudFormationTemplate;
+}
+type GraphType = graphlib.Graph;
+interface DagBuilderOptions {
+  relaxCdkVpcDefensiveDeps?: boolean;
+}
+export declare class DagBuilder {
+  private logger;
+  private parser;
+  private options;
+  constructor(options?: DagBuilderOptions);
+  buildGraph(template: CloudFormationTemplate): GraphType;
+  getExecutionLevels(graph: GraphType): string[][];
+  private findCycles;
+  getAllDependencies(graph: GraphType, logicalId: string): Set<string>;
+  getAllDependents(graph: GraphType, logicalId: string): Set<string>;
+  getDirectDependencies(graph: GraphType, logicalId: string): string[];
+  getDirectDependents(graph: GraphType, logicalId: string): string[];
+  dependsOn(graph: GraphType, resourceA: string, resourceB: string): boolean;
+  private addCustomResourcePolicyEdges;
+  private addLambdaVpcEdges;
+  private isCustomResourceType;
+  private buildRolePoliciesMap;
+  private extractAttachedRoleIds;
+  private extractLogicalIdFromReference;
+}
+interface ReplacementSiblings {
+  readonly oldProperties: Readonly<Record<string, unknown>>;
+  readonly newProperties: Readonly<Record<string, unknown>>;
+}
+interface ReadProvenanceSources {
+  inherited?: ReadonlyMap<string, ReferenceProvenance>;
+  crossStackOutputs?: (value: unknown) => Promise<ReadonlyArray<Record<string, ReferenceProvenance>>>;
+}
+type IntrinsicResolveFn = (value: unknown) => Promise<unknown>;
+type CanonicalizePropertiesFn = (resourceType: string, properties: Record<string, unknown>) => Record<string, unknown>;
+type NoEchoCompareFn = (input: {
+  logicalId: string;
+  resourceType: string;
+  templateProperties: Record<string, unknown>;
+  desired: Record<string, unknown>;
+  current: Record<string, unknown>;
+}) => {
+  desired: Record<string, unknown>;
+  current: Record<string, unknown>;
+} | undefined;
+export declare class DiffCalculator {
+  private logger;
+  private replacementRules;
+  private parser;
+  conditionalReplacementVerdict(resourceType: string, propertyPath: string, oldValue: unknown, newValue: unknown, siblings?: ReplacementSiblings): boolean | undefined;
+  calculateDiff(currentState: StackState, desiredTemplate: CloudFormationTemplate, resolveFn?: IntrinsicResolveFn, canonicalizeProperties?: CanonicalizePropertiesFn, allowedUnsupportedProperties?: ReadonlySet<string>, freshParameters?: ReadonlySet<string>, maskForLog?: MaskerFn, recreateTargets?: ReadonlySet<string>, maskedInputs?: {
+    sources: MaskedInputSources;
+    rebaselined?: Map<string, Record<string, string>>;
+  }, refusalRecovery?: LockRecoveryContext, noEchoCompare?: NoEchoCompareFn, readProvenance?: ReadProvenanceSources): Promise<Map<string, ResourceChange>>;
+  private promoteReadProvenanceDependents;
+  private loadSyntheticCreateOnlyPaths;
+  private syntheticRequiresReplacement;
+  private promoteReplacementDependents;
+  private promoteInPlaceAttributeDependents;
+  private static extractGetAttRefs;
+  private resolveBestEffort;
+  private compareAttributes;
+  private compareProperties;
+  private maskedEditRequiresReplacement;
+  private static readonly INTRINSIC_KEYS;
+  private static isIntrinsic;
+  private valuesEqual;
+  getSummary(changes: Map<string, ResourceChange>): {
+    create: number;
+    update: number;
+    delete: number;
+    noChange: number;
+    total: number;
+  };
+  filterByType(changes: Map<string, ResourceChange>, type: ChangeType): ResourceChange[];
+  hasChanges(changes: Map<string, ResourceChange>): boolean;
+  getReplacementChanges(changes: Map<string, ResourceChange>): ResourceChange[];
+}
+export declare class IAMRoleProvider implements ResourceProvider {
+  private iamClient;
+  private readonly createClient;
+  private logger;
+  private wrapMaskedError;
+  handledProperties: Map<string, ReadonlySet<string>>;
+  removalDefaults: Map<string, ReadonlyMap<string, unknown>>;
+  removalHandledInUpdate: Map<string, ReadonlySet<string>>;
+  constructor();
+  create(logicalId: string, resourceType: string, properties: Record<string, unknown>, context?: CreateContext): Promise<ResourceCreateResult>;
+  update(logicalId: string, physicalId: string, resourceType: string, properties: Record<string, unknown>, previousProperties: Record<string, unknown>, context?: UpdateContext): Promise<ResourceUpdateResult>;
+  delete(logicalId: string, physicalId: string, resourceType: string, _properties?: Record<string, unknown>, context?: DeleteContext): Promise<void | ResourceDeleteResult>;
+  private detachAllManagedPolicies;
+  private deleteAllInlinePolicies;
+  private removeFromAllInstanceProfiles;
+  private updateManagedPolicies;
+  private updateInlinePolicies;
+  private updateTags;
+  getAttribute(physicalId: string, _resourceType: string, attributeName: string): Promise<unknown>;
+  isSameResource(journaledPhysicalId: string, record: {
+    physicalId: string;
+  }, resourceType: string, context: {
+    expectedRegion: string;
+  }): Promise<ResourceIdentityVerdict>;
+  resourceIdentity(physicalId: string, resourceType: string, context: {
+    expectedRegion: string;
+  }): Promise<string | ResourceNotFound | undefined>;
+  private readRoleIdIfExists;
+  readCurrentState(physicalId: string, _logicalId: string, _resourceType: string, properties?: Record<string, unknown>, context?: ReadCurrentStateContext): Promise<Record<string, unknown> | ResourceNotFound | undefined>;
+  import(input: ResourceImportInput): Promise<ResourceImportResult | null>;
+}
+interface MovedTo {
+  stackName: string;
+  logicalId: string;
+}
+type DestructiveImpact = 'WILL_REPLACE' | 'MAY_REPLACE' | 'WILL_DESTROY' | 'WILL_ORPHAN';
+interface DestructiveChange {
+  stackName: string;
+  logicalId: string;
+  resourceType: string;
+  constructPath?: string;
+  impact: DestructiveImpact;
+  movedTo?: MovedTo;
+}
+interface DeployEngineOptions {
+  concurrency?: number;
+  dryRun?: boolean;
+  lockTimeout?: number;
+  parameters?: Record<string, string>;
+  noRollback?: boolean;
+  roleArn?: string;
+  refusalRecovery?: LockRecoveryContext;
+  resourceWarnAfterMs?: number;
+  resourceTimeoutMs?: number;
+  resourceWarnAfterByType?: Record<string, number>;
+  resourceTimeoutByType?: Record<string, number>;
+  unsettledRevertWait?: {
+    timeoutMs: number;
+    pollMs: number;
+  };
+  captureObservedState?: boolean;
+  assetRedirect?: AssetRedirectMap;
+  terminationProtection?: boolean;
+  parentStackInfo?: {
+    parentStack: string;
+    parentLogicalId: string;
+    parentRegion: string;
+  };
+  inheritedSecrets?: RecordedSecretValues;
+  inheritedPhysicalNameCopies?: ReadonlySet<string> | undefined;
+  inheritedReferenceProvenance?: ReadonlyMap<string, ReferenceProvenance> | undefined;
+  passedParameterClasses?: ReadonlyMap<string, 'clean' | 'secret' | 'unknown'>;
+  passedNoEchoParameters?: ReadonlySet<string> | undefined;
+  inheritedProducerRegions?: (() => ProducerRegionEvidence) | undefined;
+  onCurrentStateLoaded?: (stackName: string, state: StackState | undefined) => Promise<void>;
+  onFirstDeployLeftNoRecord?: (stackName: string) => Promise<void>;
+  pinCcApi?: {
+    stackName: string;
+    logicalIds: ReadonlySet<string>;
+  };
+  recreateTargets?: {
+    stackName: string;
+    viaCcApi: ReadonlySet<string>;
+    viaSdkProvider: ReadonlySet<string>;
+  };
+  eventRecorder?: DeploymentEventRecorder;
+  replace?: boolean;
+  forceStatefulRecreation?: boolean;
+  strictGetAtt?: boolean;
+  cfnFallback?: boolean;
+  producerLookup?: ProducerLookup;
+  consumerAccount?: string;
+  skipFinalSnapshot?: boolean;
+  finalSnapshotClients?: PreDeleteSnapshotClients;
+  requireApproval?: RequireApprovalLevel;
+  approveDeployment?: DeploymentApprover;
+  onDestructivePlan?: ((stackName: string, destructive: readonly DestructiveChange[], stage?: 'late') => Promise<void>) | undefined;
+  crossPrefixHolder?: ((stackName: string) => Promise<ForeignHolding>) | undefined;
+}
+type RequireApprovalLevel = 'never' | 'any-change' | 'broadening' | 'destructive';
+type DeploymentApprover = ((request: DeploymentApprovalRequest) => Promise<boolean>) & {
+  readonly autoApproves?: boolean;
+};
+interface DeploymentApprovalRequest {
+  stackName: string;
+  level: Exclude<RequireApprovalLevel, 'never'>;
+  counts: {
+    create: number;
+    update: number;
+    delete: number;
+  };
+  destructiveChanges: DestructiveChange[];
+  outputsOnly?: true;
+  securityChanges?: string;
+}
+interface DeployResult {
+  stackName: string;
+  created: number;
+  updated: number;
+  deleted: number;
+  deleteSkipped: number;
+  updatePartial: number;
+  nestedUpdatePartial?: number;
+  crossPrefixKept?: number;
+  unchanged: number;
+  durationMs: number;
+  outputs?: Record<string, unknown>;
+  attributeFallbackCount: number;
+}
+export declare class DeployEngine {
+  private inlinePolicyWriters;
+  constructor(stateBackend: S3StateBackend, lockManager: LockManager, dagBuilder: DagBuilder, diffCalculator: DiffCalculator, providerRegistry: ProviderRegistry, options: DeployEngineOptions | undefined, stackRegion: string, exportIndexStore?: ExportIndexStore);
+  deploy(stackName: string, template: CloudFormationTemplate): Promise<DeployResult>;
+  private redactStateForPersist;
+  private referenceProvenanceToPersist;
+  private redactCrossStackReads;
+  private doDeploy;
+  private maskSecretsInEvent;
+  private maskingRetryLogger;
+}
+export type { AssetPublisherOptions, CdkdConfig, ChangeType, CloudFormationTemplate, DeployEngineOptions, DeployOptions, DeployResult, IndeterminateGuard, LockInfo, LogLevel, Logger, NormalizeAwsErrorContext, PropertyChange, ResolveBucketRegionOptions, ResourceChange, ResourceCreateResult, ResourceDeleteResult, ResourceProvider, ResourceState, ResourceUpdateOutcome, ResourceUpdateResult, StackInfo, StackState, StateBackendConfig, SynthesisOptions, SynthesisResult, TemplateOutput, TemplateParameter, TemplateResource };
+//# sourceMappingURL=index.d.ts.map