@go-to-k/cdkd 0.231.0 → 0.231.2

package/dist/{deploy-engine-IqXCHYxE.js → deploy-engine-B9NOJeGf.js}

@@ -1,4 +1,4 @@
-import { E as SynthesisError, F as getLiveRenderer, M as getLogger, S as ResourceUpdateNotSupportedError, T as StateError, U as withStackName, V as generateResourceNameWithFallback, a as assertRegionMatch, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, n as matchesCdkPath, o as disableInstanceApiTermination, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, x as ResourceTimeoutError, z as applyDefaultNameForFallback } from "./import-helpers-DayvBD4T.js";
+import { B as generateResourceName, E as SynthesisError, F as getLiveRenderer, M as getLogger, S as ResourceUpdateNotSupportedError, T as StateError, U as withStackName, V as generateResourceNameWithFallback, a as normalizeAwsTagsToCfn, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, s as assertRegionMatch, t as disableInstanceApiTermination, x as ResourceTimeoutError, z as applyDefaultNameForFallback } from "./ec2-termination-protection-uvVnteGl.js";
 import { r as getAwsClients } from "./aws-clients-pjPwZz1r.js";
 import { randomUUID } from "node:crypto";
 import { DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -31,6 +31,7 @@ import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from
 import { DescribeReplicationGroupsCommand, ElastiCacheClient } from "@aws-sdk/client-elasticache";
 import { DescribeClustersCommand, RedshiftClient } from "@aws-sdk/client-redshift";
 import { DescribeDomainCommand, OpenSearchClient } from "@aws-sdk/client-opensearch";
+import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$8, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 
 //#region src/utils/aws-region-resolver.ts
@@ -6061,6 +6062,342 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/providers/wafv2-provider.ts
+/**
+* Translate the empty-string placeholder `readCurrentState` emits for an
+* absent `Description` to `undefined` before shipping it to AWS.
+*
+* `readCurrentState` always-emits `Description: ''` on a WebACL with no
+* description (the comparator's top-level walk is state-keys-only, so
+* the placeholder is required to detect a console-side description add).
+* AWS WAFv2 `CreateWebACL` / `UpdateWebACL` reject `Description: ''`
+* with `Member must have length greater than or equal to 1` (min 1 / max
+* 256). On `cdkd drift --revert` the placeholder would round-trip
+* through `update()` and surface as a hard AWS rejection, so we sanitize
+* the wire-layer payload while keeping the read-side placeholder
+* intact. This is the Class 2 pattern from
+* `docs/provider-development.md § 3b`.
+*/
+function sanitizeDescription(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "string" && value.length === 0) return void 0;
+	return value;
+}
+/**
+* Parse WAFv2 WebACL ARN to extract Id, Name, and Scope.
+*
+* ARN format:
+*   arn:aws:wafv2:{region}:{account}:regional/webacl/{name}/{id}
+*   arn:aws:wafv2:{region}:{account}:global/webacl/{name}/{id}
+*
+* A short / malformed ARN yields `undefined` for `name` / `id` (the path
+* segments simply are not there) — callers must guard. `scope` is always
+* defined (anything not `global` maps to `REGIONAL`).
+*/
+function parseWebACLArn(arn) {
+	const segments = arn.split(":").slice(5).join(":").split("/");
+	const scopeRaw = segments[0];
+	const name = segments[2];
+	return {
+		id: segments[3],
+		name,
+		scope: scopeRaw === "global" ? "CLOUDFRONT" : "REGIONAL"
+	};
+}
+/**
+* AWS WAFv2 WebACL Provider
+*
+* Implements resource provisioning for AWS::WAFv2::WebACL using the WAFv2 SDK.
+* WHY: WAFv2 CreateWebACL is synchronous - the CC API adds unnecessary polling
+* overhead for an operation that completes immediately.
+* This SDK provider eliminates that polling and returns instantly.
+*/
+var WAFv2WebACLProvider = class {
+	wafv2Client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("WAFv2WebACLProvider");
+	handledProperties = new Map([["AWS::WAFv2::WebACL", new Set([
+		"Name",
+		"Scope",
+		"Tags",
+		"DefaultAction",
+		"Description",
+		"Rules",
+		"VisibilityConfig",
+		"CustomResponseBodies",
+		"CaptchaConfig",
+		"ChallengeConfig",
+		"TokenDomains",
+		"AssociationConfig"
+	])]]);
+	getClient() {
+		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.wafv2Client;
+	}
+	/**
+	* Create a WAFv2 WebACL
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
+		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const scope = properties["Scope"] || "REGIONAL";
+		try {
+			const tags = [];
+			if (properties["Tags"]) {
+				const tagList = properties["Tags"];
+				for (const tag of tagList) tags.push({
+					Key: tag.Key,
+					Value: tag.Value
+				});
+			}
+			const summary = (await this.getClient().send(new CreateWebACLCommand({
+				Name: name,
+				Scope: scope,
+				DefaultAction: properties["DefaultAction"],
+				Description: sanitizeDescription(properties["Description"]),
+				Rules: properties["Rules"] || [],
+				VisibilityConfig: properties["VisibilityConfig"],
+				...tags.length > 0 && { Tags: tags },
+				CustomResponseBodies: properties["CustomResponseBodies"],
+				CaptchaConfig: properties["CaptchaConfig"],
+				ChallengeConfig: properties["ChallengeConfig"],
+				TokenDomains: properties["TokenDomains"],
+				AssociationConfig: properties["AssociationConfig"]
+			}))).Summary;
+			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
+			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
+			return {
+				physicalId: summary.ARN,
+				attributes: {
+					Arn: summary.ARN,
+					Id: summary.Id,
+					LabelNamespace: summary["LabelNamespace"]
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a WAFv2 WebACL
+	*
+	* Name and Scope are immutable - changes to those require replacement.
+	* UpdateWebACL requires LockToken obtained from GetWebACL.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
+		try {
+			const { id, name, scope } = parseWebACLArn(physicalId);
+			const getResponse = await this.getClient().send(new GetWebACLCommand({
+				Name: name,
+				Scope: scope,
+				Id: id
+			}));
+			const lockToken = getResponse.LockToken;
+			if (!lockToken) throw new Error("GetWebACL did not return LockToken");
+			await this.getClient().send(new UpdateWebACLCommand({
+				Name: name,
+				Scope: scope,
+				Id: id,
+				LockToken: lockToken,
+				DefaultAction: properties["DefaultAction"],
+				Description: sanitizeDescription(properties["Description"]),
+				Rules: properties["Rules"] || [],
+				VisibilityConfig: properties["VisibilityConfig"],
+				CustomResponseBodies: properties["CustomResponseBodies"],
+				CaptchaConfig: properties["CaptchaConfig"],
+				ChallengeConfig: properties["ChallengeConfig"],
+				TokenDomains: properties["TokenDomains"],
+				AssociationConfig: properties["AssociationConfig"]
+			}));
+			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
+			this.logger.debug(`Successfully updated WAFv2 WebACL ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: {
+					Arn: physicalId,
+					Id: id,
+					LabelNamespace: getResponse.WebACL?.LabelNamespace
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Delete a WAFv2 WebACL
+	*
+	* DeleteWebACL requires LockToken obtained from GetWebACL.
+	* WAFNonexistentItemException is treated as success (idempotent delete).
+	*/
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting WAFv2 WebACL ${logicalId}: ${physicalId}`);
+		try {
+			const { id, name, scope } = parseWebACLArn(physicalId);
+			const lockToken = (await this.getClient().send(new GetWebACLCommand({
+				Name: name,
+				Scope: scope,
+				Id: id
+			}))).LockToken;
+			if (!lockToken) throw new Error("GetWebACL did not return LockToken");
+			await this.getClient().send(new DeleteWebACLCommand({
+				Name: name,
+				Scope: scope,
+				Id: id,
+				LockToken: lockToken
+			}));
+			this.logger.debug(`Successfully deleted WAFv2 WebACL ${logicalId}`);
+		} catch (error) {
+			if (error instanceof WAFNonexistentItemException) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`WAFv2 WebACL ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Apply a diff between old and new CFn-shape Tags arrays via WAFv2's
+	* `TagResource` / `UntagResource` APIs (keyed by `ResourceARN`).
+	*/
+	async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+		const toMap = (tags) => {
+			const m = /* @__PURE__ */ new Map();
+			for (const t of tags ?? []) if (t.Key !== void 0 && t.Value !== void 0) m.set(t.Key, t.Value);
+			return m;
+		};
+		const oldMap = toMap(oldTagsRaw);
+		const newMap = toMap(newTagsRaw);
+		const tagsToAdd = [];
+		for (const [k, v] of newMap) if (oldMap.get(k) !== v) tagsToAdd.push({
+			Key: k,
+			Value: v
+		});
+		const tagsToRemove = [];
+		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
+		if (tagsToRemove.length > 0) {
+			await this.getClient().send(new UntagResourceCommand$8({
+				ResourceARN: arn,
+				TagKeys: tagsToRemove
+			}));
+			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
+		}
+		if (tagsToAdd.length > 0) {
+			await this.getClient().send(new TagResourceCommand$9({
+				ResourceARN: arn,
+				Tags: tagsToAdd
+			}));
+			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on WAFv2 WebACL ${arn}`);
+		}
+	}
+	/**
+	* Read the AWS-current WAFv2 WebACL configuration in CFn-property shape.
+	*
+	* The cdkd physicalId is the WebACL ARN; we parse it back to
+	* `(id, name, scope)` and call `GetWebACL`. The response holds Name,
+	* Description, DefaultAction, Rules, VisibilityConfig,
+	* CustomResponseBodies, CaptchaConfig, ChallengeConfig, TokenDomains,
+	* and AssociationConfig — every key cdkd state declares as
+	* `handledProperties`. `Scope` is recovered from the ARN parse.
+	*
+	* Tags are surfaced via a follow-up `ListTagsForResource(ResourceARN)`
+	* call. CDK's `aws:*` auto-tags are filtered out and the result key is
+	* omitted when AWS reports no user tags. Returns `undefined`
+	* when the ARN can't be parsed or the WebACL is gone
+	* (`WAFNonexistentItemException`).
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const { id, name, scope } = parseWebACLArn(physicalId);
+		if (!id || !name) return void 0;
+		let webACL;
+		try {
+			webACL = (await this.getClient().send(new GetWebACLCommand({
+				Id: id,
+				Name: name,
+				Scope: scope
+			}))).WebACL;
+		} catch (err) {
+			if (err instanceof WAFNonexistentItemException) return void 0;
+			throw err;
+		}
+		if (!webACL) return void 0;
+		const result = {};
+		if (webACL.Name !== void 0) result["Name"] = webACL.Name;
+		result["Scope"] = scope;
+		result["Description"] = webACL.Description ?? "";
+		if (webACL.DefaultAction) result["DefaultAction"] = webACL.DefaultAction;
+		result["Rules"] = (webACL.Rules ?? []).map((r) => r);
+		if (webACL.VisibilityConfig) result["VisibilityConfig"] = webACL.VisibilityConfig;
+		result["CustomResponseBodies"] = webACL.CustomResponseBodies ?? {};
+		if (webACL.CaptchaConfig) result["CaptchaConfig"] = webACL.CaptchaConfig;
+		if (webACL.ChallengeConfig) result["ChallengeConfig"] = webACL.ChallengeConfig;
+		result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
+		if (webACL.AssociationConfig) result["AssociationConfig"] = webACL.AssociationConfig;
+		try {
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceARN: physicalId }))).TagInfoForResource?.TagList);
+		} catch (err) {
+			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return result;
+	}
+	/**
+	* Adopt an existing WAFv2 WebACL into cdkd state.
+	*
+	* Lookup order:
+	*  1. `--resource <id>=<arn>` override → verify with `GetWebACL` (parses
+	*     Name/Id/Scope back out of the ARN).
+	*  2. Walk `ListWebACLs(Scope)` → match `aws:cdk:path` via
+	*     `ListTagsForResource(ResourceARN)` (returns
+	*     `TagInfoForResource.TagList`, standard `Key`/`Value` shape).
+	*
+	* `Scope` is required by `ListWebACLs` — read from
+	* `Properties.Scope` (`REGIONAL` is the default).
+	*/
+	async import(input) {
+		if (input.knownPhysicalId) try {
+			const { id, name, scope } = parseWebACLArn(input.knownPhysicalId);
+			await this.getClient().send(new GetWebACLCommand({
+				Id: id,
+				Name: name,
+				Scope: scope
+			}));
+			return {
+				physicalId: input.knownPhysicalId,
+				attributes: {}
+			};
+		} catch (err) {
+			if (err instanceof WAFNonexistentItemException) return null;
+			throw err;
+		}
+		if (!input.cdkPath) return null;
+		const scope = input.properties["Scope"] || "REGIONAL";
+		let nextMarker;
+		do {
+			const list = await this.getClient().send(new ListWebACLsCommand({
+				Scope: scope,
+				...nextMarker && { NextMarker: nextMarker }
+			}));
+			for (const item of list.WebACLs ?? []) {
+				if (!item.ARN) continue;
+				const tagList = (await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceARN: item.ARN }))).TagInfoForResource?.TagList;
+				if (matchesCdkPath(tagList, input.cdkPath)) return {
+					physicalId: item.ARN,
+					attributes: {}
+				};
+			}
+			nextMarker = list.NextMarker;
+		} while (nextMarker);
+		return null;
+	}
+};
+
 //#endregion
 //#region src/deployment/intrinsic-function-resolver.ts
 /**
@@ -6127,8 +6464,15 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 *      CFn-generated synthetic id like `mysta-metho-01234b567890example`, not
 *      reconstructible from the `<apiId>|<resourceId>|<verb>` physical id).
 *      Also EXCLUDE types whose AWS-docs page documents NO `Ref` return value
-*      at all (ApiGateway::DocumentationVersion) — with no contract to honor,
-*      the raw physical id is the least-surprising value.
+*      at all (ApiGateway::DocumentationVersion, Lambda::Permission) — with no
+*      contract to honor, the raw physical id is the least-surprising value.
+*      The 2026-07-03 cross-family audit of every SDK-registered compound-id
+*      type also excluded EC2::Route ("the ID of the route") /
+*      EC2::VPCGatewayAttachment ("the ID of the VPC gateway attachment") /
+*      Lambda::EventInvokeConfig ("a unique identifier") — all synthetic CFn
+*      ids with no bare-segment contract and no consuming API — and
+*      confirmed WAFv2::WebACL's `Ref` IS the pipe-joined compound (see the
+*      special case in {@link cfnRefValueFromPhysicalId}).
 *   4. Types whose primaryIdentifier puts the `Ref` component FIRST
 *      (`[<refId>, <parentId>]` — e.g. ApiGateway::Deployment /
 *      ::DocumentationPart) belong in
@@ -6158,7 +6502,9 @@ const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
 	"AWS::AppConfig::Environment",
 	"AWS::AppConfig::ConfigurationProfile",
 	"AWS::AppConfig::HostedConfigurationVersion",
-	"AWS::AppConfig::Deployment"
+	"AWS::AppConfig::Deployment",
+	"AWS::S3Tables::Namespace",
+	"AWS::S3Tables::Table"
 ]);
 /**
 * Sibling of {@link REF_RETURNS_SEGMENT_AFTER_PIPE} for compound-id types
@@ -6191,7 +6537,8 @@ const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = new Set([
 	"AWS::ApiGateway::Deployment",
 	"AWS::ApiGateway::DocumentationPart",
 	"AWS::ApiGatewayV2::Authorizer",
-	"AWS::ApiGatewayV2::ApiMapping"
+	"AWS::ApiGatewayV2::ApiMapping",
+	"AWS::ECS::Service"
 ]);
 /**
 * SDK-provisioned types whose provider stores the resource ARN as the physical
@@ -6214,6 +6561,11 @@ const REF_RETURNS_NAME_FROM_ARN = new Map([["AWS::Events::Rule", ":rule/"], ["AW
 * extraction and name-from-ARN extraction included).
 */
 function cfnRefValueFromPhysicalId(resourceType, physicalId) {
+	if (resourceType === "AWS::WAFv2::WebACL" && physicalId.startsWith("arn:")) {
+		const { id, name, scope } = parseWebACLArn(physicalId);
+		if (name && id) return `${name}|${id}|${scope}`;
+		return physicalId;
+	}
 	const nameMarker = REF_RETURNS_NAME_FROM_ARN.get(resourceType);
 	if (nameMarker && physicalId.startsWith("arn:")) {
 		const markerIdx = physicalId.indexOf(nameMarker);
@@ -8269,7 +8621,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dgj3loIG.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dd9Xze-T.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -14507,5 +14859,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { resolveStateBucketWithDefaultAndSource as $, TemplateParser as A, getDockerCmd as B, findActionableSilentDrops as C, applyRoleArnIfSet as D, cfnRefValueFromPhysicalId as E, AssetPublisher as F, Synthesizer as G, runDockerStreaming as H, stringifyValue as I, getLegacyStateBucketName as J, synthesisStatusMessage as K, WorkGraph as L, S3StateBackend as M, rebuildClientForBucketRegion as N, DiffCalculator as O, shouldRetainResource as P, resolveStateBucketWithDefault as Q, buildDockerImage as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, AssetManifestLoader as U, runDockerForeground as V, getDockerImageBySourceHash as W, resolveCaptureObservedState as X, resolveApp as Y, resolveSkipPrefix as Z, green as _, withRetry as a, uploadCfnTemplate as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveBucketRegion as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, findLargeInlineResources as it, LockManager as j, DagBuilder as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_URL_LIMIT as nt, isRetryableTransientError as o, AssemblyReader as ot, formatResourceLine as p, getDefaultStateBucketName as q, DeployEngine as r, MIGRATE_TMP_PREFIX as rt, IMPLICIT_DELETE_DEPENDENCIES as s, clearBucketRegionCache as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_BODY_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, formatDockerLoginError as z };
-//# sourceMappingURL=deploy-engine-IqXCHYxE.js.map
+export { resolveStateBucketWithDefault as $, DagBuilder as A, formatDockerLoginError as B, findActionableSilentDrops as C, WAFv2WebACLProvider as D, cfnRefValueFromPhysicalId as E, shouldRetainResource as F, getDockerImageBySourceHash as G, runDockerForeground as H, AssetPublisher as I, getDefaultStateBucketName as J, Synthesizer as K, stringifyValue as L, LockManager as M, S3StateBackend as N, applyRoleArnIfSet as O, rebuildClientForBucketRegion as P, resolveSkipPrefix as Q, WorkGraph as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, runDockerStreaming as U, getDockerCmd as V, AssetManifestLoader as W, resolveApp as X, getLegacyStateBucketName as Y, resolveCaptureObservedState as Z, green as _, withRetry as a, findLargeInlineResources as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, clearBucketRegionCache as ct, isStatefulRecreateTargetSync as d, resolveStateBucketWithDefaultAndSource as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, MIGRATE_TMP_PREFIX as it, TemplateParser as j, DiffCalculator as k, extractDeploymentEventError as l, resolveBucketRegion as lt, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_BODY_LIMIT as nt, isRetryableTransientError as o, uploadCfnTemplate as ot, formatResourceLine as p, synthesisStatusMessage as q, DeployEngine as r, CFN_TEMPLATE_URL_LIMIT as rt, IMPLICIT_DELETE_DEPENDENCIES as s, AssemblyReader as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, warnDeprecatedNoPrefixCliFlag as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, buildDockerImage as z };
+//# sourceMappingURL=deploy-engine-B9NOJeGf.js.map