@go-to-k/cdkd 0.234.1 → 0.235.1

package/dist/{deploy-engine-CdAkyW9k.js → deploy-engine-iahWC4C1.js}

@@ -1,5 +1,7 @@
-import { B as generateResourceName, E as SynthesisError, F as getLiveRenderer, M as getLogger, S as ResourceUpdateNotSupportedError, T as StateError, U as withStackName, V as generateResourceNameWithFallback, a as normalizeAwsTagsToCfn, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, s as assertRegionMatch, t as disableInstanceApiTermination, x as ResourceTimeoutError, z as applyDefaultNameForFallback } from "./ec2-termination-protection-uvVnteGl.js";
-import { r as getAwsClients } from "./aws-clients-pjPwZz1r.js";
+import { a as getLiveRenderer, d as generateResourceNameWithFallback, l as applyDefaultNameForFallback, n as getLogger, p as withStackName, u as generateResourceName } from "./logger-BzO-joNR.js";
+import { E as SynthesisError, S as ResourceUpdateNotSupportedError, T as StateError, a as normalizeAwsTagsToCfn, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, s as assertRegionMatch, t as disableInstanceApiTermination, x as ResourceTimeoutError } from "./ec2-termination-protection-q-WGWgxa.js";
+import { r as getAwsClients } from "./aws-clients-B15NAPbL.js";
+import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
@@ -77,7 +79,11 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 			...opts.credentials && { credentials: opts.credentials }
 		});
 		try {
-			return (await client.send(new GetBucketLocationCommand({ Bucket: bucketName }))).LocationConstraint || "us-east-1";
+			const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
+			return (await client.send(new GetBucketLocationCommand({
+				Bucket: bucketName,
+				...await expectedOwnerParam(client)
+			}))).LocationConstraint || "us-east-1";
 		} catch {
 			return opts.fallbackRegion ?? "us-east-1";
 		} finally {
@@ -1366,6 +1372,7 @@ async function uploadCfnTemplate(args) {
 	const key = `${MIGRATE_TMP_PREFIX}/${stackName}/${Date.now()}.${ext}`;
 	try {
 		await s3.send(new PutObjectCommand({
+			...await expectedOwnerParam(s3),
 			Bucket: bucket,
 			Key: key,
 			Body: body,
@@ -1380,7 +1387,8 @@ async function uploadCfnTemplate(args) {
 		try {
 			await s3.send(new DeleteObjectCommand({
 				Bucket: bucket,
-				Key: key
+				Key: key,
+				...await expectedOwnerParam(s3)
 			}));
 		} finally {
 			s3.destroy();
@@ -1790,6 +1798,23 @@ function resolveUseCdkBootstrapAssets(cliValue) {
 	return (loadCdkJson()?.context?.["cdkd"])?.["useCdkBootstrapAssets"] === true;
 }
 /**
+* Resolve the effective "auto-create cdkd asset storage on first deploy into
+* an un-opted-in region" value (issue #1007).
+*
+* Mirrors {@link resolveCaptureObservedState}'s `--no-X` shape: Commander
+* reports `--no-auto-asset-storage` as `autoAssetStorage: false`, and the
+* implicit default is `true` — so the cdk.json fallback
+* (`context.cdkd.autoAssetStorage`, boolean) only fires when the CLI value
+* is the implicit default. Priority: CLI `false` wins > cdk.json boolean >
+* default `true`.
+*/
+function resolveAutoAssetStorage(cliValue) {
+	if (cliValue === false) return false;
+	const v = (loadCdkJson()?.context?.["cdkd"])?.["autoAssetStorage"];
+	if (typeof v === "boolean") return v;
+	return true;
+}
+/**
 * Pre-parse argv walk that surfaces the deprecation warning when the
 * user explicitly passes the legacy `--no-prefix-user-supplied-names`
 * flag. Commander's auto-negation of `--prefix-user-supplied-names`
@@ -1911,7 +1936,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-pjPwZz1r.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-B15NAPbL.js").then((n) => n.n);
 	const accountId = (await getAwsClients().sts.send(new GetCallerIdentityCommand({}))).Account;
 	const newName = getDefaultStateBucketName(accountId);
 	const legacyName = getLegacyStateBucketName(accountId, region);
@@ -1969,11 +1994,13 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 */
 async function bucketHasAnyState(client, bucketName) {
 	const { ListObjectsV2Command } = await import("@aws-sdk/client-s3");
+	const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
 	try {
 		return ((await client.send(new ListObjectsV2Command({
 			Bucket: bucketName,
 			Prefix: "cdkd/",
-			MaxKeys: 1
+			MaxKeys: 1,
+			...await expectedOwnerParam(client)
 		}))).KeyCount ?? 0) > 0;
 	} catch {
 		return true;
@@ -1994,8 +2021,12 @@ async function bucketHasAnyState(client, bucketName) {
 */
 async function bucketExists(client, bucketName) {
 	const { HeadBucketCommand } = await import("@aws-sdk/client-s3");
+	const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
 	try {
-		await client.send(new HeadBucketCommand({ Bucket: bucketName }));
+		await client.send(new HeadBucketCommand({
+			Bucket: bucketName,
+			...await expectedOwnerParam(client)
+		}));
 		return true;
 	} catch (error) {
 		const err = error;
@@ -3183,12 +3214,14 @@ var AssetModeResolver = class {
 	profile;
 	useCdkBootstrapAssets;
 	suppressLegacyNotice;
+	autoCreate;
 	constructor(stateBackend, accountId, opts = {}) {
 		this.stateBackend = stateBackend;
 		this.accountId = accountId;
 		this.profile = opts.profile;
 		this.useCdkBootstrapAssets = opts.useCdkBootstrapAssets ?? false;
 		this.suppressLegacyNotice = opts.suppressLegacyNotice ?? false;
+		this.autoCreate = opts.autoCreate;
 	}
 	/**
 	* Resolve the asset mode for a deploy region. Concurrent callers for the
@@ -3209,6 +3242,10 @@ var AssetModeResolver = class {
 		const markerKey = getBootstrapMarkerKey(region);
 		const body = await this.stateBackend.getRawObject(markerKey);
 		if (body === null) {
+			if (this.autoCreate) {
+				const created = await this.tryAutoCreate(region, markerKey);
+				if (created) return created;
+			}
 			if (!this.legacyNoticeShownRegions.has(region) && !this.suppressLegacyNotice) {
 				this.legacyNoticeShownRegions.add(region);
 				this.logger.info(`Assets for region '${region}' are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Run 'cdkd bootstrap --region ${region}' to create cdkd-owned asset storage that 'cdk gc' never touches.`);
@@ -3223,6 +3260,59 @@ var AssetModeResolver = class {
 			marker
 		};
 	}
+	/**
+	* Issue #1007 — first deploy into an un-opted-in region: confirm, then
+	* create the asset bucket + container repo + marker via the same
+	* {@link ensureAssetStorage} `cdkd bootstrap` uses (squatting defense,
+	* idempotent creation, marker-written-last all included). Returns `null`
+	* (= stay legacy) when the user declines or creation fails — the caller
+	* then shows the legacy notice, so the user still learns the exact
+	* `cdkd bootstrap --region <r>` remediation.
+	*/
+	async tryAutoCreate(region, markerKey) {
+		let confirmed;
+		try {
+			confirmed = await this.autoCreate.confirm(region);
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) return null;
+		let s3Client;
+		let ecrClient;
+		try {
+			s3Client = new S3Client({
+				region,
+				...this.profile && { profile: this.profile }
+			});
+			ecrClient = new ECRClient({
+				region,
+				...this.profile && { profile: this.profile }
+			});
+			await ensureAssetStorage({
+				s3Client,
+				ecrClient,
+				stateBackend: this.stateBackend,
+				accountId: this.accountId,
+				region,
+				force: false
+			});
+			const body = await this.stateBackend.getRawObject(markerKey);
+			if (body === null) throw new CdkdError(`bootstrap marker missing at '${markerKey}' right after creation`, "ASSET_STORAGE_MARKER_MISSING");
+			const marker = parseBootstrapMarker(body, markerKey);
+			this.logger.debug(`cdkd asset storage auto-created for region '${region}': ${marker.assetBucket} / ${marker.containerRepo}`);
+			return {
+				mode: "cdkd-assets",
+				marker
+			};
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.logger.warn(`Failed to auto-create cdkd asset storage for region '${region}': ${message} Falling back to the CDK bootstrap destinations for this run — run 'cdkd bootstrap --region ${region}' (with S3/ECR create permissions) to opt the region in.`);
+			return null;
+		} finally {
+			s3Client?.destroy();
+			ecrClient?.destroy();
+		}
+	}
 };
 
 //#endregion
@@ -4095,10 +4185,24 @@ var S3StateBackend = class {
 	* synthetic `UnknownError` (e.g. cross-region HEAD) becomes a concrete
 	* "Bucket does not exist" / "Access denied" / "different region" message.
 	*/
+	/**
+	* `ExpectedBucketOwner` spread for every state-bucket S3 call — S3 itself
+	* rejects the call (403) when the bucket is owned by another account,
+	* closing the predictable-name squatting hole (a foreign bucket that
+	* ALLOWS this account would otherwise silently receive state
+	* reads/writes). Best-effort: resolves to an empty object for
+	* non-standard clients (test doubles) — see expected-bucket-owner.ts.
+	*/
+	async ownerParam() {
+		return expectedOwnerParam(this.s3Client);
+	}
 	async verifyBucketExists() {
 		await this.ensureClientForBucket();
 		try {
-			await this.s3Client.send(new HeadBucketCommand({ Bucket: this.config.bucket }));
+			await this.s3Client.send(new HeadBucketCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam()
+			}));
 		} catch (error) {
 			const name = error.name;
 			if (name === "NotFound" || name === "NoSuchBucket") throw new StateError(`State bucket '${this.config.bucket}' does not exist. Run 'cdkd bootstrap' to create it, or specify an existing bucket via --state-bucket, CDKD_STATE_BUCKET, or cdk.json context.cdkd.stateBucket.`);
@@ -4145,6 +4249,7 @@ var S3StateBackend = class {
 			this.logger.debug(`Getting state for stack: ${stackName} (${region})`);
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: newKey
 			}));
 			if (!response.Body) throw new StateError(`State file for stack '${stackName}' (${region}) has no body`);
@@ -4207,6 +4312,7 @@ var S3StateBackend = class {
 			const bodyString = JSON.stringify(body, null, 2);
 			const response = await this.s3Client.send(new PutObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: newKey,
 				Body: bodyString,
 				ContentLength: Buffer.byteLength(bodyString),
@@ -4218,6 +4324,7 @@ var S3StateBackend = class {
 			if (migrateLegacy) try {
 				await this.s3Client.send(new DeleteObjectCommand({
 					Bucket: this.config.bucket,
+					...await this.ownerParam(),
 					Key: this.getLegacyStateKey(stackName)
 				}));
 				this.logger.info(`Migrated state for stack '${stackName}' to region-scoped layout (${region})`);
@@ -4247,11 +4354,13 @@ var S3StateBackend = class {
 			this.logger.debug(`Deleting state: ${stackName} (${region})`);
 			await this.s3Client.send(new DeleteObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: this.getStateKey(stackName, region)
 			}));
 			if (await this.legacyMatchesRegion(stackName, region)) {
 				await this.s3Client.send(new DeleteObjectCommand({
 					Bucket: this.config.bucket,
+					...await this.ownerParam(),
 					Key: this.getLegacyStateKey(stackName)
 				}));
 				this.logger.debug(`Deleted legacy state for stack: ${stackName}`);
@@ -4290,6 +4399,7 @@ var S3StateBackend = class {
 			do {
 				const response = await this.s3Client.send(new ListObjectsV2Command({
 					Bucket: this.config.bucket,
+					...await this.ownerParam(),
 					Prefix: prefix,
 					...continuationToken && { ContinuationToken: continuationToken }
 				}));
@@ -4349,6 +4459,7 @@ var S3StateBackend = class {
 		await this.ensureClientForBucket();
 		await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.config.bucket,
+			...await this.ownerParam(),
 			Key: key,
 			Body: body,
 			ContentLength: Buffer.byteLength(body),
@@ -4364,6 +4475,7 @@ var S3StateBackend = class {
 		try {
 			return await (await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key
 			}))).Body?.transformToString() ?? null;
 		} catch (error) {
@@ -4383,6 +4495,7 @@ var S3StateBackend = class {
 		do {
 			const response = await this.s3Client.send(new ListObjectsV2Command({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Prefix: keyPrefix,
 				...continuationToken && { ContinuationToken: continuationToken }
 			}));
@@ -4413,6 +4526,7 @@ var S3StateBackend = class {
 			const chunk = keys.slice(i, i + 1e3);
 			const response = await this.s3Client.send(new DeleteObjectsCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Delete: {
 					Objects: chunk.map((Key) => ({ Key })),
 					Quiet: true
@@ -4430,6 +4544,7 @@ var S3StateBackend = class {
 		try {
 			await this.s3Client.send(new HeadObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key
 			}));
 			return true;
@@ -4447,6 +4562,7 @@ var S3StateBackend = class {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: this.getLegacyStateKey(stackName)
 			}));
 			if (!response.Body) return void 0;
@@ -4470,6 +4586,7 @@ var S3StateBackend = class {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: this.getLegacyStateKey(stackName)
 			}));
 			if (!response.Body || !response.ETag) return null;
@@ -4567,6 +4684,14 @@ var LockManager = class {
 	* so when the state backend has already resolved the same bucket this
 	* incurs no additional `GetBucketLocation` call.
 	*/
+	/**
+	* `ExpectedBucketOwner` spread for every state-bucket S3 call (squatting
+	* hardening — see src/utils/expected-bucket-owner.ts). Best-effort:
+	* resolves to an empty object for non-standard clients (test doubles).
+	*/
+	async ownerParam() {
+		return expectedOwnerParam(this.s3Client);
+	}
 	async ensureClientForBucket() {
 		if (this.clientResolved) return;
 		if (this.resolveInFlight) return this.resolveInFlight;
@@ -4656,6 +4781,7 @@ var LockManager = class {
 			const lockBody = JSON.stringify(lockInfo, null, 2);
 			await this.s3Client.send(new PutObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key,
 				Body: lockBody,
 				ContentLength: Buffer.byteLength(lockBody),
@@ -4675,6 +4801,7 @@ var LockManager = class {
 						const retryBody = JSON.stringify(lockInfo, null, 2);
 						await this.s3Client.send(new PutObjectCommand({
 							Bucket: this.config.bucket,
+							...await this.ownerParam(),
 							Key: key,
 							Body: retryBody,
 							ContentLength: Buffer.byteLength(retryBody),
@@ -4710,6 +4837,7 @@ var LockManager = class {
 			this.logger.debug(`Getting lock info for stack: ${stackName}`);
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key
 			}));
 			if (!response.Body) throw new LockError(`Lock file for stack '${stackName}' has no body`);
@@ -4747,6 +4875,7 @@ var LockManager = class {
 			this.logger.debug(`Releasing lock for stack: ${stackName} (${region})`);
 			await this.s3Client.send(new DeleteObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key
 			}));
 			this.logger.debug(`Lock released for stack: ${stackName} (${region})`);
@@ -4780,6 +4909,7 @@ var LockManager = class {
 		const key = this.getLockKey(stackName, region);
 		await this.s3Client.send(new DeleteObjectCommand({
 			Bucket: this.config.bucket,
+			...await this.ownerParam(),
 			Key: key
 		}));
 	}
@@ -9451,7 +9581,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dd9Xze-T.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dbl1_mwT.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -15767,5 +15897,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { AssetManifestLoader as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, buildDockerImage as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, runDockerStreaming as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, getDockerCmd as X, formatDockerLoginError as Y, runDockerForeground as Z, green as _, AssemblyReader as _t, withRetry as a, resolveApp as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveStateBucketWithDefault as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as dt, getDockerImageBySourceHash as et, renderStatefulReason as f, CFN_TEMPLATE_BODY_LIMIT as ft, gray as g, uploadCfnTemplate as gt, cyan as h, findLargeInlineResources as ht, withResourceDeadline as i, getLegacyStateBucketName as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveStateBucketWithDefaultAndSource as lt, bold as m, MIGRATE_TMP_PREFIX as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, synthesisStatusMessage as nt, isRetryableTransientError as o, resolveCaptureObservedState as ot, formatResourceLine as p, CFN_TEMPLATE_URL_LIMIT as pt, parseBootstrapMarker as q, DeployEngine as r, getDefaultStateBucketName as rt, IMPLICIT_DELETE_DEPENDENCIES as s, resolveSkipPrefix as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, Synthesizer as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveUseCdkBootstrapAssets as ut, red as v, clearBucketRegionCache as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, resolveBucketRegion as yt, WorkGraph as z };
-//# sourceMappingURL=deploy-engine-CdAkyW9k.js.map
+export { AssetManifestLoader as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, buildDockerImage as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, runDockerStreaming as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, getDockerCmd as X, formatDockerLoginError as Y, runDockerForeground as Z, green as _, uploadCfnTemplate as _t, withRetry as a, resolveApp as at, IAMRoleProvider as b, resolveBucketRegion as bt, computeImplicitDeleteEdges as c, resolveSkipPrefix as ct, isStatefulRecreateTargetSync as d, resolveUseCdkBootstrapAssets as dt, getDockerImageBySourceHash as et, renderStatefulReason as f, warnDeprecatedNoPrefixCliFlag as ft, gray as g, findLargeInlineResources as gt, cyan as h, MIGRATE_TMP_PREFIX as ht, withResourceDeadline as i, getLegacyStateBucketName as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveStateBucketWithDefault as lt, bold as m, CFN_TEMPLATE_URL_LIMIT as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, synthesisStatusMessage as nt, isRetryableTransientError as o, resolveAutoAssetStorage as ot, formatResourceLine as p, CFN_TEMPLATE_BODY_LIMIT as pt, parseBootstrapMarker as q, DeployEngine as r, getDefaultStateBucketName as rt, IMPLICIT_DELETE_DEPENDENCIES as s, resolveCaptureObservedState as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, Synthesizer as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveStateBucketWithDefaultAndSource as ut, red as v, AssemblyReader as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, clearBucketRegionCache as yt, WorkGraph as z };
+//# sourceMappingURL=deploy-engine-iahWC4C1.js.map