@go-to-k/cdkd 0.256.0 → 0.257.0

package/dist/{deploy-engine-vUgwldVH.js → deploy-engine-DOPBIRKR.js}

@@ -8216,146 +8216,470 @@ function normalizeAwsTagsToCfn(tags) {
 }
 
 //#endregion
-//#region src/provisioning/providers/wafv2-provider.ts
+//#region src/deployment/retryable-errors.ts
 /**
-* Translate the empty-string placeholder `readCurrentState` emits for an
-* absent `Description` to `undefined` before shipping it to AWS.
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*/
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
+	"cannot be assumed",
+	"Firehose is unable to assume role",
+	"is unable to assume provided role",
+	"role defined for the function",
+	"not authorized to perform",
+	"execution role",
+	"trust policy",
+	"Role validation failed",
+	"does not have required permissions",
+	"Trusted Entity",
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"Invalid principal in policy",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
+	"required permissions for: ENHANCED_MONITORING",
+	"Caught ServiceAccessDeniedException",
+	"permissions required to assume the role",
+	"authorized to assume the provided role",
+	"conflicting conditional operation",
+	"scheduled for deletion",
+	"Cannot access stream",
+	"Please ensure the role can perform",
+	"KMS key is invalid for CreateGrant",
+	"Policy contains a statement with one or more invalid principals",
+	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
+	"Could not deliver test message",
+	"wait 60 seconds",
+	"concurrent update operation",
+	"because it is in use",
+	"Rate exceeded"
+];
+/**
+* HTTP status codes that always indicate a transient failure worth retrying.
+* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
+*/
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
+/**
+* AWS SDK v3 canonical throttling error names. Mirrors
+* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
+* error (or wrapped cause) whose `name` is one of these is a transient rate-
+* limit rejection worth retrying with backoff. Detecting by NAME is more
+* robust than by HTTP status because most AWS throttles surface as HTTP 400
+* (not 429) with the throttling signal carried only in the error code / name
+* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
+*/
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
+/**
+* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
+* signal — either an AWS SDK v3 throttling error `name`
+* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
+* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
 *
-* `readCurrentState` always-emits `Description: ''` on a WebACL with no
-* description (the comparator's top-level walk is state-keys-only, so
-* the placeholder is required to detect a console-side description add).
-* AWS WAFv2 `CreateWebACL` / `UpdateWebACL` reject `Description: ''`
-* with `Member must have length greater than or equal to 1` (min 1 / max
-* 256). On `cdkd drift --revert` the placeholder would round-trip
-* through `update()` and surface as a hard AWS rejection, so we sanitize
-* the wire-layer payload while keeping the read-side placeholder
-* intact. This is the Class 2 pattern from
-* `docs/provider-development.md § 3b`.
+* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
+* typically one cause-link deep; the bounded walk also tolerates SDK errors
+* that nest a `$response`/cause without exploding on a cyclic chain.
+*
+* BOTH signals are checked at EVERY depth. An earlier version checked the name
+* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
+* links deep was missed. This is the single shared cause-walk: the read-only
+* import tag walk (`src/provisioning/import-tag-walk.ts`) composes its own
+* classifier on top of this function rather than re-implementing the traversal,
+* so the two cannot drift apart again.
 */
-function sanitizeDescription(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (typeof value === "string" && value.length === 0) return void 0;
-	return value;
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
 }
 /**
-* Parse WAFv2 WebACL ARN to extract Id, Name, and Scope.
-*
-* ARN format:
-*   arn:aws:wafv2:{region}:{account}:regional/webacl/{name}/{id}
-*   arn:aws:wafv2:{region}:{account}:global/webacl/{name}/{id}
+* Determine whether an AWS error should be retried.
 *
-* A short / malformed ARN yields `undefined` for `name` / `id` (the path
-* segments simply are not there) — callers must guard. `scope` is always
-* defined (anything not `global` maps to `REGIONAL`).
+* Checks (in order):
+*   1. Rate-limit signal on the error or any wrapped cause — throttling error
+*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
+*      429, so the name check carries most of the weight). See
+*      {@link isThrottlingError}.
+*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
 */
-function parseWebACLArn(arn) {
-	const segments = arn.split(":").slice(5).join(":").split("/");
-	const scopeRaw = segments[0];
-	const name = segments[2];
-	return {
-		id: segments[3],
-		name,
-		scope: scopeRaw === "global" ? "CLOUDFRONT" : "REGIONAL"
-	};
+function isRetryableTransientError(error, message) {
+	if (isThrottlingError(error)) return true;
+	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
+
+//#endregion
+//#region src/deployment/retry.ts
 /**
-* AWS WAFv2 WebACL Provider
+* Retry helper for resource provisioning operations that hit transient
+* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
+* dependency violations, etc.).
 *
-* Implements resource provisioning for AWS::WAFv2::WebACL using the WAFv2 SDK.
-* WHY: WAFv2 CreateWebACL is synchronous - the CC API adds unnecessary polling
-* overhead for an operation that completes immediately.
-* This SDK provider eliminates that polling and returns instantly.
+* Extracted from DeployEngine so the backoff schedule can be unit-tested
+* in isolation. The retryable-error classifier itself lives in
+* `./retryable-errors.ts`.
 */
-var WAFv2WebACLProvider = class {
-	wafv2Client;
-	providerRegion = process.env["AWS_REGION"];
-	logger = getLogger().child("WAFv2WebACLProvider");
-	handledProperties = /* @__PURE__ */ new Map([["AWS::WAFv2::WebACL", /* @__PURE__ */ new Set([
-		"Name",
-		"Scope",
-		"Tags",
-		"DefaultAction",
-		"Description",
-		"Rules",
-		"VisibilityConfig",
-		"CustomResponseBodies",
-		"CaptchaConfig",
-		"ChallengeConfig",
-		"TokenDomains",
-		"AssociationConfig"
-	])]]);
-	getClient() {
-		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client(this.providerRegion ? { region: this.providerRegion } : {});
-		return this.wafv2Client;
-	}
-	/**
-	* Create a WAFv2 WebACL
-	*/
-	async create(logicalId, resourceType, properties) {
-		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
-		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
-		const scope = properties["Scope"] || "REGIONAL";
-		try {
-			const tags = [];
-			if (properties["Tags"]) {
-				const tagList = properties["Tags"];
-				for (const tag of tagList) tags.push({
-					Key: tag.Key,
-					Value: tag.Value
-				});
-			}
-			const summary = (await this.getClient().send(new CreateWebACLCommand({
-				Name: name,
-				Scope: scope,
-				DefaultAction: properties["DefaultAction"],
-				Description: sanitizeDescription(properties["Description"]),
-				Rules: properties["Rules"] || [],
-				VisibilityConfig: properties["VisibilityConfig"],
-				...tags.length > 0 && { Tags: tags },
-				CustomResponseBodies: properties["CustomResponseBodies"],
-				CaptchaConfig: properties["CaptchaConfig"],
-				ChallengeConfig: properties["ChallengeConfig"],
-				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
-			}))).Summary;
-			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
-			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
-			return {
-				physicalId: summary.ARN,
-				attributes: {
-					Arn: summary.ARN,
-					Id: summary.Id,
-					LabelNamespace: summary["LabelNamespace"]
-				}
-			};
-		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+* Run `operation`, retrying transient failures with exponential backoff
+* capped at `maxDelayMs`.
+*
+* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
+*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
+*
+* Non-retryable errors are rethrown immediately. The transient-error
+* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
+*/
+async function withRetry(operation, logicalId, opts = {}) {
+	const maxRetries = opts.maxRetries ?? 8;
+	const initialDelayMs = opts.initialDelayMs ?? 1e3;
+	const maxDelayMs = opts.maxDelayMs ?? 8e3;
+	const sleep = opts.sleep ?? defaultSleep;
+	let lastError;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await operation();
+	} catch (error) {
+		lastError = error;
+		const message = error instanceof Error ? error.message : String(error);
+		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
+		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
+		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
+		for (let waited = 0; waited < delay; waited += 1e3) {
+			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
+			await sleep(Math.min(1e3, delay - waited));
 		}
 	}
-	/**
-	* Update a WAFv2 WebACL
-	*
-	* Name and Scope are immutable - changes to those require replacement.
-	* UpdateWebACL requires LockToken obtained from GetWebACL.
+	throw lastError;
+}
+
+//#endregion
+//#region src/provisioning/import-tag-walk.ts
+/**
+* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
+*
+* Providers that adopt a resource without an explicit name property fall back
+* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
+* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
+* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
+* summaries usually do not carry tags. That is an inherent **N+1** read
+* pattern: an account with many resources of the type produces one API call
+* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
+*
+* Every provider previously hand-rolled this loop with NO backoff, so a single
+* throttled `Describe*` aborted the whole `cdkd import` run. This helper
+* centralises the loop and wraps BOTH the list page fetch and the per-candidate
+* describe in the deploy engine's `withRetry` with exponential backoff.
+*
+* ## Why a narrower classifier than `isRetryableTransientError`
+*
+* The deploy engine's classifier is tuned for the WRITE path: it also treats
+* eventual-consistency phrasings like `does not exist` / `not authorized to
+* perform` as transient, because a just-created dependency legitimately needs a
+* moment to propagate. On a read-only import walk those messages mean the
+* opposite — the candidate really is gone, or the caller's credentials really
+* lack the permission — and retrying them burns the full backoff budget per
+* candidate before surfacing the true error.
+*
+* So the walk retries throttling ONLY, reusing the deploy engine's throttle
+* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
+* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
+*
+* ## Batching
+*
+* Batched tag reads are deliberately NOT modelled here: the services this
+* helper currently serves (EMR `DescribeCluster`, DocDB
+* `ListTagsForResource`) expose only single-resource reads. A service that
+* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
+* satisfy several candidates from one call inside its own `describe` callback,
+* or bypass the helper entirely.
+*/
+/** Max number of retries after the first attempt, per API call in the walk. */
+const DEFAULT_MAX_RETRIES = 5;
+/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
+const DEFAULT_INITIAL_DELAY_MS = 500;
+/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
+const DEFAULT_MAX_DELAY_MS = 5e3;
+/**
+* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
+* one call. Backoff is per-call, so without this a sustained throttle against a
+* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
+* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
+* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
+* DocDB account completes in seconds when AWS is not throttling) and bounds the
+* pathological case to something a user will wait through.
+*/
+const DEFAULT_MAX_WALK_MS = 10 * 6e4;
+/**
+* Ceiling on pages fetched. A service that returns a non-advancing pagination
+* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
+* forever. This is now the shared path every migrated provider runs on, so the
+* guard belongs here rather than in each caller.
+*/
+const DEFAULT_MAX_PAGES = 1e3;
+/**
+* Whether an error hit during the read-only tag walk is a rate-limit rejection
+* worth backing off on.
+*
+* Delegates the error + `.cause` chain traversal to the deploy engine's
+* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
+* at every cause depth) and adds the canonical `Rate exceeded` message, which
+* several services return with an HTTP 400 and a service-specific error name.
+*
+* This is deliberately NARROWER than `isRetryableTransientError`: that
+* classifier also treats write-path eventual-consistency phrasings (`does not
+* exist`, `not authorized to perform`) as transient, because a just-created
+* dependency legitimately needs a moment to propagate. On a read-only walk
+* those mean the candidate really is gone or the credentials really lack the
+* permission, and retrying them burns the full backoff budget per candidate
+* before surfacing the true error.
+*
+* Exported for direct unit testing and for providers whose tag walk cannot use
+* {@link importTagWalk} verbatim.
+*/
+function isThrottlingLikeError(error, message) {
+	return isThrottlingError(error) || message.includes("Rate exceeded");
+}
+/**
+* Module-level test hooks for the walk's backoff.
+*
+* Providers do not expose a retry option on `import()`, so their wiring tests
+* cannot inject `retry.sleep` per call — without this hook every throttle-path
+* wiring test pays a real 0.5s+ backoff wait. Tests set `sleep` to a resolved
+* no-op in `beforeEach` (and clear it in `afterEach`); a per-call
+* `retry.sleep` still wins when supplied. Never set this in production code.
+*/
+const importTagWalkTestHooks = {};
+/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
+var ImportTagWalkLimitError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ImportTagWalkLimitError";
+	}
+};
+/**
+* Paginate `listPage`, `describe` each candidate, and return the first one
+* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
+* candidate matches (or when `cdkPath` is empty).
+*
+* Both callbacks are individually retried with exponential backoff on
+* throttling errors, so one rate-limited call mid-walk no longer aborts the
+* whole import.
+*/
+async function importTagWalk(options) {
+	const { cdkPath, listPage, describe, tagsOf } = options;
+	if (!cdkPath) return null;
+	const logicalId = options.logicalId ?? "import";
+	const logger = options.retry?.logger ?? getLogger();
+	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
+	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
+	const sleep = options.retry?.sleep ?? importTagWalkTestHooks.sleep;
+	const retryOpts = {
+		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
+		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
+		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
+		isRetryable: (message, error) => isThrottlingLikeError(error, message),
+		logger,
+		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
+		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
+		...sleep && { sleep }
+	};
+	const startedAt = Date.now();
+	const assertWithinBudget = (stage) => {
+		const elapsed = Date.now() - startedAt;
+		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+	};
+	let marker;
+	let pages = 0;
+	do {
+		assertWithinBudget("listing candidates");
+		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+		const currentMarker = marker;
+		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
+		for (const summary of page.items ?? []) {
+			assertWithinBudget("reading candidate tags");
+			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
+			if (detail === void 0) {
+				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
+				continue;
+			}
+			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
+				summary,
+				detail
+			};
+		}
+		marker = page.nextMarker;
+	} while (marker);
+	return null;
+}
+
+//#endregion
+//#region src/provisioning/providers/wafv2-provider.ts
+/**
+* Translate the empty-string placeholder `readCurrentState` emits for an
+* absent `Description` to `undefined` before shipping it to AWS.
+*
+* `readCurrentState` always-emits `Description: ''` on a WebACL with no
+* description (the comparator's top-level walk is state-keys-only, so
+* the placeholder is required to detect a console-side description add).
+* AWS WAFv2 `CreateWebACL` / `UpdateWebACL` reject `Description: ''`
+* with `Member must have length greater than or equal to 1` (min 1 / max
+* 256). On `cdkd drift --revert` the placeholder would round-trip
+* through `update()` and surface as a hard AWS rejection, so we sanitize
+* the wire-layer payload while keeping the read-side placeholder
+* intact. This is the Class 2 pattern from
+* `docs/provider-development.md § 3b`.
+*/
+function sanitizeDescription(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "string" && value.length === 0) return void 0;
+	return value;
+}
+/**
+* Parse WAFv2 WebACL ARN to extract Id, Name, and Scope.
+*
+* ARN format:
+*   arn:aws:wafv2:{region}:{account}:regional/webacl/{name}/{id}
+*   arn:aws:wafv2:{region}:{account}:global/webacl/{name}/{id}
+*
+* A short / malformed ARN yields `undefined` for `name` / `id` (the path
+* segments simply are not there) — callers must guard. `scope` is always
+* defined (anything not `global` maps to `REGIONAL`).
+*/
+function parseWebACLArn(arn) {
+	const segments = arn.split(":").slice(5).join(":").split("/");
+	const scopeRaw = segments[0];
+	const name = segments[2];
+	return {
+		id: segments[3],
+		name,
+		scope: scopeRaw === "global" ? "CLOUDFRONT" : "REGIONAL"
+	};
+}
+/**
+* AWS WAFv2 WebACL Provider
+*
+* Implements resource provisioning for AWS::WAFv2::WebACL using the WAFv2 SDK.
+* WHY: WAFv2 CreateWebACL is synchronous - the CC API adds unnecessary polling
+* overhead for an operation that completes immediately.
+* This SDK provider eliminates that polling and returns instantly.
+*/
+var WAFv2WebACLProvider = class {
+	wafv2Client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("WAFv2WebACLProvider");
+	handledProperties = /* @__PURE__ */ new Map([["AWS::WAFv2::WebACL", /* @__PURE__ */ new Set([
+		"Name",
+		"Scope",
+		"Tags",
+		"DefaultAction",
+		"Description",
+		"Rules",
+		"VisibilityConfig",
+		"CustomResponseBodies",
+		"CaptchaConfig",
+		"ChallengeConfig",
+		"TokenDomains",
+		"AssociationConfig"
+	])]]);
+	getClient() {
+		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.wafv2Client;
+	}
+	/**
+	* Create a WAFv2 WebACL
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
+		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const scope = properties["Scope"] || "REGIONAL";
 		try {
-			const { id, name, scope } = parseWebACLArn(physicalId);
-			const getResponse = await this.getClient().send(new GetWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id
-			}));
-			const lockToken = getResponse.LockToken;
-			if (!lockToken) throw new Error("GetWebACL did not return LockToken");
-			await this.getClient().send(new UpdateWebACLCommand({
+			const tags = [];
+			if (properties["Tags"]) {
+				const tagList = properties["Tags"];
+				for (const tag of tagList) tags.push({
+					Key: tag.Key,
+					Value: tag.Value
+				});
+			}
+			const summary = (await this.getClient().send(new CreateWebACLCommand({
 				Name: name,
 				Scope: scope,
-				Id: id,
-				LockToken: lockToken,
+				DefaultAction: properties["DefaultAction"],
+				Description: sanitizeDescription(properties["Description"]),
+				Rules: properties["Rules"] || [],
+				VisibilityConfig: properties["VisibilityConfig"],
+				...tags.length > 0 && { Tags: tags },
+				CustomResponseBodies: properties["CustomResponseBodies"],
+				CaptchaConfig: properties["CaptchaConfig"],
+				ChallengeConfig: properties["ChallengeConfig"],
+				TokenDomains: properties["TokenDomains"],
+				AssociationConfig: properties["AssociationConfig"]
+			}))).Summary;
+			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
+			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
+			return {
+				physicalId: summary.ARN,
+				attributes: {
+					Arn: summary.ARN,
+					Id: summary.Id,
+					LabelNamespace: summary["LabelNamespace"]
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a WAFv2 WebACL
+	*
+	* Name and Scope are immutable - changes to those require replacement.
+	* UpdateWebACL requires LockToken obtained from GetWebACL.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
+		try {
+			const { id, name, scope } = parseWebACLArn(physicalId);
+			const getResponse = await this.getClient().send(new GetWebACLCommand({
+				Name: name,
+				Scope: scope,
+				Id: id
+			}));
+			const lockToken = getResponse.LockToken;
+			if (!lockToken) throw new Error("GetWebACL did not return LockToken");
+			await this.getClient().send(new UpdateWebACLCommand({
+				Name: name,
+				Scope: scope,
+				Id: id,
+				LockToken: lockToken,
 				DefaultAction: properties["DefaultAction"],
 				Description: sanitizeDescription(properties["Description"]),
 				Rules: properties["Rules"] || [],
@@ -8529,25 +8853,31 @@ var WAFv2WebACLProvider = class {
 			if (err instanceof WAFNonexistentItemException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
 		const scope = input.properties["Scope"] || "REGIONAL";
-		let nextMarker;
-		do {
-			const list = await this.getClient().send(new ListWebACLsCommand({
-				Scope: scope,
-				...nextMarker && { NextMarker: nextMarker }
-			}));
-			for (const item of list.WebACLs ?? []) {
-				if (!item.ARN) continue;
-				const tagList = (await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: item.ARN }))).TagInfoForResource?.TagList;
-				if (matchesCdkPath(tagList, input.cdkPath)) return {
-					physicalId: item.ARN,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListWebACLsCommand({
+					Scope: scope,
+					...marker && { NextMarker: marker }
+				}));
+				return {
+					items: list.WebACLs,
+					nextMarker: list.NextMarker
 				};
-			}
-			nextMarker = list.NextMarker;
-		} while (nextMarker);
-		return null;
+			},
+			describe: async (item) => {
+				if (!item.ARN) return void 0;
+				return await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: item.ARN }));
+			},
+			tagsOf: (tagsResp) => tagsResp.TagInfoForResource?.TagList
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.ARN,
+			attributes: {}
+		};
 	}
 };
 
@@ -10954,7 +11284,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DbIC4hWG.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-6IZKZOKp.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -14753,319 +15083,6 @@ function isCustomResource(resourceType) {
 	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
 }
 
-//#endregion
-//#region src/deployment/retryable-errors.ts
-/**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
-	"cannot be assumed",
-	"Firehose is unable to assume role",
-	"is unable to assume provided role",
-	"role defined for the function",
-	"not authorized to perform",
-	"execution role",
-	"trust policy",
-	"Role validation failed",
-	"does not have required permissions",
-	"Trusted Entity",
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
-	"Invalid principal in policy",
-	"Policy Error: PrincipalNotFound",
-	"Invalid value for the parameter Policy",
-	"required permissions for: ENHANCED_MONITORING",
-	"Caught ServiceAccessDeniedException",
-	"permissions required to assume the role",
-	"authorized to assume the provided role",
-	"conflicting conditional operation",
-	"scheduled for deletion",
-	"Cannot access stream",
-	"Please ensure the role can perform",
-	"KMS key is invalid for CreateGrant",
-	"Policy contains a statement with one or more invalid principals",
-	"Invalid IAM Instance Profile",
-	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
-	"Could not deliver test message",
-	"wait 60 seconds",
-	"concurrent update operation",
-	"because it is in use",
-	"Rate exceeded"
-];
-/**
-* HTTP status codes that always indicate a transient failure worth retrying.
-* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
-*/
-const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
-/**
-* AWS SDK v3 canonical throttling error names. Mirrors
-* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
-* error (or wrapped cause) whose `name` is one of these is a transient rate-
-* limit rejection worth retrying with backoff. Detecting by NAME is more
-* robust than by HTTP status because most AWS throttles surface as HTTP 400
-* (not 429) with the throttling signal carried only in the error code / name
-* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
-*/
-const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
-	"BandwidthLimitExceeded",
-	"EC2ThrottledException",
-	"LimitExceededException",
-	"PriorRequestNotComplete",
-	"ProvisionedThroughputExceededException",
-	"RequestLimitExceeded",
-	"RequestThrottled",
-	"RequestThrottledException",
-	"SlowDown",
-	"ThrottledException",
-	"Throttling",
-	"ThrottlingException",
-	"TooManyRequestsException",
-	"TransactionInProgressException"
-]);
-/**
-* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
-* signal — either an AWS SDK v3 throttling error `name`
-* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
-* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
-*
-* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
-* typically one cause-link deep; the bounded walk also tolerates SDK errors
-* that nest a `$response`/cause without exploding on a cyclic chain.
-*
-* BOTH signals are checked at EVERY depth. An earlier version checked the name
-* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
-* links deep was missed. This is the single shared cause-walk: the read-only
-* import tag walk (`src/provisioning/import-tag-walk.ts`) composes its own
-* classifier on top of this function rather than re-implementing the traversal,
-* so the two cannot drift apart again.
-*/
-function isThrottlingError(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		const name = current.name;
-		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
-		const status = current.$metadata?.httpStatusCode;
-		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
-		current = current.cause;
-	}
-	return false;
-}
-/**
-* Determine whether an AWS error should be retried.
-*
-* Checks (in order):
-*   1. Rate-limit signal on the error or any wrapped cause — throttling error
-*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
-*      429, so the name check carries most of the weight). See
-*      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
-*/
-function isRetryableTransientError(error, message) {
-	if (isThrottlingError(error)) return true;
-	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-
-//#endregion
-//#region src/deployment/retry.ts
-/**
-* Retry helper for resource provisioning operations that hit transient
-* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
-* dependency violations, etc.).
-*
-* Extracted from DeployEngine so the backoff schedule can be unit-tested
-* in isolation. The retryable-error classifier itself lives in
-* `./retryable-errors.ts`.
-*/
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/**
-* Run `operation`, retrying transient failures with exponential backoff
-* capped at `maxDelayMs`.
-*
-* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
-*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
-*
-* Non-retryable errors are rethrown immediately. The transient-error
-* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
-*/
-async function withRetry(operation, logicalId, opts = {}) {
-	const maxRetries = opts.maxRetries ?? 8;
-	const initialDelayMs = opts.initialDelayMs ?? 1e3;
-	const maxDelayMs = opts.maxDelayMs ?? 8e3;
-	const sleep = opts.sleep ?? defaultSleep;
-	let lastError;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		return await operation();
-	} catch (error) {
-		lastError = error;
-		const message = error instanceof Error ? error.message : String(error);
-		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
-		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
-		for (let waited = 0; waited < delay; waited += 1e3) {
-			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
-			await sleep(Math.min(1e3, delay - waited));
-		}
-	}
-	throw lastError;
-}
-
-//#endregion
-//#region src/provisioning/import-tag-walk.ts
-/**
-* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
-*
-* Providers that adopt a resource without an explicit name property fall back
-* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
-* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
-* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
-* summaries usually do not carry tags. That is an inherent **N+1** read
-* pattern: an account with many resources of the type produces one API call
-* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
-*
-* Every provider previously hand-rolled this loop with NO backoff, so a single
-* throttled `Describe*` aborted the whole `cdkd import` run. This helper
-* centralises the loop and wraps BOTH the list page fetch and the per-candidate
-* describe in the deploy engine's `withRetry` with exponential backoff.
-*
-* ## Why a narrower classifier than `isRetryableTransientError`
-*
-* The deploy engine's classifier is tuned for the WRITE path: it also treats
-* eventual-consistency phrasings like `does not exist` / `not authorized to
-* perform` as transient, because a just-created dependency legitimately needs a
-* moment to propagate. On a read-only import walk those messages mean the
-* opposite — the candidate really is gone, or the caller's credentials really
-* lack the permission — and retrying them burns the full backoff budget per
-* candidate before surfacing the true error.
-*
-* So the walk retries throttling ONLY, reusing the deploy engine's throttle
-* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
-* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
-*
-* ## Batching
-*
-* Batched tag reads are deliberately NOT modelled here: the services this
-* helper currently serves (EMR `DescribeCluster`, DocDB
-* `ListTagsForResource`) expose only single-resource reads. A service that
-* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
-* satisfy several candidates from one call inside its own `describe` callback,
-* or bypass the helper entirely.
-*/
-/** Max number of retries after the first attempt, per API call in the walk. */
-const DEFAULT_MAX_RETRIES = 5;
-/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
-const DEFAULT_INITIAL_DELAY_MS = 500;
-/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
-const DEFAULT_MAX_DELAY_MS = 5e3;
-/**
-* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
-* one call. Backoff is per-call, so without this a sustained throttle against a
-* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
-* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
-* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
-* DocDB account completes in seconds when AWS is not throttling) and bounds the
-* pathological case to something a user will wait through.
-*/
-const DEFAULT_MAX_WALK_MS = 10 * 6e4;
-/**
-* Ceiling on pages fetched. A service that returns a non-advancing pagination
-* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
-* forever. This is now the shared path every migrated provider runs on, so the
-* guard belongs here rather than in each caller.
-*/
-const DEFAULT_MAX_PAGES = 1e3;
-/**
-* Whether an error hit during the read-only tag walk is a rate-limit rejection
-* worth backing off on.
-*
-* Delegates the error + `.cause` chain traversal to the deploy engine's
-* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
-* at every cause depth) and adds the canonical `Rate exceeded` message, which
-* several services return with an HTTP 400 and a service-specific error name.
-*
-* This is deliberately NARROWER than `isRetryableTransientError`: that
-* classifier also treats write-path eventual-consistency phrasings (`does not
-* exist`, `not authorized to perform`) as transient, because a just-created
-* dependency legitimately needs a moment to propagate. On a read-only walk
-* those mean the candidate really is gone or the credentials really lack the
-* permission, and retrying them burns the full backoff budget per candidate
-* before surfacing the true error.
-*
-* Exported for direct unit testing and for providers whose tag walk cannot use
-* {@link importTagWalk} verbatim.
-*/
-function isThrottlingLikeError(error, message) {
-	return isThrottlingError(error) || message.includes("Rate exceeded");
-}
-/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
-var ImportTagWalkLimitError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ImportTagWalkLimitError";
-	}
-};
-/**
-* Paginate `listPage`, `describe` each candidate, and return the first one
-* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
-* candidate matches (or when `cdkPath` is empty).
-*
-* Both callbacks are individually retried with exponential backoff on
-* throttling errors, so one rate-limited call mid-walk no longer aborts the
-* whole import.
-*/
-async function importTagWalk(options) {
-	const { cdkPath, listPage, describe, tagsOf } = options;
-	if (!cdkPath) return null;
-	const logicalId = options.logicalId ?? "import";
-	const logger = options.retry?.logger ?? getLogger();
-	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
-	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
-	const retryOpts = {
-		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
-		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
-		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
-		isRetryable: (message, error) => isThrottlingLikeError(error, message),
-		logger,
-		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
-		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
-		...options.retry?.sleep && { sleep: options.retry.sleep }
-	};
-	const startedAt = Date.now();
-	const assertWithinBudget = (stage) => {
-		const elapsed = Date.now() - startedAt;
-		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-	};
-	let marker;
-	let pages = 0;
-	do {
-		assertWithinBudget("listing candidates");
-		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-		const currentMarker = marker;
-		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
-		for (const summary of page.items ?? []) {
-			assertWithinBudget("reading candidate tags");
-			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
-			if (detail === void 0) {
-				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
-				continue;
-			}
-			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
-				summary,
-				detail
-			};
-		}
-		marker = page.nextMarker;
-	} while (marker);
-	return null;
-}
-
 //#endregion
 //#region src/provisioning/providers/iam-role-provider.ts
 /**
@@ -17782,5 +17799,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { BOOTSTRAP_MARKER_PREFIX as $, StateError as $t, refStateLookupFromResource as A, AssemblyReader as At, TemplateParser as B, DependencyError as Bt, ProviderRegistry as C, warnDeprecatedNoPrefixCliFlag as Ct, isTerminationProtectionPropagationError as D, findLargeInlineResources as Dt, disableInstanceApiTermination as E, MIGRATE_TMP_PREFIX as Et, resolveExplicitPhysicalId as F, resetAwsClients as Ft, AssetPublisher as G, MissingCdkCliError as Gt, S3StateBackend as H, LocalMigrateError as Ht, assertRegionMatch as I, setAwsClients as It, buildAssetRedirectMap as J, ProvisioningError as Jt, stringifyValue as K, NestedStackChildDirectDestroyError as Kt, applyRoleArnIfSet as L, AssetError as Lt, CDK_PATH_TAG as M, resolveBucketRegion as Mt, matchesCdkPath as N, AwsClients as Nt, IntrinsicFunctionResolver as O, uploadCfnTemplate as Ot, normalizeAwsTagsToCfn as P, getAwsClients as Pt, AssetModeResolver as Q, StackTerminationProtectionError as Qt, DiffCalculator as R, CdkdError as Rt, isRetryableTransientError as S, resolveUseCdkBootstrapAssets as St, CloudControlProvider as T, CFN_TEMPLATE_URL_LIMIT as Tt, rebuildClientForBucketRegion as U, LocalStartServiceError as Ut, LockManager as V, LocalInvokeBuildError as Vt, shouldRetainResource as W, LockError as Wt, loadPublishableAssetManifest as X, ResourceUpdateNotSupportedError as Xt, createAssetRedirectResolver as Y, ResourceTimeoutError as Yt, rewriteTemplateAssetReferences as Z, StackHasActiveImportsError as Zt, yellow as _, resolveAutoAssetStorage as _t, IMPLICIT_DELETE_DEPENDENCIES as a, __exportAll as an, buildDockerImage as at, importTagWalk as b, resolveStateBucketWithDefault as bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as c, runDockerForeground as ct, formatResourceLine as d, getDockerImageBySourceHash as dt, SynthesisError as en, ensureAssetStorage as et, bold as f, Synthesizer as ft, red as g, resolveApp as gt, green as h, getLegacyStateBucketName as ht, withResourceDeadline as i, withErrorHandling as in, validateContainerRepoName as it, WAFv2WebACLProvider as j, clearBucketRegionCache as jt, cfnRefValueFromPhysicalId as k, expectedOwnerParam as kt, isStatefulRecreateTargetSync as l, runDockerStreaming as lt, gray as m, getDefaultStateBucketName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as nn, parseBootstrapMarker as nt, computeImplicitDeleteEdges as o, formatDockerLoginError as ot, cyan as p, synthesisStatusMessage as pt, WorkGraph as q, PartialFailureError as qt, DeployEngine as r, normalizeAwsError as rn, validateAssetBucketName as rt, extractDeploymentEventError as s, getDockerCmd as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as tn, getBootstrapMarkerKey as tt, renderStatefulReason as u, AssetManifestLoader as ut, IAMRoleProvider as v, resolveCaptureObservedState as vt, findActionableSilentDrops as w, CFN_TEMPLATE_BODY_LIMIT as wt, withRetry as x, resolveStateBucketWithDefaultAndSource as xt, collectInlinePolicyNamesManagedBySiblings as y, resolveSkipPrefix as yt, DagBuilder as z, ConfigError as zt };
-//# sourceMappingURL=deploy-engine-vUgwldVH.js.map
+export { BOOTSTRAP_MARKER_PREFIX as $, StateError as $t, withRetry as A, AssemblyReader as At, TemplateParser as B, DependencyError as Bt, disableInstanceApiTermination as C, warnDeprecatedNoPrefixCliFlag as Ct, refStateLookupFromResource as D, findLargeInlineResources as Dt, cfnRefValueFromPhysicalId as E, MIGRATE_TMP_PREFIX as Et, resolveExplicitPhysicalId as F, resetAwsClients as Ft, AssetPublisher as G, MissingCdkCliError as Gt, S3StateBackend as H, LocalMigrateError as Ht, assertRegionMatch as I, setAwsClients as It, buildAssetRedirectMap as J, ProvisioningError as Jt, stringifyValue as K, NestedStackChildDirectDestroyError as Kt, applyRoleArnIfSet as L, AssetError as Lt, CDK_PATH_TAG as M, resolveBucketRegion as Mt, matchesCdkPath as N, AwsClients as Nt, WAFv2WebACLProvider as O, uploadCfnTemplate as Ot, normalizeAwsTagsToCfn as P, getAwsClients as Pt, AssetModeResolver as Q, StackTerminationProtectionError as Qt, DiffCalculator as R, CdkdError as Rt, CloudControlProvider as S, resolveUseCdkBootstrapAssets as St, IntrinsicFunctionResolver as T, CFN_TEMPLATE_URL_LIMIT as Tt, rebuildClientForBucketRegion as U, LocalStartServiceError as Ut, LockManager as V, LocalInvokeBuildError as Vt, shouldRetainResource as W, LockError as Wt, loadPublishableAssetManifest as X, ResourceUpdateNotSupportedError as Xt, createAssetRedirectResolver as Y, ResourceTimeoutError as Yt, rewriteTemplateAssetReferences as Z, StackHasActiveImportsError as Zt, yellow as _, resolveAutoAssetStorage as _t, IMPLICIT_DELETE_DEPENDENCIES as a, __exportAll as an, buildDockerImage as at, ProviderRegistry as b, resolveStateBucketWithDefault as bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as c, runDockerForeground as ct, formatResourceLine as d, getDockerImageBySourceHash as dt, SynthesisError as en, ensureAssetStorage as et, bold as f, Synthesizer as ft, red as g, resolveApp as gt, green as h, getLegacyStateBucketName as ht, withResourceDeadline as i, withErrorHandling as in, validateContainerRepoName as it, isRetryableTransientError as j, clearBucketRegionCache as jt, importTagWalk as k, expectedOwnerParam as kt, isStatefulRecreateTargetSync as l, runDockerStreaming as lt, gray as m, getDefaultStateBucketName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as nn, parseBootstrapMarker as nt, computeImplicitDeleteEdges as o, formatDockerLoginError as ot, cyan as p, synthesisStatusMessage as pt, WorkGraph as q, PartialFailureError as qt, DeployEngine as r, normalizeAwsError as rn, validateAssetBucketName as rt, extractDeploymentEventError as s, getDockerCmd as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as tn, getBootstrapMarkerKey as tt, renderStatefulReason as u, AssetManifestLoader as ut, IAMRoleProvider as v, resolveCaptureObservedState as vt, isTerminationProtectionPropagationError as w, CFN_TEMPLATE_BODY_LIMIT as wt, findActionableSilentDrops as x, resolveStateBucketWithDefaultAndSource as xt, collectInlinePolicyNamesManagedBySiblings as y, resolveSkipPrefix as yt, DagBuilder as z, ConfigError as zt };
+//# sourceMappingURL=deploy-engine-DOPBIRKR.js.map