@go-to-k/cdkd 0.257.3 → 0.258.0

package/dist/{deploy-engine-0U3bYBq4.js → deploy-engine-Dg51mHCV.js}

@@ -2,7 +2,7 @@ import { a as getLiveRenderer, d as generateResourceNameWithFallback, l as apply
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
-import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, ListRolesCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
+import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
 import { SQSClient } from "@aws-sdk/client-sqs";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
@@ -19,6 +19,7 @@ import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
 import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore-control";
 import { ACMClient } from "@aws-sdk/client-acm";
+import { LambdaMicrovmsClient } from "@aws-sdk/client-lambda-microvms";
 import { createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, isAbsolute, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
@@ -35,7 +36,7 @@ import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from
 import { DescribeReplicationGroupsCommand, ElastiCacheClient } from "@aws-sdk/client-elasticache";
 import { DescribeClustersCommand, RedshiftClient } from "@aws-sdk/client-redshift";
 import { DescribeDomainCommand, OpenSearchClient } from "@aws-sdk/client-opensearch";
-import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
+import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 
 //#region \0rolldown/runtime.js
@@ -609,6 +610,7 @@ var AwsClients = class {
 	cloudWatchLogsClient;
 	bedrockAgentCoreControlClient;
 	acmClient;
+	lambdaMicrovmsClient;
 	config;
 	constructor(config = {}) {
 		this.config = config;
@@ -893,6 +895,28 @@ var AwsClients = class {
 		return this.getACMClient();
 	}
 	/**
+	* Get Lambda MicroVMs client.
+	*
+	* Backs `AWS::Lambda::MicrovmImage` (`LambdaMicrovmImageProvider`). This is
+	* the dedicated `lambda-microvms` service, NOT `@aws-sdk/client-lambda` —
+	* the MicroVM image / MicroVM run APIs live in their own service model.
+	* Region-scoped: MicroVM images and their code-artifact S3 buckets must be
+	* in the same region.
+	*/
+	getLambdaMicrovmsClient() {
+		if (!this.lambdaMicrovmsClient) this.lambdaMicrovmsClient = new LambdaMicrovmsClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.lambdaMicrovmsClient;
+	}
+	/**
+	* Convenience getter for Lambda MicroVMs client
+	*/
+	get lambdaMicrovms() {
+		return this.getLambdaMicrovmsClient();
+	}
+	/**
 	* Get CloudWatch client
 	*/
 	getCloudWatchClient() {
@@ -963,6 +987,7 @@ var AwsClients = class {
 		this.cloudWatchLogsClient?.destroy();
 		this.bedrockAgentCoreControlClient?.destroy();
 		this.acmClient?.destroy();
+		this.lambdaMicrovmsClient?.destroy();
 	}
 };
 /**
@@ -2488,6 +2513,25 @@ function findLargeInlineResources(template, threshold = LARGE_INLINE_RESOURCE_TH
 const WAITER_MAX_WAIT_SECONDS = 600;
 const PARAMETER_PLACEHOLDER = "cdkd-macro-expand-placeholder";
 /**
+* AWS's managed pre-deployment validation hooks
+* (`AWS::EarlyValidation::*`, e.g. `ResourceExistenceCheck`) can
+* reject the transient expansion changeset INTERMITTENTLY (issue
+* #1151: two consecutive rejections followed by a clean pass on the
+* same template minutes later, with the same named resources
+* existing throughout). The changeset is never executed — cdkd only
+* reads the Processed-stage template — so a validation-hook rejection
+* carries no real risk and is worth retrying with a fresh transient
+* stack before failing the whole run.
+*/
+const EARLY_VALIDATION_MAX_ATTEMPTS = 3;
+const EARLY_VALIDATION_RETRY_BASE_DELAY_MS = 2e3;
+/** Matches the changeset FAILED StatusReason emitted by the hook family. */
+function isEarlyValidationRejection(err) {
+	return err instanceof MacroExpansionError && /AWS::EarlyValidation::/.test(err.message);
+}
+/** Test seam: overridable sleep so retry tests don't wait wall-clock. */
+const retryDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+/**
 * Capabilities sent on every `CreateChangeSet` call:
 *
 * - `CAPABILITY_AUTO_EXPAND` is the load-bearing one — required for CFn
@@ -2583,6 +2627,19 @@ const PARAMETER_TYPE_PLACEHOLDERS = {
 async function expandMacros(template, opts) {
 	const logger = getLogger().child("MacroExpander");
 	if (!containsMacro(template)) return template;
+	for (let attempt = 1;; attempt++) try {
+		return await expandMacrosAttempt(template, opts, logger);
+	} catch (err) {
+		if (attempt < EARLY_VALIDATION_MAX_ATTEMPTS && isEarlyValidationRejection(err)) {
+			const delayMs = EARLY_VALIDATION_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1);
+			logger.warn(`Macro expansion changeset was rejected by an AWS EarlyValidation hook (attempt ${attempt}/${EARLY_VALIDATION_MAX_ATTEMPTS}); this rejection is known to be intermittent — retrying with a fresh transient stack in ${delayMs / 1e3}s...`);
+			await retryDelays.sleep(delayMs);
+			continue;
+		}
+		throw err;
+	}
+}
+async function expandMacrosAttempt(template, opts, logger) {
 	const macros = enumerateMacros(template);
 	logger.debug(`Macro expansion: detected transforms [${macros.join(", ")}], starting CFn round-trip...`);
 	const transientStackName = `cdkd-macro-expand-${randomUUID().slice(0, 16)}`;
@@ -3131,19 +3188,7 @@ var Synthesizer = class {
 			this.logger.debug(`Using pre-synthesized cloud assembly at ${appPath}`);
 			const manifest = this.assemblyReader.readManifest(appPath);
 			const stacks = this.assemblyReader.getAllStacks(appPath, manifest);
-			const presynthRegion = options.region || process.env["AWS_REGION"] || process.env["AWS_DEFAULT_REGION"];
-			let presynthAccountId;
-			try {
-				const stsClient = new STSClient({ ...presynthRegion && { region: presynthRegion } });
-				presynthAccountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
-				stsClient.destroy();
-			} catch {
-				this.logger.debug("Could not resolve AWS account ID via STS (pre-synth branch)");
-			}
-			await this.expandMacrosForStacks(stacks, options, {
-				region: presynthRegion,
-				...presynthAccountId && { accountId: presynthAccountId }
-			});
+			if (!options.deferMacroExpansion) await this.expandMacrosForStacks(stacks, options);
 			this.logger.debug(`Loaded ${stacks.length} stack(s) from pre-synthesized assembly`);
 			return {
 				manifest,
@@ -3162,7 +3207,8 @@ var Synthesizer = class {
 			"aws:cdk:version-reporting": true,
 			"aws:cdk:bundling-stacks": ["**"]
 		};
-		const region = options.region || process.env["AWS_REGION"] || process.env["AWS_DEFAULT_REGION"];
+		const explicitRegion = options.region || process.env["AWS_REGION"] || process.env["AWS_DEFAULT_REGION"];
+		const region = explicitRegion || await resolveSdkDefaultRegion(options.profile);
 		let accountId;
 		try {
 			const stsClient = new STSClient({ ...region && { region } });
@@ -3196,8 +3242,8 @@ var Synthesizer = class {
 			const manifest = this.assemblyReader.readManifest(outputDir);
 			if (!manifest.missing || manifest.missing.length === 0) {
 				const stacks = this.assemblyReader.getAllStacks(outputDir, manifest);
-				await this.expandMacrosForStacks(stacks, options, {
-					region,
+				if (!options.deferMacroExpansion) await this.expandMacrosForStacks(stacks, options, {
+					region: explicitRegion,
 					...accountId && { accountId }
 				});
 				this.logger.debug(`Synthesis complete: ${stacks.length} stack(s)`);
@@ -3218,10 +3264,16 @@ var Synthesizer = class {
 		}
 	}
 	/**
-	* List stack names in CDK app
+	* List stack names in CDK app. Names come straight from the
+	* manifest, so the macro-expansion pre-pass is skipped entirely —
+	* listing a macro app needs no AWS region or CloudFormation access
+	* (issue #1150).
 	*/
 	async listStacks(options) {
-		return (await this.synthesize(options)).stacks.map((s) => s.stackName);
+		return (await this.synthesize({
+			...options,
+			deferMacroExpansion: true
+		})).stacks.map((s) => s.stackName);
 	}
 	/**
 	* Per-stack macro-expansion pass (Issue #463). Mutates each stack's
@@ -3230,23 +3282,36 @@ var Synthesizer = class {
 	* analyzer / provisioner pipeline consumes the templates, so every
 	* downstream stage sees the post-expansion shape.
 	*
-	* Skipped silently when no stack carries a macro — pure no-op cost.
-	* When a macro IS detected and the caller did NOT thread a
-	* region into the synthesizer, falls back to resolving region from
-	* the synthesized stack's environment (set by `cdk.Stack.region`).
-	* Throws `SynthesisError` when no region can be resolved (the
-	* upstream caller treats it as a synth failure) and propagates
-	* `MacroExpansionError` (from {@link expandMacros}) on any CFn-side
-	* failure during the round-trip.
+	* PUBLIC since issue #1150: selection-aware commands (deploy / diff)
+	* synthesize with `deferMacroExpansion: true` and invoke this
+	* directly with ONLY the stacks they will actually consume, so an
+	* unselected macro-carrying sibling can never fail or slow the run.
+	*
+	* Skipped silently when no stack carries a macro — pure no-op cost
+	* (in particular, no STS hop). When a macro IS detected and the
+	* caller did NOT thread a resolved region/account, both are
+	* resolved here (STS for the default state bucket; the region chain
+	* below for the CFn client). Throws `SynthesisError` when no region
+	* can be resolved (the upstream caller treats it as a synth
+	* failure) and propagates `MacroExpansionError` (from {@link
+	* expandMacros}) on any CFn-side failure during the round-trip.
 	*/
 	async expandMacrosForStacks(stacks, options, resolved) {
 		const stacksWithMacros = stacks.filter((s) => containsMacro(s.template));
 		if (stacksWithMacros.length === 0) return;
-		const region = resolved?.region || options.region || process.env["AWS_REGION"] || process.env["AWS_DEFAULT_REGION"] || stacksWithMacros[0]?.region;
+		const region = resolved?.region || options.region || process.env["AWS_REGION"] || process.env["AWS_DEFAULT_REGION"] || stacksWithMacros[0]?.region || await resolveSdkDefaultRegion(options.profile);
 		if (!region) throw new SynthesisError(`Stack(s) [${stacksWithMacros.map((s) => s.stackName).join(", ")}] use CloudFormation macros (Transform / Fn::Transform) but cdkd could not resolve an AWS region for the expansion round-trip. Set AWS_REGION, pass --region <r>, or set env: { region: '<r>' } in your CDK Stack constructor.`);
+		let accountId = resolved?.accountId;
+		if (resolved === void 0 && !options.stateBucket) try {
+			const stsClient = new STSClient({ region });
+			accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
+			stsClient.destroy();
+		} catch {
+			this.logger.debug("Could not resolve AWS account ID via STS (macro expansion)");
+		}
 		let stateBucket;
 		if (options.stateBucket) stateBucket = options.stateBucket;
-		else if (resolved?.accountId) stateBucket = `cdkd-state-${resolved.accountId}`;
+		else if (accountId) stateBucket = `cdkd-state-${accountId}`;
 		else {
 			const oversize = stacksWithMacros.find((s) => JSON.stringify(s.template).length > 51200);
 			if (oversize) throw new SynthesisError(`Stack '${oversize.stackName}' uses CloudFormation macros AND its serialized template exceeds the 51,200-byte inline TemplateBody limit, so cdkd must upload the template to S3 for the transient expansion changeset. cdkd could not resolve a state bucket: STS GetCallerIdentity failed AND --state-bucket was not provided. Pass --state-bucket <name> (cdkd uses the same bucket as cdkd deploy state storage; typically 'cdkd-state-<accountId>').`);
@@ -3268,6 +3333,31 @@ var Synthesizer = class {
 	}
 };
 /**
+* Resolve the AWS SDK's own default region (env vars, shared config
+* file profile region, etc.) — the same chain every cdkd AWS client
+* consults implicitly when constructed without an explicit region.
+* Returns `undefined` when the chain yields nothing so callers can
+* fall through to their own hard-error (issue #1149: the
+* macro-expansion pre-pass previously checked only explicit
+* option/env sources and hard-errored for users whose region lives in
+* `~/.aws/config`).
+*
+* Implemented by asking a throwaway STS client for its resolved
+* region provider — that is exactly the chain the real provisioning
+* clients use, so the two can never diverge.
+*/
+async function resolveSdkDefaultRegion(profile) {
+	let client;
+	try {
+		client = new STSClient({ ...profile && { profile } });
+		return await client.config.region() || void 0;
+	} catch {
+		return;
+	} finally {
+		client?.destroy?.();
+	}
+}
+/**
 * Check if two sets contain the same elements
 */
 function setsEqual(a, b) {
@@ -8158,21 +8248,6 @@ function resolveExplicitPhysicalId(input, nameProperty) {
 	}
 }
 /**
-* The standard tag CDK puts on every deployed resource — its construct path
-* within the app, e.g. `MyStack/MyConstruct/MyBucket`. Used as the lookup key
-* when no explicit name is in the template.
-*/
-const CDK_PATH_TAG = "aws:cdk:path";
-/**
-* Match an AWS resource's tag set against the CDK path the template carries.
-* Returns true if the resource was deployed by the same CDK construct.
-*/
-function matchesCdkPath(tags, cdkPath) {
-	if (!tags || !cdkPath) return false;
-	for (const t of tags) if (t.Key === "aws:cdk:path" && t.Value === cdkPath) return true;
-	return false;
-}
-/**
 * Re-shape an AWS tag list (any of the common shapes — array of `{Key, Value}`,
 * map keyed by tag name, or v2-style array of `{TagKey, TagValue}`) into the
 * canonical CFn shape (`Array<{Key, Value}>`) that cdkd state holds, with
@@ -8215,330 +8290,6 @@ function normalizeAwsTagsToCfn(tags) {
 	return out;
 }
 
-//#endregion
-//#region src/deployment/retryable-errors.ts
-/**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
-	"cannot be assumed",
-	"Firehose is unable to assume role",
-	"is unable to assume provided role",
-	"role defined for the function",
-	"not authorized to perform",
-	"execution role",
-	"trust policy",
-	"Role validation failed",
-	"does not have required permissions",
-	"Trusted Entity",
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
-	"Invalid principal in policy",
-	"Policy Error: PrincipalNotFound",
-	"Invalid value for the parameter Policy",
-	"required permissions for: ENHANCED_MONITORING",
-	"Caught ServiceAccessDeniedException",
-	"permissions required to assume the role",
-	"authorized to assume the provided role",
-	"conflicting conditional operation",
-	"scheduled for deletion",
-	"Cannot access stream",
-	"Please ensure the role can perform",
-	"KMS key is invalid for CreateGrant",
-	"Policy contains a statement with one or more invalid principals",
-	"Invalid IAM Instance Profile",
-	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
-	"Could not deliver test message",
-	"wait 60 seconds",
-	"concurrent update operation",
-	"because it is in use",
-	"Rate exceeded"
-];
-/**
-* HTTP status codes that always indicate a transient failure worth retrying.
-* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
-*/
-const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
-/**
-* AWS SDK v3 canonical throttling error names. Mirrors
-* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
-* error (or wrapped cause) whose `name` is one of these is a transient rate-
-* limit rejection worth retrying with backoff. Detecting by NAME is more
-* robust than by HTTP status because most AWS throttles surface as HTTP 400
-* (not 429) with the throttling signal carried only in the error code / name
-* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
-*/
-const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
-	"BandwidthLimitExceeded",
-	"EC2ThrottledException",
-	"LimitExceededException",
-	"PriorRequestNotComplete",
-	"ProvisionedThroughputExceededException",
-	"RequestLimitExceeded",
-	"RequestThrottled",
-	"RequestThrottledException",
-	"SlowDown",
-	"ThrottledException",
-	"Throttling",
-	"ThrottlingException",
-	"TooManyRequestsException",
-	"TransactionInProgressException"
-]);
-/**
-* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
-* signal — either an AWS SDK v3 throttling error `name`
-* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
-* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
-*
-* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
-* typically one cause-link deep; the bounded walk also tolerates SDK errors
-* that nest a `$response`/cause without exploding on a cyclic chain.
-*
-* BOTH signals are checked at EVERY depth. An earlier version checked the name
-* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
-* links deep was missed. This is the single shared cause-walk: the read-only
-* import tag walk (`src/provisioning/import-tag-walk.ts`) composes its own
-* classifier on top of this function rather than re-implementing the traversal,
-* so the two cannot drift apart again.
-*/
-function isThrottlingError(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		const name = current.name;
-		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
-		const status = current.$metadata?.httpStatusCode;
-		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
-		current = current.cause;
-	}
-	return false;
-}
-/**
-* Determine whether an AWS error should be retried.
-*
-* Checks (in order):
-*   1. Rate-limit signal on the error or any wrapped cause — throttling error
-*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
-*      429, so the name check carries most of the weight). See
-*      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
-*/
-function isRetryableTransientError(error, message) {
-	if (isThrottlingError(error)) return true;
-	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-
-//#endregion
-//#region src/deployment/retry.ts
-/**
-* Retry helper for resource provisioning operations that hit transient
-* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
-* dependency violations, etc.).
-*
-* Extracted from DeployEngine so the backoff schedule can be unit-tested
-* in isolation. The retryable-error classifier itself lives in
-* `./retryable-errors.ts`.
-*/
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/**
-* Run `operation`, retrying transient failures with exponential backoff
-* capped at `maxDelayMs`.
-*
-* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
-*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
-*
-* Non-retryable errors are rethrown immediately. The transient-error
-* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
-*/
-async function withRetry(operation, logicalId, opts = {}) {
-	const maxRetries = opts.maxRetries ?? 8;
-	const initialDelayMs = opts.initialDelayMs ?? 1e3;
-	const maxDelayMs = opts.maxDelayMs ?? 8e3;
-	const sleep = opts.sleep ?? defaultSleep;
-	let lastError;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		return await operation();
-	} catch (error) {
-		lastError = error;
-		const message = error instanceof Error ? error.message : String(error);
-		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
-		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
-		for (let waited = 0; waited < delay; waited += 1e3) {
-			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
-			await sleep(Math.min(1e3, delay - waited));
-		}
-	}
-	throw lastError;
-}
-
-//#endregion
-//#region src/provisioning/import-tag-walk.ts
-/**
-* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
-*
-* Providers that adopt a resource without an explicit name property fall back
-* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
-* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
-* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
-* summaries usually do not carry tags. That is an inherent **N+1** read
-* pattern: an account with many resources of the type produces one API call
-* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
-*
-* Every provider previously hand-rolled this loop with NO backoff, so a single
-* throttled `Describe*` aborted the whole `cdkd import` run. This helper
-* centralises the loop and wraps BOTH the list page fetch and the per-candidate
-* describe in the deploy engine's `withRetry` with exponential backoff.
-*
-* ## Why a narrower classifier than `isRetryableTransientError`
-*
-* The deploy engine's classifier is tuned for the WRITE path: it also treats
-* eventual-consistency phrasings like `does not exist` / `not authorized to
-* perform` as transient, because a just-created dependency legitimately needs a
-* moment to propagate. On a read-only import walk those messages mean the
-* opposite — the candidate really is gone, or the caller's credentials really
-* lack the permission — and retrying them burns the full backoff budget per
-* candidate before surfacing the true error.
-*
-* So the walk retries throttling ONLY, reusing the deploy engine's throttle
-* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
-* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
-*
-* ## Batching
-*
-* Batched tag reads are deliberately NOT modelled here: the services this
-* helper currently serves (EMR `DescribeCluster`, DocDB
-* `ListTagsForResource`) expose only single-resource reads. A service that
-* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
-* satisfy several candidates from one call inside its own `describe` callback,
-* or bypass the helper entirely.
-*/
-/** Max number of retries after the first attempt, per API call in the walk. */
-const DEFAULT_MAX_RETRIES = 5;
-/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
-const DEFAULT_INITIAL_DELAY_MS = 500;
-/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
-const DEFAULT_MAX_DELAY_MS = 5e3;
-/**
-* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
-* one call. Backoff is per-call, so without this a sustained throttle against a
-* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
-* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
-* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
-* DocDB account completes in seconds when AWS is not throttling) and bounds the
-* pathological case to something a user will wait through.
-*/
-const DEFAULT_MAX_WALK_MS = 10 * 6e4;
-/**
-* Ceiling on pages fetched. A service that returns a non-advancing pagination
-* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
-* forever. This is now the shared path every migrated provider runs on, so the
-* guard belongs here rather than in each caller.
-*/
-const DEFAULT_MAX_PAGES = 1e3;
-/**
-* Whether an error hit during the read-only tag walk is a rate-limit rejection
-* worth backing off on.
-*
-* Delegates the error + `.cause` chain traversal to the deploy engine's
-* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
-* at every cause depth) and adds the canonical `Rate exceeded` message, which
-* several services return with an HTTP 400 and a service-specific error name.
-*
-* This is deliberately NARROWER than `isRetryableTransientError`: that
-* classifier also treats write-path eventual-consistency phrasings (`does not
-* exist`, `not authorized to perform`) as transient, because a just-created
-* dependency legitimately needs a moment to propagate. On a read-only walk
-* those mean the candidate really is gone or the credentials really lack the
-* permission, and retrying them burns the full backoff budget per candidate
-* before surfacing the true error.
-*
-* Exported for direct unit testing and for providers whose tag walk cannot use
-* {@link importTagWalk} verbatim.
-*/
-function isThrottlingLikeError(error, message) {
-	return isThrottlingError(error) || message.includes("Rate exceeded");
-}
-/**
-* Module-level test hooks for the walk's backoff.
-*
-* Providers do not expose a retry option on `import()`, so their wiring tests
-* cannot inject `retry.sleep` per call — without this hook every throttle-path
-* wiring test pays a real 0.5s+ backoff wait. Tests set `sleep` to a resolved
-* no-op in `beforeEach` (and clear it in `afterEach`); a per-call
-* `retry.sleep` still wins when supplied. Never set this in production code.
-*/
-const importTagWalkTestHooks = {};
-/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
-var ImportTagWalkLimitError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ImportTagWalkLimitError";
-	}
-};
-/**
-* Paginate `listPage`, `describe` each candidate, and return the first one
-* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
-* candidate matches (or when `cdkPath` is empty).
-*
-* Both callbacks are individually retried with exponential backoff on
-* throttling errors, so one rate-limited call mid-walk no longer aborts the
-* whole import.
-*/
-async function importTagWalk(options) {
-	const { cdkPath, listPage, describe, tagsOf } = options;
-	if (!cdkPath) return null;
-	const logicalId = options.logicalId ?? "import";
-	const logger = options.retry?.logger ?? getLogger();
-	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
-	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
-	const sleep = options.retry?.sleep ?? importTagWalkTestHooks.sleep;
-	const retryOpts = {
-		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
-		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
-		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
-		isRetryable: (message, error) => isThrottlingLikeError(error, message),
-		logger,
-		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
-		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
-		...sleep && { sleep }
-	};
-	const startedAt = Date.now();
-	const assertWithinBudget = (stage) => {
-		const elapsed = Date.now() - startedAt;
-		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-	};
-	let marker;
-	let pages = 0;
-	do {
-		assertWithinBudget("listing candidates");
-		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-		const currentMarker = marker;
-		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
-		for (const summary of page.items ?? []) {
-			assertWithinBudget("reading candidate tags");
-			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
-			if (detail === void 0) {
-				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
-				continue;
-			}
-			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
-				summary,
-				detail
-			};
-		}
-		marker = page.nextMarker;
-	} while (marker);
-	return null;
-}
-
 //#endregion
 //#region src/provisioning/providers/wafv2-provider.ts
 /**
@@ -8760,14 +8511,14 @@ var WAFv2WebACLProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$12({
+			await this.getClient().send(new UntagResourceCommand$13({
 				ResourceARN: arn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$12({
+			await this.getClient().send(new TagResourceCommand$13({
 				ResourceARN: arn,
 				Tags: tagsToAdd
 			}));
@@ -8830,12 +8581,6 @@ var WAFv2WebACLProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<arn>` override → verify with `GetWebACL` (parses
 	*     Name/Id/Scope back out of the ARN).
-	*  2. Walk `ListWebACLs(Scope)` → match `aws:cdk:path` via
-	*     `ListTagsForResource(ResourceARN)` (returns
-	*     `TagInfoForResource.TagList`, standard `Key`/`Value` shape).
-	*
-	* `Scope` is required by `ListWebACLs` — read from
-	* `Properties.Scope` (`REGIONAL` is the default).
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -8853,31 +8598,7 @@ var WAFv2WebACLProvider = class {
 			if (err instanceof WAFNonexistentItemException) return null;
 			throw err;
 		}
-		const scope = input.properties["Scope"] || "REGIONAL";
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListWebACLsCommand({
-					Scope: scope,
-					...marker && { NextMarker: marker }
-				}));
-				return {
-					items: list.WebACLs,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (item) => {
-				if (!item.ARN) return void 0;
-				return await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: item.ARN }));
-			},
-			tagsOf: (tagsResp) => tagsResp.TagInfoForResource?.TagList
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.ARN,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -10900,6 +10621,7 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::AppStream::Fleet",
 	"AWS::AppSync::ApiCache",
 	"AWS::AutoScalingPlans::ScalingPlan",
+	"AWS::Bedrock::DefaultPromptRouter",
 	"AWS::Bedrock::ModelInvocationJob",
 	"AWS::BedrockAgentCore::TokenVault",
 	"AWS::Cloud9::EnvironmentEC2",
@@ -11343,7 +11065,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Co34HfIH.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-rcNqhfPS.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -14078,6 +13800,25 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
+	["AWS::Lambda::MicrovmImage", {
+		handled: /* @__PURE__ */ new Set([
+			"AdditionalOsCapabilities",
+			"BaseImageArn",
+			"BaseImageVersion",
+			"BuildRoleArn",
+			"CodeArtifact",
+			"CpuConfigurations",
+			"Description",
+			"EgressNetworkConnectors",
+			"EnvironmentVariables",
+			"Hooks",
+			"Logging",
+			"Name",
+			"Resources",
+			"Tags"
+		]),
+		silentDrop: /* @__PURE__ */ new Map()
+	}],
 	["AWS::Lambda::Permission", {
 		handled: /* @__PURE__ */ new Set([
 			"Action",
@@ -15673,12 +15414,6 @@ var IAMRoleProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.RoleName` → use directly,
 	*     verify via `GetRole`.
-	*  2. `ListRoles` + `ListRoleTags`, match `aws:cdk:path` tag.
-	*
-	* `ListRoles` is paginated and IAM is global (no region scoping), so this
-	* walks every role in the account once. Acceptable for the cardinalities
-	* we expect (typically <100 roles per account); larger accounts may want
-	* to provide `--resource` overrides instead.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "RoleName");
@@ -15692,32 +15427,7 @@ var IAMRoleProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.iamClient.send(new ListRolesCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Roles,
-					nextMarker: list.IsTruncated ? list.Marker : void 0
-				};
-			},
-			describe: async (role) => {
-				if (!role.RoleName) return void 0;
-				try {
-					return await this.iamClient.send(new ListRoleTagsCommand({ RoleName: role.RoleName }));
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tags) => tags.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.RoleName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 /**
@@ -16213,6 +15923,167 @@ function computeImplicitDeleteEdges(resources) {
 	return edges;
 }
 
+//#endregion
+//#region src/deployment/retryable-errors.ts
+/**
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*/
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
+	"cannot be assumed",
+	"Firehose is unable to assume role",
+	"is unable to assume provided role",
+	"role defined for the function",
+	"not authorized to perform",
+	"execution role",
+	"trust policy",
+	"Role validation failed",
+	"does not have required permissions",
+	"Trusted Entity",
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"Invalid principal in policy",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
+	"required permissions for: ENHANCED_MONITORING",
+	"Caught ServiceAccessDeniedException",
+	"permissions required to assume the role",
+	"authorized to assume the provided role",
+	"conflicting conditional operation",
+	"scheduled for deletion",
+	"Cannot access stream",
+	"Please ensure the role can perform",
+	"KMS key is invalid for CreateGrant",
+	"Policy contains a statement with one or more invalid principals",
+	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
+	"Could not deliver test message",
+	"wait 60 seconds",
+	"concurrent update operation",
+	"because it is in use",
+	"Rate exceeded"
+];
+/**
+* HTTP status codes that always indicate a transient failure worth retrying.
+* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
+*/
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
+/**
+* AWS SDK v3 canonical throttling error names. Mirrors
+* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
+* error (or wrapped cause) whose `name` is one of these is a transient rate-
+* limit rejection worth retrying with backoff. Detecting by NAME is more
+* robust than by HTTP status because most AWS throttles surface as HTTP 400
+* (not 429) with the throttling signal carried only in the error code / name
+* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
+*/
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
+/**
+* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
+* signal — either an AWS SDK v3 throttling error `name`
+* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
+* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
+*
+* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
+* typically one cause-link deep; the bounded walk also tolerates SDK errors
+* that nest a `$response`/cause without exploding on a cyclic chain.
+*
+* BOTH signals are checked at EVERY depth. An earlier version checked the name
+* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
+* links deep was missed.
+*/
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
+* Determine whether an AWS error should be retried.
+*
+* Checks (in order):
+*   1. Rate-limit signal on the error or any wrapped cause — throttling error
+*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
+*      429, so the name check carries most of the weight). See
+*      {@link isThrottlingError}.
+*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
+*/
+function isRetryableTransientError(error, message) {
+	if (isThrottlingError(error)) return true;
+	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+
+//#endregion
+//#region src/deployment/retry.ts
+/**
+* Retry helper for resource provisioning operations that hit transient
+* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
+* dependency violations, etc.).
+*
+* Extracted from DeployEngine so the backoff schedule can be unit-tested
+* in isolation. The retryable-error classifier itself lives in
+* `./retryable-errors.ts`.
+*/
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+* Run `operation`, retrying transient failures with exponential backoff
+* capped at `maxDelayMs`.
+*
+* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
+*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
+*
+* Non-retryable errors are rethrown immediately. The transient-error
+* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
+*/
+async function withRetry(operation, logicalId, opts = {}) {
+	const maxRetries = opts.maxRetries ?? 8;
+	const initialDelayMs = opts.initialDelayMs ?? 1e3;
+	const maxDelayMs = opts.maxDelayMs ?? 8e3;
+	const sleep = opts.sleep ?? defaultSleep;
+	let lastError;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await operation();
+	} catch (error) {
+		lastError = error;
+		const message = error instanceof Error ? error.message : String(error);
+		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
+		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
+		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
+		for (let waited = 0; waited < delay; waited += 1e3) {
+			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
+			await sleep(Math.min(1e3, delay - waited));
+		}
+	}
+	throw lastError;
+}
+
 //#endregion
 //#region src/deployment/resource-deadline.ts
 /**
@@ -17860,5 +17731,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { AssetModeResolver as $, StackTerminationProtectionError as $t, importTagWalk as A, expectedOwnerParam as At, DagBuilder as B, ConfigError as Bt, slowCcOperationTimeoutMs as C, resolveUseCdkBootstrapAssets as Ct, cfnRefValueFromPhysicalId as D, MIGRATE_TMP_PREFIX as Dt, IntrinsicFunctionResolver as E, CFN_TEMPLATE_URL_LIMIT as Et, normalizeAwsTagsToCfn as F, getAwsClients as Ft, shouldRetainResource as G, LockError as Gt, LockManager as H, LocalInvokeBuildError as Ht, resolveExplicitPhysicalId as I, resetAwsClients as It, WorkGraph as J, PartialFailureError as Jt, AssetPublisher as K, MissingCdkCliError as Kt, assertRegionMatch as L, setAwsClients as Lt, isRetryableTransientError as M, clearBucketRegionCache as Mt, CDK_PATH_TAG as N, resolveBucketRegion as Nt, refStateLookupFromResource as O, findLargeInlineResources as Ot, matchesCdkPath as P, AwsClients as Pt, rewriteTemplateAssetReferences as Q, StackHasActiveImportsError as Qt, applyRoleArnIfSet as R, AssetError as Rt, CloudControlProvider as S, resolveStateBucketWithDefaultAndSource as St, isTerminationProtectionPropagationError as T, CFN_TEMPLATE_BODY_LIMIT as Tt, S3StateBackend as U, LocalMigrateError as Ut, TemplateParser as V, DependencyError as Vt, rebuildClientForBucketRegion as W, LocalStartServiceError as Wt, createAssetRedirectResolver as X, ResourceTimeoutError as Xt, buildAssetRedirectMap as Y, ProvisioningError as Yt, loadPublishableAssetManifest as Z, ResourceUpdateNotSupportedError as Zt, yellow as _, resolveApp as _t, IMPLICIT_DELETE_DEPENDENCIES as a, withErrorHandling as an, validateContainerRepoName as at, ProviderRegistry as b, resolveSkipPrefix as bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as c, getDockerCmd as ct, formatResourceLine as d, AssetManifestLoader as dt, StateError as en, BOOTSTRAP_MARKER_PREFIX as et, bold as f, getDockerImageBySourceHash as ft, red as g, getLegacyStateBucketName as gt, green as h, getDefaultStateBucketName as ht, withResourceDeadline as i, normalizeAwsError as in, validateAssetBucketName as it, withRetry as j, AssemblyReader as jt, WAFv2WebACLProvider as k, uploadCfnTemplate as kt, isStatefulRecreateTargetSync as l, runDockerForeground as lt, gray as m, synthesisStatusMessage as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatError as nn, getBootstrapMarkerKey as nt, computeImplicitDeleteEdges as o, __exportAll as on, buildDockerImage as ot, cyan as p, Synthesizer as pt, stringifyValue as q, NestedStackChildDirectDestroyError as qt, DeployEngine as r, isCdkdError as rn, parseBootstrapMarker as rt, extractDeploymentEventError as s, formatDockerLoginError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, SynthesisError as tn, ensureAssetStorage as tt, renderStatefulReason as u, runDockerStreaming as ut, IAMRoleProvider as v, resolveAutoAssetStorage as vt, disableInstanceApiTermination as w, warnDeprecatedNoPrefixCliFlag as wt, findActionableSilentDrops as x, resolveStateBucketWithDefault as xt, collectInlinePolicyNamesManagedBySiblings as y, resolveCaptureObservedState as yt, DiffCalculator as z, CdkdError as zt };
-//# sourceMappingURL=deploy-engine-0U3bYBq4.js.map
+export { getBootstrapMarkerKey as $, formatError as $t, refStateLookupFromResource as A, resolveBucketRegion as At, S3StateBackend as B, LocalMigrateError as Bt, findActionableSilentDrops as C, CFN_TEMPLATE_URL_LIMIT as Ct, isTerminationProtectionPropagationError as D, expectedOwnerParam as Dt, disableInstanceApiTermination as E, uploadCfnTemplate as Et, applyRoleArnIfSet as F, AssetError as Ft, WorkGraph as G, PartialFailureError as Gt, shouldRetainResource as H, LockError as Ht, DiffCalculator as I, CdkdError as It, loadPublishableAssetManifest as J, ResourceUpdateNotSupportedError as Jt, buildAssetRedirectMap as K, ProvisioningError as Kt, DagBuilder as L, ConfigError as Lt, normalizeAwsTagsToCfn as M, getAwsClients as Mt, resolveExplicitPhysicalId as N, resetAwsClients as Nt, IntrinsicFunctionResolver as O, AssemblyReader as Ot, assertRegionMatch as P, setAwsClients as Pt, ensureAssetStorage as Q, SynthesisError as Qt, TemplateParser as R, DependencyError as Rt, ProviderRegistry as S, CFN_TEMPLATE_BODY_LIMIT as St, slowCcOperationTimeoutMs as T, findLargeInlineResources as Tt, AssetPublisher as U, MissingCdkCliError as Ut, rebuildClientForBucketRegion as V, LocalStartServiceError as Vt, stringifyValue as W, NestedStackChildDirectDestroyError as Wt, AssetModeResolver as X, StackTerminationProtectionError as Xt, rewriteTemplateAssetReferences as Y, StackHasActiveImportsError as Yt, BOOTSTRAP_MARKER_PREFIX as Z, StateError as Zt, green as _, resolveSkipPrefix as _t, withRetry as a, getDockerCmd as at, IAMRoleProvider as b, resolveUseCdkBootstrapAssets as bt, computeImplicitDeleteEdges as c, AssetManifestLoader as ct, isStatefulRecreateTargetSync as d, synthesisStatusMessage as dt, isCdkdError as en, parseBootstrapMarker as et, renderStatefulReason as f, getDefaultStateBucketName as ft, gray as g, resolveCaptureObservedState as gt, cyan as h, resolveAutoAssetStorage as ht, withResourceDeadline as i, formatDockerLoginError as it, WAFv2WebACLProvider as j, AwsClients as jt, cfnRefValueFromPhysicalId as k, clearBucketRegionCache as kt, extractDeploymentEventError as l, getDockerImageBySourceHash as lt, bold as m, resolveApp as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, withErrorHandling as nn, validateContainerRepoName as nt, isRetryableTransientError as o, runDockerForeground as ot, formatResourceLine as p, getLegacyStateBucketName as pt, createAssetRedirectResolver as q, ResourceTimeoutError as qt, DeployEngine as r, __exportAll as rn, buildDockerImage as rt, IMPLICIT_DELETE_DEPENDENCIES as s, runDockerStreaming as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, normalizeAwsError as tn, validateAssetBucketName as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, Synthesizer as ut, red as v, resolveStateBucketWithDefault as vt, CloudControlProvider as w, MIGRATE_TMP_PREFIX as wt, collectInlinePolicyNamesManagedBySiblings as x, warnDeprecatedNoPrefixCliFlag as xt, yellow as y, resolveStateBucketWithDefaultAndSource as yt, LockManager as z, LocalInvokeBuildError as zt };
+//# sourceMappingURL=deploy-engine-Dg51mHCV.js.map