@go-to-k/cdkd 0.267.19 → 0.268.0

package/dist/{deploy-engine-CZCV0ofI.js → deploy-engine-B5cRuFij.js}

@@ -977,7 +977,7 @@ function resetAwsClients() {
 * request — the second caller awaits the same promise instead of issuing a
 * duplicate API call.
 */
-const cache$1 = /* @__PURE__ */ new Map();
+const cache = /* @__PURE__ */ new Map();
 /**
 * Resolve the AWS region of an S3 bucket via `GetBucketLocation`.
 *
@@ -1002,7 +1002,7 @@ const cache$1 = /* @__PURE__ */ new Map();
 *   `opts.fallbackRegion` if provided, else `us-east-1`.
 */
 async function resolveBucketRegion(bucketName, opts = {}) {
-	const cached = cache$1.get(bucketName);
+	const cached = cache.get(bucketName);
 	if (cached) return cached;
 	const promise = (async () => {
 		const client = new S3Client({
@@ -1022,7 +1022,7 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 			client.destroy();
 		}
 	})();
-	cache$1.set(bucketName, promise);
+	cache.set(bucketName, promise);
 	return promise;
 }
 /**
@@ -1030,7 +1030,7 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 * cases — production code never needs to call this.
 */
 function clearBucketRegionCache() {
-	cache$1.clear();
+	cache.clear();
 }
 /**
 * Resolve the cdkd state bucket name + region for a sibling AWS account.
@@ -2359,53 +2359,157 @@ function collectFnTransformNames(value, seen, out) {
 */
 var expected_bucket_owner_exports = /* @__PURE__ */ __exportAll({
 	expectedOwnerParam: () => expectedOwnerParam,
+	recordResolvedAccountId: () => recordResolvedAccountId,
 	resolveExpectedBucketOwner: () => resolveExpectedBucketOwner
 });
-const cache = /* @__PURE__ */ new WeakMap();
+/**
+* Fast path: per-S3-client memoization, so repeated calls on ONE client skip
+* even the (local) credential resolution.
+*/
+const clientCache = /* @__PURE__ */ new WeakMap();
+/**
+* Slow path: the actual `sts:GetCallerIdentity`, memoized by the resolved
+* **access key id** rather than by client identity (issue #1283).
+*
+* Why this key is both correct and safe:
+*
+*  - An AWS access key id belongs to exactly ONE account, so "the account
+*    behind these credentials" is a deterministic function of the credentials.
+*    Keying on it is semantically identical to resolving per client — it is
+*    strictly a better cache key for the same question.
+*  - It cannot leak one identity's account onto another. An assumed-role
+*    session has its own (`ASIA…`) key id, so the cross-account
+*    `Fn::GetStackOutput` `RoleArn` path — whose ephemeral client carries the
+*    ASSUMED credentials and must resolve the PRODUCER account — still misses
+*    the cache and resolves its own account, exactly as before.
+*
+* The per-client WeakMap alone could not collapse the calls this cache
+* collapses: cdkd builds several S3 clients from the SAME credential chain in
+* one deploy preflight (the bucket-existence probe, the shared
+* `AwsClients.s3`, and the region-corrected client `ensureClientForBucket`
+* rebuilds), each of which used to pay its own STS round trip — with a fresh
+* TLS handshake, since each resolution constructs and destroys its own
+* `STSClient`.
+*/
+const credentialsCache = /* @__PURE__ */ new Map();
+/**
+* Resolve (and memoize) the account id behind a specific set of credentials.
+*
+* Failures are deliberately NOT cached — a transient STS throttle at process
+* start must not silently disable the header for the rest of the run (mirrors
+* write-only-properties.ts's no-failure-caching).
+*/
+function resolveAccountIdForCredentials(region, credentials) {
+	const key = credentials.accessKeyId;
+	const cached = credentialsCache.get(key);
+	if (cached) return cached;
+	const promise = (async () => {
+		const sts = new STSClient({
+			...typeof region === "string" && region ? { region } : {},
+			credentials: {
+				accessKeyId: credentials.accessKeyId,
+				secretAccessKey: credentials.secretAccessKey,
+				...credentials.sessionToken && { sessionToken: credentials.sessionToken }
+			}
+		});
+		try {
+			return (await sts.send(new GetCallerIdentityCommand({}))).Account;
+		} finally {
+			sts.destroy();
+		}
+	})();
+	credentialsCache.set(key, promise);
+	promise.catch(() => {
+		if (credentialsCache.get(key) === promise) credentialsCache.delete(key);
+	});
+	return promise;
+}
+/**
+* Read a client's resolved region + credentials, or `undefined` when the
+* client is a test double / non-standard object.
+*/
+async function readClientIdentity(client) {
+	const config = client.config;
+	if (!config || typeof config.region !== "function" || typeof config.credentials !== "function") return;
+	return {
+		region: await config.region(),
+		credentials: await config.credentials() ?? {}
+	};
+}
 /**
 * Resolve the AWS account id of the caller behind an S3 client's
-* credentials. Cached per client instance for the process lifetime (a
-* region-rebuilt replacement client re-resolves once — same credentials,
-* one extra STS call).
+* credentials. Memoized per client instance AND — for the STS call itself —
+* per resolved access key id, for the process lifetime.
 *
 * Works for the cross-account state-read path too (`Fn::GetStackOutput`
 * `RoleArn`): the ephemeral backend's client carries the ASSUMED
-* credentials, so the resolved owner is the producer account — exactly the
-* owner its `cdkd-state-{producerAccountId}` bucket must have.
+* credentials, whose access key id differs from the default chain's, so the
+* resolved owner is the producer account — exactly the owner its
+* `cdkd-state-{producerAccountId}` bucket must have.
 */
 function resolveExpectedBucketOwner(client) {
-	const cached = cache.get(client);
+	const cached = clientCache.get(client);
 	if (cached) return cached;
 	const promise = (async () => {
 		try {
-			const config = client.config;
-			if (!config || typeof config.region !== "function" || typeof config.credentials !== "function") return;
-			const region = await config.region();
-			const credentials = await config.credentials();
-			if (!credentials?.accessKeyId || !credentials.secretAccessKey) return;
-			const sts = new STSClient({
-				...typeof region === "string" && region ? { region } : {},
-				credentials: {
-					accessKeyId: credentials.accessKeyId,
-					secretAccessKey: credentials.secretAccessKey,
-					...credentials.sessionToken && { sessionToken: credentials.sessionToken }
-				}
+			const identity = await readClientIdentity(client);
+			if (!identity) return;
+			const { region, credentials } = identity;
+			if (!credentials.accessKeyId || !credentials.secretAccessKey) return;
+			return await resolveAccountIdForCredentials(region, {
+				...credentials,
+				accessKeyId: credentials.accessKeyId,
+				secretAccessKey: credentials.secretAccessKey
 			});
-			try {
-				return (await sts.send(new GetCallerIdentityCommand({}))).Account;
-			} finally {
-				sts.destroy();
-			}
 		} catch (error) {
 			getLogger().debug(`ExpectedBucketOwner resolution skipped (header omitted): ${String(error)}`);
-			cache.delete(client);
+			clientCache.delete(client);
 			return;
 		}
 	})();
-	cache.set(client, promise);
+	clientCache.set(client, promise);
 	return promise;
 }
 /**
+* Record an account id that a `sts:GetCallerIdentity` **already issued with
+* this client's own credentials** returned, so the next
+* {@link resolveExpectedBucketOwner} for any client sharing those credentials
+* is a cache hit instead of a second round trip (issue #1283).
+*
+* This is a memoization of a call that just happened, NOT an override:
+*
+*  - The account is keyed by the credentials THIS client resolves, read from
+*    the client itself. The caller cannot name the key, so it cannot attach
+*    an account to credentials it does not hold.
+*  - Consequently it can never be applied to a client carrying assumed or
+*    foreign credentials on behalf of a different identity: seeding with an
+*    assumed-credentials client records that SESSION's own account, under
+*    that session's `ASIA…` key id, affecting only calls made with those
+*    same credentials. There is deliberately no global "current account"
+*    setter.
+*
+* The one real precondition — that `accountId` came from a
+* `GetCallerIdentity` made with `client`'s credentials — is why the only
+* caller is the state-bucket default-name resolution, which does exactly
+* that, on the line above the call.
+*
+* Best-effort: a non-standard client (test double) or an unresolvable
+* credential chain is a silent no-op; a later resolution just pays the round
+* trip it would have paid anyway.
+*/
+async function recordResolvedAccountId(client, accountId) {
+	if (!accountId) return;
+	try {
+		const identity = await readClientIdentity(client);
+		const accessKeyId = identity?.credentials.accessKeyId;
+		if (!accessKeyId || !identity.credentials.secretAccessKey) return;
+		if (credentialsCache.has(accessKeyId)) return;
+		credentialsCache.set(accessKeyId, Promise.resolve(accountId));
+	} catch (error) {
+		getLogger().debug(`ExpectedBucketOwner seed skipped: ${String(error)}`);
+	}
+}
+/**
 * Spread helper: `{...(await expectedOwnerParam(client))}` adds
 * `ExpectedBucketOwner` when the owner resolved, nothing otherwise.
 */
@@ -2903,6 +3007,33 @@ function resolveApp(cliApp) {
 	return loadCdkJson()?.app ?? void 0;
 }
 /**
+* Did this resolution already prove the bucket is there AND usable by these
+* credentials — making the state backend's own `HeadBucket` pure duplication?
+*
+* Both conditions matter:
+*
+*  - The source must be a default-name path.
+*    {@link resolveStateBucketWithDefaultAndSource} picks between
+*    `cdkd-state-{accountId}` and the legacy `cdkd-state-{accountId}-{region}`
+*    by `HeadBucket`-ing both, with the same credentials the state client
+*    will use. An explicitly-specified bucket (`--state-bucket` /
+*    `CDKD_STATE_BUCKET` / `cdk.json`) is taken verbatim and never probed.
+*  - The probe must have come back `'ok'`. A 403 counts as "exists" for
+*    NAME resolution but says nothing good about usability, and it is
+*    precisely the case where a second `HeadBucket` still earns its round
+*    trip — it turns a confusing mid-deploy state-read failure into an
+*    up-front "Access denied" before any asset is published.
+*
+* Consumed by `cdkd deploy` to skip the duplicate `HeadBucket` in
+* `S3StateBackend.verifyBucketExists` (issue
+* [#1283](https://github.com/go-to-k/cdkd/issues/1283)) — one fewer sequential
+* round trip on the deploy preflight's critical path.
+*/
+function stateBucketExistenceConfirmed(resolved) {
+	if (resolved.source !== "default" && resolved.source !== "default-legacy") return false;
+	return resolved.probe === "ok";
+}
+/**
 * Resolve the `--capture-observed-state` / `--no-capture-observed-state`
 * option's effective value, falling through to `cdk.json
 * context.cdkd.captureObservedState` when the CLI flag was not passed.
@@ -3074,43 +3205,60 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 	const logger = getLogger();
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const { S3Client } = await import("@aws-sdk/client-s3");
+	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
 	const { getAwsClients } = await Promise.resolve().then(() => aws_clients_exports);
-	const accountId = (await getAwsClients().sts.send(new GetCallerIdentityCommand({}))).Account;
+	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
+	const probeDeps = {
+		HeadBucketCommand,
+		ListObjectsV2Command,
+		expectedOwnerParam
+	};
+	const stsClient = getAwsClients().sts;
+	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
+	await recordResolvedAccountId(stsClient, accountId);
 	const newName = getDefaultStateBucketName(accountId);
 	const legacyName = getLegacyStateBucketName(accountId, region);
-	const probe = new S3Client({ region: "us-east-1" });
+	const stsCredentials = stsClient.config?.credentials;
+	const probe = new S3Client({
+		region: "us-east-1",
+		...typeof stsCredentials === "function" && { credentials: stsCredentials }
+	});
 	try {
-		const newExists = await bucketExists(probe, newName);
-		const legacyExists = await bucketExists(probe, legacyName);
+		const [newProbe, legacyProbe] = await Promise.all([probeBucket(probe, newName, probeDeps), probeBucket(probe, legacyName, probeDeps)]);
+		const newExists = newProbe !== "missing";
+		const legacyExists = legacyProbe !== "missing";
 		if (newExists && legacyExists) {
-			if (!await bucketHasAnyState(probe, newName)) {
-				if (await bucketHasAnyState(probe, legacyName)) {
+			if (!await bucketHasAnyState(probe, newName, probeDeps)) {
+				if (await bucketHasAnyState(probe, legacyName, probeDeps)) {
 					logger.warn(`Both '${newName}' (new default) and '${legacyName}' (legacy default) exist, but the new bucket is empty and the legacy one has state. Reading from legacy. Run \`cdkd state migrate --region ${region}\` to copy the state into the new bucket and stop seeing this warning.`);
 					return {
 						bucket: legacyName,
-						source: "default-legacy"
+						source: "default-legacy",
+						probe: legacyProbe
 					};
 				}
 			}
 			logger.debug(`State bucket: ${newName}`);
 			return {
 				bucket: newName,
-				source: "default"
+				source: "default",
+				probe: newProbe
 			};
 		}
 		if (newExists) {
 			logger.debug(`State bucket: ${newName}`);
 			return {
 				bucket: newName,
-				source: "default"
+				source: "default",
+				probe: newProbe
 			};
 		}
 		if (legacyExists) {
 			logger.warn(`Using legacy state bucket name '${legacyName}'. The default has changed to '${newName}'. To migrate, run:\n\n    cdkd state migrate --region ${region}\n\n(add --remove-legacy to delete the legacy bucket after a successful copy; legacy support will be dropped in a future release.)`);
 			return {
 				bucket: legacyName,
-				source: "default-legacy"
+				source: "default-legacy",
+				probe: legacyProbe
 			};
 		}
 		throw new Error(`No cdkd state bucket found for account ${accountId}. Looked for '${newName}' (current default) and '${legacyName}' (legacy default). Run 'cdkd bootstrap' to create '${newName}'.`);
@@ -3131,9 +3279,8 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 * downstream getState call will surface the real read error); a false
 * negative would silently route to legacy and be confusing.
 */
-async function bucketHasAnyState(client, bucketName) {
-	const { ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { expectedOwnerParam } = await Promise.resolve().then(() => expected_bucket_owner_exports);
+async function bucketHasAnyState(client, bucketName, deps) {
+	const { ListObjectsV2Command, expectedOwnerParam } = deps;
 	try {
 		return ((await client.send(new ListObjectsV2Command({
 			Bucket: bucketName,
@@ -3148,30 +3295,35 @@ async function bucketHasAnyState(client, bucketName) {
 /**
 * Probe whether an S3 bucket exists from this account's perspective.
 *
-* Returns:
-*  - `true` for any 2xx (`HeadBucket` succeeded) **or** 301 (the bucket
+* Returns a {@link BucketProbeOutcome}:
+*  - `'ok'` for any 2xx (`HeadBucket` succeeded) **or** 301 (the bucket
 *    exists, just in a different region — we can still use it because the
 *    real region is resolved later by `resolveBucketRegion`).
-*  - `true` for 403 (we lack permission to head it, but it exists; let the
-*    state-backend produce a more specific error later).
-*  - `false` for 404 / `NotFound` / `NoSuchBucket`.
+*  - `'access-denied'` for 403 (we lack permission to head it, but it
+*    exists; name resolution still picks it and the state backend produces
+*    a more specific error later).
+*  - `'missing'` for 404 / `NotFound` / `NoSuchBucket`.
 *  - Re-throws anything else so credential / network failures aren't silently
 *    swallowed by the lookup chain.
+*
+* Name resolution only cares about `'missing'` vs. not; the `'ok'` /
+* `'access-denied'` split exists so `stateBucketExistenceConfirmed` can tell
+* "already verified" from "merely known to exist" (issue #1283).
 */
-async function bucketExists(client, bucketName) {
-	const { HeadBucketCommand } = await import("@aws-sdk/client-s3");
-	const { expectedOwnerParam } = await Promise.resolve().then(() => expected_bucket_owner_exports);
+async function probeBucket(client, bucketName, deps) {
+	const { HeadBucketCommand, expectedOwnerParam } = deps;
 	try {
 		await client.send(new HeadBucketCommand({
 			Bucket: bucketName,
 			...await expectedOwnerParam(client)
 		}));
-		return true;
+		return "ok";
 	} catch (error) {
 		const err = error;
 		const status = err.$metadata?.httpStatusCode;
-		if (err.name === "NotFound" || err.name === "NoSuchBucket" || status === 404) return false;
-		if (status === 301 || status === 403) return true;
+		if (err.name === "NotFound" || err.name === "NoSuchBucket" || status === 404) return "missing";
+		if (status === 301) return "ok";
+		if (status === 403) return "access-denied";
 		throw error;
 	}
 }
@@ -5546,8 +5698,12 @@ var S3StateBackend = class {
 	async ownerParam() {
 		return expectedOwnerParam(this.s3Client);
 	}
-	async verifyBucketExists() {
+	async verifyBucketExists(options = {}) {
 		await this.ensureClientForBucket();
+		if (options.existenceAlreadyProbed) {
+			this.logger.debug(`Skipping the redundant HeadBucket on '${this.config.bucket}' — the default-name resolution already confirmed it exists with these credentials (issue #1283).`);
+			return;
+		}
 		try {
 			await this.s3Client.send(new HeadBucketCommand({
 				Bucket: this.config.bucket,
@@ -11637,7 +11793,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C156B4uU.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-ZylgRJOY.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -13373,6 +13529,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		handled: /* @__PURE__ */ new Set(["DistributionConfig", "Tags"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
+	["AWS::CloudFront::OriginAccessControl", {
+		handled: /* @__PURE__ */ new Set(["OriginAccessControlConfig"]),
+		silentDrop: /* @__PURE__ */ new Map()
+	}],
 	["AWS::CloudTrail::Trail", {
 		handled: /* @__PURE__ */ new Set([
 			"CloudWatchLogsLogGroupArn",
@@ -17345,7 +17505,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.267.19";
+	return "0.268.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -19350,5 +19510,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { WorkGraph as $, NestedStackChildDirectDestroyError as $t, slowCcOperationTimeoutMs as A, CFN_TEMPLATE_BODY_LIMIT as At, applyRoleArnIfSet as B, AwsClients as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, expectedOwnerParam as Ft, DagBuilder as G, CdkdError as Gt, describeTypeWithThrottleRetry as H, resetAwsClients as Ht, WAFv2WebACLProvider as I, AssemblyReader as It, S3StateBackend as J, LocalInvokeBuildError as Jt, TemplateParser as K, ConfigError as Kt, normalizeAwsTagsToCfn as L, processStackMessages as Lt, isTerminationProtectionPropagationError as M, MIGRATE_TMP_PREFIX as Mt, IntrinsicFunctionResolver as N, findLargeInlineResources as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, uploadCfnTemplate as Pt, stringifyValue as Q, MissingCdkCliError as Qt, resolveExplicitPhysicalId as R, clearBucketRegionCache as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, setAwsClients as Ut, DiffCalculator as V, getAwsClients as Vt, isRetryableTransientError as W, AssetError as Wt, shouldRetainResource as X, LocalStartServiceError as Xt, rebuildClientForBucketRegion as Y, LocalMigrateError as Yt, AssetPublisher as Z, LockError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, StackTerminationProtectionError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, formatError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, withErrorHandling as dn, buildDockerImage as dt, PartialFailureError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, __exportAll as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, StackHasActiveImportsError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_URL_LIMIT as jt, CloudControlProvider as k, warnDeprecatedNoPrefixCliFlag as kt, replayRollback as l, isCdkdError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceTimeoutError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StateError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, getDockerCmd as pt, LockManager as q, DependencyError as qt, DeployEngine as r, ResourceUpdateNotSupportedError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, SynthesisError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ProvisioningError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, normalizeAwsError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, resolveBucketRegion as zt };
-//# sourceMappingURL=deploy-engine-CZCV0ofI.js.map
+export { WorkGraph as $, MissingCdkCliError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LockError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalMigrateError as Xt, rebuildClientForBucketRegion as Y, LocalInvokeBuildError as Yt, AssetPublisher as Z, LocalStartServiceError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, StackHasActiveImportsError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, SynthesisError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, normalizeAwsError as dn, buildDockerImage as dt, NestedStackChildDirectDestroyError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, withErrorHandling as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceUpdateNotSupportedError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, formatError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ProvisioningError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackTerminationProtectionError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, __exportAll as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ResourceTimeoutError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StateError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, PartialFailureError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, isCdkdError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
+//# sourceMappingURL=deploy-engine-B5cRuFij.js.map