@go-to-k/cdkd 0.267.3 → 0.267.4

package/dist/{deploy-engine-CXHDJKCt.js → deploy-engine-DYrhAO-0.js}

@@ -7486,6 +7486,266 @@ var ReplacementRulesRegistry = class {
 	}
 };
 
+//#endregion
+//#region src/deployment/retryable-errors.ts
+/**
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*/
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
+	"cannot be assumed",
+	"Firehose is unable to assume role",
+	"is unable to assume provided role",
+	"role defined for the function",
+	"not authorized to perform",
+	"execution role",
+	"trust policy",
+	"Role validation failed",
+	"does not have required permissions",
+	"Trusted Entity",
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"Invalid principal in policy",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
+	"required permissions for: ENHANCED_MONITORING",
+	"Caught ServiceAccessDeniedException",
+	"permissions required to assume the role",
+	"authorized to assume the provided role",
+	"conflicting conditional operation",
+	"scheduled for deletion",
+	"Cannot access stream",
+	"Please ensure the role can perform",
+	"KMS key is invalid for CreateGrant",
+	"Policy contains a statement with one or more invalid principals",
+	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
+	"Could not deliver test message",
+	"wait 60 seconds",
+	"concurrent update operation",
+	"because it is in use",
+	"Rate exceeded"
+];
+/**
+* HTTP status codes that always indicate a transient failure worth retrying.
+* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
+*/
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
+/**
+* AWS SDK v3 canonical throttling error names. Mirrors
+* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
+* error (or wrapped cause) whose `name` is one of these is a transient rate-
+* limit rejection worth retrying with backoff. Detecting by NAME is more
+* robust than by HTTP status because most AWS throttles surface as HTTP 400
+* (not 429) with the throttling signal carried only in the error code / name
+* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
+*/
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
+/**
+* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
+* signal — either an AWS SDK v3 throttling error `name`
+* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
+* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
+*
+* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
+* typically one cause-link deep; the bounded walk also tolerates SDK errors
+* that nest a `$response`/cause without exploding on a cyclic chain.
+*
+* BOTH signals are checked at EVERY depth. An earlier version checked the name
+* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
+* links deep was missed.
+*/
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
+* Determine whether an AWS error should be retried.
+*
+* Checks (in order):
+*   1. Rate-limit signal on the error or any wrapped cause — throttling error
+*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
+*      429, so the name check carries most of the weight). See
+*      {@link isThrottlingError}.
+*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
+*/
+function isRetryableTransientError(error, message) {
+	if (isThrottlingError(error)) return true;
+	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+/**
+* Match the "already exists" name-collision signature raised when a create
+* targets a physical name still held by another resource (or by the same
+* name's not-yet-released tombstone after an async delete).
+*
+* Deliberately NOT part of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}: a name
+* collision is only worth retrying at the specific re-create sites that just
+* deleted the old holder (the deploy engine's --replace delete-first fallback
+* and the rollback executor's reverse-replacement) — everywhere else it is a
+* genuine conflict that must fail fast. Shared by those sites' collision
+* detection + retry filters so a signature extension lands in one place.
+*/
+function isNameCollisionError(message) {
+	return /already exists/i.test(message) || message.includes("AlreadyExists");
+}
+/**
+* Match the SQS same-name re-creation cooldown: after `DeleteQueue`, creating
+* a queue with the SAME name inside ~60s fails with
+* `AWS.SimpleQueueService.QueueDeletedRecently` ("You must wait 60 seconds
+* after deleting a queue before you can create another with the same name").
+*
+* The generic transient table above already carries 'wait 60 seconds' for
+* plain CREATEs (rapid destroy → redeploy loops), but the delete-then-re-create
+* sites (the deploy engine's --replace delete-first fallback and the rollback
+* executor's reverse-replacement) override the retry filter with
+* {@link isNameCollisionError}, which this signature does NOT match — so a
+* replacement revert used to fail fast mid-flight with the resource absent
+* from both AWS and state (issue #1206). Those sites now OR this matcher into
+* their retry filter, with a schedule long enough to cover the 60s window.
+*
+* Kept separate from {@link isNameCollisionError} on purpose: a cooldown at a
+* create-first site must NOT be treated as a collision (deleting the new
+* resource would not release the cooldown on the old name).
+*/
+function isNameCooldownError(message) {
+	return message.includes("QueueDeletedRecently") || message.includes("wait 60 seconds");
+}
+/**
+* Retry filter for the delete-then-re-create sites: the old name holder was
+* just deleted, so both the late name release ("already exists" from an async
+* delete) and the SQS 60s name cooldown are worth waiting out. Pair with a
+* schedule that covers the full cooldown window (maxRetries 8, delays
+* 2s/4s/8s then capped at 10s ≈ 64s total sleep).
+*/
+function isRecreateRetryableError(message) {
+	return isNameCollisionError(message) || isNameCooldownError(message);
+}
+
+//#endregion
+//#region src/deployment/retry.ts
+/**
+* Retry helper for resource provisioning operations that hit transient
+* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
+* dependency violations, etc.).
+*
+* Extracted from DeployEngine so the backoff schedule can be unit-tested
+* in isolation. The retryable-error classifier itself lives in
+* `./retryable-errors.ts`.
+*/
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+* Run `operation`, retrying transient failures with exponential backoff
+* capped at `maxDelayMs`.
+*
+* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
+*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
+*
+* Non-retryable errors are rethrown immediately. The transient-error
+* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
+*/
+async function withRetry(operation, logicalId, opts = {}) {
+	const maxRetries = opts.maxRetries ?? 8;
+	const initialDelayMs = opts.initialDelayMs ?? 1e3;
+	const maxDelayMs = opts.maxDelayMs ?? 8e3;
+	const sleep = opts.sleep ?? defaultSleep;
+	let lastError;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await operation();
+	} catch (error) {
+		lastError = error;
+		const message = error instanceof Error ? error.message : String(error);
+		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
+		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
+		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
+		for (let waited = 0; waited < delay; waited += 1e3) {
+			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
+			await sleep(Math.min(1e3, delay - waited));
+		}
+	}
+	throw lastError;
+}
+
+//#endregion
+//#region src/provisioning/describe-type.ts
+/**
+* Shared `cloudformation:DescribeType` invocation with throttle-only retry
+* (issue #1236).
+*
+* DescribeType is throttled per-account, and a deploy can issue a burst of
+* them (the #1182 create-only schema prefetch describes every type in the
+* template at deploy start). A lookup issued moments later — the write-only
+* property resolution during a CC-routed UPDATE is the critical case — can
+* then be throttled past the SDK's own short retry, and the caller's graceful
+* fallback turns the transient throttle into a real failure: the minimal
+* update patch drops a load-bearing write-only property and the update
+* hard-fails (`AWS::ECS::Service.VolumeConfigurations`), or a replacement is
+* mis-classified from a missing create-only schema.
+*
+* The fix is to retry ONLY throttle-shaped failures ({@link isThrottlingError})
+* with the standard backoff before surfacing the error. Non-throttle failures
+* (a missing `cloudformation:DescribeType` permission being the important one)
+* are rethrown immediately so the callers' warn-and-fall-back path stays as
+* fast as before — a caller permanently without the permission must not pay a
+* retry sleep on every lookup.
+*/
+/**
+* Test seam: overriding `sleep` lets unit tests drive the backoff schedule
+* without real waits (mirrors macro-expander's `retryDelays`).
+*/
+const describeTypeRetryDelays = {};
+/**
+* Retries after the first attempt, throttle-shaped failures only. At the
+* default backoff (1s -> 2s -> 4s -> 8s) this adds at most ~15s of sleep —
+* enough to ride out a prefetch-burst throttle window, small next to the
+* failed-update + rollback cycle it prevents.
+*/
+const MAX_THROTTLE_RETRIES = 4;
+/**
+* Issue `DescribeType` for a resource type, retrying throttle-shaped failures
+* with exponential backoff. Any other failure (or a throttle persisting past
+* the retry budget) is thrown to the caller unchanged.
+*/
+function describeTypeWithThrottleRetry(resourceType) {
+	return withRetry(() => getAwsClients().cloudFormation.send(new DescribeTypeCommand({
+		Type: "RESOURCE",
+		TypeName: resourceType
+	})), resourceType, {
+		maxRetries: MAX_THROTTLE_RETRIES,
+		isRetryable: (_message, error) => isThrottlingError(error),
+		logger: getLogger().child("DescribeType"),
+		...describeTypeRetryDelays.sleep ? { sleep: describeTypeRetryDelays.sleep } : {}
+	});
+}
+
 //#endregion
 //#region src/provisioning/create-only-properties.ts
 /**
@@ -7642,10 +7902,7 @@ function isIntrinsicShaped(value) {
 */
 async function fetchCreateOnlyPropertyPaths(resourceType) {
 	const logger = getLogger().child("CreateOnlyProperties");
-	const response = await getAwsClients().cloudFormation.send(new DescribeTypeCommand({
-		Type: "RESOURCE",
-		TypeName: resourceType
-	}));
+	const response = await describeTypeWithThrottleRetry(resourceType);
 	const result = [];
 	if (response.Schema) {
 		const createOnly = JSON.parse(response.Schema).createOnlyProperties;
@@ -10826,10 +11083,7 @@ function getTopLevelWriteOnlyProperties(resourceType) {
 */
 async function fetchTopLevelWriteOnlyProperties(resourceType) {
 	const logger = getLogger().child("WriteOnlyProperties");
-	const response = await getAwsClients().cloudFormation.send(new DescribeTypeCommand({
-		Type: "RESOURCE",
-		TypeName: resourceType
-	}));
+	const response = await describeTypeWithThrottleRetry(resourceType);
 	const result = /* @__PURE__ */ new Set();
 	if (response.Schema) {
 		const writeOnly = JSON.parse(response.Schema).writeOnlyProperties;
@@ -11354,7 +11608,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dj8krtJ3.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C8yQ0Br2.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -16401,214 +16655,6 @@ function computeImplicitDeleteEdges(resources) {
 	return edges;
 }
 
-//#endregion
-//#region src/deployment/retryable-errors.ts
-/**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
-	"cannot be assumed",
-	"Firehose is unable to assume role",
-	"is unable to assume provided role",
-	"role defined for the function",
-	"not authorized to perform",
-	"execution role",
-	"trust policy",
-	"Role validation failed",
-	"does not have required permissions",
-	"Trusted Entity",
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
-	"Invalid principal in policy",
-	"Policy Error: PrincipalNotFound",
-	"Invalid value for the parameter Policy",
-	"required permissions for: ENHANCED_MONITORING",
-	"Caught ServiceAccessDeniedException",
-	"permissions required to assume the role",
-	"authorized to assume the provided role",
-	"conflicting conditional operation",
-	"scheduled for deletion",
-	"Cannot access stream",
-	"Please ensure the role can perform",
-	"KMS key is invalid for CreateGrant",
-	"Policy contains a statement with one or more invalid principals",
-	"Invalid IAM Instance Profile",
-	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
-	"Could not deliver test message",
-	"wait 60 seconds",
-	"concurrent update operation",
-	"because it is in use",
-	"Rate exceeded"
-];
-/**
-* HTTP status codes that always indicate a transient failure worth retrying.
-* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
-*/
-const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
-/**
-* AWS SDK v3 canonical throttling error names. Mirrors
-* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
-* error (or wrapped cause) whose `name` is one of these is a transient rate-
-* limit rejection worth retrying with backoff. Detecting by NAME is more
-* robust than by HTTP status because most AWS throttles surface as HTTP 400
-* (not 429) with the throttling signal carried only in the error code / name
-* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
-*/
-const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
-	"BandwidthLimitExceeded",
-	"EC2ThrottledException",
-	"LimitExceededException",
-	"PriorRequestNotComplete",
-	"ProvisionedThroughputExceededException",
-	"RequestLimitExceeded",
-	"RequestThrottled",
-	"RequestThrottledException",
-	"SlowDown",
-	"ThrottledException",
-	"Throttling",
-	"ThrottlingException",
-	"TooManyRequestsException",
-	"TransactionInProgressException"
-]);
-/**
-* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
-* signal — either an AWS SDK v3 throttling error `name`
-* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
-* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
-*
-* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
-* typically one cause-link deep; the bounded walk also tolerates SDK errors
-* that nest a `$response`/cause without exploding on a cyclic chain.
-*
-* BOTH signals are checked at EVERY depth. An earlier version checked the name
-* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
-* links deep was missed.
-*/
-function isThrottlingError(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		const name = current.name;
-		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
-		const status = current.$metadata?.httpStatusCode;
-		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
-		current = current.cause;
-	}
-	return false;
-}
-/**
-* Determine whether an AWS error should be retried.
-*
-* Checks (in order):
-*   1. Rate-limit signal on the error or any wrapped cause — throttling error
-*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
-*      429, so the name check carries most of the weight). See
-*      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
-*/
-function isRetryableTransientError(error, message) {
-	if (isThrottlingError(error)) return true;
-	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-/**
-* Match the "already exists" name-collision signature raised when a create
-* targets a physical name still held by another resource (or by the same
-* name's not-yet-released tombstone after an async delete).
-*
-* Deliberately NOT part of {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}: a name
-* collision is only worth retrying at the specific re-create sites that just
-* deleted the old holder (the deploy engine's --replace delete-first fallback
-* and the rollback executor's reverse-replacement) — everywhere else it is a
-* genuine conflict that must fail fast. Shared by those sites' collision
-* detection + retry filters so a signature extension lands in one place.
-*/
-function isNameCollisionError(message) {
-	return /already exists/i.test(message) || message.includes("AlreadyExists");
-}
-/**
-* Match the SQS same-name re-creation cooldown: after `DeleteQueue`, creating
-* a queue with the SAME name inside ~60s fails with
-* `AWS.SimpleQueueService.QueueDeletedRecently` ("You must wait 60 seconds
-* after deleting a queue before you can create another with the same name").
-*
-* The generic transient table above already carries 'wait 60 seconds' for
-* plain CREATEs (rapid destroy → redeploy loops), but the delete-then-re-create
-* sites (the deploy engine's --replace delete-first fallback and the rollback
-* executor's reverse-replacement) override the retry filter with
-* {@link isNameCollisionError}, which this signature does NOT match — so a
-* replacement revert used to fail fast mid-flight with the resource absent
-* from both AWS and state (issue #1206). Those sites now OR this matcher into
-* their retry filter, with a schedule long enough to cover the 60s window.
-*
-* Kept separate from {@link isNameCollisionError} on purpose: a cooldown at a
-* create-first site must NOT be treated as a collision (deleting the new
-* resource would not release the cooldown on the old name).
-*/
-function isNameCooldownError(message) {
-	return message.includes("QueueDeletedRecently") || message.includes("wait 60 seconds");
-}
-/**
-* Retry filter for the delete-then-re-create sites: the old name holder was
-* just deleted, so both the late name release ("already exists" from an async
-* delete) and the SQS 60s name cooldown are worth waiting out. Pair with a
-* schedule that covers the full cooldown window (maxRetries 8, delays
-* 2s/4s/8s then capped at 10s ≈ 64s total sleep).
-*/
-function isRecreateRetryableError(message) {
-	return isNameCollisionError(message) || isNameCooldownError(message);
-}
-
-//#endregion
-//#region src/deployment/retry.ts
-/**
-* Retry helper for resource provisioning operations that hit transient
-* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
-* dependency violations, etc.).
-*
-* Extracted from DeployEngine so the backoff schedule can be unit-tested
-* in isolation. The retryable-error classifier itself lives in
-* `./retryable-errors.ts`.
-*/
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/**
-* Run `operation`, retrying transient failures with exponential backoff
-* capped at `maxDelayMs`.
-*
-* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
-*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
-*
-* Non-retryable errors are rethrown immediately. The transient-error
-* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
-*/
-async function withRetry(operation, logicalId, opts = {}) {
-	const maxRetries = opts.maxRetries ?? 8;
-	const initialDelayMs = opts.initialDelayMs ?? 1e3;
-	const maxDelayMs = opts.maxDelayMs ?? 8e3;
-	const sleep = opts.sleep ?? defaultSleep;
-	let lastError;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		return await operation();
-	} catch (error) {
-		lastError = error;
-		const message = error instanceof Error ? error.message : String(error);
-		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
-		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
-		for (let waited = 0; waited < delay; waited += 1e3) {
-			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
-			await sleep(Math.min(1e3, delay - waited));
-		}
-	}
-	throw lastError;
-}
-
 //#endregion
 //#region src/deployment/resource-deadline.ts
 /**
@@ -17265,7 +17311,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.267.3";
+	return "0.267.4";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -19252,5 +19298,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { buildAssetRedirectMap as $, PartialFailureError as $t, findActionableSilentDrops as A, CFN_TEMPLATE_URL_LIMIT as At, resolveExplicitPhysicalId as B, getAwsClients as Bt, green as C, resolveCaptureObservedState as Ct, collectInlinePolicyNamesManagedBySiblings as D, resolveUseCdkBootstrapAssets as Dt, IAMRoleProvider as E, resolveStateBucketWithDefaultAndSource as Et, IntrinsicFunctionResolver as F, AssemblyReader as Ft, TemplateParser as G, ConfigError as Gt, applyRoleArnIfSet as H, setAwsClients as Ht, cfnRefValueFromPhysicalId as I, processStackMessages as It, rebuildClientForBucketRegion as J, LocalMigrateError as Jt, LockManager as K, DependencyError as Kt, refStateLookupFromResource as L, clearBucketRegionCache as Lt, slowCcOperationTimeoutMs as M, findLargeInlineResources as Mt, disableInstanceApiTermination as N, uploadCfnTemplate as Nt, clearOnUpdateRemoval as O, warnDeprecatedNoPrefixCliFlag as Ot, isTerminationProtectionPropagationError as P, expectedOwnerParam as Pt, WorkGraph as Q, NestedStackChildDirectDestroyError as Qt, WAFv2WebACLProvider as R, resolveBucketRegion as Rt, gray as S, resolveAutoAssetStorage as St, yellow as T, resolveStateBucketWithDefault as Tt, DiffCalculator as U, AssetError as Ut, assertRegionMatch as V, resetAwsClients as Vt, DagBuilder as W, CdkdError as Wt, AssetPublisher as X, LockError as Xt, shouldRetainResource as Y, LocalStartServiceError as Yt, stringifyValue as Z, MissingCdkCliError as Zt, isStatefulRecreateTargetSync as _, Synthesizer as _t, DeploymentEventsStore as a, StateError as an, ensureAssetStorage as at, bold as b, getLegacyStateBucketName as bt, replayFailedOperations as c, isCdkdError as cn, validateAssetBucketName as ct, withRetry as d, __exportAll as dn, formatDockerLoginError as dt, ProvisioningError as en, createAssetRedirectResolver as et, isRetryableTransientError as f, getDockerCmd as ft, MULTI_REGION_RECREATE_BLOCKED_TYPES as g, getDockerImageBySourceHash as gt, extractDeploymentEventError as h, AssetManifestLoader as ht, DeploymentEventsReader as i, StackTerminationProtectionError as in, BOOTSTRAP_MARKER_PREFIX as it, CloudControlProvider as j, MIGRATE_TMP_PREFIX as jt, ProviderRegistry as k, CFN_TEMPLATE_BODY_LIMIT as kt, replayRollback as l, normalizeAwsError as ln, validateContainerRepoName as lt, computeImplicitDeleteEdges as m, runDockerStreaming as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceUpdateNotSupportedError as nn, rewriteTemplateAssetReferences as nt, planFailedOps as o, SynthesisError as on, getBootstrapMarkerKey as ot, IMPLICIT_DELETE_DEPENDENCIES as p, runDockerForeground as pt, S3StateBackend as q, LocalInvokeBuildError as qt, DeployEngine as r, StackHasActiveImportsError as rn, AssetModeResolver as rt, planRollback as s, formatError as sn, parseBootstrapMarker as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ResourceTimeoutError as tn, loadPublishableAssetManifest as tt, withResourceDeadline as u, withErrorHandling as un, buildDockerImage as ut, renderStatefulReason as v, synthesisStatusMessage as vt, red as w, resolveSkipPrefix as wt, cyan as x, resolveApp as xt, formatResourceLine as y, getDefaultStateBucketName as yt, normalizeAwsTagsToCfn as z, AwsClients as zt };
-//# sourceMappingURL=deploy-engine-CXHDJKCt.js.map
+export { buildAssetRedirectMap as $, PartialFailureError as $t, slowCcOperationTimeoutMs as A, CFN_TEMPLATE_URL_LIMIT as At, applyRoleArnIfSet as B, getAwsClients as Bt, yellow as C, resolveCaptureObservedState as Ct, ProviderRegistry as D, resolveUseCdkBootstrapAssets as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefaultAndSource as Et, refStateLookupFromResource as F, AssemblyReader as Ft, TemplateParser as G, ConfigError as Gt, withRetry as H, setAwsClients as Ht, WAFv2WebACLProvider as I, processStackMessages as It, rebuildClientForBucketRegion as J, LocalMigrateError as Jt, LockManager as K, DependencyError as Kt, normalizeAwsTagsToCfn as L, clearBucketRegionCache as Lt, isTerminationProtectionPropagationError as M, findLargeInlineResources as Mt, IntrinsicFunctionResolver as N, uploadCfnTemplate as Nt, findActionableSilentDrops as O, warnDeprecatedNoPrefixCliFlag as Ot, cfnRefValueFromPhysicalId as P, expectedOwnerParam as Pt, WorkGraph as Q, NestedStackChildDirectDestroyError as Qt, resolveExplicitPhysicalId as R, resolveBucketRegion as Rt, red as S, resolveAutoAssetStorage as St, collectInlinePolicyNamesManagedBySiblings as T, resolveStateBucketWithDefault as Tt, isRetryableTransientError as U, AssetError as Ut, DiffCalculator as V, resetAwsClients as Vt, DagBuilder as W, CdkdError as Wt, AssetPublisher as X, LockError as Xt, shouldRetainResource as Y, LocalStartServiceError as Yt, stringifyValue as Z, MissingCdkCliError as Zt, formatResourceLine as _, Synthesizer as _t, DeploymentEventsStore as a, StateError as an, ensureAssetStorage as at, gray as b, getLegacyStateBucketName as bt, replayFailedOperations as c, isCdkdError as cn, validateAssetBucketName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, __exportAll as dn, formatDockerLoginError as dt, ProvisioningError as en, createAssetRedirectResolver as et, computeImplicitDeleteEdges as f, getDockerCmd as ft, renderStatefulReason as g, getDockerImageBySourceHash as gt, isStatefulRecreateTargetSync as h, AssetManifestLoader as ht, DeploymentEventsReader as i, StackTerminationProtectionError as in, BOOTSTRAP_MARKER_PREFIX as it, disableInstanceApiTermination as j, MIGRATE_TMP_PREFIX as jt, CloudControlProvider as k, CFN_TEMPLATE_BODY_LIMIT as kt, replayRollback as l, normalizeAwsError as ln, validateContainerRepoName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, runDockerStreaming as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceUpdateNotSupportedError as nn, rewriteTemplateAssetReferences as nt, planFailedOps as o, SynthesisError as on, getBootstrapMarkerKey as ot, extractDeploymentEventError as p, runDockerForeground as pt, S3StateBackend as q, LocalInvokeBuildError as qt, DeployEngine as r, StackHasActiveImportsError as rn, AssetModeResolver as rt, planRollback as s, formatError as sn, parseBootstrapMarker as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ResourceTimeoutError as tn, loadPublishableAssetManifest as tt, withResourceDeadline as u, withErrorHandling as un, buildDockerImage as ut, bold as v, synthesisStatusMessage as vt, IAMRoleProvider as w, resolveSkipPrefix as wt, green as x, resolveApp as xt, cyan as y, getDefaultStateBucketName as yt, assertRegionMatch as z, AwsClients as zt };
+//# sourceMappingURL=deploy-engine-DYrhAO-0.js.map