@go-to-k/cdkd 0.281.17 → 0.281.18

package/dist/{deploy-engine-B6DcyQpS.js → deploy-engine-D-0t_IlI.js}

@@ -4176,11 +4176,70 @@ function cacheOptionToFlag(option) {
 	return flag;
 }
 
+//#endregion
+//#region src/utils/aws-partition.ts
+/**
+* AWS partition / URL-suffix derivation, shared across layers.
+*
+* Lives in `src/utils/` because it has consumers in two different layers: the
+* `cdkd local *` command family (which passes a region in once to keep the STS
+* hop minimal) and the provisioning layer's `AppSyncProvider`, which rebuilds a
+* child resource's ARN when AWS did not report one.
+*
+* It was originally defined in `src/local/ecs-task-resolver.ts`, which
+* re-exports it so every existing call site is unchanged; a provisioning
+* provider importing from `src/local/**` would invert the layering.
+*
+* NOTE `getAccountInfo().partition`
+* (`src/deployment/intrinsic-function-resolver.ts`) was hardcoded to `'aws'`
+* until issue #1730, which made it derive through THIS helper — so the two now
+* agree and either spelling is correct. Prefer this one where a region is
+* already in hand, since it needs no STS round trip.
+*/
+/**
+* Derive the AWS partition / URL suffix for an AWS region. Same mapping
+* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
+*/
+function derivePartitionAndUrlSuffix(region) {
+	if (region.startsWith("cn-")) return {
+		partition: "aws-cn",
+		urlSuffix: "amazonaws.com.cn"
+	};
+	if (region.startsWith("us-gov-")) return {
+		partition: "aws-us-gov",
+		urlSuffix: "amazonaws.com"
+	};
+	if (region.startsWith("us-iso-")) return {
+		partition: "aws-iso",
+		urlSuffix: "c2s.ic.gov"
+	};
+	if (region.startsWith("us-isob-")) return {
+		partition: "aws-iso-b",
+		urlSuffix: "sc2s.sgov.gov"
+	};
+	return {
+		partition: "aws",
+		urlSuffix: "amazonaws.com"
+	};
+}
+
 //#endregion
 //#region src/assets/docker-asset-publisher.ts
 /**
+* The ECR registry host suffix for a region (issue #1745).
+*
+* Every registry URI here was hardcoded to `amazonaws.com`, so outside the
+* commercial partition cdkd built a hostname that does not resolve —
+* `aws-cn` registries live under `amazonaws.com.cn`, and `us-iso*` under
+* `c2s.ic.gov` / `sc2s.sgov.gov`. Commercial output is byte-identical, which is
+* what makes the change safe to ship without a non-commercial account.
+*/
+function ecrUrlSuffix(region) {
+	return derivePartitionAndUrlSuffix(region).urlSuffix;
+}
+/**
 * Registries this process has already logged in to, keyed by registry host
-* (`<accountId>.dkr.ecr.<region>.amazonaws.com`, which uniquely encodes the
+* (`<accountId>.dkr.ecr.<region>.<urlSuffix>`, which uniquely encodes the
 * account + region credential context). ECR authorization tokens are valid
 * for ~12h and a deploy process is short-lived, so a successful login is
 * reused for the process lifetime — mirroring `cdk-assets`, which skips
@@ -4221,7 +4280,7 @@ var DockerAssetPublisher = class {
 			const repositoryName = this.resolvePlaceholders(dest.repositoryName, accountId, region);
 			const imageTag = this.resolvePlaceholders(dest.imageTag, accountId, region);
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
-			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
+			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
 			this.logger.debug(`Publishing Docker image ${asset.displayName || assetHash} → ${ecrUri}`);
 			const client = new ECRClient({ region: destRegion });
 			try {
@@ -4231,8 +4290,7 @@ var DockerAssetPublisher = class {
 				}
 				const localTag = `cdkd-asset-${assetHash}`;
 				await this.buildImage(asset, cdkOutputDir, localTag);
-				const fullUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
-				await this.tagAndPushWithLazyLogin(client, localTag, fullUri, accountId, destRegion);
+				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, accountId, destRegion);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
 				client.destroy();
@@ -4259,15 +4317,14 @@ var DockerAssetPublisher = class {
 			const repositoryName = this.resolvePlaceholders(dest.repositoryName, accountId, region);
 			const imageTag = this.resolvePlaceholders(dest.imageTag, accountId, region);
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
-			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
+			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
 			const client = new ECRClient({ region: destRegion });
 			try {
 				if (await this.imageExists(client, repositoryName, imageTag)) {
 					this.logger.debug(`Image already exists, skipping: ${ecrUri}`);
 					continue;
 				}
-				const fullUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
-				await this.tagAndPushWithLazyLogin(client, localTag, fullUri, accountId, destRegion);
+				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, accountId, destRegion);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
 				client.destroy();
@@ -4354,7 +4411,7 @@ var DockerAssetPublisher = class {
 	/**
 	* Authenticate with ECR via `docker login --password-stdin`.
 	*
-	* The login is cached per registry (`<accountId>.dkr.ecr.<region>`) for the
+	* The login is cached per registry (`<accountId>.dkr.ecr.<region>.<urlSuffix>`) for the
 	* process lifetime: a repeat publish to the same registry returns early
 	* without the `GetAuthorizationToken` call or the `docker login` subprocess
 	* (mirrors `cdk-assets`). ECR tokens are valid ~12h and a deploy process is
@@ -4366,7 +4423,7 @@ var DockerAssetPublisher = class {
 	* token that AWS has already expired.
 	*/
 	async ecrLogin(client, accountId, region, options = {}) {
-		const registryKey = `${accountId}.dkr.ecr.${region}.amazonaws.com`;
+		const registryKey = `${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
 		if (!options.force && loggedInRegistries.has(registryKey)) {
 			this.logger.debug(`Reusing cached ECR login for ${registryKey}`);
 			return;
@@ -4375,7 +4432,7 @@ var DockerAssetPublisher = class {
 		if (!authData?.authorizationToken) throw new AssetError("Failed to get ECR authorization token");
 		const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 		if (!username || password === void 0) throw new AssetError("ECR authorization token has unexpected shape (missing username/password)");
-		const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
+		const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
 		try {
 			await runDockerStreaming([
 				"login",
@@ -4995,8 +5052,8 @@ function evaluatePseudoParam(name, map) {
 	switch (name) {
 		case "AWS::AccountId": return map.accountId;
 		case "AWS::Region": return map.region;
-		case "AWS::Partition": return map.partition;
-		case "AWS::URLSuffix": return "amazonaws.com";
+		case "AWS::Partition": return derivePartitionAndUrlSuffix(map.region).partition;
+		case "AWS::URLSuffix": return derivePartitionAndUrlSuffix(map.region).urlSuffix;
 		default: throw new Error(`Not a foldable pseudo parameter: ${name}`);
 	}
 }
@@ -9232,53 +9289,6 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
-//#endregion
-//#region src/utils/aws-partition.ts
-/**
-* AWS partition / URL-suffix derivation, shared across layers.
-*
-* Lives in `src/utils/` because it has consumers in two different layers: the
-* `cdkd local *` command family (which passes a region in once to keep the STS
-* hop minimal) and the provisioning layer's `AppSyncProvider`, which rebuilds a
-* child resource's ARN when AWS did not report one.
-*
-* It was originally defined in `src/local/ecs-task-resolver.ts`, which
-* re-exports it so every existing call site is unchanged; a provisioning
-* provider importing from `src/local/**` would invert the layering.
-*
-* NOTE `getAccountInfo().partition`
-* (`src/deployment/intrinsic-function-resolver.ts`) was hardcoded to `'aws'`
-* until issue #1730, which made it derive through THIS helper — so the two now
-* agree and either spelling is correct. Prefer this one where a region is
-* already in hand, since it needs no STS round trip.
-*/
-/**
-* Derive the AWS partition / URL suffix for an AWS region. Same mapping
-* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
-*/
-function derivePartitionAndUrlSuffix(region) {
-	if (region.startsWith("cn-")) return {
-		partition: "aws-cn",
-		urlSuffix: "amazonaws.com.cn"
-	};
-	if (region.startsWith("us-gov-")) return {
-		partition: "aws-us-gov",
-		urlSuffix: "amazonaws.com"
-	};
-	if (region.startsWith("us-iso-")) return {
-		partition: "aws-iso",
-		urlSuffix: "c2s.ic.gov"
-	};
-	if (region.startsWith("us-isob-")) return {
-		partition: "aws-iso-b",
-		urlSuffix: "sc2s.sgov.gov"
-	};
-	return {
-		partition: "aws",
-		urlSuffix: "amazonaws.com"
-	};
-}
-
 //#endregion
 //#region src/provisioning/config-shape.ts
 /**
@@ -10767,7 +10777,7 @@ function buildUnknownIntrinsicError(key) {
 	const issueUrl = `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(title)}&labels=intrinsic-support`;
 	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function "${key}": cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
 }
-let cachedAccountInfo = null;
+let cachedAccountIdentity = null;
 /**
 * Cache for availability zones per region
 */
@@ -10786,18 +10796,30 @@ const cachedDynamicReferences = {};
 */
 const cachedEc2InstanceAttributes = {};
 /**
-* Re-derive the partition for a region the caller overrode (issue #1730).
+* The region this call answers for: the caller's override, else the ambient one.
 *
-* `partition` is a FUNCTION of `region`, so handing back a cached entry with a
-* different region than the one its partition was derived from would produce
-* `arn:aws:...:cn-north-1:...` for a `cn-` override. Every return path that
-* swaps the region goes through here.
+* Kept as one helper so the cached and the freshly-resolved paths cannot pick
+* different defaults (issue #1746).
 */
-function withOverrideRegion(info, region) {
+function effectiveAccountInfoRegion(overrideRegion) {
+	return overrideRegion || process.env["AWS_REGION"] || "us-east-1";
+}
+/**
+* Build the caller's full answer from the cached account identity (issue #1746).
+*
+* `partition` is a FUNCTION of `region`, so it is derived HERE — per call —
+* rather than carried alongside the account. This is what makes the cache safe
+* to share between callers with different regions: an `arn:aws:...:cn-north-1`
+* (or the inverse `arn:aws-cn:...:us-east-1`) is structurally valid, so nothing
+* downstream could catch it.
+*/
+function accountInfoFor(identity, overrideRegion) {
+	const region = effectiveAccountInfoRegion(overrideRegion);
 	return {
-		...info,
+		accountId: identity.accountId,
 		region,
-		partition: derivePartitionAndUrlSuffix(region).partition
+		partition: derivePartitionAndUrlSuffix(region).partition,
+		...identity.fabricated ? { fabricated: true } : {}
 	};
 }
 /**
@@ -10814,7 +10836,7 @@ function withOverrideRegion(info, region) {
 const FABRICATED_ACCOUNT_INFO_TTL_MS = 1e4;
 /** Test seam for {@link FABRICATED_ACCOUNT_INFO_TTL_MS} expiry. */
 const accountInfoClock = { now: () => Date.now() };
-let fabricatedAccountInfo = null;
+let fabricatedAccountIdentity = null;
 /**
 * The single in-flight lookup, so N concurrent callers share ONE round trip.
 *
@@ -10826,66 +10848,95 @@ let fabricatedAccountInfo = null;
 */
 let accountInfoInFlight = null;
 /**
+* Bumped by {@link resetAccountInfoCache}, so a lookup that was already in
+* flight cannot write the cache it was asked to forget.
+*
+* Without it the reset only cleared the SETTLED caches: an in-flight resolve
+* would land afterwards and re-populate `cachedAccountIdentity`, so the next
+* caller read the pre-reset account. That is the `*Once`-leak shape one layer
+* down — a later test silently inheriting an earlier one's answer — and the
+* reset's own comment already claimed to forget it.
+*/
+let accountInfoGeneration = 0;
+/**
 * Get AWS account information from STS
 */
 async function getAccountInfo(overrideRegion) {
-	const forRegion = (info) => overrideRegion && overrideRegion !== info.region ? withOverrideRegion(info, overrideRegion) : info;
-	if (cachedAccountInfo) return forRegion(cachedAccountInfo);
-	if (fabricatedAccountInfo && accountInfoClock.now() < fabricatedAccountInfo.expiresAt) return forRegion(fabricatedAccountInfo.info);
-	if (accountInfoInFlight) return forRegion(await accountInfoInFlight);
-	accountInfoInFlight = resolveAccountInfo(overrideRegion);
+	if (cachedAccountIdentity) return accountInfoFor(cachedAccountIdentity, overrideRegion);
+	if (fabricatedAccountIdentity && accountInfoClock.now() < fabricatedAccountIdentity.expiresAt) return accountInfoFor(fabricatedAccountIdentity.identity, overrideRegion);
+	if (accountInfoInFlight) return accountInfoFor(await accountInfoInFlight, overrideRegion);
+	const inFlight = resolveAccountIdentity();
+	accountInfoInFlight = inFlight;
 	try {
-		return forRegion(await accountInfoInFlight);
+		return accountInfoFor(await inFlight, overrideRegion);
 	} finally {
-		accountInfoInFlight = null;
+		if (accountInfoInFlight === inFlight) accountInfoInFlight = null;
 	}
 }
-async function resolveAccountInfo(overrideRegion) {
+async function resolveAccountIdentity() {
+	const generation = accountInfoGeneration;
+	const stillCurrent = () => generation === accountInfoGeneration;
 	const logger = getLogger().child("IntrinsicFunctionResolver");
 	const stsClient = getAwsClients().sts;
 	try {
 		const response = await stsClient.send(new GetCallerIdentityCommand({}));
 		const accountId = response.Account || "123456789012";
-		const region = overrideRegion || process.env["AWS_REGION"] || "us-east-1";
-		const partition = derivePartitionAndUrlSuffix(region).partition;
 		const resolved = {
 			accountId,
-			region,
-			partition,
 			...response.Account ? {} : { fabricated: true }
 		};
-		if (resolved.fabricated) fabricatedAccountInfo = {
-			info: resolved,
+		if (!stillCurrent()) {} else if (resolved.fabricated) fabricatedAccountIdentity = {
+			identity: resolved,
 			expiresAt: accountInfoClock.now() + FABRICATED_ACCOUNT_INFO_TTL_MS
 		};
 		else {
-			cachedAccountInfo = resolved;
-			fabricatedAccountInfo = null;
+			cachedAccountIdentity = resolved;
+			fabricatedAccountIdentity = null;
 		}
-		logger.debug(`Retrieved AWS account info: ${accountId}, ${region}, ${partition}`);
+		logger.debug(`Retrieved AWS account info: ${accountId}`);
 		return resolved;
 	} catch (error) {
 		logger.warn(`Failed to get AWS account info from STS: ${error instanceof Error ? error.message : String(error)}, using defaults`);
-		const region = overrideRegion || process.env["AWS_REGION"] || "us-east-1";
 		const fallback = {
 			accountId: process.env["AWS_ACCOUNT_ID"] || "123456789012",
-			region,
-			partition: derivePartitionAndUrlSuffix(region).partition,
 			...process.env["AWS_ACCOUNT_ID"] ? {} : { fabricated: true }
 		};
+		if (!stillCurrent()) return fallback;
 		if (fallback.fabricated) {
-			if (!cachedAccountInfo) fabricatedAccountInfo = {
-				info: fallback,
+			if (!cachedAccountIdentity) fabricatedAccountIdentity = {
+				identity: fallback,
 				expiresAt: accountInfoClock.now() + FABRICATED_ACCOUNT_INFO_TTL_MS
 			};
 		} else {
-			cachedAccountInfo = fallback;
-			fabricatedAccountInfo = null;
+			cachedAccountIdentity = fallback;
+			fabricatedAccountIdentity = null;
 		}
 		return fallback;
 	}
 }
 /**
+* Does a constructed `Fn::GetAtt` answer embed the placeholder account id?
+*
+* The guard in `constructGuardedAttribute` used to test
+* `typeof value === 'string'` directly (issue #1746). Every account-bearing
+* branch of `constructAttribute` returns a string today — the only non-string
+* returns are the EC2 IPv6 CIDR LISTS, which carry no account — so that was
+* complete as written, but a future list-valued attribute embedding an account
+* would have slipped past silently with no test failing. Walking string arrays
+* (one level, which is the shape `constructAttribute` actually produces) closes
+* it now rather than at the moment someone adds one. A non-string, non-array
+* value is not account-bearing by construction and is left alone.
+*
+* EXPORTED for its own test: no `constructAttribute` branch returns an
+* account-bearing array today, so the array arm is unreachable through the
+* public resolver API and would ship unexercised otherwise.
+*/
+function embedsAccountId(value, accountId) {
+	if (typeof value === "string") return value.includes(accountId);
+	if (Array.isArray(value)) return value.some((entry) => typeof entry === "string" && entry.includes(accountId));
+	return false;
+}
+/**
 * Collect every name referenced (Ref / Fn::Sub placeholder / other intrinsic
 * argument) by the sections cdkd actually evaluates: Resources, Outputs, and
 * Conditions. Deliberately excludes `Rules` (assertion-only, never evaluated
@@ -11349,7 +11400,7 @@ var IntrinsicFunctionResolver = class {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && typeof value === "string" && value.includes(accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -13404,7 +13455,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-MpqWnvQI.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CRgl7pV6.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -13554,7 +13605,7 @@ var CloudControlProvider = class {
 	* else's account, and the record heals on the resource's next update.
 	*/
 	async accountInfoForSynthesizedArn(resourceType, attributeName, physicalId) {
-		const accountInfo = await getAccountInfo();
+		const accountInfo = await getAccountInfo(await this.cloudControlClient.config.region());
 		if (accountInfo.fabricated) {
 			this.logger.warn(`Not enriching ${resourceType} ${attributeName} for ${physicalId}: STS did not report this deploy's account id, so the value would be built from a placeholder account and would be indistinguishable from a real one. Fix the credentials (or set AWS_ACCOUNT_ID) and deploy again — the record heals on the next update.`);
 			return;
@@ -20312,7 +20363,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.281.17";
+	return "0.281.18";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22480,5 +22531,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { replayWarn as $, findLargeInlineResources as $t, green as A, isCdkdError as An, buildDockerImage as At, slowCcOperationTimeoutMs as B, getLegacyStateBucketName as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, ResourceTimeoutError as Cn, AssetModeResolver as Ct, bold as D, StateError as Dn, parseBootstrapMarker as Dt, formatResourceLine as E, StackTerminationProtectionError as En, getBootstrapMarkerKey as Et, clearOnUpdateRemoval as F, AssetManifestLoader as Ft, getAccountInfo as G, resolveStateBucketWithDefault as Gt, isTerminationProtectionPropagationError as H, resolveAutoAssetStorage as Ht, ProviderRegistry as I, getDockerImageBySourceHash as It, normalizeAwsTagsToCfn as J, stateBucketExistenceConfirmed as Jt, refStateLookupFromResource as K, resolveStateBucketWithDefaultAndSource as Kt, findActionableSilentDrops as L, Synthesizer as Lt, yellow as M, withErrorHandling as Mn, getDockerCmd as Mt, IAMRoleProvider as N, __exportAll as Nn, runDockerForeground as Nt, cyan as O, SynthesisError as On, validateAssetBucketName as Ot, collectInlinePolicyNamesManagedBySiblings as P, runDockerStreaming as Pt, readConfigString as Q, MIGRATE_TMP_PREFIX as Qt, findSilentDropProperties as R, synthesisStatusMessage as Rt, extractDeploymentEventError as S, ProvisioningError as Sn, rewriteTemplateAssetReferences as St, renderStatefulReason as T, StackHasActiveImportsError as Tn, ensureAssetStorage as Tt, IntrinsicFunctionResolver as U, resolveCaptureObservedState as Ut, disableInstanceApiTermination as V, resolveApp as Vt, cfnRefValueFromPhysicalId as W, resolveSkipPrefix as Wt, assertRegionMatch as X, CFN_TEMPLATE_BODY_LIMIT as Xt, resolveExplicitPhysicalId as Y, warnDeprecatedNoPrefixCliFlag as Yt, configStringRefusal as Z, CFN_TEMPLATE_URL_LIMIT as Zt, createPreDeleteFinalSnapshot as _, LocalStartServiceError as _n, stringifyValue as _t, DeploymentEventsStore as a, resolveBucketRegion as an, DiffCalculator as at, unsupportedFinalSnapshotError as b, NestedStackChildDirectDestroyError as bn, createAssetRedirectResolver as bt, replayFailedOperations as c, resetAwsClients as cn, isRetryableTransientError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, CdkdError as dn, TemplateParser as dt, uploadCfnTemplate as en, requireConfigArray as et, computeImplicitDeleteEdges as f, ConfigError as fn, LockManager as ft, ccRoutedFinalSnapshotError as g, LocalMigrateError as gn, AssetPublisher as gt, buildFinalSnapshotIdentifier as h, LocalInvokeBuildError as hn, shouldRetainResource as ht, DeploymentEventsReader as i, clearBucketRegionCache as in, applyRoleArnIfSet as it, red as j, normalizeAwsError as jn, formatDockerLoginError as jt, gray as k, formatError as kn, validateContainerRepoName as kt, replayRollback as l, setAwsClients as ln, isThrottlingError as lt, PRE_DELETE_SNAPSHOT_TYPES as m, DeployCancelledError as mn, rebuildClientForBucketRegion as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssemblyReader as nn, requireConfigString as nt, planFailedOps as o, AwsClients as on, describeTypeWithThrottleRetry as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, DependencyError as pn, S3StateBackend as pt, WAFv2WebACLProvider as q, resolveUseCdkBootstrapAssets as qt, DeployEngine as r, processStackMessages as rn, derivePartitionAndUrlSuffix as rt, planRollback as s, getAwsClients as sn, withRetry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, expectedOwnerParam as tn, requireConfigObject as tt, withResourceDeadline as u, AssetError as un, DagBuilder as ut, isFinalSnapshotError as v, LockError as vn, WorkGraph as vt, isStatefulRecreateTargetSync as w, ResourceUpdateNotSupportedError as wn, BOOTSTRAP_MARKER_PREFIX as wt, makeCanonicalizePropertiesFn as x, PartialFailureError as xn, loadPublishableAssetManifest as xt, refusesFinalSnapshot as y, MissingCdkCliError as yn, buildAssetRedirectMap as yt, CloudControlProvider as z, getDefaultStateBucketName as zt };
-//# sourceMappingURL=deploy-engine-B6DcyQpS.js.map
+export { replayWarn as $, findLargeInlineResources as $t, green as A, isCdkdError as An, buildDockerImage as At, slowCcOperationTimeoutMs as B, getLegacyStateBucketName as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, ResourceTimeoutError as Cn, BOOTSTRAP_MARKER_PREFIX as Ct, bold as D, StateError as Dn, validateAssetBucketName as Dt, formatResourceLine as E, StackTerminationProtectionError as En, parseBootstrapMarker as Et, clearOnUpdateRemoval as F, AssetManifestLoader as Ft, getAccountInfo as G, resolveStateBucketWithDefault as Gt, isTerminationProtectionPropagationError as H, resolveAutoAssetStorage as Ht, ProviderRegistry as I, getDockerImageBySourceHash as It, normalizeAwsTagsToCfn as J, stateBucketExistenceConfirmed as Jt, refStateLookupFromResource as K, resolveStateBucketWithDefaultAndSource as Kt, findActionableSilentDrops as L, Synthesizer as Lt, yellow as M, withErrorHandling as Mn, getDockerCmd as Mt, IAMRoleProvider as N, __exportAll as Nn, runDockerForeground as Nt, cyan as O, SynthesisError as On, validateContainerRepoName as Ot, collectInlinePolicyNamesManagedBySiblings as P, runDockerStreaming as Pt, readConfigString as Q, MIGRATE_TMP_PREFIX as Qt, findSilentDropProperties as R, synthesisStatusMessage as Rt, extractDeploymentEventError as S, ProvisioningError as Sn, AssetModeResolver as St, renderStatefulReason as T, StackHasActiveImportsError as Tn, getBootstrapMarkerKey as Tt, IntrinsicFunctionResolver as U, resolveCaptureObservedState as Ut, disableInstanceApiTermination as V, resolveApp as Vt, cfnRefValueFromPhysicalId as W, resolveSkipPrefix as Wt, assertRegionMatch as X, CFN_TEMPLATE_BODY_LIMIT as Xt, resolveExplicitPhysicalId as Y, warnDeprecatedNoPrefixCliFlag as Yt, configStringRefusal as Z, CFN_TEMPLATE_URL_LIMIT as Zt, createPreDeleteFinalSnapshot as _, LocalStartServiceError as _n, WorkGraph as _t, DeploymentEventsStore as a, resolveBucketRegion as an, describeTypeWithThrottleRetry as at, unsupportedFinalSnapshotError as b, NestedStackChildDirectDestroyError as bn, loadPublishableAssetManifest as bt, replayFailedOperations as c, resetAwsClients as cn, isThrottlingError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, CdkdError as dn, LockManager as dt, uploadCfnTemplate as en, requireConfigArray as et, computeImplicitDeleteEdges as f, ConfigError as fn, S3StateBackend as ft, ccRoutedFinalSnapshotError as g, LocalMigrateError as gn, stringifyValue as gt, buildFinalSnapshotIdentifier as h, LocalInvokeBuildError as hn, AssetPublisher as ht, DeploymentEventsReader as i, clearBucketRegionCache as in, DiffCalculator as it, red as j, normalizeAwsError as jn, formatDockerLoginError as jt, gray as k, formatError as kn, derivePartitionAndUrlSuffix as kt, replayRollback as l, setAwsClients as ln, DagBuilder as lt, PRE_DELETE_SNAPSHOT_TYPES as m, DeployCancelledError as mn, shouldRetainResource as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssemblyReader as nn, requireConfigString as nt, planFailedOps as o, AwsClients as on, withRetry as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, DependencyError as pn, rebuildClientForBucketRegion as pt, WAFv2WebACLProvider as q, resolveUseCdkBootstrapAssets as qt, DeployEngine as r, processStackMessages as rn, applyRoleArnIfSet as rt, planRollback as s, getAwsClients as sn, isRetryableTransientError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, expectedOwnerParam as tn, requireConfigObject as tt, withResourceDeadline as u, AssetError as un, TemplateParser as ut, isFinalSnapshotError as v, LockError as vn, buildAssetRedirectMap as vt, isStatefulRecreateTargetSync as w, ResourceUpdateNotSupportedError as wn, ensureAssetStorage as wt, makeCanonicalizePropertiesFn as x, PartialFailureError as xn, rewriteTemplateAssetReferences as xt, refusesFinalSnapshot as y, MissingCdkCliError as yn, createAssetRedirectResolver as yt, CloudControlProvider as z, getDefaultStateBucketName as zt };
+//# sourceMappingURL=deploy-engine-D-0t_IlI.js.map