@go-to-k/cdkd 0.283.16 → 0.283.18

package/dist/{deploy-engine-C1wXn1V7.js → deploy-engine-B-0iA5XV.js}

@@ -236,11 +236,29 @@ function markNonRetryable(error) {
 * intended case and stays terminal. UPWARD is the inverse: wrapping a marked
 * refusal as the `cause` of a genuinely RETRYABLE outer error
 * (`new Error(msg, { cause: markedRefusal })`) makes the outer error terminal
-* too, because this walk finds the marker on the cause. Unconstructible today
-* (`ProvisioningError` is built with no `cause` at the one marking site), and
-* the failure is fail-fast rather than silent, but a future wrapper that
-* carries a marked cause into a transient error would stop retrying something
-* that should retry. Strip or re-raise the cause there rather than nesting it.
+* too, because this walk finds the marker on the cause. That shape IS
+* constructed today, on purpose: `deploy-engine.ts`'s `--strict-getatt`
+* output re-wrap threads `{ cause: error }` precisely so a marked resolver
+* refusal survives the wrap (issue #1874) — the wrapper inlines the refusal's
+* text, including template-controlled identifiers, so without the cause the
+* marker is dropped and the classifier can read the copied text as transient.
+* The hazard is therefore not "can this be built" but "is the OUTER error
+* genuinely retryable": wrapping a marked refusal as the cause of a
+* transient error would stop retrying something that should retry. Thread the
+* cause when the wrapper is as terminal as its cause (the case above); strip
+* or re-raise it when the wrapper is retryable in its own right. That applies
+* to every `markNonRetryable` call site — `grep -rn 'markNonRetryable(' src/`
+* is the authority, deliberately in place of a list here.
+*
+* **Do not restate the sites as a count or an enumeration.** Both have already
+* gone stale in this one comment: it first said "six", which was the count of
+* `IntrinsicResolutionRefusalError` THROW sites transplanted from the other
+* file, and the per-file list that replaced it was stale within a day, when a
+* parallel lane added two sites in `nested-stack-provider.ts`. Marking is a
+* per-site judgement any lane can make, so any tally written here is a
+* snapshot of one moment that then reads as complete — which is the defect
+* {@link file://../utils/error-handler.ts}'s own enumeration warning
+* describes. What is stable, and all a reader needs, is the RULE above.
 */
 function isMarkedNonRetryable(error) {
 	let current = error;
@@ -565,16 +583,45 @@ function formatDuration(ms) {
 * resolution, which speculatively tries `Ref` and then `Fn::GetAtt` and keeps
 * the raw `${...}` placeholder when neither resolves. That warn-and-keep is the
 * long-standing, deliberate behavior for a genuinely unknown variable — but a
-* bare `catch` around it also swallowed every REFUSAL the resolver raises on
-* purpose (`guardedPhysicalIdFallback`'s ARN / URL shape hard-fail, the
-* `--strict-getatt` rejection, `rejectPlaceholderArnAttribute`), so a template
-* that hard-fails when the reference sits in a resource property silently
-* degraded to shipping a literal `${Resource.Attribute}` to AWS when the
-* IDENTICAL reference was written inside an `Fn::Sub`.
+* bare `catch` around it also swallowed every REFUSAL raised on that PATH, so a
+* template that hard-fails when the reference sits in a resource property
+* silently degraded to shipping a literal `${Resource.Attribute}` to AWS when
+* the IDENTICAL reference was written inside an `Fn::Sub`.
 *
 * Throwing this class rather than a bare `Error` is what lets that catch
 * re-raise a refusal (carrying its own message and remedy) while leaving the
 * not-found path on warn-and-keep. Nothing else branches on it.
+*
+* **Throw sites split into two groups, and the enumeration is worth keeping
+* accurate** — an out-of-date one reads as "these are all of them", which is
+* how the #1730 site below went unlisted for three releases. All live in
+* `src/deployment/intrinsic-function-resolver.ts`:
+*
+* 1. Reachable from `Fn::Sub`'s `${LogicalId.Attribute}` form, i.e. the ones
+*    the laundering fix above is actually about: `guardedPhysicalIdFallback`'s
+*    ARN / URL shape hard-fail (the #1103 class), the `--strict-getatt`
+*    rejection, `rejectPlaceholderArnAttribute` (#1729), and the
+*    fabricated-account guard (#1730), which refuses to build a value from the
+*    placeholder account id when STS did not answer.
+* 2. NOT reachable from it, and thrown as this class only so that "deliberate
+*    refusal" is a property of the THROW rather than of the one catch that
+*    inspects it: `resolveSplit`'s two refusals of a non-string value (#1874).
+*    `Fn::Sub` cannot syntactically contain an `Fn::Split`, so those change no
+*    behavior by being this class.
+*
+* The class is deliberately NOT `markNonRetryable` at construction, unlike
+* {@link ResourceUpdateNotSupportedError}: EXACTLY ONE of its throw sites is
+* genuinely time-dependent — the fabricated-account guard, where
+* `getAccountInfo` caches a fabricated answer for only 10s precisely so a
+* later attempt can heal — so a constructor-level marker would wrongly make
+* that one terminal. Every OTHER site marks at its own `throw`: all five
+* decide from inputs a retry cannot change (a persisted state record, an
+* attribute-name suffix, a CLI flag, an already-resolved value's type), and
+* all five interpolate template-controlled text into their message, which the
+* SUBSTRING-matching retry classifiers can read as transient (issue #1838 —
+* a logical id like `MyDependencyViolationHandler` is enough). So the split is
+* "which SITE can heal", not "which class"; do not read the unmarked class as
+* a statement that these refusals are retryable.
 */
 var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
 	constructor(message, cause) {
@@ -11931,7 +11978,7 @@ var IntrinsicFunctionResolver = class {
 	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId) {
 		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
 		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
-		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: the recorded value "${value}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`);
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: the recorded value "${value}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
 	}
 	/**
 	* Construct resource attribute value based on resource type, refusing to
@@ -12306,8 +12353,8 @@ var IntrinsicFunctionResolver = class {
 	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId) {
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
-		if (expectsArnShape || expectsUrlShape) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
-		if (this.strictGetAtt) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		if (expectsArnShape || expectsUrlShape) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`));
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`));
 		this.physicalIdFallbackCount++;
 		this.logger.warn(`Unknown attribute ${attributeName} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
@@ -12435,15 +12482,143 @@ var IntrinsicFunctionResolver = class {
 		return result;
 	}
 	/**
+	* Render ONE `Fn::GetAtt` argument for {@link describeSplitValueSource}'s
+	* label. A string is emitted verbatim; anything else is named by its
+	* intrinsic key (`<Fn::Sub>`) or, failing that, as `<intrinsic>` — never by
+	* default stringification, whose answer for an object is `[object Object]`.
+	*/
+	renderGetAttArg(arg) {
+		if (typeof arg === "string") return arg;
+		if (typeof arg === "object" && arg !== null && !Array.isArray(arg)) {
+			const keys = Object.keys(arg);
+			const key = keys.length === 1 ? keys[0] : void 0;
+			if (key !== void 0 && (key === "Ref" || key.startsWith("Fn::"))) return `<${key}>`;
+		}
+		return "<intrinsic>";
+	}
+	/**
+	* Name the UNRESOLVED value argument of an `Fn::Split` for its refusal
+	* message (issue [#1874](https://github.com/go-to-k/cdkd/issues/1874)).
+	*
+	* `ResolverContext` carries no referencing logical id / attribute, and
+	* threading one through this cross-cutting file for a message would be a
+	* plumbing change out of proportion to the win. The value EXPRESSION is
+	* already in hand, though, and for the shapes that actually reach the
+	* refusal it is exactly what the user needs to find the site:
+	*
+	* - a list-valued `Fn::GetAtt` renders as `Fn::GetAtt [Zone, NameServers]`,
+	*   naming both the resource and the attribute;
+	* - a `Ref` to a `CommaDelimitedList` / `List<Number>` parameter — the
+	*   SECOND genuinely reachable array source, via `coerceParameterValue` —
+	*   renders as `Ref MyListParam`, naming the parameter.
+	*
+	* Anything else degrades to its bare intrinsic key, or to `undefined` for a
+	* literal (which the message then simply omits).
+	*
+	* `kind` is not decoration: the caller uses it to pick the remedy, since the
+	* `Fn::GetAtt` remedy (drop the `Fn::Split`, and the #1868 note for the
+	* reader whose `Fn::Split` was that bug's workaround) is irrelevant and
+	* confusing for a parameter reference or a hand-written literal.
+	*/
+	describeSplitValueSource(value) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+		const keys = Object.keys(value);
+		if (keys.length !== 1) return void 0;
+		const key = keys[0];
+		const args = value[key];
+		if (key === "Ref") return typeof args === "string" ? {
+			label: `Ref ${args}`,
+			kind: "ref"
+		} : {
+			label: "Ref",
+			kind: "ref"
+		};
+		if (key !== "Fn::GetAtt") return key.startsWith("Fn::") ? {
+			label: key,
+			kind: "other"
+		} : void 0;
+		if (Array.isArray(args)) return {
+			label: `Fn::GetAtt [${args.map((a) => this.renderGetAttArg(a)).join(", ")}]`,
+			kind: "getatt"
+		};
+		if (typeof args === "string") {
+			const dot = args.indexOf(".");
+			return {
+				label: `Fn::GetAtt [${dot === -1 ? args : `${args.slice(0, dot)}, ${args.slice(dot + 1)}`}]`,
+				kind: "getatt"
+			};
+		}
+		return {
+			label: "Fn::GetAtt",
+			kind: "getatt"
+		};
+	}
+	/**
 	* Resolve Fn::Split intrinsic function
 	*
 	* Fn::Split: [delimiter, string]
 	* Splits a string into a list of strings using the specified delimiter
+	*
+	* A non-string value is REFUSED, and an ARRAY is refused with its own
+	* message (issue [#1874](https://github.com/go-to-k/cdkd/issues/1874)).
+	* Passing an array through unchanged was considered and rejected: real
+	* CloudFormation rejects `Fn::Split` over a list too, so a template written
+	* that way was never valid CFn. It only ever worked because cdkd resolved
+	* `AWS::Route53::HostedZone.NameServers` to a comma-delimited STRING, which
+	* was the defect PR #1868 fixed — so the post-upgrade failure is a correct
+	* rejection of an invalid template, not a regression. Accepting the array
+	* would let cdkd deploy templates that `cdkd export` /
+	* `cdkd import --migrate-from-cloudformation` then cannot hand back to
+	* CloudFormation, breaking the bidirectional-migration guarantee. What WAS
+	* genuinely wrong is the message: `value must be a string, got object` names
+	* neither the situation nor the remedy.
+	*
+	* Both refusals throw {@link IntrinsicResolutionRefusalError} rather than a
+	* bare `Error`, matching the deliberate refusals already in this file. The
+	* #1740 laundering path this class exists for is NOT reachable from here
+	* today: `Fn::Sub`'s `${LogicalId.Attribute}` form cannot syntactically
+	* contain an `Fn::Split`, and its 2-arg variable-map form resolves each
+	* value through `resolveValue` OUTSIDE any catch, so either class would
+	* propagate identically there. Using the class anyway keeps "deliberate
+	* refusal" a property of the THROW rather than of the one catch that
+	* happens to inspect it. It does NOT make the refusal un-launderable: this
+	* file's own `evaluateConditions` catches everything per condition, warns,
+	* and downgrades that condition to `false`, so an `Fn::Split`-over-a-list
+	* inside a `Conditions` entry IS silently absorbed today — by both classes
+	* alike, so the choice regresses nothing, but the class is not a guarantee
+	* against a class-agnostic catch.
+	*
+	* Both are additionally `markNonRetryable` (issue #1838). The test is "can
+	* this ever succeed on a retry" — an `Fn::Split` over an array never can —
+	* NOT "does today's wording collide with a pattern", which is exactly the
+	* criterion `retryable-errors.ts` documents as insufficient: the classifiers
+	* match by SUBSTRING, and `sourceClause` interpolates template-controlled
+	* text, so a logical id like `MyDependencyViolationHandler` puts
+	* `DependencyViolation` (the table's only whitespace-free entry) into the
+	* message. Reachability is real even though resolution runs outside
+	* `withRetry` on the flat path: `NestedStackProvider.create` runs a child
+	* `DeployEngine.deploy()` and re-throws, and the parent wraps `create()` in
+	* `withRetry` — so inside a nested stack each retry re-runs a full child
+	* deploy plus rollback, up to the ~47s schedule, on a path that cannot
+	* succeed. Marked at the THROW rather than in the constructor because the
+	* class is retryable in general: its fabricated-account arm (see
+	* `constructGuardedAttribute`) IS genuinely time-dependent
+	* (`getAccountInfo` caches a fabricated answer for only 10s precisely so a
+	* later attempt can heal), so a constructor-level marker would wrongly make
+	* that one terminal too.
 	*/
 	async resolveSplit(splitArgs, context) {
 		const [delimiter, value] = splitArgs;
 		const resolvedValue = await this.resolveValue(value, context);
-		if (typeof resolvedValue !== "string") throw new Error(`Fn::Split: value must be a string, got ${typeof resolvedValue}`);
+		if (typeof resolvedValue !== "string") {
+			const source = this.describeSplitValueSource(value);
+			const sourceClause = source ? ` (from ${source.label})` : "";
+			if (Array.isArray(resolvedValue)) {
+				const remedy = source?.kind === "ref" ? `A CommaDelimitedList / List<Number> parameter is already a list.` : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a CommaDelimitedList / List<Number> parameter, Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
+				throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} is ALREADY a list (an array of ${resolvedValue.length} item${resolvedValue.length === 1 ? "" : "s"}), not a string. CloudFormation rejects Fn::Split over a list too, so this template is not valid CloudFormation either. Remove the Fn::Split and use the value directly. ${remedy}`));
+			}
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
+		}
 		const result = resolvedValue.split(delimiter);
 		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(result)}`);
 		return result;
@@ -14037,7 +14212,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C3dMUcV4.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D8Ln3-ij.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -21141,7 +21316,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.16";
+	return "0.283.18";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -23338,7 +23513,7 @@ var DeployEngine = class {
 					if (typeof exportName === "string") outputs[exportName] = value;
 				}
 			} catch (error) {
-				if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`);
+				if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, { cause: error });
 				this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
 				outputs[outputKey] = void 0;
 			}
@@ -23358,4 +23533,4 @@ var DeployEngine = class {
 
 //#endregion
 export { coerceCfnBoolean as $, resolveStateBucketWithDefault as $t, cyan as A, MissingCdkCliError as An, AssetModeResolver as At, findSilentDropProperties as B, formatError as Bn, getDockerCmd as Bt, makeCanonicalizePropertiesFn as C, ConfigError as Cn, stringifyValue as Ct, renderStatefulReason as D, LocalMigrateError as Dn, loadPublishableAssetManifest as Dt, isStatefulRecreateTargetSync as E, LocalInvokeBuildError as En, createAssetRedirectResolver as Et, IAMRoleProvider as F, ResourceUpdateNotSupportedError as Fn, validateAssetBucketName as Ft, IntrinsicFunctionResolver as G, isRetryableTransientError as Gn, Synthesizer as Gt, slowCcOperationTimeoutMs as H, normalizeAwsError as Hn, runDockerStreaming as Ht, collectInlinePolicyNamesManagedBySiblings as I, StackHasActiveImportsError as In, validateContainerRepoName as It, refStateLookupFromResource as J, __exportAll as Jn, getLegacyStateBucketName as Jt, cfnRefValueFromPhysicalId as K, isThrottlingError as Kn, synthesisStatusMessage as Kt, clearOnUpdateRemoval as L, StackTerminationProtectionError as Ln, buildDenyExternalAccessPolicy as Lt, green as M, PartialFailureError as Mn, ensureAssetStorage as Mt, red as N, ProvisioningError as Nn, getBootstrapMarkerKey as Nt, formatResourceLine as O, LocalStartServiceError as On, rewriteTemplateAssetReferences as Ot, yellow as P, ResourceTimeoutError as Pn, parseBootstrapMarker as Pt, assertRegionMatch as Q, resolveSkipPrefix as Qt, ProviderRegistry as R, StateError as Rn, buildDockerImage as Rt, unsupportedFinalSnapshotError as S, CdkdError as Sn, AssetPublisher as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, DeployCancelledError as Tn, buildAssetRedirectMap as Tt, disableInstanceApiTermination as U, withErrorHandling as Un, AssetManifestLoader as Ut, CloudControlProvider as V, isCdkdError as Vn, runDockerForeground as Vt, isTerminationProtectionPropagationError as W, isMarkedNonRetryable as Wn, getDockerImageBySourceHash as Wt, normalizeAwsTagsToCfn as X, resolveAutoAssetStorage as Xt, WAFv2WebACLProvider as Y, resolveApp as Yt, resolveExplicitPhysicalId as Z, resolveCaptureObservedState as Zt, buildFinalSnapshotIdentifier as _, AwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, CFN_TEMPLATE_URL_LIMIT as an, requireConfigObject as at, isFinalSnapshotError as b, setAwsClients as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, uploadCfnTemplate as cn, s3BucketDomainName as ct, deleteSkipReason as d, canonicalizeRegion as dn, s3BucketWebsiteUrl as dt, resolveStateBucketWithDefaultAndSource as en, configBooleanRefusal as et, withResourceDeadline as f, derivePartitionAndUrlSuffix as fn, applyRoleArnIfSet as ft, PRE_DELETE_SNAPSHOT_TYPES as g, resolveBucketRegion as gn, DagBuilder as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, clearBucketRegionCache as hn, withRetry as ht, DeploymentEventsReader as i, CFN_TEMPLATE_BODY_LIMIT as in, requireConfigArray as it, gray as j, NestedStackChildDirectDestroyError as jn, BOOTSTRAP_MARKER_PREFIX as jt, bold as k, LockError as kn, escapeRegExp as kt, replayRollback as l, expectedOwnerParam as ln, s3BucketDualStackDomainName as lt, computeImplicitDeleteEdges as m, processStackMessages as mn, describeTypeWithThrottleRetry as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, stateBucketExistenceConfirmed as nn, readConfigString as nt, planFailedOps as o, MIGRATE_TMP_PREFIX as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, AssemblyReader as pn, DiffCalculator as pt, getAccountInfo as q, markNonRetryable as qn, getDefaultStateBucketName as qt, DeployEngine as r, warnDeprecatedNoPrefixCliFlag as rn, replayWarn as rt, planRollback as s, findLargeInlineResources as sn, s3BucketArn as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveUseCdkBootstrapAssets as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, PARTITION_TABLE as un, s3BucketRegionalDomainName as ut, ccRoutedFinalSnapshotError as v, getAwsClients as vn, LockManager as vt, extractDeploymentEventError as w, DependencyError as wn, WorkGraph as wt, refusesFinalSnapshot as x, AssetError as xn, shouldRetainResource as xt, createPreDeleteFinalSnapshot as y, resetAwsClients as yn, S3StateBackend as yt, findActionableSilentDrops as z, SynthesisError as zn, formatDockerLoginError as zt };
-//# sourceMappingURL=deploy-engine-C1wXn1V7.js.map
+//# sourceMappingURL=deploy-engine-B-0iA5XV.js.map