@go-to-k/cdkd 0.283.3 → 0.283.5

package/dist/{deploy-engine-DxpS3fJ9.js → deploy-engine-BcwNPlSk.js}

@@ -8234,6 +8234,84 @@ const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
 	"TransactionInProgressException"
 ]);
 /**
+* Marker for an error cdkd raised as a DELIBERATE refusal rather than as a
+* relayed AWS failure (issue [#1778](https://github.com/go-to-k/cdkd/issues/1778)).
+*
+* Every classifier below is SUBSTRING-based, which is the right shape for
+* relaying a vendor's message and the wrong one for cdkd's own prose: a
+* refusal message is assembled from values cdkd does not control — a provider
+* `reason`, a state-borne physicalId, a template logical id — and any of them
+* can happen to contain a retryable pattern. Measured: a resource named
+* `MyDependencyViolationSub` puts `DependencyViolation` in the message, so a
+* deterministic refusal was classified transient and burned the whole backoff
+* schedule before failing exactly as it would have immediately. Keeping the
+* offending values OUT of the message narrows that surface but cannot close
+* it, because a message with no identifiers at all is not diagnosable.
+*
+* A marker inverts the burden: the raiser STATES that the error is terminal,
+* so no wording can make it retryable. Deliberately a `Symbol.for` key —
+* global-registry symbols survive a duplicated module instance (dual
+* bundling), where a module-local symbol would silently stop matching — and
+* non-enumerable, so it cannot leak into a serialized error payload.
+*/
+const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
+/**
+* Mark a cdkd-authored refusal as terminal and return it, for
+* `throw markNonRetryable(new ProvisioningError(...))`.
+*
+* Reach for it when the error means "this cannot succeed on a retry" as a
+* matter of cdkd's own logic — NOT for a relayed AWS failure, whose
+* retryability is the classifiers' business.
+*
+* KNOWN LIVE INSTANCE NOT YET COVERED: `ResourceUpdateNotSupportedError`
+* (`src/utils/error-handler.ts`) interpolates the logical id and is thrown by
+* ~20 providers from inside the retried `update()` in `deploy-engine.ts`, so a
+* stack with a resource named e.g. `MyDependencyViolationSub` burns the full
+* ~47s backoff schedule before the `--replace` fallback is even reached. That
+* is a LIVE occurrence of the class this marker exists for, unlike the
+* latent-today SNS abort that motivated it. Marking it belongs in that error's
+* constructor, in a file this change does not own; tracked separately.
+*/
+function markNonRetryable(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, NON_RETRYABLE_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+/**
+* True when the error, or anything in its bounded `.cause` chain, was marked
+* by {@link markNonRetryable}.
+*
+* The chain walk mirrors {@link isThrottlingError}'s: cdkd wraps errors, so a
+* marked refusal can end up one or more links deep, and a marker that stopped
+* counting after a single wrap would be a fence that quietly falls open.
+*
+* That reach is DIRECTIONAL, and the upward direction is a hazard worth
+* stating. Downward — a marked refusal wrapped by an outer error — is the
+* intended case and stays terminal. UPWARD is the inverse: wrapping a marked
+* refusal as the `cause` of a genuinely RETRYABLE outer error
+* (`new Error(msg, { cause: markedRefusal })`) makes the outer error terminal
+* too, because this walk finds the marker on the cause. Unconstructible today
+* (`ProvisioningError` is built with no `cause` at the one marking site), and
+* the failure is fail-fast rather than silent, but a future wrapper that
+* carries a marked cause into a transient error would stop retrying something
+* that should retry. Strip or re-raise the cause there rather than nesting it.
+*/
+function isMarkedNonRetryable(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			if (current[NON_RETRYABLE_MARKER] === true) return true;
+		}
+		current = current.cause;
+	}
+	return false;
+}
+/**
 * Walk the error + its `.cause` chain (bounded) looking for a rate-limit
 * signal — either an AWS SDK v3 throttling error `name`
 * ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
@@ -8262,6 +8340,10 @@ function isThrottlingError(error) {
 * Determine whether an AWS error should be retried.
 *
 * Checks (in order):
+*   0. {@link isMarkedNonRetryable} — a cdkd-authored refusal is terminal by
+*      declaration, ahead of every message / name heuristic below. FIRST on
+*      purpose: the marker states the error cannot succeed on a retry, so
+*      nothing a later check reads out of the message can overturn it.
 *   1. Rate-limit signal on the error or any wrapped cause — throttling error
 *      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
 *      429, so the name check carries most of the weight). See
@@ -8269,6 +8351,7 @@ function isThrottlingError(error) {
 *   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
 */
 function isRetryableTransientError(error, message) {
+	if (isMarkedNonRetryable(error)) return false;
 	if (isThrottlingError(error)) return true;
 	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
@@ -8448,7 +8531,11 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 * a throttle backs OFF exponentially for that attempt instead of hammering.
 *
 * Non-retryable errors are rethrown immediately. The transient-error
-* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
+* classifier is `isRetryableTransientError` from ./retryable-errors.ts, or
+* `opts.isRetryable` when the caller supplies one — EXCEPT for an error marked
+* by `markNonRetryable`, which is rethrown ahead of either, so a deliberate
+* cdkd refusal cannot be turned back into a retry by a custom classifier
+* (issue #1778).
 */
 async function withRetry(operation, logicalId, opts = {}) {
 	const maxRetries = opts.maxRetries ?? 8;
@@ -8464,6 +8551,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 	} catch (error) {
 		lastError = error;
 		const message = error instanceof Error ? error.message : String(error);
+		if (isMarkedNonRetryable(error)) throw error;
 		const retryable = opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message);
 		const propagation = defaultSchedule && isIamPropagationError(message);
 		if (propagation) sawPropagation = true;
@@ -13775,7 +13863,11 @@ var CloudControlProvider = class {
 		if (error.ccErrorCode === "ResourceConflict") return;
 		this.logger.info(`CREATE of ${logicalId} failed after materializing ${error.physicalId}; deleting the remnant so a retry can re-create it`);
 		try {
-			await this.delete(logicalId, error.physicalId, resourceType);
+			const cleanupResult = await this.delete(logicalId, error.physicalId, resourceType);
+			if (cleanupResult?.outcome === "skipped") {
+				this.logger.warn(`Skipped deleting the remnant ${error.physicalId} left by the failed CREATE of ${logicalId}: ${cleanupResult.reason} — a retry may fail with AlreadyExists until it is removed manually`);
+				return;
+			}
 			this.logger.debug(`Removed failed-create remnant ${error.physicalId} for ${logicalId}`);
 		} catch (cleanupError) {
 			const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
@@ -13845,9 +13937,8 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CtmogXk9.js").then((n) => n.n);
-			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
-			return;
+			const { ASGProvider } = await import("./asg-provider-B9eSuRPc.js").then((n) => n.n);
+			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
 		if (isProtectedEc2Instance) await disableInstanceApiTermination(getAwsClients().ec2, physicalId, this.logger);
@@ -14506,6 +14597,32 @@ var CloudControlProvider = class {
 //#endregion
 //#region src/provisioning/providers/custom-resource-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the no-properties DELETE arm reports
+* (issue [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line, so it is the SHORT form; the full
+* remediation sentence goes out as the `logger.warn` beside it.
+*/
+const CR_NO_PROPERTIES_SKIP_REASON = "no properties in state — Delete handler not invoked";
+/**
+* Sibling of {@link CR_NO_PROPERTIES_SKIP_REASON} for the arm where properties
+* exist but carry no `ServiceToken`. Distinct because the repair differs: one
+* record lost everything, the other lost the one field that names the handler.
+*/
+const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete handler not invoked";
+/**
+* The deploy-side caveat both skip warnings in this file carry (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arms are ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the resource has to be
+* torn down by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family.
+*/
+const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, tear the resource down by hand.";
+/**
 * Type guard to validate Lambda response payload structure
 */
 function isCustomResourceResponsePayload(value) {
@@ -14931,13 +15048,19 @@ var CustomResourceProvider = class CustomResourceProvider {
 	async delete(logicalId, physicalId, resourceType, properties, _context) {
 		this.logger.debug(`Deleting custom resource ${logicalId}: ${physicalId} (${resourceType})`);
 		if (!properties) {
-			this.logger.warn(`No properties available for custom resource ${logicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`No properties available for custom resource ${logicalId}, skipping deletion — the handler is never invoked, so anything this custom resource manages is LEFT IN PLACE. Restore the record's properties in state.json and re-run, or tear the resource down by hand. ${DEPLOY_SKIP_CAVEAT}`);
+			return {
+				outcome: "skipped",
+				reason: CR_NO_PROPERTIES_SKIP_REASON
+			};
 		}
 		const serviceToken = properties["ServiceToken"];
 		if (!serviceToken) {
-			this.logger.warn(`No ServiceToken found for custom resource ${logicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`No ServiceToken found for custom resource ${logicalId}, skipping deletion — there is no handler to send the Delete request to, so anything this custom resource manages is LEFT IN PLACE. Restore ServiceToken in state.json and re-run, or tear the resource down by hand. ${DEPLOY_SKIP_CAVEAT}`);
+			return {
+				outcome: "skipped",
+				reason: CR_NO_SERVICE_TOKEN_SKIP_REASON
+			};
 		}
 		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run \`cdkd import\` or \`cdkd state orphan <stack>\` to recover.`, resourceType, logicalId, physicalId);
 		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
@@ -15881,7 +16004,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TreatMissingData",
 			"Unit"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])
+		silentDrop: /* @__PURE__ */ new Map([
+			["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
+			["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
+			["EvaluationWindow", "not yet implemented by cdkd"]
+		])
 	}],
 	["AWS::CloudWatch::AnomalyDetector", {
 		handled: /* @__PURE__ */ new Set([
@@ -15970,7 +16097,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WebAuthnRelyingPartyID",
 			"WebAuthnUserVerification"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])
+		silentDrop: /* @__PURE__ */ new Map([
+			["IssuerConfiguration", "not yet implemented by cdkd"],
+			["KeyConfiguration", "not yet implemented by cdkd"],
+			["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]
+		])
 	}],
 	["AWS::DLM::LifecyclePolicy", {
 		handled: /* @__PURE__ */ new Set([
@@ -16219,7 +16350,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VpcEndpointId",
 			"VpcPeeringConnectionId"
 		]),
-		silentDrop: /* @__PURE__ */ new Map()
+		silentDrop: /* @__PURE__ */ new Map([["OdbNetworkArn", "not yet implemented by cdkd"]])
 	}],
 	["AWS::EC2::RouteTable", {
 		handled: /* @__PURE__ */ new Set(["Tags", "VpcId"]),
@@ -16290,7 +16421,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"InstanceTenancy",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["Ipv4IpamPoolId", "not yet implemented by cdkd"], ["Ipv4NetmaskLength", "not yet implemented by cdkd"]])
+		silentDrop: /* @__PURE__ */ new Map([
+			["Ipv4IpamPoolId", "not yet implemented by cdkd"],
+			["Ipv4NetmaskLength", "not yet implemented by cdkd"],
+			["VpcEncryptionControl", "not yet implemented by cdkd"]
+		])
 	}],
 	["AWS::EC2::VPCGatewayAttachment", {
 		handled: /* @__PURE__ */ new Set(["InternetGatewayId", "VpcId"]),
@@ -16464,7 +16599,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Protocol",
 			"SslPolicy"
 		]),
-		silentDrop: /* @__PURE__ */ new Map()
+		silentDrop: /* @__PURE__ */ new Map([["Tags", "not yet implemented by cdkd"]])
 	}],
 	["AWS::ElasticLoadBalancingV2::LoadBalancer", {
 		handled: /* @__PURE__ */ new Set([
@@ -17034,6 +17169,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
 			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
 			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
+			["GlobalClusterIdentifier", "not yet implemented by cdkd"],
+			["NetworkType", "not yet implemented by cdkd"],
 			["RestoreToTime", "not yet implemented by cdkd"],
 			["RestoreType", "not yet implemented by cdkd"],
 			["ServerlessScalingConfiguration", "not yet implemented by cdkd"],
@@ -17577,6 +17714,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		silentDrop: /* @__PURE__ */ new Map([
 			["ApplicationConfig", "not yet implemented by cdkd"],
 			["DataProtectionConfig", "not yet implemented by cdkd"],
+			["MonetizationConfig", "not yet implemented by cdkd"],
 			["OnSourceDDoSProtectionConfig", "not yet implemented by cdkd"]
 		])
 	}]
@@ -18306,7 +18444,8 @@ var IAMRoleProvider = class {
 			this.logger.debug(`${reason} changed, replacing role: ${physicalId} (${reason}: ${reason === "RoleName" ? `${physicalId} -> ${newRoleName}` : `${oldPath} -> ${newPath}`})`);
 			const createResult = await this.create(logicalId, resourceType, properties);
 			try {
-				await this.delete(logicalId, physicalId, resourceType);
+				const deleteResult = await this.delete(logicalId, physicalId, resourceType);
+				if (deleteResult?.outcome === "skipped") this.logger.warn(`Skipped deleting old role ${physicalId} during replacement: ${deleteResult.reason}. The old role may be orphaned and require manual cleanup.`);
 			} catch (error) {
 				this.logger.warn(`Failed to delete old role ${physicalId} during replacement: ${String(error)}. The old role may be orphaned and require manual cleanup.`);
 			}
@@ -20762,7 +20901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.3";
+	return "0.283.5";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22930,5 +23069,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { configStringRefusal as $, resolveStateBucketWithDefaultAndSource as $t, green as A, NestedStackChildDirectDestroyError as An, BOOTSTRAP_MARKER_PREFIX as At, slowCcOperationTimeoutMs as B, isCdkdError as Bn, runDockerForeground as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, DependencyError as Cn, stringifyValue as Ct, bold as D, LocalStartServiceError as Dn, loadPublishableAssetManifest as Dt, formatResourceLine as E, LocalMigrateError as En, createAssetRedirectResolver as Et, clearOnUpdateRemoval as F, StackHasActiveImportsError as Fn, validateContainerRepoName as Ft, getAccountInfo as G, synthesisStatusMessage as Gt, isTerminationProtectionPropagationError as H, withErrorHandling as Hn, AssetManifestLoader as Ht, ProviderRegistry as I, StackTerminationProtectionError as In, buildDenyExternalAccessPolicy as It, normalizeAwsTagsToCfn as J, resolveApp as Jt, refStateLookupFromResource as K, getDefaultStateBucketName as Kt, findActionableSilentDrops as L, StateError as Ln, buildDockerImage as Lt, yellow as M, ProvisioningError as Mn, getBootstrapMarkerKey as Mt, IAMRoleProvider as N, ResourceTimeoutError as Nn, parseBootstrapMarker as Nt, cyan as O, LockError as On, rewriteTemplateAssetReferences as Ot, collectInlinePolicyNamesManagedBySiblings as P, ResourceUpdateNotSupportedError as Pn, validateAssetBucketName as Pt, configBooleanRefusal as Q, resolveStateBucketWithDefault as Qt, findSilentDropProperties as R, SynthesisError as Rn, formatDockerLoginError as Rt, extractDeploymentEventError as S, ConfigError as Sn, AssetPublisher as St, renderStatefulReason as T, LocalInvokeBuildError as Tn, buildAssetRedirectMap as Tt, IntrinsicFunctionResolver as U, __exportAll as Un, getDockerImageBySourceHash as Ut, disableInstanceApiTermination as V, normalizeAwsError as Vn, runDockerStreaming as Vt, cfnRefValueFromPhysicalId as W, Synthesizer as Wt, assertRegionMatch as X, resolveCaptureObservedState as Xt, resolveExplicitPhysicalId as Y, resolveAutoAssetStorage as Yt, coerceCfnBoolean as Z, resolveSkipPrefix as Zt, createPreDeleteFinalSnapshot as _, getAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, MIGRATE_TMP_PREFIX as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, AssetError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, expectedOwnerParam as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, derivePartitionAndUrlSuffix as dn, DiffCalculator as dt, resolveUseCdkBootstrapAssets as en, readConfigString as et, computeImplicitDeleteEdges as f, AssemblyReader as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, AwsClients as gn, DagBuilder as gt, buildFinalSnapshotIdentifier as h, resolveBucketRegion as hn, isThrottlingError as ht, DeploymentEventsReader as i, CFN_TEMPLATE_URL_LIMIT as in, requireConfigString as it, red as j, PartialFailureError as jn, ensureAssetStorage as jt, gray as k, MissingCdkCliError as kn, AssetModeResolver as kt, replayRollback as l, PARTITION_TABLE as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, clearBucketRegionCache as mn, isRetryableTransientError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, warnDeprecatedNoPrefixCliFlag as nn, requireConfigArray as nt, planFailedOps as o, findLargeInlineResources as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, processStackMessages as pn, withRetry as pt, WAFv2WebACLProvider as q, getLegacyStateBucketName as qt, DeployEngine as r, CFN_TEMPLATE_BODY_LIMIT as rn, requireConfigObject as rt, planRollback as s, uploadCfnTemplate as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, stateBucketExistenceConfirmed as tn, replayWarn as tt, withResourceDeadline as u, canonicalizeRegion as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, resetAwsClients as vn, LockManager as vt, isStatefulRecreateTargetSync as w, DeployCancelledError as wn, WorkGraph as wt, makeCanonicalizePropertiesFn as x, CdkdError as xn, shouldRetainResource as xt, refusesFinalSnapshot as y, setAwsClients as yn, S3StateBackend as yt, CloudControlProvider as z, formatError as zn, getDockerCmd as zt };
-//# sourceMappingURL=deploy-engine-DxpS3fJ9.js.map
+export { configStringRefusal as $, resolveSkipPrefix as $t, green as A, LockError as An, rewriteTemplateAssetReferences as At, slowCcOperationTimeoutMs as B, SynthesisError as Bn, formatDockerLoginError as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, CdkdError as Cn, shouldRetainResource as Ct, bold as D, LocalInvokeBuildError as Dn, buildAssetRedirectMap as Dt, formatResourceLine as E, DeployCancelledError as En, WorkGraph as Et, clearOnUpdateRemoval as F, ResourceTimeoutError as Fn, parseBootstrapMarker as Ft, getAccountInfo as G, __exportAll as Gn, getDockerImageBySourceHash as Gt, isTerminationProtectionPropagationError as H, isCdkdError as Hn, runDockerForeground as Ht, ProviderRegistry as I, ResourceUpdateNotSupportedError as In, validateAssetBucketName as It, normalizeAwsTagsToCfn as J, getDefaultStateBucketName as Jt, refStateLookupFromResource as K, Synthesizer as Kt, findActionableSilentDrops as L, StackHasActiveImportsError as Ln, validateContainerRepoName as Lt, yellow as M, NestedStackChildDirectDestroyError as Mn, BOOTSTRAP_MARKER_PREFIX as Mt, IAMRoleProvider as N, PartialFailureError as Nn, ensureAssetStorage as Nt, cyan as O, LocalMigrateError as On, createAssetRedirectResolver as Ot, collectInlinePolicyNamesManagedBySiblings as P, ProvisioningError as Pn, getBootstrapMarkerKey as Pt, configBooleanRefusal as Q, resolveCaptureObservedState as Qt, findSilentDropProperties as R, StackTerminationProtectionError as Rn, buildDenyExternalAccessPolicy as Rt, extractDeploymentEventError as S, AssetError as Sn, rebuildClientForBucketRegion as St, renderStatefulReason as T, DependencyError as Tn, stringifyValue as Tt, IntrinsicFunctionResolver as U, normalizeAwsError as Un, runDockerStreaming as Ut, disableInstanceApiTermination as V, formatError as Vn, getDockerCmd as Vt, cfnRefValueFromPhysicalId as W, withErrorHandling as Wn, AssetManifestLoader as Wt, assertRegionMatch as X, resolveApp as Xt, resolveExplicitPhysicalId as Y, getLegacyStateBucketName as Yt, coerceCfnBoolean as Z, resolveAutoAssetStorage as Zt, createPreDeleteFinalSnapshot as _, resolveBucketRegion as _n, markNonRetryable as _t, DeploymentEventsStore as a, CFN_TEMPLATE_BODY_LIMIT as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, resetAwsClients as bn, LockManager as bt, replayFailedOperations as c, findLargeInlineResources as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, PARTITION_TABLE as dn, DiffCalculator as dt, resolveStateBucketWithDefault as en, readConfigString as et, computeImplicitDeleteEdges as f, canonicalizeRegion as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, clearBucketRegionCache as gn, isThrottlingError as gt, buildFinalSnapshotIdentifier as h, processStackMessages as hn, isRetryableTransientError as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as in, requireConfigString as it, red as j, MissingCdkCliError as jn, AssetModeResolver as jt, gray as k, LocalStartServiceError as kn, loadPublishableAssetManifest as kt, replayRollback as l, uploadCfnTemplate as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, AssemblyReader as mn, isMarkedNonRetryable as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as nn, requireConfigArray as nt, planFailedOps as o, CFN_TEMPLATE_URL_LIMIT as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, derivePartitionAndUrlSuffix as pn, withRetry as pt, WAFv2WebACLProvider as q, synthesisStatusMessage as qt, DeployEngine as r, stateBucketExistenceConfirmed as rn, requireConfigObject as rt, planRollback as s, MIGRATE_TMP_PREFIX as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as tn, replayWarn as tt, withResourceDeadline as u, expectedOwnerParam as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, AwsClients as vn, DagBuilder as vt, isStatefulRecreateTargetSync as w, ConfigError as wn, AssetPublisher as wt, makeCanonicalizePropertiesFn as x, setAwsClients as xn, S3StateBackend as xt, refusesFinalSnapshot as y, getAwsClients as yn, TemplateParser as yt, CloudControlProvider as z, StateError as zn, buildDockerImage as zt };
+//# sourceMappingURL=deploy-engine-BcwNPlSk.js.map