@go-to-k/cdkd 0.283.30 → 0.283.31

package/dist/{deploy-engine-Bb4ECtz3.js → deploy-engine-AWFiXyhp.js}

@@ -9925,40 +9925,88 @@ function buildNeedleRegex(values) {
 	if (needles.length === 0) return void 0;
 	return new RegExp(needles.map(escapeRegExp).join("|"), "g");
 }
-/** The bag was produced by resolving the source: same shape, template source. */
+/**
+* The bag was produced by resolving the source: same shape, template source.
+*
+* `sourceIsSameGeneration` is FALSE despite the name, and that is the whole
+* lesson of issue #1917's review: the RULES describe the source, but the deploy
+* engine's persist choke point applies them to every record in the state map,
+* including ones this pass never rewrote. A template can never certify the
+* generation of the bag it is walked against.
+*/
 const TEMPLATE_DERIVED_RULES = {
 	descendArrays: true,
-	trustAnyExpression: false
+	trustAnyExpression: false,
+	sourceIsSameGeneration: false
+};
+/**
+* An AWS readback, or a persisted STATE bag, projected from the TEMPLATE: no
+* relaxation applies.
+*
+* One constant covers both bags because the template is what decides all three
+* rules here, and it decides them identically: shapes may diverge (no
+* positional descent), the template carries PUBLIC ssm expressions (no blanket
+* trust), and it is a different generation from anything it is walked against
+* (no source-takes-precedence on an expression-shaped leaf). An earlier draft
+* split this into a second `TEMPLATE_SOURCED_STATE_BAG_RULES` for `cdkd scrub`;
+* the two ended up byte-identical once the axis moved from CALLER to
+* GENERATION, and two identical constants are a drift hazard, not a
+* distinction.
+*/
+const TEMPLATE_SOURCED_RULES = {
+	descendArrays: false,
+	trustAnyExpression: false,
+	sourceIsSameGeneration: false
 };
-/** An AWS readback projected from a persisted STATE bag. */
+/** An AWS readback projected from THIS record's own persisted STATE bag. */
 const STATE_SOURCED_READBACK_RULES = {
 	descendArrays: false,
-	trustAnyExpression: true
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true
 };
-/** An AWS readback projected from the TEMPLATE: neither relaxation applies. */
-const TEMPLATE_SOURCED_READBACK_RULES = {
+/**
+* A STATE source that is no longer this bag's own generation — `cdkd scrub`'s
+* `observedProperties` walk (issue #1917 review).
+*
+* It differs from {@link STATE_SOURCED_READBACK_RULES} on one flag, and the
+* difference is not cosmetic. Scrub positions `properties` against TODAY's
+* template BEFORE the observed bag is walked, so the "record's own properties"
+* that serve as the observed source may already carry an expression the stack
+* has never deployed. Taking that source for an observed leaf that ALREADY
+* holds an expression rewrites the drift baseline onto an undeployed
+* reference — which `cdkd drift --revert` then pushes to AWS.
+*
+* `trustAnyExpression` stays TRUE: the source is still a STATE bag, holding no
+* public expressions, and that relaxation is what lets scrub clean a legacy
+* PLAINTEXT observed leaf (issue #1900) rather than falling back to a value
+* scan that an old state file gives no needles for.
+*/
+const STATE_SOURCED_CROSS_GENERATION_RULES = {
 	descendArrays: false,
-	trustAnyExpression: false
+	trustAnyExpression: true,
+	sourceIsSameGeneration: false
 };
 /**
-* The bag was produced by resolving a STATE source — both relaxations apply.
+* The bag was produced by resolving a STATE source — every relaxation applies.
 *
 * The rollback replay is the case (issue #1910): `resolveReplayProps` resolves
 * the JOURNALED bag and the provider's `effectiveProperties` come back from
 * that, so the two have identical structure and positional array descent is
-* sound exactly as it is for a template-derived bag. And the source is a
-* persisted record, which holds no PUBLIC expressions — a `String` ssm
-* reference is stored resolved — so any `{{resolve:...}}` in it is by
-* construction a secret.
+* sound exactly as it is for a template-derived bag. The source is a persisted
+* record, which holds no PUBLIC expressions — a `String` ssm reference is
+* stored resolved — so any `{{resolve:...}}` in it is by construction a secret.
+* And it is the SAME generation the bag was resolved from, one statement
+* earlier in the same call, which is as strong as that claim ever gets.
 *
-* Using `STATE_SOURCED_READBACK_RULES` here instead would be wrong in the
-* quiet direction: it turns array descent OFF, so a secret nested in a
-* `Tags[]` / ECS `secrets[]` element falls to the value scan and a colliding
-* pair still collapses there.
+* Using a `*_SOURCED_*` constant here instead would be wrong in the quiet
+* direction: it turns positional array descent OFF for a bag that genuinely
+* does correspond positionally, and drops the generation claim for the one
+* writer that can actually make it.
 */
 const STATE_DERIVED_RULES = {
 	descendArrays: true,
-	trustAnyExpression: true
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true
 };
 function isDynamicReferenceString(value) {
 	return typeof value === "string" && value.includes("{{resolve:");
@@ -10252,6 +10300,103 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	return matched;
 }
 /**
+* Keys tried, in order, when pairing two arrays whose ORDER cannot be trusted
+* (issue #1915).
+*
+* Both are the identity field of an unordered CloudFormation list that really
+* does carry secrets: `Name` is the ECS `ContainerDefinitions[]` /
+* `Environment[]` / `Secrets[]` and CodeBuild `EnvironmentVariables[]` shape,
+* `Key` is the `Tags[]` shape the drift normalizer already keys on
+* (`canonicalizeTagListsDeep` in `src/analyzer/drift-normalize.ts`). The list
+* is deliberately SHORT: an entry is only useful when it is a genuine identity,
+* and a wrong entry costs a refused pairing rather than a wrong one (see
+* {@link identityKeyFor}), so widening it buys little and has to be justified
+* per shape.
+*
+* Worth naming rather than leaving to be rediscovered: `drift-normalize.ts`
+* deliberately moved its GENERAL case OFF heuristics like this one, onto
+* provider-DECLARED paths (`getDriftUnorderedPaths` + `matchesPathPrefix`),
+* after issue #1783 showed a heuristic claiming order-independence for a list
+* that was order-SIGNIFICANT (`KeySchema`). Only its `Tags[]` pass is still a
+* heuristic. This module diverges on purpose, because the two failure modes are
+* not comparable: there, a wrong claim SUPPRESSES real drift; here, the worst a
+* wrong pairing key can do is fail the uniqueness test and refuse, leaving the
+* leaf exactly where the value scan already had it. If that ever stops being
+* true — if a pairing gains the power to DELETE or REORDER rather than only to
+* rewrite a matched leaf — this list has to move to a declared seam too.
+*/
+const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
+/**
+* Is every element of `items` a plain object carrying a NON-EMPTY OWN string at
+* `key`, with no two elements sharing a value?
+*
+* `Object.hasOwn` for the same reason the object walk below uses it: without
+* it the prototype chain answers for a key like `constructor`, and while state
+* that came from `JSON.parse` cannot carry one, this module is called with
+* caller-constructed bags too and the two walks disagreeing is the kind of gap
+* that only shows up once something else changes.
+*
+* The empty string is excluded because it is not a distinguishing identity —
+* the same reason the value scan refuses it as a needle. Two elements both
+* carrying `Name: ''` would otherwise pair on "equality" that means nothing.
+*/
+function isUniquelyKeyedBy(items, key) {
+	if (items.length === 0) return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!isPlainObject$2(item) || !Object.hasOwn(item, key)) return false;
+		const id = item[key];
+		if (typeof id !== "string" || id === "") return false;
+		if (seen.has(id)) return false;
+		seen.add(id);
+	}
+	return true;
+}
+/**
+* Pick a key that identifies the elements of BOTH arrays, or `undefined` when
+* none does (issue #1915).
+*
+* This is what lets a leaf nested in an ARRAY be positioned on a path where
+* positional descent is refused. `descendArrays: false` is not a claim that the
+* bag and source elements are unrelated — it is a claim that their ORDER does
+* not correspond, because AWS does not preserve list order (the reason
+* `src/analyzer/drift-normalize.ts` exists). Matching by an identity FIELD
+* answers the order objection directly instead of working around it, so the
+* relaxation is sound on every rules constant and is deliberately NOT gated on
+* one.
+*
+* Requiring uniqueness WITHIN each array is what makes a pairing impossible to
+* get wrong: pairing is by string EQUALITY, so a bag element can only ever meet
+* the source element carrying the same identity, and uniqueness means there is
+* at most one of those. A key that is not really an identity (a repeated enum
+* value) fails the uniqueness test and refuses the whole pairing rather than
+* producing a plausible-looking wrong one. An element with no partner is not
+* guessed at either — it falls to the value scan, exactly as the whole array
+* did before.
+*
+* Keys are tried in {@link ARRAY_IDENTITY_KEYS} order and the FIRST one that
+* qualifies on both sides wins; a key that fails does not veto the next one.
+*
+* Two shapes this deliberately does NOT reach, stated so they are bounds rather
+* than surprises — both fail closed, leaving the leaf to the value scan:
+*
+* - **The identity field itself holds a secret.** The source element carries
+*   `{Name: '{{resolve:...}}'}` and the bag element the resolved plaintext, so
+*   the two never pair and the element's other leaves are not reached either.
+*   Closing it would mean pairing on a field whose two sides are KNOWN to
+*   differ, i.e. exactly the guessing the uniqueness rule exists to forbid. On
+*   the unchanged-resource path the value scan is also a no-op, so such a leaf
+*   keeps its plaintext — narrow (an identity field is a name, not a
+*   credential) but real.
+* - **Arrays of arrays.** `M: [[{Name, Value}]]` pairs nothing, because the
+*   OUTER elements are arrays rather than plain objects and have no identity
+*   field to key on. Positional descent into the outer list would reintroduce
+*   the order assumption this function exists to avoid.
+*/
+function identityKeyFor(bag, source) {
+	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
+}
+/**
 * PATH-based redaction: walk `bag` alongside a SOURCE bag that still carries the
 * unresolved `{{resolve:...}}` expressions, and wherever the source leaf is such
 * a string, persist THAT string verbatim.
@@ -10284,16 +10429,41 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 * where neither is.
 */
 function redactByPath(bag, source, secrets, rules, secretExpressions) {
-	if (typeof bag === "string" && isSingleDynamicReferenceToken(bag)) return bag;
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
-		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) return source;
+		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
+			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
+			return source;
+		}
 		return redactSecretsForState(bag, secrets);
 	}
 	if (typeof bag === "string" && isPlainObject$2(source)) {
 		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
 		if (positioned !== void 0) return positioned;
 	}
-	if (rules.descendArrays && Array.isArray(bag) && Array.isArray(source) && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
+	if (Array.isArray(bag) && Array.isArray(source)) {
+		const key = identityKeyFor(bag, source);
+		if (key !== void 0) {
+			const sourceIndexById = /* @__PURE__ */ new Map();
+			source.forEach((item, i) => {
+				sourceIndexById.set(item[key], i);
+			});
+			let orderPreserved = true;
+			const partnerIndex = bag.map((item, i) => {
+				const j = sourceIndexById.get(item[key]);
+				if (j === void 0) return -1;
+				if (j !== i) orderPreserved = false;
+				return j;
+			});
+			const positionalIsExact = rules.descendArrays && bag.length === source.length && orderPreserved;
+			return bag.map((item, i) => {
+				const j = partnerIndex[i];
+				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions);
+				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions);
+				return redactSecretsForState(item, secrets);
+			});
+		}
+		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
+	}
 	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
 		const out = {};
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions) : redactSecretsForState(v, secrets);
@@ -10319,6 +10489,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		if (typeof value === "string") {
 			const whole = wholeValueExpr(value);
 			if (whole !== void 0) return whole;
+			if (isSingleDynamicReferenceToken(value)) return value;
 			if (!regex) return value;
 			regex.lastIndex = 0;
 			if (!regex.test(value)) return value;
@@ -10342,13 +10513,23 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 * changed, or the input by identity when there are no secrets — so callers can
 * detect a no-op cheaply. Shared by the deploy engine's save choke point and
 * the `cdkd scrub` command so both scrub the same three fields identically.
-*/
-function scrubResourceRecord(record, secrets, sourceProperties) {
+*
+* `observedRules` overrides the rules the `observedProperties` walk would
+* otherwise DERIVE from whether a `sourceProperties` bag was supplied. Exactly
+* one caller needs it and the reason is not obvious, so it is a parameter
+* rather than another derivation: `cdkd scrub` has already repositioned
+* `properties` against TODAY's template by the time it calls this, so the
+* "record's own properties" this walk falls back to are no longer the same
+* GENERATION as the observed bag beside them (issue #1917 review). Left
+* unspecified, the derivation below is right for every other caller, whose
+* `properties` reach this function untouched.
+*/
+function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
 	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
 	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_READBACK_RULES);
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_RULES));
 	return next;
 }
 /**
@@ -14895,7 +15076,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BpVWOeU3.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-SQ0V0nFd.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -21526,16 +21707,22 @@ async function resolveReplayProps(props, resolver, secrets) {
 * deploy reports a change that never converges — the same defect the four
 * deploy-side writers had, arriving here through the replay instead.
 *
-* It takes `STATE_DERIVED_RULES`, which is BOTH relaxations. The source is a
+* It takes `STATE_DERIVED_RULES`, which is every relaxation. The source is a
 * persisted record, so it holds no PUBLIC expressions (a `String` ssm reference
 * is stored resolved) and any `{{resolve:...}}` in it is by construction a
 * secret — that is `trustAnyExpression`. And the bag WAS produced by resolving
 * that source (`resolveReplayProps` -> the provider's `effectiveProperties`),
 * so the two have identical structure and positional array descent is sound —
-* that is `descendArrays`. Using `STATE_SOURCED_READBACK_RULES` here reads
-* plausible and is wrong in the quiet direction: it turns array descent off, so
-* a secret nested in a `Tags[]` / ECS `secrets[]` element would still collapse
-* on the replay path.
+* that is `descendArrays`. It is also the SAME generation, resolved one
+* statement earlier in this call — that is `sourceIsSameGeneration`, and this
+* writer is one of only two that can honestly claim it.
+*
+* Using `STATE_SOURCED_READBACK_RULES` here reads plausible and is wrong in the
+* quiet direction: it turns positional array descent off. Since issue #1915 a
+* `Tags[]` / ECS `Environment[]` element is reached by KEYED descent either
+* way, so the concrete loss is narrower than it was — it is a list whose
+* elements carry no `Name` / `Key` identity, which only positional descent can
+* walk.
 *
 * No-op when the op resolved no secret.
 */
@@ -22107,7 +22294,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.30";
+	return "0.283.31";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -24489,5 +24676,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { coerceCfnBoolean as $, resolveApp as $t, cyan as A, LocalInvokeBuildError as An, createAssetRedirectResolver as At, findSilentDropProperties as B, StackHasActiveImportsError as Bn, validateContainerRepoName as Bt, makeCanonicalizePropertiesFn as C, resetAwsClients as Cn, S3StateBackend as Ct, renderStatefulReason as D, ConfigError as Dn, stringifyValue as Dt, isStatefulRecreateTargetSync as E, CdkdError as En, AssetPublisher as Et, IAMRoleProvider as F, NestedStackChildDirectDestroyError as Fn, BOOTSTRAP_MARKER_PREFIX as Ft, IntrinsicFunctionResolver as G, isCdkdError as Gn, runDockerForeground as Gt, slowCcOperationTimeoutMs as H, StateError as Hn, buildDockerImage as Ht, collectInlinePolicyNamesManagedBySiblings as I, PartialFailureError as In, ensureAssetStorage as It, refStateLookupFromResource as J, isMarkedNonRetryable as Jn, getDockerImageBySourceHash as Jt, cfnRefValueFromPhysicalId as K, normalizeAwsError as Kn, runDockerStreaming as Kt, clearOnUpdateRemoval as L, ProvisioningError as Ln, getBootstrapMarkerKey as Lt, green as M, LocalStartServiceError as Mn, rewriteTemplateAssetReferences as Mt, red as N, LockError as Nn, escapeRegExp$1 as Nt, formatResourceLine as O, DependencyError as On, WorkGraph as Ot, yellow as P, MissingCdkCliError as Pn, AssetModeResolver as Pt, assertRegionMatch as Q, __exportAll as Qn, getLegacyStateBucketName as Qt, ProviderRegistry as R, ResourceTimeoutError as Rn, parseBootstrapMarker as Rt, unsupportedFinalSnapshotError as S, getAwsClients as Sn, LockManager as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, AssetError as Tn, shouldRetainResource as Tt, disableInstanceApiTermination as U, SynthesisError as Un, formatDockerLoginError as Ut, CloudControlProvider as V, StackTerminationProtectionError as Vn, buildDenyExternalAccessPolicy as Vt, isTerminationProtectionPropagationError as W, formatError as Wn, getDockerCmd as Wt, normalizeAwsTagsToCfn as X, isThrottlingError as Xn, synthesisStatusMessage as Xt, WAFv2WebACLProvider as Y, isRetryableTransientError as Yn, Synthesizer as Yt, resolveExplicitPhysicalId as Z, markNonRetryable as Zn, getDefaultStateBucketName as Zt, buildFinalSnapshotIdentifier as _, AssemblyReader as _n, INTRINSIC_KEYS as _t, DeploymentEventsStore as a, resolveUseCdkBootstrapAssets as an, requireConfigObject as at, isFinalSnapshotError as b, resolveBucketRegion as bn, DagBuilder as bt, replayFailedOperations as c, CFN_TEMPLATE_BODY_LIMIT as cn, redactSecretsForState as ct, deleteSkipReason as d, findLargeInlineResources as dn, s3BucketDomainName as dt, resolveAutoAssetStorage as en, configBooleanRefusal as et, withResourceDeadline as f, uploadCfnTemplate as fn, s3BucketDualStackDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, derivePartitionAndUrlSuffix as gn, DiffCalculator as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, canonicalizeRegion as hn, applyRoleArnIfSet as ht, DeploymentEventsReader as i, resolveStateBucketWithDefaultAndSource as in, requireConfigArray as it, gray as j, LocalMigrateError as jn, loadPublishableAssetManifest as jt, bold as k, DeployCancelledError as kn, buildAssetRedirectMap as kt, replayRollback as l, CFN_TEMPLATE_URL_LIMIT as ln, scrubResourceRecord as lt, computeImplicitDeleteEdges as m, PARTITION_TABLE as mn, s3BucketWebsiteUrl as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveSkipPrefix as nn, readConfigString as nt, planFailedOps as o, stateBucketExistenceConfirmed as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, expectedOwnerParam as pn, s3BucketRegionalDomainName as pt, getAccountInfo as q, withErrorHandling as qn, AssetManifestLoader as qt, DeployEngine as r, resolveStateBucketWithDefault as rn, replayWarn as rt, planRollback as s, warnDeprecatedNoPrefixCliFlag as sn, TEMPLATE_SOURCED_READBACK_RULES as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveCaptureObservedState as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, MIGRATE_TMP_PREFIX as un, s3BucketArn as ut, ccRoutedFinalSnapshotError as v, processStackMessages as vn, describeTypeWithThrottleRetry as vt, extractDeploymentEventError as w, setAwsClients as wn, rebuildClientForBucketRegion as wt, refusesFinalSnapshot as x, AwsClients as xn, TemplateParser as xt, createPreDeleteFinalSnapshot as y, clearBucketRegionCache as yn, withRetry as yt, findActionableSilentDrops as z, ResourceUpdateNotSupportedError as zn, validateAssetBucketName as zt };
-//# sourceMappingURL=deploy-engine-Bb4ECtz3.js.map
+export { coerceCfnBoolean as $, __exportAll as $n, getLegacyStateBucketName as $t, cyan as A, DeployCancelledError as An, buildAssetRedirectMap as At, findSilentDropProperties as B, ResourceUpdateNotSupportedError as Bn, validateAssetBucketName as Bt, makeCanonicalizePropertiesFn as C, getAwsClients as Cn, LockManager as Ct, renderStatefulReason as D, CdkdError as Dn, AssetPublisher as Dt, isStatefulRecreateTargetSync as E, AssetError as En, shouldRetainResource as Et, IAMRoleProvider as F, MissingCdkCliError as Fn, AssetModeResolver as Ft, IntrinsicFunctionResolver as G, formatError as Gn, getDockerCmd as Gt, slowCcOperationTimeoutMs as H, StackTerminationProtectionError as Hn, buildDenyExternalAccessPolicy as Ht, collectInlinePolicyNamesManagedBySiblings as I, NestedStackChildDirectDestroyError as In, BOOTSTRAP_MARKER_PREFIX as It, refStateLookupFromResource as J, withErrorHandling as Jn, AssetManifestLoader as Jt, cfnRefValueFromPhysicalId as K, isCdkdError as Kn, runDockerForeground as Kt, clearOnUpdateRemoval as L, PartialFailureError as Ln, ensureAssetStorage as Lt, green as M, LocalMigrateError as Mn, loadPublishableAssetManifest as Mt, red as N, LocalStartServiceError as Nn, rewriteTemplateAssetReferences as Nt, formatResourceLine as O, ConfigError as On, stringifyValue as Ot, yellow as P, LockError as Pn, escapeRegExp$1 as Pt, assertRegionMatch as Q, markNonRetryable as Qn, getDefaultStateBucketName as Qt, ProviderRegistry as R, ProvisioningError as Rn, getBootstrapMarkerKey as Rt, unsupportedFinalSnapshotError as S, AwsClients as Sn, TemplateParser as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, setAwsClients as Tn, rebuildClientForBucketRegion as Tt, disableInstanceApiTermination as U, StateError as Un, buildDockerImage as Ut, CloudControlProvider as V, StackHasActiveImportsError as Vn, validateContainerRepoName as Vt, isTerminationProtectionPropagationError as W, SynthesisError as Wn, formatDockerLoginError as Wt, normalizeAwsTagsToCfn as X, isRetryableTransientError as Xn, Synthesizer as Xt, WAFv2WebACLProvider as Y, isMarkedNonRetryable as Yn, getDockerImageBySourceHash as Yt, resolveExplicitPhysicalId as Z, isThrottlingError as Zn, synthesisStatusMessage as Zt, buildFinalSnapshotIdentifier as _, derivePartitionAndUrlSuffix as _n, DiffCalculator as _t, DeploymentEventsStore as a, resolveStateBucketWithDefaultAndSource as an, requireConfigObject as at, isFinalSnapshotError as b, clearBucketRegionCache as bn, withRetry as bt, replayFailedOperations as c, warnDeprecatedNoPrefixCliFlag as cn, TEMPLATE_SOURCED_RULES as ct, deleteSkipReason as d, MIGRATE_TMP_PREFIX as dn, s3BucketArn as dt, resolveApp as en, configBooleanRefusal as et, withResourceDeadline as f, findLargeInlineResources as fn, s3BucketDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, canonicalizeRegion as gn, applyRoleArnIfSet as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, PARTITION_TABLE as hn, s3BucketWebsiteUrl as ht, DeploymentEventsReader as i, resolveStateBucketWithDefault as in, requireConfigArray as it, gray as j, LocalInvokeBuildError as jn, createAssetRedirectResolver as jt, bold as k, DependencyError as kn, WorkGraph as kt, replayRollback as l, CFN_TEMPLATE_BODY_LIMIT as ln, redactSecretsForState as lt, computeImplicitDeleteEdges as m, expectedOwnerParam as mn, s3BucketRegionalDomainName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveCaptureObservedState as nn, readConfigString as nt, planFailedOps as o, resolveUseCdkBootstrapAssets as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, uploadCfnTemplate as pn, s3BucketDualStackDomainName as pt, getAccountInfo as q, normalizeAwsError as qn, runDockerStreaming as qt, DeployEngine as r, resolveSkipPrefix as rn, replayWarn as rt, planRollback as s, stateBucketExistenceConfirmed as sn, STATE_SOURCED_CROSS_GENERATION_RULES as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveAutoAssetStorage as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, CFN_TEMPLATE_URL_LIMIT as un, scrubResourceRecord as ut, ccRoutedFinalSnapshotError as v, AssemblyReader as vn, INTRINSIC_KEYS as vt, extractDeploymentEventError as w, resetAwsClients as wn, S3StateBackend as wt, refusesFinalSnapshot as x, resolveBucketRegion as xn, DagBuilder as xt, createPreDeleteFinalSnapshot as y, processStackMessages as yn, describeTypeWithThrottleRetry as yt, findActionableSilentDrops as z, ResourceTimeoutError as zn, parseBootstrapMarker as zt };
+//# sourceMappingURL=deploy-engine-AWFiXyhp.js.map