@go-to-k/cdkd 0.283.31 → 0.283.32

package/dist/{deploy-engine-AWFiXyhp.js → deploy-engine-rYTNzst0.js}

@@ -5560,6 +5560,27 @@ var AssetModeResolver = class {
 function escapeRegExp$1(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+/**
+* Remove control characters from a value about to be PRINTED.
+*
+* Lives beside {@link escapeRegExp} for the reason that helper's own note
+* gives: this was spelled twice — in `src/cli/commands/diff-recursive.ts` and
+* in `src/deployment/outputs-export-alias.ts` — and copies of a
+* security-shaped helper drift. Both print the same class of string: a
+* resolved CloudFormation Output / `Export.Name`, which passed no CFn
+* validator, so it can carry ANSI escapes or bidi overrides straight into a
+* terminal or a CI log.
+*
+* C0 + DEL + C1 + the bidi marks and isolates. Apply on HUMAN-render paths
+* only: a `--json` payload is a machine interface where an export name is data
+* a consumer may match on, and mutating it there trades a correctness
+* regression for a display concern (see `stripDisplayOnlyChars`, which is the
+* narrower guard for an already-serialized payload and stays local to its
+* caller because its C0 exclusion is specific to that path).
+*/
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
 
 //#endregion
 //#region src/assets/asset-redirect.ts
@@ -15076,7 +15097,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-SQ0V0nFd.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CVoisQ0L.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -20131,6 +20152,262 @@ function collectInlinePolicyNamesManagedBySiblings(targetPhysicalId, context, at
 	return result;
 }
 
+//#endregion
+//#region src/deployment/outputs-export-alias.ts
+/**
+* Does CloudFormation suppress this output on this deploy?
+*
+* CFn does not create an output whose `Condition` evaluates false, and
+* `resolveOutputs` mirrors that (issue #1028). Unknown condition names are
+* KEPT, matching `filterResourcesByCondition` on the resource side — a
+* condition cdkd could not evaluate must not silently delete an output.
+*
+* DEPLOY-SIDE ONLY. `cdkd scrub` deliberately does not use this: see
+* {@link collectDeclaredOutputNames}.
+*/
+function isOutputSuppressedByCondition(output, conditions) {
+	return output.Condition !== void 0 && conditions?.[output.Condition] === false;
+}
+/**
+* The output NAMES this deploy actually publishes — every declared output minus
+* the condition-suppressed ones.
+*
+* This is the set that owns keys in BOTH bags, and the reason the answer is
+* "published" rather than "declared": a suppressed output writes no value, so
+* it must not write a position source either, and its name is free for an
+* export alias to use. Reserving names for suppressed outputs would drop a
+* WORKING export the moment an unrelated condition went false.
+*
+* Sound at deploy time because these are the SAME condition values the deploy
+* itself acted on. Not sound in scrub — see {@link collectDeclaredOutputNames}.
+*/
+function collectPublishedOutputNames(outputs, conditions) {
+	const names = /* @__PURE__ */ new Set();
+	for (const [name, output] of Object.entries(outputs)) if (!isOutputSuppressedByCondition(output, conditions)) names.add(name);
+	return names;
+}
+/**
+* Every DECLARED output name, conditions ignored — the set `cdkd scrub` tests
+* collisions against.
+*
+* Scrub must be a SUPERSET here, and the asymmetry with the deploy engine is
+* forced by what scrub can know. Its condition values are re-evaluated
+* best-effort, from template defaults only (the command takes no
+* `--parameters`), and `evaluateConditions` assumes FALSE on any evaluation
+* failure. So "suppressed" is both easy to hit spuriously and impossible to
+* confirm against the deploy that actually wrote the state.
+*
+* The two error directions are not symmetric, which is what settles the rule:
+*
+* - Judging a colliding output suppressed when the DEPLOY published it (the
+*   spurious-false case above) makes scrub miss the collision, write the
+*   exporting output's expression over the colliding key, and persist a
+*   reference naming a DIFFERENT secret — the #1919 corruption, produced by
+*   the remediation command itself.
+* - Judging it published when the deploy suppressed it costs one spurious
+*   warning and one key redacted by VALUE match instead of by position. State
+*   exactly what that costs, since an earlier revision understated it: the
+*   value map is keyed by PLAINTEXT, so when two DISTINCT secrets resolve to
+*   one value it keeps only the last, and that key can be persisted holding a
+*   reference naming the OTHER secret. It is a smaller blast radius than the
+*   first case (one key, and only when two secrets coincide, versus every
+*   collision) but it is the same KIND of error, not a mere loss of precision.
+*
+* A wrong reference beats a lost precision bound, so scrub over-approximates.
+*/
+function collectDeclaredOutputNames(outputs) {
+	return new Set(Object.keys(outputs));
+}
+/**
+* Would aliasing `exportName` land on a key another output owns?
+*
+* An output exporting under its OWN name is not a collision: the alias rewrites
+* the identical key with the identical value, and both bags then carry the same
+* source.
+*
+* Deliberately NOT extended to two outputs sharing one `Export.Name` with no
+* output of that name. Both bags stay consistent there (one iteration writes
+* both the value and its source), so it is not this issue's class — see
+* `docs/cross-stack-references.md`.
+*/
+function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
+	return exportName !== outputKey && ownedOutputNames.has(exportName);
+}
+/**
+* Mirrors `secret-redaction`'s own `MIN_NEEDLE_LENGTH`. Duplicated rather than
+* imported because the two bounds answer different questions and should be free
+* to diverge: that one bounds what may be REWRITTEN, this one what may be
+* REFUSED or REPORTED.
+*/
+const MIN_SECRET_NEEDLE = 4;
+/**
+* Which recorded secrets are visible in `text`, or `undefined` when none is.
+*
+* ONE rule for both callers below, because they were inconsistent and the
+* inconsistency was a hole: the export-name check refused only an exact
+* whole-name match while the state-KEY scan did bounded containment over the
+* same kind of map — so `prod-<secret>-endpoint` was written as a state key by
+* the deploy and then reported by `cdkd scrub` as an UNREPAIRABLE leak. The tool
+* was creating the exact state it tells the user it cannot fix.
+*
+* A WHOLE-value match counts at any length; an EMBEDDED one only at or above
+* {@link MIN_SECRET_NEEDLE}. The bound is what makes containment safe to use for
+* a refusal at all — an unbounded scan over a degenerate one-character secret
+* matches almost every name and silently drops working exports — and its cost
+* is stated rather than hidden: a secret of three characters or fewer embedded
+* in a longer string is not seen. That value is indistinguishable from
+* coincidence, and the same bound already governs every substring redaction
+* cdkd performs.
+*
+* No empty-string case is needed at either caller: the resolver never records an
+* empty secret (`secret-redaction` says so — an empty needle would match every
+* leaf), and the length bound excludes it from the containment arm regardless.
+*/
+function secretsPresentIn(text, secrets) {
+	if (!secrets || secrets.size === 0) return void 0;
+	const exposure = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets) if (text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext)) exposure.set(plaintext, expression);
+	return exposure.size > 0 ? exposure : void 0;
+}
+/**
+* The secrets present in a resolved `Export.Name`, or `undefined` when it
+* carries none.
+*
+* An `Export.Name` may be an intrinsic (`Fn::Sub` / `Fn::Join`), and those
+* substitute dynamic references — so the resolved name can contain a resolved
+* secret. That name would become a state KEY, and every redaction pass walks
+* VALUES only, so the plaintext would land in `state.json` and be republished
+* into the exports index.
+*
+* TWO signals, and neither subsumes the other:
+*
+* - `substitutedIntoName` — the caller resolves the name with its OWN
+*   `recordedSecretValues` map, so a non-empty map means the resolver
+*   substituted a secret INTO THIS NAME. Exact, and the only arm that can see a
+*   substituted secret SHORTER than the containment bound below.
+* - a bounded containment scan of `recordedThisPass` ({@link secretsPresentIn}),
+*   which catches plaintext that arrived by any other route — a literal name, a
+*   cache hit, an `Fn::Sub` variable echoing the value.
+*
+* An earlier revision had only the first, calling the scan unpromising because
+* an UNBOUNDED one is: a degenerate one-character recorded secret would make
+* every name containing that character "secret" and silently drop working
+* exports. The bound is what makes the scan safe, and without the scan the
+* deploy wrote `prod-<secret>-endpoint` as a state key that `cdkd scrub` then
+* reported as unrepairable.
+*
+* The containment arm applies with no order caveat any more: the deploy engine
+* resolves EVERY output value
+* before deciding any alias, so this arm sees the complete map whatever the
+* declaration order. (An earlier revision of this paragraph said catching that
+* required "resolving the whole template before deciding anything" and called
+* it impractical — the value pass already does exactly that, at no extra cost.
+* The residual is now only a secret first substituted by ANOTHER output's
+* `Export.Name`, since those resolve in the second pass, in declaration order.)
+*
+* No empty-string special case, in either map: the resolver never records an
+* empty secret (`secret-redaction.ts` states it — an empty needle would match
+* every leaf), so an `''` key cannot reach here, and a guard against it would
+* be a branch no test could ever distinguish.
+*/
+function exportNameSecretExposure(exportName, substitutedIntoName, recordedThisPass) {
+	const exposure = new Map(substitutedIntoName);
+	for (const [plaintext, expression] of secretsPresentIn(exportName, recordedThisPass) ?? []) exposure.set(plaintext, expression);
+	return exposure.size > 0 ? exposure : void 0;
+}
+/**
+* Secrets visible in a state KEY, or `undefined` when there are none.
+*
+* Unlike {@link exportNameSecretExposure} there is no resolution to attribute
+* this to: the key was written by an EARLIER binary, so containment is the only
+* available signal. It is therefore bounded the same way `secret-redaction`
+* bounds its own substring scan — a value shorter than {@link MIN_SECRET_NEEDLE}
+* is matched only as the WHOLE key — because an unbounded containment scan over
+* a degenerate short secret flags every key in the state and fails the
+* `--dry-run --fail` CI gate repo-wide, which is the availability failure the
+* export-name check was redesigned to avoid.
+*
+* Bound and cost are {@link secretsPresentIn}'s; see there.
+*/
+function stateKeySecretExposure(key, secrets) {
+	return secretsPresentIn(key, secrets);
+}
+/**
+* Replace EVERY occurrence of every exposed secret with the mask.
+*
+* Deliberately not `maskSecretsInText`: that helper skips needles shorter than
+* its minimum length, which is right when scanning arbitrary bags for
+* coincidental matches but wrong here, where the values are known to be IN this
+* string. Feeding a detected-but-unmaskable name to it printed the secret under
+* a "masked:" label — a message asserting a protection it had not performed.
+* Longest-first so a secret containing another is masked whole.
+*/
+function maskEveryOccurrence(text, exposure) {
+	let out = text;
+	for (const value of Array.from(exposure.keys()).sort((a, b) => b.length - a.length)) out = out.split(value).join("***");
+	return out;
+}
+/**
+* Warning for an `Export.Name` that resolved to something containing secret
+* plaintext. Refused rather than published: the name would be a state KEY, and
+* keys are never redacted.
+*
+* The name is shown MASKED, and omitted entirely if masking somehow left it
+* unchanged. stderr is a reader like any other, so the invariant is absolute: a
+* message must never claim a masking it did not perform.
+*/
+function secretBearingExportNameWarning(outputKey, exportName, exposure) {
+	const masked = stripControlChars(maskEveryOccurrence(exportName, exposure));
+	const shown = masked === stripControlChars(exportName) ? "" : `(masked: "${masked}") `;
+	return `Output ${stripControlChars(outputKey)} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
+}
+/**
+* Warning for a state KEY that already holds secret plaintext — the residue an
+* EARLIER binary left when it published an export name that resolved to one.
+*
+* `cdkd scrub` cannot repair this. Every redaction pass rewrites VALUES; a key
+* is the export's identity, so renaming it here would silently retire an export
+* consumers resolve by name, and dropping it would delete a live export. The
+* remedy is in the template: give the output a non-secret `Export.Name` and
+* redeploy, which rewrites `state.outputs` wholesale and republishes the index.
+* Reported so the `--dry-run --fail` CI gate stops calling such a state clean.
+*/
+function secretBearingStateKeyWarning(stackName, key, exposure) {
+	return `State for ${stripControlChars(stackName)} holds an output KEY containing a secret (masked: "${stripControlChars(maskEveryOccurrence(key, exposure))}") — cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
+}
+/**
+* Warning for an `Export.Name` colliding with an output NAME it does not own.
+*
+* Names both outputs because the two are equally likely to be the mistake, and
+* says which value survives — the export is skipped, so the key keeps the
+* output's own value.
+*
+* No masking here, and none is needed: the name printed is one that MATCHED a
+* declared output name, i.e. template text, and a name carrying a secret is
+* refused by {@link secretBearingExportNameWarning} before this is reached.
+*/
+function exportAliasCollisionWarning(outputKey, exportName) {
+	const shown = stripControlChars(exportName);
+	const from = stripControlChars(outputKey);
+	return `Output ${from} exports as "${shown}", which is also the name of another output in this stack — skipping the export alias, so output ${shown} keeps its own value and the export is not published. A consumer's Fn::ImportValue on "${shown}" therefore resolves to output ${shown}, NOT to ${from} (CloudFormation would publish both). Rename the export, or the colliding output.`;
+}
+/**
+* Warning for the same collision seen by `cdkd scrub`, whose remedy differs.
+*
+* Scrub does not resolve outputs — it redacts state written by an EARLIER
+* binary, where the alias may have won the colliding key — so it cannot claim
+* the key belongs to either output. It drops the position source for that key
+* and lets the value scan decide from the plaintext actually stored, which is
+* why this message promises something weaker than the deploy-time one. It can
+* also fire on a template the deploy handled cleanly, per
+* {@link collectDeclaredOutputNames}.
+*/
+function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
+	const exposure = secretsPresentIn(exportName, secrets);
+	const shown = stripControlChars(exposure ? maskEveryOccurrence(exportName, exposure) : exportName);
+	return `Output ${stripControlChars(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
+}
+
 //#endregion
 //#region src/utils/colors.ts
 /**
@@ -22294,7 +22571,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.31";
+	return "0.283.32";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22935,6 +23212,14 @@ var DeployEngine = class {
 	*/
 	outputsTemplateSource = {};
 	/**
+	* Whether {@link outputsTemplateSource} may be used to POSITION the outputs
+	* redaction. False once an outputs pass threw partway: the post-loop
+	* name pass never ran, so the bag holds only the alias keys written before
+	* the throw — a partial source built from THIS template, while the bag the
+	* failure path then redacts is the PREVIOUS deploy's. Reset per `deploy()`.
+	*/
+	outputsSourceUsable = true;
+	/**
 	* Per-logical-id snapshot of the intrinsic-RESOLVED desired properties
 	* each CREATE / UPDATE attempted (issue #1198). Written just before the
 	* provider call; read only when the op FAILS, to journal the failed op's
@@ -22979,6 +23264,7 @@ var DeployEngine = class {
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsTemplateSource = {};
+		this.outputsSourceUsable = true;
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
@@ -23022,7 +23308,7 @@ var DeployEngine = class {
 	*/
 	redactOutputs(outputs) {
 		if (this.outputSecrets.size === 0) return outputs;
-		return redactSecretsForState(outputs, this.outputSecrets, this.outputsTemplateSource);
+		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0);
 	}
 	/**
 	* Redact resolved secret plaintext out of rollback-journal operations (GHSA
@@ -24626,9 +24912,30 @@ var DeployEngine = class {
 		});
 	}
 	/**
-	* Resolve stack outputs from template and resource attributes
+	* What a failed Output resolution does, shared by both passes of
+	* {@link resolveOutputs} so they cannot drift — the alias pass reports the
+	* SAME failure for a name it could not resolve as the value pass does for a
+	* value, which is what the single-pass shape did when both lived in one
+	* `try`.
 	*
-	* Uses IntrinsicFunctionResolver for full CloudFormation intrinsic function support.
+	* Issue #1111 item 2: under `--strict-getatt` an unresolvable Output fails
+	* the deploy instead of silently publishing nothing (which breaks downstream
+	* `Fn::ImportValue` consumers with "export not found" long after this deploy
+	* exits 0).
+	*/
+	handleOutputResolutionFailure(error, outputKey, outputs) {
+		if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, { cause: error });
+		this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
+		outputs[outputKey] = void 0;
+	}
+	/**
+	* Resolve stack outputs from template and resource attributes.
+	*
+	* Uses `IntrinsicFunctionResolver` for full CloudFormation intrinsic function
+	* support, and runs in TWO passes — every value, then every export alias —
+	* so an alias decision sees the complete set of secrets this pass resolved
+	* rather than whatever the declaration order happened to have recorded by
+	* then (issue #1919).
 	*/
 	async resolveOutputs(template, resources, stackName, parameterValues, conditions) {
 		if (!template.Outputs) return {};
@@ -24639,29 +24946,58 @@ var DeployEngine = class {
 			...parameterValues && { parameters: parameterValues },
 			...conditions && { conditions }
 		}, stackName);
-		for (const [outputKey, output] of Object.entries(template.Outputs)) {
-			if (output.Condition !== void 0 && conditions?.[output.Condition] === false) {
-				this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
-				continue;
+		const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
+		let outputsPassCompleted = false;
+		try {
+			for (const [outputKey, output] of Object.entries(template.Outputs)) {
+				if (isOutputSuppressedByCondition(output, conditions)) {
+					this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+					continue;
+				}
+				try {
+					outputs[outputKey] = await this.resolver.resolve(output.Value, context);
+				} catch (error) {
+					this.handleOutputResolutionFailure(error, outputKey, outputs);
+				}
 			}
-			try {
-				const value = await this.resolver.resolve(output.Value, context);
-				outputs[outputKey] = value;
-				if (output.Export?.Name) {
-					const exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, context);
-					if (typeof exportName === "string") {
-						outputs[exportName] = value;
-						this.outputsTemplateSource[exportName] = output.Value;
+			for (const [outputKey, output] of Object.entries(template.Outputs)) {
+				if (isOutputSuppressedByCondition(output, conditions)) continue;
+				if (!output.Export?.Name) continue;
+				const value = outputs[outputKey];
+				if (value === void 0) continue;
+				const nameSecrets = /* @__PURE__ */ new Map();
+				let exportName;
+				try {
+					try {
+						exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
+							...context,
+							recordedSecretValues: nameSecrets
+						});
+					} finally {
+						for (const [plaintext, expression] of nameSecrets) context.recordedSecretValues?.set(plaintext, expression);
 					}
+				} catch (error) {
+					this.handleOutputResolutionFailure(error, outputKey, outputs);
+					continue;
+				}
+				if (typeof exportName !== "string") continue;
+				const exposure = exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues);
+				if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure));
+				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName));
+				else {
+					outputs[exportName] = value;
+					this.outputsTemplateSource[exportName] = output.Value;
 				}
-			} catch (error) {
-				if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, { cause: error });
-				this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
-				outputs[outputKey] = void 0;
 			}
+			outputsPassCompleted = true;
+		} finally {
+			if (context.recordedSecretValues) for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
+			if (!outputsPassCompleted) this.outputsSourceUsable = false;
+		}
+		for (const [outputKey, output] of Object.entries(template.Outputs)) {
+			if (!publishedOutputNames.has(outputKey)) continue;
+			this.outputsTemplateSource[outputKey] = output.Value;
 		}
-		if (context.recordedSecretValues) for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
-		for (const [outputKey, output] of Object.entries(template.Outputs)) this.outputsTemplateSource[outputKey] = output.Value;
 		return outputs;
 	}
 	buildDisplayOutputs(template, resolvedOutputs) {
@@ -24676,5 +25012,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { coerceCfnBoolean as $, __exportAll as $n, getLegacyStateBucketName as $t, cyan as A, DeployCancelledError as An, buildAssetRedirectMap as At, findSilentDropProperties as B, ResourceUpdateNotSupportedError as Bn, validateAssetBucketName as Bt, makeCanonicalizePropertiesFn as C, getAwsClients as Cn, LockManager as Ct, renderStatefulReason as D, CdkdError as Dn, AssetPublisher as Dt, isStatefulRecreateTargetSync as E, AssetError as En, shouldRetainResource as Et, IAMRoleProvider as F, MissingCdkCliError as Fn, AssetModeResolver as Ft, IntrinsicFunctionResolver as G, formatError as Gn, getDockerCmd as Gt, slowCcOperationTimeoutMs as H, StackTerminationProtectionError as Hn, buildDenyExternalAccessPolicy as Ht, collectInlinePolicyNamesManagedBySiblings as I, NestedStackChildDirectDestroyError as In, BOOTSTRAP_MARKER_PREFIX as It, refStateLookupFromResource as J, withErrorHandling as Jn, AssetManifestLoader as Jt, cfnRefValueFromPhysicalId as K, isCdkdError as Kn, runDockerForeground as Kt, clearOnUpdateRemoval as L, PartialFailureError as Ln, ensureAssetStorage as Lt, green as M, LocalMigrateError as Mn, loadPublishableAssetManifest as Mt, red as N, LocalStartServiceError as Nn, rewriteTemplateAssetReferences as Nt, formatResourceLine as O, ConfigError as On, stringifyValue as Ot, yellow as P, LockError as Pn, escapeRegExp$1 as Pt, assertRegionMatch as Q, markNonRetryable as Qn, getDefaultStateBucketName as Qt, ProviderRegistry as R, ProvisioningError as Rn, getBootstrapMarkerKey as Rt, unsupportedFinalSnapshotError as S, AwsClients as Sn, TemplateParser as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, setAwsClients as Tn, rebuildClientForBucketRegion as Tt, disableInstanceApiTermination as U, StateError as Un, buildDockerImage as Ut, CloudControlProvider as V, StackHasActiveImportsError as Vn, validateContainerRepoName as Vt, isTerminationProtectionPropagationError as W, SynthesisError as Wn, formatDockerLoginError as Wt, normalizeAwsTagsToCfn as X, isRetryableTransientError as Xn, Synthesizer as Xt, WAFv2WebACLProvider as Y, isMarkedNonRetryable as Yn, getDockerImageBySourceHash as Yt, resolveExplicitPhysicalId as Z, isThrottlingError as Zn, synthesisStatusMessage as Zt, buildFinalSnapshotIdentifier as _, derivePartitionAndUrlSuffix as _n, DiffCalculator as _t, DeploymentEventsStore as a, resolveStateBucketWithDefaultAndSource as an, requireConfigObject as at, isFinalSnapshotError as b, clearBucketRegionCache as bn, withRetry as bt, replayFailedOperations as c, warnDeprecatedNoPrefixCliFlag as cn, TEMPLATE_SOURCED_RULES as ct, deleteSkipReason as d, MIGRATE_TMP_PREFIX as dn, s3BucketArn as dt, resolveApp as en, configBooleanRefusal as et, withResourceDeadline as f, findLargeInlineResources as fn, s3BucketDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, canonicalizeRegion as gn, applyRoleArnIfSet as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, PARTITION_TABLE as hn, s3BucketWebsiteUrl as ht, DeploymentEventsReader as i, resolveStateBucketWithDefault as in, requireConfigArray as it, gray as j, LocalInvokeBuildError as jn, createAssetRedirectResolver as jt, bold as k, DependencyError as kn, WorkGraph as kt, replayRollback as l, CFN_TEMPLATE_BODY_LIMIT as ln, redactSecretsForState as lt, computeImplicitDeleteEdges as m, expectedOwnerParam as mn, s3BucketRegionalDomainName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveCaptureObservedState as nn, readConfigString as nt, planFailedOps as o, resolveUseCdkBootstrapAssets as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, uploadCfnTemplate as pn, s3BucketDualStackDomainName as pt, getAccountInfo as q, normalizeAwsError as qn, runDockerStreaming as qt, DeployEngine as r, resolveSkipPrefix as rn, replayWarn as rt, planRollback as s, stateBucketExistenceConfirmed as sn, STATE_SOURCED_CROSS_GENERATION_RULES as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveAutoAssetStorage as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, CFN_TEMPLATE_URL_LIMIT as un, scrubResourceRecord as ut, ccRoutedFinalSnapshotError as v, AssemblyReader as vn, INTRINSIC_KEYS as vt, extractDeploymentEventError as w, resetAwsClients as wn, S3StateBackend as wt, refusesFinalSnapshot as x, resolveBucketRegion as xn, DagBuilder as xt, createPreDeleteFinalSnapshot as y, processStackMessages as yn, describeTypeWithThrottleRetry as yt, findActionableSilentDrops as z, ResourceTimeoutError as zn, parseBootstrapMarker as zt };
-//# sourceMappingURL=deploy-engine-AWFiXyhp.js.map
+export { getAccountInfo as $, isCdkdError as $n, runDockerForeground as $t, cyan as A, getAwsClients as An, S3StateBackend as At, stateKeySecretExposure as B, LocalStartServiceError as Bn, escapeRegExp$1 as Bt, makeCanonicalizePropertiesFn as C, canonicalizeRegion as Cn, DiffCalculator as Ct, renderStatefulReason as D, clearBucketRegionCache as Dn, DagBuilder as Dt, isStatefulRecreateTargetSync as E, processStackMessages as En, withRetry as Et, collectDeclaredOutputNames as F, ConfigError as Fn, WorkGraph as Ft, findActionableSilentDrops as G, ProvisioningError as Gn, getBootstrapMarkerKey as Gt, collectInlinePolicyNamesManagedBySiblings as H, MissingCdkCliError as Hn, AssetModeResolver as Ht, collectPublishedOutputNames as I, DependencyError as In, buildAssetRedirectMap as It, slowCcOperationTimeoutMs as J, StackHasActiveImportsError as Jn, validateContainerRepoName as Jt, findSilentDropProperties as K, ResourceTimeoutError as Kn, parseBootstrapMarker as Kt, exportAliasCollisionScrubWarning as L, DeployCancelledError as Ln, createAssetRedirectResolver as Lt, green as M, setAwsClients as Mn, shouldRetainResource as Mt, red as N, AssetError as Nn, AssetPublisher as Nt, formatResourceLine as O, resolveBucketRegion as On, TemplateParser as Ot, yellow as P, CdkdError as Pn, stringifyValue as Pt, cfnRefValueFromPhysicalId as Q, formatError as Qn, getDockerCmd as Qt, isExportAliasCollision as R, LocalInvokeBuildError as Rn, loadPublishableAssetManifest as Rt, unsupportedFinalSnapshotError as S, PARTITION_TABLE as Sn, applyRoleArnIfSet as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, AssemblyReader as Tn, describeTypeWithThrottleRetry as Tt, clearOnUpdateRemoval as U, NestedStackChildDirectDestroyError as Un, BOOTSTRAP_MARKER_PREFIX as Ut, IAMRoleProvider as V, LockError as Vn, stripControlChars as Vt, ProviderRegistry as W, PartialFailureError as Wn, ensureAssetStorage as Wt, isTerminationProtectionPropagationError as X, StateError as Xn, buildDockerImage as Xt, disableInstanceApiTermination as Y, StackTerminationProtectionError as Yn, buildDenyExternalAccessPolicy as Yt, IntrinsicFunctionResolver as Z, SynthesisError as Zn, formatDockerLoginError as Zt, buildFinalSnapshotIdentifier as _, CFN_TEMPLATE_URL_LIMIT as _n, s3BucketArn as _t, DeploymentEventsStore as a, getDefaultStateBucketName as an, markNonRetryable as ar, coerceCfnBoolean as at, isFinalSnapshotError as b, uploadCfnTemplate as bn, s3BucketRegionalDomainName as bt, replayFailedOperations as c, resolveAutoAssetStorage as cn, readConfigString as ct, deleteSkipReason as d, resolveStateBucketWithDefault as dn, requireConfigObject as dt, runDockerStreaming as en, normalizeAwsError as er, refStateLookupFromResource as et, withResourceDeadline as f, resolveStateBucketWithDefaultAndSource as fn, requireConfigString as ft, PRE_DELETE_SNAPSHOT_TYPES as g, CFN_TEMPLATE_BODY_LIMIT as gn, scrubResourceRecord as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, warnDeprecatedNoPrefixCliFlag as hn, redactSecretsForState as ht, DeploymentEventsReader as i, synthesisStatusMessage as in, isThrottlingError as ir, assertRegionMatch as it, gray as j, resetAwsClients as jn, rebuildClientForBucketRegion as jt, bold as k, AwsClients as kn, LockManager as kt, replayRollback as l, resolveCaptureObservedState as ln, replayWarn as lt, computeImplicitDeleteEdges as m, stateBucketExistenceConfirmed as mn, TEMPLATE_SOURCED_RULES as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, getDockerImageBySourceHash as nn, isMarkedNonRetryable as nr, normalizeAwsTagsToCfn as nt, planFailedOps as o, getLegacyStateBucketName as on, __exportAll as or, configBooleanRefusal as ot, IMPLICIT_DELETE_DEPENDENCIES as p, resolveUseCdkBootstrapAssets as pn, STATE_SOURCED_CROSS_GENERATION_RULES as pt, CloudControlProvider as q, ResourceUpdateNotSupportedError as qn, validateAssetBucketName as qt, DeployEngine as r, Synthesizer as rn, isRetryableTransientError as rr, resolveExplicitPhysicalId as rt, planRollback as s, resolveApp as sn, configStringRefusal as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssetManifestLoader as tn, withErrorHandling as tr, WAFv2WebACLProvider as tt, UNSPECIFIED_SKIP_REASON as u, resolveSkipPrefix as un, requireConfigArray as ut, ccRoutedFinalSnapshotError as v, MIGRATE_TMP_PREFIX as vn, s3BucketDomainName as vt, extractDeploymentEventError as w, derivePartitionAndUrlSuffix as wn, INTRINSIC_KEYS as wt, refusesFinalSnapshot as x, expectedOwnerParam as xn, s3BucketWebsiteUrl as xt, createPreDeleteFinalSnapshot as y, findLargeInlineResources as yn, s3BucketDualStackDomainName as yt, secretBearingStateKeyWarning as z, LocalMigrateError as zn, rewriteTemplateAssetReferences as zt };
+//# sourceMappingURL=deploy-engine-rYTNzst0.js.map