@go-to-k/cdkd 0.283.35 → 0.283.36

package/dist/{deploy-engine-fBYrdrmB.js → deploy-engine-Bhq_JPCc.js}

@@ -9887,20 +9887,32 @@ const SECRET_MASK = "***";
 * homing it here means no call site has to thread it: the four sibling writers
 * #1910 fixes pass a position SOURCE and nothing else.
 *
-* Its lifetime matches the resolver's `cachedDynamicReferences` — the resolver
-* clears both together, and that shared lifetime is the point: this set IS the
-* resolver's own SecureString verdict store, which already had exactly this
-* scope, so nothing is widened by homing it here.
-*
-* Process-wide is therefore INHERITED, not claimed to be ideal. It is not
-* strictly sound across regions or accounts in one run — the same expression
-* can name a `SecureString` in one region and a plain `String` in another — but
-* `cachedDynamicReferences` caches the resolved VALUE under the same
-* assumption, so a per-region store here would fix nothing on its own. Note
-* which way the imprecision points: an entry only ever GRANTS "persist the
-* source leaf verbatim", and the leaf is the resource's own template
-* expression, so the failure mode is a public reference stored as an expression
-* (a spurious UPDATE, issue #1901's class), never a secret stored as plaintext.
+* Its lifetime NO LONGER matches the resolver's `cachedDynamicReferences`, and
+* that divergence is now deliberate (issue
+* [#1933](https://github.com/go-to-k/cdkd/issues/1933)). The resolved VALUES
+* moved onto the RESOLVER INSTANCE — one per stack, each carrying its own
+* region — because a value is only true for the region that read it. A VERDICT
+* is a statement about a reference's TYPE and has to be readable with no
+* resolver in hand: {@link isKnownSecretExpression} is consulted from the
+* redaction path, whose callers thread a position SOURCE and nothing else. So
+* this set stays process-wide while the values do not, and
+* `resetAccountInfoCache` now clears only this one.
+*
+* Process-wide is therefore CHOSEN here rather than inherited, and the choice
+* is what makes a stale verdict correctable: a resolver whose fresh
+* `GetParameter` reports a public `Type` RETRACTS the entry
+* ({@link forgetSecretExpression}) for every later reader, which a per-region
+* store would scope away. It is still not strictly sound across regions or
+* accounts in one run — the same expression can name a `SecureString` in one
+* region and a plain `String` in another — but note which way the imprecision
+* points in EACH direction now that the two stores can disagree. An entry only
+* ever GRANTS "persist the source leaf verbatim", so a verdict inherited from
+* another region can at worst store a public reference as an expression (a
+* spurious UPDATE, issue #1901's class), never a secret as plaintext. And the
+* opposite move — another region RETRACTING a verdict this stack still needs —
+* cannot un-redact anything either, because each of the resolver's own cache
+* entries carries the verdict that produced it and re-records on a hit without
+* consulting this set.
 */
 const recordedSecretExpressions$1 = /* @__PURE__ */ new Set();
 /** Remember that `expression` resolves to a secret. Called by the resolver. */
@@ -12152,15 +12164,19 @@ let cachedAccountIdentity = null;
 */
 const cachedAvailabilityZones = {};
 /**
-* Cache for resolved dynamic references (secretsmanager, ssm)
-*/
-const cachedDynamicReferences = {};
-/**
 * The `{{resolve:...}}` expressions this process has PROVEN resolve to a
 * SECRET, reached through `secret-redaction.ts`'s `recordedSecretExpressions`
-* store. Lifetime is {@link cachedDynamicReferences}'s — `resetAccountInfoCache`
-* clears both, so a stale verdict can never decide secret-ness for a reference
-* whose resolved value that call just asked to forget.
+* store. Process-global, and cleared by `resetAccountInfoCache` so a test (or a
+* later phase) cannot inherit a verdict it just asked to forget.
+*
+* NOTE this store is deliberately WIDER-lived than the resolved VALUES it was
+* once paired with: those moved onto the resolver instance (issue #1933), while
+* a verdict is a statement about a reference's TYPE, which the redaction path
+* must be able to read with no resolver in hand. The asymmetry is safe in the
+* one direction that matters — a verdict inherited across regions can only make
+* a reference be treated AS a secret (persisted as its expression, never as
+* plaintext), and the reverse case re-asks AWS because the fresh response is
+* authoritative and the value cache no longer answers for another region.
 *
 * `ssm` is the kind that NEEDS the memory (issue #1901). A plain `ssm`
 * reference is not a secret by SPELLING the way `secretsmanager` is — whether
@@ -12249,6 +12265,24 @@ function accountInfoFor(identity, overrideRegion) {
 * the same deploy heal.
 */
 const FABRICATED_ACCOUNT_INFO_TTL_MS = 1e4;
+/**
+* Retries after the first attempt for a dynamic-reference lookup, THROTTLE-shaped
+* failures only (issue #1933 review). Everything else — a missing parameter, a
+* denied secret — is a real answer and is thrown to the caller unchanged.
+*
+* It matters more since the cache became per-resolver AND stopped memoizing a
+* value whose ssm `Type` was unclassifiable: both raise the call COUNT for the
+* same template (one lookup per resolver rather than per process; one per
+* occurrence for the anomalous type), and a bare `send` turned the resulting
+* throttle into an aborted deploy. At the default backoff (1s -> 2s -> 4s -> 8s)
+* this adds at most ~15s of sleep, against re-running the whole deploy.
+*/
+const MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES = 4;
+/**
+* Test seam: overriding `sleep` lets unit tests drive the backoff schedule
+* without real waits (mirrors `describeTypeRetryDelays`).
+*/
+const dynamicReferenceRetryDelays = {};
 /** Test seam for {@link FABRICATED_ACCOUNT_INFO_TTL_MS} expiry. */
 const accountInfoClock = { now: () => Date.now() };
 let fabricatedAccountIdentity = null;
@@ -12435,6 +12469,89 @@ var IntrinsicFunctionResolver = class {
 	* deploy summary.
 	*/
 	physicalIdFallbackCount = 0;
+	/**
+	* Resolved `{{resolve:secretsmanager:...}}` / `{{resolve:ssm:...}}` values,
+	* keyed by the full expression — INSTANCE-scoped, which closes the CACHE half
+	* of issue [#1933](https://github.com/go-to-k/cdkd/issues/1933). The issue is
+	* only PARTIALLY addressed by this field: see "what this does NOT settle"
+	* below.
+	*
+	* It used to be a module-global map keyed by the expression ALONE, and both
+	* halves of that were wrong for the same reason: the key and the lifetime
+	* were narrower than the value they stood for.
+	*
+	* - REGION. Secrets Manager secrets and SSM parameters are regional and
+	*   independent — the same NAME in `us-east-1` and `ap-northeast-1` is two
+	*   different values, routinely two different credentials — so the first
+	*   region to resolve an expression won it for the whole process, and every
+	*   later stack in every other region silently reused that value.
+	* - STACK. Nothing reset the map between stacks, so a second stack's
+	*   resolution cache-HIT and skipped the lookup that re-records the value as
+	*   a secret. `cdkd scrub --all` then found an empty secrets map for that
+	*   stack and reported it clean.
+	*
+	* Instance scope settles both at once because a region boundary and a stack
+	* boundary are BOTH resolver boundaries in cdkd: {@link resolverRegion} is
+	* fixed at construction, and every caller builds one resolver per stack
+	* (`DeployEngine` per deploy, `scrub` / `import` / `diff-recursive` /
+	* `rollback-executor` per stack). Re-keying by region alone would have left
+	* the stack half open, which is why the lifetime — not the key — is what
+	* moved.
+	*
+	* ONE caller is a known EXCEPTION to that invariant, and it is written down
+	* here because an invariant recorded without its exception is how the next
+	* change breaks it: `cdkd export` builds a single `paramResolver`
+	* (`src/cli/commands/export.ts`, the `buildResolvedParametersPerStack`
+	* pre-pass) and shares it across every node of a nested-stack tree, while the
+	* nodes carry a per-node `region`. It is safe TODAY for two independent
+	* reasons — the resolver is constructed with the tree's single `rootRegion`
+	* and nested children do not yet diverge from it, and that pre-pass passes no
+	* `recordedSecretValues` bag, so neither the region nor the secrets-recording
+	* dimension has anything to cross. Both stop holding the moment cross-region
+	* nested stacks ship or that pass starts recording secrets; a resolver per
+	* node is the fix then, not a wider key here.
+	*
+	* What this does NOT settle — issue
+	* [#1957](https://github.com/go-to-k/cdkd/issues/1957) owns it: the lookups
+	* themselves still go through the process-ambient `getAwsClients()` singleton
+	* (see `resolveSecretsManagerReference` / `resolveSSMReference`), whose region
+	* is whichever the process installed last. So a resolver constructed for
+	* region B while the ambient clients point at region A still reads A on its
+	* FIRST resolution — no cache involved, so nothing here can prevent it.
+	* `cdkd deploy` re-pins the singleton per stack, which makes a SERIAL
+	* multi-region deploy correct end to end, but the default
+	* `--stack-concurrency 4` races for it (a hazard `deploy.ts` already
+	* documents) and `cdkd scrub` installs its clients once while resolving
+	* stacks in several regions. The split of ownership is therefore: THIS field
+	* closes the cache as a cross-region / cross-stack carrier, while #1957 owns
+	* the wrong-region READ — which is the outcome #1933's title names, so #1933
+	* is not fully resolved until #1957 lands. Pinning the lookup to
+	* {@link resolverRegion} means constructing region-scoped clients, which is a
+	* credentials decision (a bare `new SSMClient({ region })` drops the ambient
+	* profile / assume-role config) and belongs to #1957 rather than here.
+	*/
+	cachedDynamicReferences = /* @__PURE__ */ new Map();
+	/**
+	* `<parameter name>\u0000<reported Type>` pairs this resolver has already
+	* warned about (issue #1933 review).
+	*
+	* Keyed on the PAIR rather than the name alone: two different anomalous types
+	* for one parameter are two different facts — the line REPORTS the type, so
+	* suppressing the second would hide a `Type` nobody has seen yet behind one
+	* that was already explained. The volume problem this set exists for is N
+	* IDENTICAL lines for N occurrences of one reference, which the pair still
+	* bounds, because the type is a property of the parameter rather than of the
+	* occurrence.
+	*
+	* The warning is per LOOKUP, and a parameter with an anomalous `Type` is
+	* deliberately never cached (see `cacheable` in `resolveDynamicReferences`),
+	* so it is re-looked-up for every occurrence of the reference in the stack —
+	* which without this set means one identical warn line per occurrence per
+	* pass, on the exact template that most needs the line to be READ. Scoped to
+	* the resolver, like the value cache: a different stack genuinely deserves
+	* its own warning, since the parameter it names may be a different region's.
+	*/
+	warnedUnrecognizedSsmTypes = /* @__PURE__ */ new Set();
 	constructor(region, options) {
 		this.resolverRegion = region || process.env["AWS_REGION"] || "us-east-1";
 		this.strictGetAtt = options?.strictGetAtt ?? false;
@@ -14014,21 +14131,35 @@ var IntrinsicFunctionResolver = class {
 			const service = inner.split(":")[0];
 			const isKnownSecret = service === "secretsmanager" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
-			if (fullMatch in cachedDynamicReferences) {
-				const cached = cachedDynamicReferences[fullMatch];
-				if (isKnownSecret && cached) context?.recordedSecretValues?.set(cached, fullMatch);
-				result = result.replace(fullMatch, () => cached);
+			const cached = this.cachedDynamicReferences.get(fullMatch);
+			if (cached) {
+				if (cached.secret && cached.value) context?.recordedSecretValues?.set(cached.value, fullMatch);
+				result = result.replace(fullMatch, () => cached.value);
 				continue;
 			}
 			const parts = inner.split(":");
 			let resolved;
 			let isSecret = isKnownSecret;
+			/**
+			* May the resolved value be REMEMBERED, or must the next pass re-ask?
+			*
+			* Cleared for exactly the answers the verdict store refuses to pin — an
+			* ssm parameter judged secret from a `Type` that is not a definitive
+			* `SecureString` (issue #1901's fail-closed arm). Caching one would pin
+			* the transient answer for the whole resolver anyway, which is what the
+			* refusal to memoize exists to prevent: before the value cache became
+			* instance-scoped this was already true process-wide, and the
+			* "next pass re-asks" property only ever held on the comparison path,
+			* which caches nothing (issue #1933).
+			*/
+			let cacheable = true;
 			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner);
 			else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
 				const param = await this.resolveSSMReference(parts, decrypt);
 				if (param.type === "SecureString") recordedSecretExpressions.add(fullMatch);
 				else if (!param.secure) recordedSecretExpressions.delete(fullMatch);
+				else cacheable = false;
 				isSecret = param.secure;
 				if (param.secure) {
 					if (!decrypt) continue;
@@ -14038,7 +14169,10 @@ var IntrinsicFunctionResolver = class {
 				this.logger.warn(`Unsupported dynamic reference service: ${service}`);
 				continue;
 			}
-			cachedDynamicReferences[fullMatch] = resolved;
+			if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
+				value: resolved,
+				secret: isSecret
+			});
 			if (isSecret && resolved) {
 				context?.recordedSecretValues?.set(resolved, fullMatch);
 				if (service === "secretsmanager") recordedSecretExpressions.add(fullMatch);
@@ -14098,7 +14232,7 @@ var IntrinsicFunctionResolver = class {
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await client.send(command)).SecretString;
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${secretId}`)).SecretString;
 		if (!secretString) throw new Error(`Dynamic reference: secret '${secretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const keyValue = JSON.parse(secretString)[jsonKey];
@@ -14197,6 +14331,43 @@ var IntrinsicFunctionResolver = class {
 		return parts.join(":");
 	}
 	/**
+	* Run one dynamic-reference lookup, retrying THROTTLE-shaped failures only
+	* (issue #1933 review).
+	*
+	* Both lookups behind `{{resolve:...}}` were bare `send` calls, so a single
+	* `Rate exceeded` aborted the deploy. That was already the wrong trade for a
+	* read, and this PR raises the call count on both paths: the resolved-value
+	* cache is per-resolver now (one lookup per stack rather than one per
+	* process), and a value whose ssm `Type` came back unclassifiable is
+	* deliberately not cached at all (one lookup per OCCURRENCE, so it re-asks
+	* AWS rather than inheriting a transient verdict). Retrying only the throttle
+	* shape keeps every real answer — `ParameterNotFound`, `AccessDenied`, a
+	* malformed reference — failing fast and unchanged.
+	*
+	* Two bounds, both NAMED rather than fixed here:
+	*
+	* - No `isInterrupted` is threaded, so a Ctrl-C landing inside the backoff is
+	*   only noticed when that sleep ends — worst case ~8s, ~15s across the whole
+	*   schedule. `withRetry` supports the hook, but the only interrupt state in
+	*   the tree is `DeployEngine.interrupted`, which reaches nothing here;
+	*   wiring it means a resolver option threaded from that engine.
+	* - It says NOTHING about concurrency. The client is captured before the
+	*   first attempt, so a sibling stack's teardown (`stackAwsClients.destroy()`
+	*   in `deploy.ts`) during a backoff surfaces as a raw, non-throttle-shaped
+	*   failure on the next attempt. That is a property of the ambient-singleton
+	*   design this PR deliberately does not touch (issue
+	*   [#1957](https://github.com/go-to-k/cdkd/issues/1957)), not something the
+	*   retry makes safe.
+	*/
+	sendWithThrottleRetry(operation, label) {
+		return withRetry(operation, label, {
+			maxRetries: MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES,
+			isRetryable: (_message, error) => isThrottlingError(error),
+			logger: this.logger,
+			...dynamicReferenceRetryDelays.sleep ? { sleep: dynamicReferenceRetryDelays.sleep } : {}
+		});
+	}
+	/**
 	* Resolve an `{{resolve:ssm:...}}` dynamic reference, reporting whether the
 	* parameter is a `SecureString` (issue #1901).
 	*
@@ -14220,12 +14391,13 @@ var IntrinsicFunctionResolver = class {
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await client.send(command);
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `ssm:${parameterName}`);
 		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
-		if (secure && paramType !== "SecureString") {
+		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
+			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
 			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:ssm:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
@@ -15097,7 +15269,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-xC0UiCjt.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BruE_3F2.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -21869,13 +22041,14 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 		eventType: "ROLLBACK_STARTED",
 		stackName
 	});
+	const resolver = new IntrinsicFunctionResolver(ctx.region);
 	const { createOps, otherOps } = partitionOps(operations);
 	for (let i = otherOps.length - 1; i >= 0; i--) {
 		if (options.isInterrupted?.()) {
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(otherOps[i], stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
+		await replaySingle(otherOps[i], stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
 	}
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
@@ -21884,7 +22057,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 				result.interrupted = true;
 				break;
 			}
-			await replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
+			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
 		}
 	}
 	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
@@ -22064,10 +22237,9 @@ function recordAfterRollbackUpdate(restored, result) {
 function recordedPropertiesAfterReplayCreate(restored, result) {
 	return result.effectiveProperties === void 0 ? restored.properties : { ...result.effectiveProperties };
 }
-async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp, isInterrupted) {
+async function replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, afterOp, isInterrupted) {
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
-	const resolver = new IntrinsicFunctionResolver(ctx.region);
 	/**
 	* The route a CREATE-rollback arm resolved for this op (issue #1366) —
 	* hoisted so the shared catch's ROLLBACK_RESOURCE_FAILED reports the route
@@ -22571,7 +22743,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.35";
+	return "0.283.36";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25013,4 +25185,4 @@ var DeployEngine = class {
 
 //#endregion
 export { getAccountInfo as $, SynthesisError as $n, formatDockerLoginError as $t, cyan as A, resolveBucketRegion as An, TemplateParser as At, stateKeySecretExposure as B, LocalInvokeBuildError as Bn, loadPublishableAssetManifest as Bt, makeCanonicalizePropertiesFn as C, expectedOwnerParam as Cn, s3BucketWebsiteUrl as Ct, renderStatefulReason as D, AssemblyReader as Dn, describeTypeWithThrottleRetry as Dt, isStatefulRecreateTargetSync as E, derivePartitionAndUrlSuffix as En, INTRINSIC_KEYS as Et, collectDeclaredOutputNames as F, AssetError as Fn, AssetPublisher as Ft, findActionableSilentDrops as G, NestedStackChildDirectDestroyError as Gn, BOOTSTRAP_MARKER_PREFIX as Gt, collectInlinePolicyNamesManagedBySiblings as H, LocalStartServiceError as Hn, escapeRegExp$1 as Ht, collectPublishedOutputNames as I, CdkdError as In, stringifyValue as It, slowCcOperationTimeoutMs as J, ResourceTimeoutError as Jn, parseBootstrapMarker as Jt, findSilentDropProperties as K, PartialFailureError as Kn, ensureAssetStorage as Kt, exportAliasCollisionScrubWarning as L, ConfigError as Ln, WorkGraph as Lt, green as M, getAwsClients as Mn, S3StateBackend as Mt, red as N, resetAwsClients as Nn, rebuildClientForBucketRegion as Nt, formatResourceLine as O, processStackMessages as On, withRetry as Ot, yellow as P, setAwsClients as Pn, shouldRetainResource as Pt, cfnRefValueFromPhysicalId as Q, StateError as Qn, buildDockerImage as Qt, isExportAliasCollision as R, DependencyError as Rn, buildAssetRedirectMap as Rt, unsupportedFinalSnapshotError as S, uploadCfnTemplate as Sn, s3BucketRegionalDomainName as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, canonicalizeRegion as Tn, DiffCalculator as Tt, clearOnUpdateRemoval as U, LockError as Un, stripControlChars as Ut, IAMRoleProvider as V, LocalMigrateError as Vn, rewriteTemplateAssetReferences as Vt, ProviderRegistry as W, MissingCdkCliError as Wn, AssetModeResolver as Wt, isTerminationProtectionPropagationError as X, StackHasActiveImportsError as Xn, validateContainerRepoName as Xt, disableInstanceApiTermination as Y, ResourceUpdateNotSupportedError as Yn, validateAssetBucketName as Yt, IntrinsicFunctionResolver as Z, StackTerminationProtectionError as Zn, buildDenyExternalAccessPolicy as Zt, buildFinalSnapshotIdentifier as _, warnDeprecatedNoPrefixCliFlag as _n, redactSecretsForState as _t, DeploymentEventsStore as a, Synthesizer as an, isRetryableTransientError as ar, coerceCfnBoolean as at, isFinalSnapshotError as b, MIGRATE_TMP_PREFIX as bn, s3BucketDomainName as bt, replayFailedOperations as c, getLegacyStateBucketName as cn, __exportAll as cr, readConfigString as ct, deleteSkipReason as d, resolveCaptureObservedState as dn, requireConfigObject as dt, getDockerCmd as en, formatError as er, refStateLookupFromResource as et, withResourceDeadline as f, resolveSkipPrefix as fn, requireConfigString as ft, PRE_DELETE_SNAPSHOT_TYPES as g, stateBucketExistenceConfirmed as gn, maskSecretsInText as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, resolveUseCdkBootstrapAssets as hn, TEMPLATE_SOURCED_RULES as ht, DeploymentEventsReader as i, getDockerImageBySourceHash as in, isMarkedNonRetryable as ir, assertRegionMatch as it, gray as j, AwsClients as jn, LockManager as jt, bold as k, clearBucketRegionCache as kn, DagBuilder as kt, replayRollback as l, resolveApp as ln, replayWarn as lt, computeImplicitDeleteEdges as m, resolveStateBucketWithDefaultAndSource as mn, STATE_SOURCED_READBACK_RULES as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, runDockerStreaming as nn, normalizeAwsError as nr, normalizeAwsTagsToCfn as nt, planFailedOps as o, synthesisStatusMessage as on, isThrottlingError as or, configBooleanRefusal as ot, IMPLICIT_DELETE_DEPENDENCIES as p, resolveStateBucketWithDefault as pn, STATE_SOURCED_CROSS_GENERATION_RULES as pt, CloudControlProvider as q, ProvisioningError as qn, getBootstrapMarkerKey as qt, DeployEngine as r, AssetManifestLoader as rn, withErrorHandling as rr, resolveExplicitPhysicalId as rt, planRollback as s, getDefaultStateBucketName as sn, markNonRetryable as sr, configStringRefusal as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, runDockerForeground as tn, isCdkdError as tr, WAFv2WebACLProvider as tt, UNSPECIFIED_SKIP_REASON as u, resolveAutoAssetStorage as un, requireConfigArray as ut, ccRoutedFinalSnapshotError as v, CFN_TEMPLATE_BODY_LIMIT as vn, scrubResourceRecord as vt, extractDeploymentEventError as w, PARTITION_TABLE as wn, applyRoleArnIfSet as wt, refusesFinalSnapshot as x, findLargeInlineResources as xn, s3BucketDualStackDomainName as xt, createPreDeleteFinalSnapshot as y, CFN_TEMPLATE_URL_LIMIT as yn, s3BucketArn as yt, secretBearingStateKeyWarning as z, DeployCancelledError as zn, createAssetRedirectResolver as zt };
-//# sourceMappingURL=deploy-engine-fBYrdrmB.js.map
+//# sourceMappingURL=deploy-engine-Bhq_JPCc.js.map