@go-to-k/cdkd 0.284.18 → 0.284.20

package/dist/{deploy-engine-HK-oROJf.js → deploy-engine-C6gt7NcL.js}

@@ -5450,6 +5450,68 @@ function getBootstrapMarkerKey(region) {
 	return `${BOOTSTRAP_MARKER_PREFIX}${region}.json`;
 }
 /**
+* Read a region's bootstrap marker, probing the CANONICAL key first and the
+* region's RAW spelling second (issues #1836 / #1995 / #2021).
+*
+* Why two probes: the READ side folds region case (SDK endpoint resolution is
+* case-sensitive, and folding also keeps one region from occupying two cache
+* slots), but the WRITE side does not — `cdkd bootstrap` derives its region as
+* `options.region || AWS_REGION || 'us-east-1'` verbatim and uses that spelling
+* for {@link getBootstrapMarkerKey}. Aligning the write side is issue #1820's
+* lane; until then this read is independent of it.
+*
+* HOW REACHABLE the raw key actually is (measured for #2021, because this PR
+* turns the probe into a SHARED contract for four callers and the earlier
+* per-caller comments overstated it). A plain `AWS_REGION=US-EAST-1 cdkd
+* bootstrap` CANNOT write `cdkd-bootstrap/US-EAST-1.json`: the marker is
+* written LAST, and both resources have to be created first with names derived
+* from that same raw region — `getCdkdAssetBucketName` yields
+* `cdkd-assets-<acct>-US-EAST-1`, which S3 rejects as a bucket name, and
+* `region !== 'us-east-1'` is true for `US-EAST-1` so `CreateBucket` is also
+* handed `LocationConstraint: 'US-EAST-1'`, an invalid enum value. The
+* conventional name is never run through `validateAssetBucketName` (that guards
+* only `--asset-bucket`), so it fails at S3 rather than earlier. The raw key is
+* therefore reachable only when ALL of these hold:
+*
+* 1. both `--asset-bucket` and `--container-repo` are given as valid lowercase
+*    names, so neither conventional name is derived from the raw region; AND
+* 2. the asset bucket ALREADY EXISTS and is owned by this account, so the
+*    `CreateBucket` carrying the bad `LocationConstraint` is never issued;
+*
+* plus, outside that flow, a marker written by hand or by a cdkd predating
+* those guards. Probe 2 is kept rather than dropped because that state is real
+* and losing it silently re-points a bootstrapped region at `cdk gc`-collectable
+* storage — the exact #2021 failure — while the cost is one extra `GetObject`
+* on a non-canonical region only. It is skipped entirely when the region was
+* already canonical, so the common path still costs exactly one `GetObject`.
+* Both conditions are pinned by tests, so this claim cannot rot silently.
+*
+* This helper deliberately does NOT catch: each caller keeps its own policy on
+* top (`cdkd gc` / `cdkd bootstrap --destroy` translate `NoSuchBucket` into a
+* "never bootstrapped" message and hard-error on anything else;
+* `loadBootstrapContainerRepo` is best-effort and warns-and-falls-back).
+*/
+async function readBootstrapMarkerBody(stateBackend, rawRegion, opts = {}) {
+	const canonicalKey = getBootstrapMarkerKey(canonicalizeRegion(rawRegion));
+	const rawKey = getBootstrapMarkerKey(rawRegion);
+	const body = await stateBackend.getRawObject(canonicalKey);
+	if (body !== null || rawKey === canonicalKey) return {
+		body,
+		resolvedKey: canonicalKey
+	};
+	const rawBody = await stateBackend.getRawObject(rawKey);
+	if (rawBody === null) return {
+		body: null,
+		resolvedKey: canonicalKey
+	};
+	const subject = opts.logPrefix ? `${opts.logPrefix}: bootstrap marker` : "Bootstrap marker";
+	getLogger().debug(`${subject} found at the un-folded key '${rawKey}' (none at '${canonicalKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+	return {
+		body: rawBody,
+		resolvedKey: rawKey
+	};
+}
+/**
 * Pragmatic S3 bucket-name check for `cdkd bootstrap --asset-bucket`
 * (issue #1011): 3-63 chars, lowercase letters / digits / dots / hyphens,
 * starting and ending with a letter or digit. Rejecting before any AWS call
@@ -5705,6 +5767,15 @@ async function ensureAssetStorage(options) {
 var AssetModeResolver = class {
 	logger = getLogger().child("AssetMode");
 	cache = /* @__PURE__ */ new Map();
+	/**
+	* NOT load-bearing today — defense-in-depth only. `resolve` sets `cache`
+	* synchronously before the first await, so `doResolve` runs at most once per
+	* canonical region, and the notice arm always returns successfully so the
+	* failure-eviction path cannot re-enter it. This Set was already ineffective
+	* BEFORE the issue #2021 fold (two spellings simply made two entries), so it
+	* is not a regression that fold introduced. Kept so removing or bypassing the
+	* cache cannot silently turn the notice into one line per resolve.
+	*/
 	legacyNoticeShownRegions = /* @__PURE__ */ new Set();
 	stateBackend;
 	accountId;
@@ -5723,24 +5794,37 @@ var AssetModeResolver = class {
 	/**
 	* Resolve the asset mode for a deploy region. Concurrent callers for the
 	* same region share one in-flight resolution.
+	*
+	* The region arrives UNFOLDED (issue #2021): both deploy-time callers derive
+	* it as `options.region || AWS_REGION || 'us-east-1'` and then
+	* `stack.region || baseRegion`, so an env-agnostic stack under
+	* `--region US-EAST-1` (or `AWS_REGION=US-EAST-1`) hands an upper-cased
+	* spelling straight through. A stack whose `env.region` is pinned in CDK is
+	* unaffected — `stack.region` comes from the Cloud Assembly and is canonical.
+	*
+	* Folding at THIS boundary rather than at each caller fixes two things at
+	* once: the marker read below (which used to miss `cdkd-bootstrap/
+	* us-east-1.json` and silently downgrade the whole region to LEGACY —
+	* `cdk gc`-collectable — storage), and the CACHE, where `us-east-1` and
+	* `US-EAST-1` occupied two slots and each re-probed S3.
 	*/
-	resolve(region) {
+	resolve(rawRegion) {
 		if (this.useCdkBootstrapAssets) return Promise.resolve({ mode: "legacy" });
+		const region = canonicalizeRegion(rawRegion);
 		const cached = this.cache.get(region);
 		if (cached) return cached;
-		const inFlight = this.doResolve(region).catch((error) => {
+		const inFlight = this.doResolve(region, rawRegion).catch((error) => {
 			this.cache.delete(region);
 			throw error;
 		});
 		this.cache.set(region, inFlight);
 		return inFlight;
 	}
-	async doResolve(region) {
-		const markerKey = getBootstrapMarkerKey(region);
-		const body = await this.stateBackend.getRawObject(markerKey);
+	async doResolve(region, rawRegion) {
+		const { body, resolvedKey } = await readBootstrapMarkerBody(this.stateBackend, rawRegion);
 		if (body === null) {
 			if (this.autoCreate) {
-				const created = await this.tryAutoCreate(region, markerKey);
+				const created = await this.tryAutoCreate(region, getBootstrapMarkerKey(region));
 				if (created) return created;
 			}
 			if (!this.legacyNoticeShownRegions.has(region) && !this.suppressLegacyNotice) {
@@ -5749,7 +5833,7 @@ var AssetModeResolver = class {
 			}
 			return { mode: "legacy" };
 		}
-		const marker = parseBootstrapMarker(body, markerKey);
+		const marker = parseBootstrapMarker(body, resolvedKey);
 		await verifyAssetStorageExists(marker, this.accountId, region, { ...this.profile && { profile: this.profile } });
 		this.logger.debug(`cdkd asset storage active for region '${region}': ${marker.assetBucket} / ${marker.containerRepo}`);
 		return {
@@ -10380,8 +10464,86 @@ function isKnownSecretExpression(expression, secretExpressions) {
 	return expression.startsWith("{{resolve:secretsmanager:") || secretExpressions.has(expression) || isRecordedSecretExpression(expression);
 }
 /**
-* Is this source leaf a SINGLE complete `{{resolve:...}}` token and nothing
-* else?
+* The character class a `{{resolve:...}}` reference's INNER text is built from,
+* and the SINGLE SOURCE OF TRUTH every dynamic-reference predicate in cdkd
+* derives from (issue
+* [#1936](https://github.com/go-to-k/cdkd/issues/1936)).
+*
+* **THE AUTHORITY IS THE RESOLVER.**
+* `IntrinsicFunctionResolver.resolveDynamicReferences`
+* (`src/deployment/intrinsic-function-resolver.ts`) scans with
+* `/\{\{resolve:([^}]+)\}\}/g`, so what cdkd will actually RESOLVE is exactly
+* `{{resolve:` followed by one or more non-`}` characters followed by `}}`.
+* A predicate that answers a different question than that scan is answering
+* about a string the resolver already substituted a value INTO, which is how a
+* leaf ends up classified as "not a token" while holding the plaintext the
+* resolver put there.
+*
+* Three sites disagreed before this constant existed, and the STRICTEST of them
+* was the one that persisted plaintext. `isSingleDynamicReferenceToken` here and
+* `isWholeDynamicReference` in `src/cli/commands/drift.ts` both spelled the
+* inner class `[^{}]*`, while `survivingDynamicReferences` (same file) spelled
+* it `[^}]+` to match the resolver. For a reference whose inner text contains a
+* `{` — a Secrets Manager JSON key or a secret name, e.g.
+* `{{resolve:secretsmanager:app/db:SecretString:my{key}}` — the resolver
+* resolves it fine, but the strict spelling said it was not a single token, so
+* `redactByPath`'s source arm refused it and on an EMPTY-map path the RESOLVED
+* PLAINTEXT was persisted verbatim. A disclosure, narrow and pre-existing.
+*
+* `cdkd scrub` is the only leaking command, and it leaks on BOTH of its walks
+* -- the second one named after the issue #2088 security review, which found
+* the first draft of this note incomplete:
+*
+* - the `properties` walk under `TEMPLATE_SOURCED_RULES`, where
+*   `isKnownSecretExpression` answers true by SPELLING but the strict
+*   predicate refused the leaf before it could; and
+* - the cross-generation `observedProperties` walk, whose value scan has no
+*   needles (issue #1900).
+*
+* The empty map is reachable on both because `scrub.ts` resolves BEST-EFFORT
+* (a deleted secret, or a role lacking read permission on it, leaves
+* `recordedSecretValues` empty) and then records `perResourceTemplateProps`
+* UNCONDITIONALLY while recording `perResourceSecrets` only when non-empty --
+* so the position source is present with no map beside it.
+*
+* `cdkd state refresh-observed` and the deploy's `drainObservedCaptures` are
+* NOT affected: they take `STATE_SOURCED_READBACK_RULES`, which sets
+* `sourceIsSameGeneration`, so {@link refuseUncertifiedReadbackPositions}
+* restores the source even under the old strict class.
+*
+* Excluding `{` bought nothing. The mangled / concatenated shapes it might seem
+* to guard — `{{resolve:a}}{{resolve:b}}`, a spliced token — are already
+* rejected by `[^}]+` under an ANCHORED pattern, because the class cannot cross
+* the first `}`. (A claim that `[^}]+` would let `{{resolve:a}}{{resolve:b}}`
+* through circulated in review and is FALSE: that string does not match
+* `^\{\{resolve:[^}]+\}\}$` either.) The only strings the two spellings
+* classify differently are the ones with a `{` inside a single token, i.e.
+* exactly the disclosure above.
+*
+* `+` rather than `*` for the same reason: `{{resolve:}}` is not something the
+* resolver would try to resolve, so nothing here may call it a token.
+*
+* The class is exported as a STRING rather than as a finished `RegExp` because
+* three different pattern shapes are built from it — anchored, global, and
+* {@link SKELETON_WILDCARD}'s zero-or-more form — and a shared global `RegExp`
+* instance would carry `lastIndex` across callers.
+*/
+const DYNAMIC_REFERENCE_INNER_CHAR = "[^}]";
+/**
+* The inner-text pattern fragment of a complete `{{resolve:...}}` reference,
+* byte-identical to the resolver's own `([^}]+)` capture. See
+* {@link DYNAMIC_REFERENCE_INNER_CHAR} for why this is one constant.
+*/
+const DYNAMIC_REFERENCE_INNER = `${DYNAMIC_REFERENCE_INNER_CHAR}+`;
+/**
+* Anchored: the WHOLE string is one complete `{{resolve:...}}` token.
+*
+* A non-global `RegExp`, so `.test` carries no `lastIndex` state and the shared
+* instance is safe to reuse.
+*/
+const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REFERENCE_INNER}\\}\\}$`);
+/**
+* Is this leaf a SINGLE complete `{{resolve:...}}` token and nothing else?
 *
 * Whole-leaf substitution is only correct for that shape. A MIXED leaf --
 * `pre{{resolve:ssm:/public}}-{{resolve:secretsmanager:x}}post`, i.e. anything
@@ -10389,9 +10551,15 @@ function isKnownSecretExpression(expression, secretExpressions) {
 * scan, which rewrites just the secret substring. Substituting the whole leaf
 * there would re-introduce every other token in it, including a public ssm
 * reference the resolver deliberately left resolved (issue #1901).
+*
+* EXPORTED since issue #1936 so `src/cli/commands/drift.ts` can consume this
+* one definition instead of carrying a hand-copied twin. Its copy's own comment
+* said "copied rather than imported because that helper is module-private and
+* this file may not widen that module's exports" — widening the exports is the
+* cheaper half of that trade once the copies have provably disagreed.
 */
 function isSingleDynamicReferenceToken(value) {
-	return /^\{\{resolve:[^{}]*\}\}$/.test(value);
+	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
 function isPlainObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -10400,14 +10568,18 @@ function isPlainObject$2(value) {
 * Stands in for a source part the skeleton cannot know — an `Fn::Join` element
 * that is itself an intrinsic, or an `Fn::Sub` `${...}` variable.
 *
-* `[^}]*` rather than `.*` because a recorded expression's INNER text never
-* contains `}`: the resolver matches them with `/\{\{resolve:([^}]+)\}\}/`, so
-* the first `}` after `{{resolve:` is already the terminator. Excluding it
-* means a wildcard can never swallow one token's terminator and run into the
-* next, so a skeleton for ONE reference cannot match a candidate built from a
-* different one.
+* Built from {@link DYNAMIC_REFERENCE_INNER_CHAR} rather than `.` because a
+* recorded expression's INNER text never contains `}`: the resolver matches
+* them with `/\{\{resolve:([^}]+)\}\}/`, so the first `}` after `{{resolve:` is
+* already the terminator. Excluding it means a wildcard can never swallow one
+* token's terminator and run into the next, so a skeleton for ONE reference
+* cannot match a candidate built from a different one.
+*
+* Zero-or-more here, unlike {@link DYNAMIC_REFERENCE_INNER}: this stands in for
+* an unknown SPAN, which may legitimately be empty (an `Fn::Join` part that
+* resolved to `''`), whereas a token with no inner text is not a token.
 */
-const SKELETON_WILDCARD = "[^}]*";
+const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
 /**
 * More wildcards than this and the skeleton is REFUSED outright.
 *
@@ -10863,9 +11035,51 @@ function subtreeHasDynamicReference(value) {
 	if (isPlainObject$2(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
-/** Every complete `{{resolve:...}}` token inside a string. */
+/**
+* Every complete `{{resolve:...}}` token inside a string.
+*
+* This was a FOURTH spelling of the token pattern (`[^{}]*`, global) and is
+* built from {@link DYNAMIC_REFERENCE_INNER} since issue #1936, so it agrees
+* with the resolver like every other predicate here.
+*
+* EXPORTED, and `drift.ts`'s `survivingDynamicReferences` calls it rather than
+* re-spelling the scan (issue #2088 review). The character CLASS was shared
+* from #1936, but the assembled PATTERN was still byte-duplicated in the two
+* files — which is how a later flag or anchor change re-forks exactly the way
+* the four spellings did.
+*
+* The pattern is a module-level constant. An earlier revision built a fresh
+* `RegExp` per call, justified as "a shared global instance carries
+* `lastIndex` between callers" — that is FALSE for this use and was measured:
+* `String.prototype.match` with a `/g` pattern sets `lastIndex` to 0 on entry
+* and leaves it 0, so no state crosses callers. The per-call construction was
+* compiling a pattern per string leaf at the persist choke point, which walks
+* every record. Do NOT call `.exec` / `.test` on this constant — those DO
+* advance `lastIndex`, which is exactly why the shared instance is safe only
+* for `.match`.
+*
+* Widening it changes one answer, in the SAFE direction for BOTH readers.
+*
+* `drift.ts`'s `survivingDynamicReferences` is the reader that is easy to
+* forget, because it lives in another file — it feeds `isSecretBySpelling`,
+* so seeing MORE tokens can only mask more, never less. Do not shorten this
+* to "the only reader": that sentence is what a later editor uses to bound
+* the blast radius of touching the class, and getting it wrong points them
+* away from the report / `--json` / `--accept` path where an unmasked
+* `ssm-secure` survivor would surface.
+*
+* The other reader is the DECLARED direction for issue #1901:
+* {@link mixedLeafMayCarryPublicReference}, which asks whether a MIXED leaf
+* embeds a `{{resolve:ssm:` token the verdict store does not know. A token
+* carrying a `{` inside it used to be INVISIBLE here, so such a leaf was
+* always treated as secret-bearing and the source expression was substituted
+* over the resolved value. Now it is seen and classified by the same rule as
+* every other token — which, on a POPULATED map, means a genuinely public ssm
+* parameter keeps the resolved value it is supposed to keep.
+*/
+const DYNAMIC_REFERENCE_TOKEN_SCAN = new RegExp(`\\{\\{resolve:${DYNAMIC_REFERENCE_INNER}\\}\\}`, "g");
 function dynamicReferenceTokens(value) {
-	return value.match(/\{\{resolve:[^{}]*\}\}/g) ?? [];
+	return value.match(DYNAMIC_REFERENCE_TOKEN_SCAN) ?? [];
 }
 /**
 * Does this MIXED leaf embed a reference that may be PUBLIC config?
@@ -16514,7 +16728,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-IPF2MfAC.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Cq-oDB62.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -24687,7 +24901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.18";
+	return "0.284.20";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -27226,5 +27440,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { isTerminationProtectionPropagationError as $, ResourceUpdateNotSupportedError as $n, validateAssetBucketName as $t, renderStatefulReason as A, derivePartitionAndUrlSuffix as An, INTRINSIC_KEYS as At, exportAliasCollisionScrubWarning as B, CdkdError as Bn, stringifyValue as Bt, isFinalSnapshotError as C, CFN_TEMPLATE_URL_LIMIT as Cn, s3BucketArn as Ct, extractDeploymentEventError as D, expectedOwnerParam as Dn, s3BucketWebsiteUrl as Dt, makeCanonicalizePropertiesFn as E, uploadCfnTemplate as En, s3BucketRegionalDomainName as Et, green as F, AwsClients as Fn, LockManager as Ft, collectInlinePolicyNamesManagedBySiblings as G, LocalMigrateError as Gn, rewriteTemplateAssetReferences as Gt, secretBearingStateKeyWarning as H, DependencyError as Hn, buildAssetRedirectMap as Ht, red as I, getAwsClients as In, S3StateBackend as It, findActionableSilentDrops as J, MissingCdkCliError as Jn, AssetModeResolver as Jt, clearOnUpdateRemoval as K, LocalStartServiceError as Kn, escapeRegExp$1 as Kt, yellow as L, resetAwsClients as Ln, rebuildClientForBucketRegion as Lt, bold as M, processStackMessages as Mn, withRetry as Mt, cyan as N, clearBucketRegionCache as Nn, DagBuilder as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, PARTITION_TABLE as On, applyRoleArnIfSet as Ot, gray as P, resolveBucketRegion as Pn, TemplateParser as Pt, disableInstanceApiTermination as Q, ResourceTimeoutError as Qn, parseBootstrapMarker as Qt, collectDeclaredOutputNames as R, setAwsClients as Rn, shouldRetainResource as Rt, createPreDeleteFinalSnapshot as S, CFN_TEMPLATE_BODY_LIMIT as Sn, scrubResourceRecord as St, unsupportedFinalSnapshotError as T, findLargeInlineResources as Tn, s3BucketDualStackDomainName as Tt, stateKeySecretExposure as U, DeployCancelledError as Un, createAssetRedirectResolver as Ut, isExportAliasCollision as V, ConfigError as Vn, WorkGraph as Vt, IAMRoleProvider as W, LocalInvokeBuildError as Wn, loadPublishableAssetManifest as Wt, CloudControlProvider as X, PartialFailureError as Xn, ensureAssetStorage as Xt, findSilentDropProperties as Y, NestedStackChildDirectDestroyError as Yn, BOOTSTRAP_MARKER_PREFIX as Yt, slowCcOperationTimeoutMs as Z, ProvisioningError as Zn, getBootstrapMarkerKey as Zt, computeImplicitDeleteEdges as _, resolveStateBucketWithDefault as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, runDockerForeground as an, isCdkdError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, stateBucketExistenceConfirmed as bn, maskSecretsInText as bt, replayFailedOperations as c, getDockerImageBySourceHash as cn, isMarkedNonRetryable as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDefaultStateBucketName as dn, markNonRetryable as dr, readConfigString as dt, validateContainerRepoName as en, StackHasActiveImportsError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, getLegacyStateBucketName as fn, __exportAll as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveSkipPrefix as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, resolveCaptureObservedState as hn, requireConfigString as ht, DeploymentEventsReader as i, getDockerCmd as in, formatError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, AssemblyReader as jn, describeTypeWithThrottleRetry as jt, isStatefulRecreateTargetSync as k, canonicalizeRegion as kn, DiffCalculator as kt, replayRollback as l, Synthesizer as ln, isRetryableTransientError as lr, configBooleanRefusal as lt, withResourceDeadline as m, resolveAutoAssetStorage as mn, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, buildDockerImage as nn, StateError as nr, getAccountInfo as nt, planFailedOps as o, runDockerStreaming as on, normalizeAwsError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, resolveApp as pn, requireConfigArray as pt, ProviderRegistry as q, LockError as qn, stripControlChars as qt, DeployEngine as r, formatDockerLoginError as rn, SynthesisError as rr, refStateLookupFromResource as rt, planRollback as s, AssetManifestLoader as sn, withErrorHandling as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDenyExternalAccessPolicy as tn, StackTerminationProtectionError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, synthesisStatusMessage as un, isThrottlingError as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveStateBucketWithDefaultAndSource as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, MIGRATE_TMP_PREFIX as wn, s3BucketDomainName as wt, ccRoutedFinalSnapshotError as x, warnDeprecatedNoPrefixCliFlag as xn, redactSecretsForState as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveUseCdkBootstrapAssets as yn, createSecretMasker as yt, collectPublishedOutputNames as z, AssetError as zn, AssetPublisher as zt };
-//# sourceMappingURL=deploy-engine-HK-oROJf.js.map
+export { isTerminationProtectionPropagationError as $, PartialFailureError as $n, getBootstrapMarkerKey as $t, renderStatefulReason as A, expectedOwnerParam as An, applyRoleArnIfSet as At, exportAliasCollisionScrubWarning as B, resetAwsClients as Bn, shouldRetainResource as Bt, isFinalSnapshotError as C, stateBucketExistenceConfirmed as Cn, redactSecretsForState as Ct, extractDeploymentEventError as D, MIGRATE_TMP_PREFIX as Dn, s3BucketDualStackDomainName as Dt, makeCanonicalizePropertiesFn as E, CFN_TEMPLATE_URL_LIMIT as En, s3BucketDomainName as Et, green as F, processStackMessages as Fn, DagBuilder as Ft, collectInlinePolicyNamesManagedBySiblings as G, DependencyError as Gn, createAssetRedirectResolver as Gt, secretBearingStateKeyWarning as H, AssetError as Hn, stringifyValue as Ht, red as I, clearBucketRegionCache as In, TemplateParser as It, findActionableSilentDrops as J, LocalMigrateError as Jn, escapeRegExp$1 as Jt, clearOnUpdateRemoval as K, DeployCancelledError as Kn, loadPublishableAssetManifest as Kt, yellow as L, resolveBucketRegion as Ln, LockManager as Lt, bold as M, canonicalizeRegion as Mn, INTRINSIC_KEYS as Mt, cyan as N, derivePartitionAndUrlSuffix as Nn, describeTypeWithThrottleRetry as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, findLargeInlineResources as On, s3BucketRegionalDomainName as Ot, gray as P, AssemblyReader as Pn, withRetry as Pt, disableInstanceApiTermination as Q, NestedStackChildDirectDestroyError as Qn, ensureAssetStorage as Qt, collectDeclaredOutputNames as R, AwsClients as Rn, S3StateBackend as Rt, createPreDeleteFinalSnapshot as S, resolveUseCdkBootstrapAssets as Sn, maskSecretsInText as St, unsupportedFinalSnapshotError as T, CFN_TEMPLATE_BODY_LIMIT as Tn, s3BucketArn as Tt, stateKeySecretExposure as U, CdkdError as Un, WorkGraph as Ut, isExportAliasCollision as V, setAwsClients as Vn, AssetPublisher as Vt, IAMRoleProvider as W, ConfigError as Wn, buildAssetRedirectMap as Wt, CloudControlProvider as X, LockError as Xn, AssetModeResolver as Xt, findSilentDropProperties as Y, LocalStartServiceError as Yn, stripControlChars as Yt, slowCcOperationTimeoutMs as Z, MissingCdkCliError as Zn, BOOTSTRAP_MARKER_PREFIX as Zt, computeImplicitDeleteEdges as _, resolveAutoAssetStorage as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, buildDockerImage as an, StateError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, resolveStateBucketWithDefault as bn, dynamicReferenceTokens as bt, replayFailedOperations as c, runDockerForeground as cn, isCdkdError as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDockerImageBySourceHash as dn, isMarkedNonRetryable as dr, readConfigString as dt, parseBootstrapMarker as en, ProvisioningError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, Synthesizer as fn, isRetryableTransientError as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveApp as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, getLegacyStateBucketName as hn, __exportAll as hr, requireConfigString as ht, DeploymentEventsReader as i, buildDenyExternalAccessPolicy as in, StackTerminationProtectionError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, PARTITION_TABLE as jn, DiffCalculator as jt, isStatefulRecreateTargetSync as k, uploadCfnTemplate as kn, s3BucketWebsiteUrl as kt, replayRollback as l, runDockerStreaming as ln, normalizeAwsError as lr, configBooleanRefusal as lt, withResourceDeadline as m, getDefaultStateBucketName as mn, markNonRetryable as mr, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, validateAssetBucketName as nn, ResourceUpdateNotSupportedError as nr, getAccountInfo as nt, planFailedOps as o, formatDockerLoginError as on, SynthesisError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, synthesisStatusMessage as pn, isThrottlingError as pr, requireConfigArray as pt, ProviderRegistry as q, LocalInvokeBuildError as qn, rewriteTemplateAssetReferences as qt, DeployEngine as r, validateContainerRepoName as rn, StackHasActiveImportsError as rr, refStateLookupFromResource as rt, planRollback as s, getDockerCmd as sn, formatError as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, readBootstrapMarkerBody as tn, ResourceTimeoutError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, AssetManifestLoader as un, withErrorHandling as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveCaptureObservedState as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, warnDeprecatedNoPrefixCliFlag as wn, scrubResourceRecord as wt, ccRoutedFinalSnapshotError as x, resolveStateBucketWithDefaultAndSource as xn, isSingleDynamicReferenceToken as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveSkipPrefix as yn, createSecretMasker as yt, collectPublishedOutputNames as z, getAwsClients as zn, rebuildClientForBucketRegion as zt };
+//# sourceMappingURL=deploy-engine-C6gt7NcL.js.map