@go-to-k/cdkd 0.284.23 → 0.284.24

package/dist/{deploy-engine-HfFU96oJ.js → deploy-engine-BJQbni1s.js}

@@ -16860,7 +16860,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Cucl2K22.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Bh0odlSk.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -17575,6 +17575,47 @@ const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete han
 */
 const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did not complete — resource unproven";
 /**
+* Fourth sibling of the three above, for the arm where the handler RAN, was
+* reached, and answered `Status: 'FAILED'` (issue
+* [#2054](https://github.com/go-to-k/cdkd/issues/2054)).
+*
+* The terminal FAILED arm used to warn and fall through to `return undefined`,
+* which `deleteSkipReason` reads as DELETED — so cdkd dropped the state
+* record, printed the row as deleted and exited 0 over a resource the handler
+* had EXPLICITLY said it did not delete. It is the same silent-orphan class
+* {@link CR_DELETE_INVOKE_FAILED_SKIP_REASON} removed from the throw arm,
+* reached through the handler's RESPONSE instead.
+*
+* **Unconditional, with no already-gone classifier.** A handler that reports
+* FAILED because the thing it manages was already absent is a real and common
+* shape, and today's leniency lets those destroys finish green. Classifying
+* the reason to keep them green was rejected: the reason is free text a user's
+* handler writes, so any classifier is a guess, and a wrong guess
+* re-introduces exactly the orphan this arm exists to stop.
+*
+* This is therefore a COMPATIBILITY BREAK: a destroy whose delete handler
+* reports FAILED now exits 2 with the record kept, where it used to exit 0
+* with the record dropped.
+*
+* **The two callers have DIFFERENT escape hatches, and only one of them is a
+* flag.** On `cdkd deploy` the skip is forced back to exit 0 by
+* `--allow-unaddressed` (issue #1960, the flag that settled the analogous
+* exit-code question). `cdkd destroy` has no such flag — a skip raises
+* `PartialFailureError` unconditionally (`src/cli/commands/destroy.ts`) — so
+* there the remedy is the one that command's own summary names: confirm the
+* resource is gone, then drop the record with `cdkd state orphan <stack>`.
+* Messages must not offer the flag on the destroy path, which is the path this
+* arm is mostly reached from.
+*
+* **Fixed wording, no interpolation**, for the reason spelled out on
+* {@link CR_DELETE_INVOKE_FAILED_SKIP_REASON}: the handler's own `Reason` is a
+* user-authored string, it goes out on the `logger.warn` beside this, and a
+* `Reason` carrying `does not exist` / `not found` would make the deploy-side
+* replacement sites classify the skip as "already gone" and drop the record
+* one layer further out.
+*/
+const CR_DELETE_HANDLER_FAILED_SKIP_REASON = "Delete handler reported FAILED — resource unproven";
+/**
 * The deploy-side caveat both skip warnings in this file carry (issue
 * [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
 *
@@ -17585,6 +17626,29 @@ const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did n
 * torn down by hand. Mirrors the caveat `compositeIdFormatMessage` already
 * carries for the composite-id family.
 */
+/**
+* The bound BOTH delete-path skips in this file have to state (found in review
+* of issue [#2054](https://github.com/go-to-k/cdkd/issues/2054)).
+*
+* A skip KEEPS the state record, and the natural thing to promise is that a
+* re-run retries the handler. **On `cdkd destroy` that promise is false**, and
+* it is false in the direction that matters. `destroy-runner.ts` walks every
+* reverse-DAG level regardless of skips, so the SAME run that skipped the
+* custom resource goes on to delete its backing Lambda. The next
+* `cdkd destroy` therefore reaches the issue-#804 pre-check above, finds the
+* function gone, and treats the resource as already deleted — dropping the
+* record and exiting 0 over a resource the handler explicitly refused to
+* remove, which is the very silent orphan #2054 removed one run earlier.
+*
+* Closing it properly means making that pre-check answer `'skipped'` when the
+* teardown was never PROVEN, which needs a durable "a prior run skipped this"
+* signal. Every candidate is outside this file: a `ResourceState` field (a
+* state-schema bump), or a `DeleteContext` flag threaded from
+* `destroy-runner.ts`. So the record is described here as what it actually is
+* — a POINTER to something that has to be torn down by hand — rather than as a
+* retry that will not happen.
+*/
+const CR_SKIP_NOT_A_RETRY_CAVEAT = "NOTE this record is a POINTER, not a retry: the same destroy run deletes the backing Lambda, so the next 'cdkd destroy' finds the handler gone and DROPS this record (issue 804 pre-check). Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one.";
 const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, tear the resource down by hand.";
 /**
 * Type guard to validate Lambda response payload structure
@@ -17898,25 +17962,50 @@ const CR_LOG_TAIL_BOILERPLATE = /^(START|END|REPORT|XRAY|INIT_START|INIT_REPORT|
 */
 const SNS_SERVICE_TOKEN_ARN_RE = /^arn:aws[a-z0-9-]*:sns:/;
 /**
+* Account segment {@link syntheticStackId} falls back to when STS could not
+* answer (`AwsAccountInfo.fabricated`, issue
+* [#1730](https://github.com/go-to-k/cdkd/issues/1730)).
+*
+* The Cloud Control enrichment sites answer a fabricated account by OMITTING
+* the value they would have built. That is not available here — `StackId` is a
+* REQUIRED member of the custom-resource request payload — so the choice is
+* between two wrong strings, and the honest one is the one a handler cannot
+* mistake for real. `getAccountInfo`'s own fallback id (`123456789012`) is
+* shaped exactly like a live account; the all-zero id is not a valid AWS
+* account and reads as the placeholder it is.
+*/
+const SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT = "000000000000";
+/**
 * The synthetic `StackId` handed to a custom-resource handler in place of the
 * CloudFormation stack ARN cdkd does not have.
 *
-* **Its `arn:aws:` prefix is deliberately NOT partition-derived** (issue
-* #1815, which fixed the SNS routing predicate above). Every segment of this
-* value is fabricated — the region is a fixed `us-east-1` rather than the
-* deploy region, and the account is the all-zero placeholder — so it addresses
-* nothing and cannot be made to. Deriving ONLY the partition would produce a
-* strictly LESS coherent ARN (`arn:aws-cn:cloudformation:us-east-1:0000...`,
-* a China partition carrying a commercial region) while fixing nothing a
-* handler could rely on. The coherent fix is to synthesize the real
-* partition / region / account together, which changes what every handler
-* observes and belongs in its own change.
+* Partition / region / account are synthesized TOGETHER from the real deploy
+* context (issue [#1866](https://github.com/go-to-k/cdkd/issues/1866)). Every
+* segment used to be fabricated — `arn:aws:cloudformation:us-east-1:0000...`
+* regardless of where the deploy actually ran — and CloudFormation-authored
+* handlers DO read `event.StackId`: to re-derive the region / account they are
+* running in, to build ARNs, to name log streams, to correlate a response.
+* Each of those read a coherent-looking ARN and got an answer that addresses
+* nothing.
+*
+* Deriving only ONE segment is worse than deriving none, which is why issue
+* #1815 deliberately left the hardcoded `arn:aws:` prefix alone rather than
+* partition-deriving it in isolation: `arn:aws-cn:cloudformation:us-east-1:…`
+* is a China partition carrying a commercial region, strictly LESS coherent
+* than a uniformly-commercial fabrication. So this takes the whole
+* {@link AwsAccountInfo} — where `partition` is already derived FROM `region`
+* — rather than any one field.
+*
+* The stack-NAME segment stays synthetic (`cdkd-<logicalId>`): cdkd has no
+* CloudFormation stack, so there is no real value to put there.
 *
 * Factored into one place so the rationale cannot go stale against two other
-* copies: the create / update / delete request builders all use it.
+* copies: the create / update / delete request builders all use it, through
+* {@link CustomResourceProvider.resolveSyntheticStackId}.
 */
-function syntheticStackId(logicalId) {
-	return `arn:aws:cloudformation:us-east-1:000000000000:stack/cdkd-${logicalId}/cdkd`;
+function syntheticStackId(logicalId, accountInfo) {
+	const account = accountInfo.fabricated ? SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT : accountInfo.accountId;
+	return `arn:${accountInfo.partition}:cloudformation:${accountInfo.region}:${account}:stack/cdkd-${logicalId}/cdkd`;
 }
 /**
 * `true` when the tail contains at least one line the HANDLER produced.
@@ -18109,11 +18198,29 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* the placeholder `PutObject`'s `withRetry` takes no knob either.
 	*/
 	preDeliveryAuthzMaxRetries = 26;
+	/**
+	* The region the client bag this provider was built from was EXPLICITLY
+	* configured with, or `undefined` (issue #1866).
+	*
+	* Captured in the constructor, beside the clients, rather than read per call:
+	* `cdkd deploy` builds a region-configured `AwsClients` and a fresh
+	* `ProviderRegistry` per stack, and with `--stack-concurrency` (default 4) it
+	* swaps the process-global bag while other stacks are mid-flight — so a
+	* call-time read can hand a SIBLING stack's region. Pairing it with the
+	* clients keeps the two consistent by construction.
+	*
+	* `AwsClients.configuredRegion` is deliberately the only region a client bag
+	* will answer (see its own note on why `client.config.region()` is unsound),
+	* and `undefined` means no region was pinned anywhere — which
+	* {@link getAccountInfo} then resolves from `AWS_REGION` itself.
+	*/
+	configuredRegion;
 	constructor(config) {
 		const awsClients = getAwsClients();
 		this.lambdaClient = awsClients.lambda;
 		this.snsClient = awsClients.sns;
 		this.s3Client = awsClients.s3;
+		this.configuredRegion = awsClients.configuredRegion;
 		this.responseBucket = config?.responseBucket;
 		this.responsePrefix = config?.responsePrefix ?? "custom-resource-responses";
 		this.asyncResponseTimeoutMs = config?.asyncResponseTimeoutMs ?? CustomResourceProvider.DEFAULT_ASYNC_RESPONSE_TIMEOUT_MS;
@@ -18211,6 +18318,22 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return this.responseClientResolveInFlight;
 	}
 	/**
+	* Resolve {@link syntheticStackId} against this deploy's REAL account /
+	* region / partition (issue #1866).
+	*
+	* `getAccountInfo` never throws — it answers a `fabricated` account when STS
+	* cannot, which {@link SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT} handles — so
+	* this cannot turn a working deploy into a failing one on the credential
+	* path. It is resolved ONCE per `create` / `update` / `delete` rather than
+	* per invocation attempt: the value does not vary between attempts, and the
+	* request builder the retry loop re-runs is synchronous.
+	*/
+	async resolveSyntheticStackId(logicalId) {
+		const accountInfo = await getAccountInfo(this.configuredRegion);
+		if (accountInfo.fabricated) this.logger.warn(`Custom resource ${logicalId}: STS did not report this deploy's account id, so the synthetic StackId handed to the handler carries the placeholder account ${SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT}. A handler that parses StackId to re-derive the account it is running in will not get a usable one — fix the credentials (or set AWS_ACCOUNT_ID) and re-run.`);
+		return syntheticStackId(logicalId, accountInfo);
+	}
+	/**
 	* Create a custom resource by invoking its Lambda handler
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -18225,7 +18348,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResponseURL: invocation.responseURL,
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties)
 			}));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
@@ -18257,7 +18380,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties),
 				OldResourceProperties: this.stringifyProperties(previousProperties)
 			}));
@@ -18298,7 +18421,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		}
 		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run \`cdkd import\` or \`cdkd state orphan <stack>\` to recover.`, resourceType, logicalId, physicalId);
 		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
-			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted`);
+			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted and DROPPING its state record. The handler can never run again, so if its teardown was never PROVEN — e.g. an earlier run reported this resource as skipped (issue 2054) — whatever it manages is still LIVE and is now untracked by cdkd. Check for leftovers before treating the stack as gone.`);
 			return;
 		}
 		try {
@@ -18309,13 +18432,19 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties)
 			}));
-			if (cfnResponse.Status === "FAILED") this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}`);
-			else this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
+			if (cfnResponse.Status === "FAILED") {
+				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ('cdkd deploy' also accepts --allow-unaddressed, which forces exit 0; 'cdkd destroy' has no such flag.) ${DEPLOY_SKIP_CAVEAT}`);
+				return {
+					outcome: "skipped",
+					reason: CR_DELETE_HANDLER_FAILED_SKIP_REASON
+				};
+			}
+			this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record so a re-run can retry it. ${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
 			return {
 				outcome: "skipped",
 				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
@@ -18391,13 +18520,22 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* PRE-delivery throw is safe to replay at all.
 	*
 	* `buildRequest` is called once per attempt with the fresh invocation so the
-	* CFn request body always carries the matching ResponseURL / RequestId.
+	* CFn request body always carries the matching ResponseURL / RequestId. The
+	* synthetic `StackId` rides the same bag although it is stable across
+	* attempts (issue #1866), for an ORDERING reason rather than a freshness one:
+	* resolving it needs an `await`, and every await before the SIGINT watch
+	* below is installed is a window in which Ctrl-C is dead — `docs/
+	* provider-development.md` requires a new wait site to be interruptible, and
+	* the pre-delivery backoff this method owns is 47.75s long.
+	*
 	* Returns the final response; the caller decides what a terminal FAILED means
-	* (create/update throw, delete warns-and-continues).
+	* (create / update throw; delete warns and returns `'skipped'` — issue
+	* #2054, which replaced its warn-and-continue).
 	*/
 	async invokeCustomResourceWithRetry(serviceToken, logicalId, operation, buildRequest) {
 		const watch = this.startInterruptWatch(logicalId);
 		try {
+			const stackId = await this.resolveSyntheticStackId(logicalId);
 			let preDeliveryRetries = 0;
 			let failedResponseRetries = 0;
 			for (let attempt = 0;; attempt++) {
@@ -18407,7 +18545,10 @@ var CustomResourceProvider = class CustomResourceProvider {
 				let invocation;
 				try {
 					invocation = await this.prepareInvocation(logicalId, watch);
-					const request = buildRequest(invocation);
+					const request = buildRequest({
+						...invocation,
+						stackId
+					});
 					this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
 					const sent = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation, () => {
 						delivered = true;
@@ -25385,7 +25526,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.23";
+	return "0.284.24";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -28006,4 +28147,4 @@ var DeployEngine = class {
 
 //#endregion
 export { disableInstanceApiTermination as $, NestedStackChildDirectDestroyError as $n, ensureAssetStorage as $t, isStatefulRecreateTargetSync as A, uploadCfnTemplate as An, s3BucketWebsiteUrl as At, collectPublishedOutputNames as B, getAwsClients as Bn, rebuildClientForBucketRegion as Bt, createPreDeleteFinalSnapshot as C, resolveUseCdkBootstrapAssets as Cn, maskSecretsInText as Ct, makeCanonicalizePropertiesFn as D, CFN_TEMPLATE_URL_LIMIT as Dn, s3BucketDomainName as Dt, unsupportedFinalSnapshotError as E, CFN_TEMPLATE_BODY_LIMIT as En, s3BucketArn as Et, gray as F, AssemblyReader as Fn, withRetry as Ft, IAMRoleProvider as G, ConfigError as Gn, buildAssetRedirectMap as Gt, isExportAliasCollision as H, setAwsClients as Hn, AssetPublisher as Ht, green as I, processStackMessages as In, DagBuilder as It, ProviderRegistry as J, LocalInvokeBuildError as Jn, rewriteTemplateAssetReferences as Jt, collectInlinePolicyNamesManagedBySiblings as K, DependencyError as Kn, createAssetRedirectResolver as Kt, red as L, clearBucketRegionCache as Ln, TemplateParser as Lt, formatResourceLine as M, PARTITION_TABLE as Mn, DiffCalculator as Mt, bold as N, canonicalizeRegion as Nn, INTRINSIC_KEYS as Nt, extractDeploymentEventError as O, MIGRATE_TMP_PREFIX as On, s3BucketDualStackDomainName as Ot, cyan as P, derivePartitionAndUrlSuffix as Pn, describeTypeWithThrottleRetry as Pt, slowCcOperationTimeoutMs as Q, MissingCdkCliError as Qn, BOOTSTRAP_MARKER_PREFIX as Qt, yellow as R, resolveBucketRegion as Rn, LockManager as Rt, ccRoutedFinalSnapshotError as S, resolveStateBucketWithDefaultAndSource as Sn, isSingleDynamicReferenceToken as St, refusesFinalSnapshot as T, warnDeprecatedNoPrefixCliFlag as Tn, scrubResourceRecord as Tt, secretBearingStateKeyWarning as U, AssetError as Un, stringifyValue as Ut, exportAliasCollisionScrubWarning as V, resetAwsClients as Vn, shouldRetainResource as Vt, stateKeySecretExposure as W, CdkdError as Wn, WorkGraph as Wt, findSilentDropProperties as X, LocalStartServiceError as Xn, stripControlChars as Xt, findActionableSilentDrops as Y, LocalMigrateError as Yn, escapeRegExp$1 as Yt, CloudControlProvider as Z, LockError as Zn, AssetModeResolver as Zt, IMPLICIT_DELETE_DEPENDENCIES as _, resolveApp as _n, STATE_SOURCED_CROSS_GENERATION_RULES as _t, DeploymentEventsStore as a, buildDenyExternalAccessPolicy as an, StackTerminationProtectionError as ar, WAFv2WebACLProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, resolveSkipPrefix as bn, createSecretMasker as bt, producerRegionsFromState as c, getDockerCmd as cn, formatError as cr, assertRegionMatch as ct, updatePartialMessage as d, AssetManifestLoader as dn, withErrorHandling as dr, configStringRefusal as dt, getBootstrapMarkerKey as en, PartialFailureError as er, isTerminationProtectionPropagationError as et, updatePartialReason as f, getDockerImageBySourceHash as fn, isMarkedNonRetryable as fr, readConfigString as ft, maskingRetryLogger as g, getLegacyStateBucketName as gn, __exportAll as gr, requireConfigString as gt, withResourceDeadline as h, getDefaultStateBucketName as hn, markNonRetryable as hr, requireConfigObject as ht, DeploymentEventsReader as i, validateContainerRepoName as in, StackHasActiveImportsError as ir, refStateLookupFromResource as it, renderStatefulReason as j, expectedOwnerParam as jn, applyRoleArnIfSet as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, findLargeInlineResources as kn, s3BucketRegionalDomainName as kt, replayFailedOperations as l, runDockerForeground as ln, isCdkdError as lr, coerceCfnBoolean as lt, deleteSkipReason as m, synthesisStatusMessage as mn, isThrottlingError as mr, requireConfigArray as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, readBootstrapMarkerBody as nn, ResourceTimeoutError as nr, cfnRefValueFromPhysicalId as nt, planFailedOps as o, buildDockerImage as on, StateError as or, normalizeAwsTagsToCfn as ot, UNSPECIFIED_SKIP_REASON as p, Synthesizer as pn, isRetryableTransientError as pr, replayWarn as pt, clearOnUpdateRemoval as q, DeployCancelledError as qn, loadPublishableAssetManifest as qt, DeployEngine as r, validateAssetBucketName as rn, ResourceUpdateNotSupportedError as rr, getAccountInfo as rt, planRollback as s, formatDockerLoginError as sn, SynthesisError as sr, resolveExplicitPhysicalId as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, parseBootstrapMarker as tn, ProvisioningError as tr, IntrinsicFunctionResolver as tt, replayRollback as u, runDockerStreaming as un, normalizeAwsError as ur, configBooleanRefusal as ut, computeImplicitDeleteEdges as v, resolveAutoAssetStorage as vn, STATE_SOURCED_READBACK_RULES as vt, isFinalSnapshotError as w, stateBucketExistenceConfirmed as wn, redactSecretsForState as wt, buildFinalSnapshotIdentifier as x, resolveStateBucketWithDefault as xn, dynamicReferenceTokens as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, resolveCaptureObservedState as yn, TEMPLATE_SOURCED_RULES as yt, collectDeclaredOutputNames as z, AwsClients as zn, S3StateBackend as zt };
-//# sourceMappingURL=deploy-engine-HfFU96oJ.js.map
+//# sourceMappingURL=deploy-engine-BJQbni1s.js.map