@go-to-k/cdkd 0.284.4 → 0.284.6

package/dist/{deploy-engine-3Z7P1hKs.js → deploy-engine-Ce7kNQp2.js}

@@ -8727,6 +8727,15 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 * by `markNonRetryable`, which is rethrown ahead of either, so a deliberate
 * cdkd refusal cannot be turned back into a retry by a custom classifier
 * (issue #1778).
+*
+* REPORTING (issue #2018). A propagation sequence that gives up emits ONE
+* `warn` line naming how many retries it spent and how much of the budget it
+* slept, and the per-attempt `debug` lines carry the running total. Before
+* this, an exhausted retry rethrew the raw AWS error and nothing in a
+* default-verbosity run distinguished "cdkd retried for 47.75s" from "cdkd
+* has no retry for this at all" — which is why a field report of exactly this
+* failure could only be diagnosed by reading the source and diffing two
+* releases. Neither counter feeds a control decision; they are reporting only.
 */
 async function withRetry(operation, logicalId, opts = {}) {
 	const maxRetries = opts.maxRetries ?? 8;
@@ -8737,6 +8746,8 @@ async function withRetry(operation, logicalId, opts = {}) {
 	const attemptCeiling = defaultSchedule ? Math.max(maxRetries, 26) : maxRetries;
 	let lastError;
 	let sawPropagation = false;
+	let propagationRetries = 0;
+	let propagationSleptMs = 0;
 	for (let attempt = 0; attempt <= attemptCeiling; attempt++) try {
 		return await operation();
 	} catch (error) {
@@ -8747,13 +8758,27 @@ async function withRetry(operation, logicalId, opts = {}) {
 		const propagation = defaultSchedule && isIamPropagationError(message);
 		if (propagation) sawPropagation = true;
 		const attemptLimit = sawPropagation ? 26 : maxRetries;
-		if (!retryable || attempt >= attemptLimit) throw error;
+		if (!retryable || attempt >= attemptLimit) {
+			if (propagationRetries > 0) {
+				const budgetExhausted = sawPropagation && attempt >= attemptLimit;
+				const summary = `${logicalId}: gave up after ${propagationRetries} IAM-propagation ${propagationRetries === 1 ? "retry" : "retries"} over ${(propagationSleptMs / 1e3).toFixed(2)}s of propagation backoff${budgetExhausted ? " (the full propagation budget)" : ""} - ${message}`;
+				try {
+					opts.logger?.warn?.(summary);
+				} catch {}
+			}
+			throw error;
+		}
 		const delay = propagation ? Math.min(250 * Math.pow(2, attempt), IAM_PROPAGATION_MAX_DELAY_MS) : Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${attemptLimit}) - ${message}`);
+		const backoffThroughThisAttemptMs = propagation ? propagationSleptMs + delay : propagationSleptMs;
+		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${attemptLimit}${propagation ? `, ${(backoffThroughThisAttemptMs / 1e3).toFixed(2)}s backoff through this attempt` : ""}) - ${message}`);
 		for (let waited = 0; waited < delay; waited += 1e3) {
 			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
 			await sleep(Math.min(1e3, delay - waited));
 		}
+		if (propagation) {
+			propagationRetries++;
+			propagationSleptMs = backoffThroughThisAttemptMs;
+		}
 	}
 	throw lastError;
 }
@@ -10659,6 +10684,29 @@ function maskSecretsInText(text, secrets) {
 	if (!regex) return text;
 	return text.replace(regex, "***");
 }
+/**
+* Bind a {@link RecordedSecretValues} bag into a {@link SecretMasker} for a
+* caller to hand to a provider.
+*
+* The bag is captured BY REFERENCE and read on every call, and there is
+* deliberately NO `secrets.size === 0` short-circuit here: collapsing an empty
+* bag to the identity function at BIND time would go permanently blind to
+* everything added afterwards. {@link maskSecretsInText} makes that check at
+* CALL time, where it is correct and costs a `Map.size` read.
+*
+* Stated as a property rather than a live requirement, because it is worth
+* being exact about: every caller today FILLS its bag before binding — the
+* rollback executor's arms run `resolveReplayProps` first and only then build
+* the masker, and the deploy engine resolves before it calls the provider — so
+* a bind-time short-circuit would pass every existing integration. It is the
+* ORDER, not the reference capture, that makes them work now, and the order is
+* the kind of thing a later refactor reverses without noticing. The unit test
+* `masks values added to the bag AFTER the masker was built` is what holds the
+* property up on its own.
+*/
+function createSecretMasker(secrets) {
+	return (text) => maskSecretsInText(text, secrets);
+}
 
 //#endregion
 //#region src/provisioning/config-shape.ts
@@ -15595,7 +15643,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C0L3_pHn.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B9L-88MC.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -22201,21 +22249,52 @@ const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 * engine's five sites (CREATE, the property-driven replacement, the
 * `--recreate-via-*` destroy-then-create, the `--replace` delete-first
 * fallback, and the update-failure replacement) are all driven by freshly
-* resolved TEMPLATE properties, so they deliberately pass no context and the
-* refusal stands where the user can edit the input.
+* resolved TEMPLATE properties, so they never set THIS FLAG and the refusal
+* stands where the user can edit the input. They DO pass a context — since
+* issue #1932 every create site REACHED FROM THE ENGINE carries a
+* `maskSecrets` capability — so the invariant is "no `replayingState`", not
+* "no context object". (A provider that re-creates inside its own `update()`
+* still passes none; see `CreateContext`.)
 *
 * The remaining call sites are the providers that re-create inside their own
 * `update()` (`this.create(...)` in ACM certificate / IAM managed policy / IAM
 * role / Lambda permission / SNS subscription). Those are NOT template-driven
 * — this executor's `revert` arm calls `provider.update(...)` with
 * `previousState.properties`, so they forward a STATE record on a replay — but
-* they CANNOT receive a context, because `update()` has no context parameter.
+* they CANNOT receive a `CreateContext`: `update()`'s own context is an
+* `UpdateContext`, which carries no `replayingState` to forward.
 * The constraint that follows is on providers, not on this constant: a
 * provider with a create-side pre-flight refusal must not re-create inside
 * `update()`. See `CreateContext` in `src/types/resource.ts`.
 */
 const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
 /**
+* The rollback arms' {@link CreateContext}, with this op's secret masker bound
+* in (issue #1932 item 3).
+*
+* The rollback path needs this MORE than the forward deploy does, not less:
+* {@link resolveReplayProps} deliberately re-resolves every redacted
+* `{{resolve:...}}` expression back to plaintext before handing the bag to a
+* provider, so a replayed bag is guaranteed to carry the concrete secret
+* whenever the resource has one. Leaving the masker off here would have left
+* the contract applied at one caller and absent at the one whose bag is
+* provably plaintext.
+*
+* Spreads the shared constant rather than mutating it: `maskSecrets` is
+* per-op, and a module-level object is shared by every op in the run.
+*
+* Called AFTER `resolveReplayProps` has filled `secrets` at every call site, so
+* the masker sees this op's re-resolved values. `createSecretMasker` reads the
+* bag by reference on every call and so does not depend on that ordering, but
+* the ordering is what makes it correct here without relying on that.
+*/
+function replayingStateCreateContext(secrets) {
+	return {
+		...REPLAYING_STATE_CREATE_CONTEXT,
+		maskSecrets: createSecretMasker(secrets)
+	};
+}
+/**
 * Which provisioning layer a delete must be judged against: the CURRENT
 * state record wins (it is what state says AWS holds right now), with the
 * journaled op's routing as the legacy-state fallback. Shared by both
@@ -22770,7 +22849,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				let deletedNewFirst = false;
 				let createResult;
 				try {
-					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
+					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, {
 						...RECREATE_RETRY_SCHEDULE,
 						logger,
 						...isInterrupted && {
@@ -22793,7 +22872,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					delete stateResources[op.logicalId];
 					await afterOp?.(op.logicalId);
 					try {
-						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
+						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, {
 							...RECREATE_RETRY_SCHEDULE,
 							logger,
 							...isInterrupted && {
@@ -22866,7 +22945,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					current.physicalId,
 					op.resourceType,
 					desiredProps ?? {},
-					currentProps ?? {}
+					currentProps ?? {},
+					{ maskSecrets: createSecretMasker(secrets) }
 				], op.logicalId, logger, isInterrupted);
 				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
 				const rollbackPartial = updatePartialReason(revertResult);
@@ -23009,7 +23089,8 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						current.physicalId,
 						op.resourceType,
 						desiredProps ?? {},
-						attemptedProps ?? {}
+						attemptedProps ?? {},
+						{ maskSecrets: createSecretMasker(secrets) }
 					], op.logicalId, logger, options.isInterrupted);
 					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
@@ -23140,7 +23221,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.4";
+	return "0.284.6";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -24908,7 +24989,7 @@ var DeployEngine = class {
 	* #960 follow-up) and the name-idempotent same-id guard (issue #1238) so
 	* the two --replace escape hatches cannot drift apart.
 	*/
-	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateReplacePolicy) {
+	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, createContext, updateReplacePolicy) {
 		const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
 		let deleteResult;
 		try {
@@ -24925,7 +25006,7 @@ var DeployEngine = class {
 		this.logger.info(`  ${green("✓")} Old resource deleted`);
 		this.logger.info(`  Re-creating ${logicalId}...`);
 		try {
-			return await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider), logicalId, {
+			return await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps, createContext), logicalId, void 0, void 0, replaceProvider), logicalId, {
 				maxRetries: 8,
 				initialDelayMs: 2e3,
 				maxDelayMs: 1e4,
@@ -24959,6 +25040,7 @@ var DeployEngine = class {
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
+				const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
@@ -24968,7 +25050,7 @@ var DeployEngine = class {
 				});
 				const createProvider = createDecision.provider;
 				const createProps = createDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
-				const result = await this.withRetry(() => createProvider.create(logicalId, resourceType, createProps), logicalId, void 0, void 0, createProvider);
+				const result = await this.withRetry(() => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) }), logicalId, void 0, void 0, createProvider);
 				const dependencies = this.extractAllDependencies(template, logicalId);
 				const templateAttrs = this.extractTemplateAttributes(template, logicalId);
 				stateResources[logicalId] = {
@@ -25079,7 +25161,7 @@ var DeployEngine = class {
 							this.logger.info(`  ${green("✓")} Old resource deleted`);
 						}
 						this.logger.info(`  Creating new ${logicalId}...`);
-						createResult = await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider), logicalId, {
+						createResult = await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }), logicalId, void 0, void 0, replaceProvider), logicalId, {
 							maxRetries: 8,
 							initialDelayMs: 2e3,
 							maxDelayMs: 1e4,
@@ -25093,7 +25175,7 @@ var DeployEngine = class {
 						this.logger.info(`  Creating new ${logicalId}...`);
 						let deletedOldFirst = false;
 						try {
-							createResult = await this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider);
+							createResult = await this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }), logicalId, void 0, void 0, replaceProvider);
 						} catch (createError) {
 							const createMsg = createError instanceof Error ? createError.message : String(createError);
 							if (!isNameCollisionError(createMsg)) throw createError;
@@ -25102,7 +25184,7 @@ var DeployEngine = class {
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
 							this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateReplacePolicy);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }, updateReplacePolicy);
 						}
 						if (!deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 							const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
@@ -25110,7 +25192,7 @@ var DeployEngine = class {
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 							this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateReplacePolicy);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }, updateReplacePolicy);
 						}
 						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
 						else {
@@ -25170,7 +25252,7 @@ var DeployEngine = class {
 					let result;
 					let resultProvisionedBy = updateDecision.provisionedBy;
 					try {
-						result = await this.withRetry(() => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps), logicalId, void 0, void 0, updateProvider);
+						result = await this.withRetry(() => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps, { maskSecrets: createSecretMasker(updateSecrets) }), logicalId, void 0, void 0, updateProvider);
 					} catch (updateError) {
 						const msg = updateError instanceof Error ? updateError.message : String(updateError);
 						const ccUnsupported = msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE");
@@ -25202,7 +25284,7 @@ var DeployEngine = class {
 							});
 							const replProvider = replDecision.provider;
 							const replProps = replDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
-							const createResult = await this.withRetry(() => replProvider.create(logicalId, resourceType, replProps), logicalId, void 0, void 0, replProvider);
+							const createResult = await this.withRetry(() => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) }), logicalId, void 0, void 0, replProvider);
 							const replacementResult = {
 								physicalId: createResult.physicalId,
 								wasReplaced: true,
@@ -25607,5 +25689,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { IntrinsicFunctionResolver as $, StackTerminationProtectionError as $n, buildDenyExternalAccessPolicy as $t, formatResourceLine as A, processStackMessages as An, withRetry as At, isExportAliasCollision as B, DependencyError as Bn, buildAssetRedirectMap as Bt, refusesFinalSnapshot as C, findLargeInlineResources as Cn, s3BucketDualStackDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, canonicalizeRegion as Dn, DiffCalculator as Dt, extractDeploymentEventError as E, PARTITION_TABLE as En, applyRoleArnIfSet as Et, red as F, resetAwsClients as Fn, rebuildClientForBucketRegion as Ft, clearOnUpdateRemoval as G, LockError as Gn, stripControlChars as Gt, stateKeySecretExposure as H, LocalInvokeBuildError as Hn, loadPublishableAssetManifest as Ht, yellow as I, setAwsClients as In, shouldRetainResource as It, findSilentDropProperties as J, PartialFailureError as Jn, ensureAssetStorage as Jt, ProviderRegistry as K, MissingCdkCliError as Kn, AssetModeResolver as Kt, collectDeclaredOutputNames as L, AssetError as Ln, AssetPublisher as Lt, cyan as M, resolveBucketRegion as Mn, TemplateParser as Mt, gray as N, AwsClients as Nn, LockManager as Nt, isStatefulRecreateTargetSync as O, derivePartitionAndUrlSuffix as On, INTRINSIC_KEYS as Ot, green as P, getAwsClients as Pn, S3StateBackend as Pt, isTerminationProtectionPropagationError as Q, StackHasActiveImportsError as Qn, validateContainerRepoName as Qt, collectPublishedOutputNames as R, CdkdError as Rn, stringifyValue as Rt, isFinalSnapshotError as S, MIGRATE_TMP_PREFIX as Sn, s3BucketDomainName as St, makeCanonicalizePropertiesFn as T, expectedOwnerParam as Tn, s3BucketWebsiteUrl as Tt, IAMRoleProvider as U, LocalMigrateError as Un, rewriteTemplateAssetReferences as Ut, secretBearingStateKeyWarning as V, DeployCancelledError as Vn, createAssetRedirectResolver as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalStartServiceError as Wn, escapeRegExp$1 as Wt, slowCcOperationTimeoutMs as X, ResourceTimeoutError as Xn, parseBootstrapMarker as Xt, CloudControlProvider as Y, ProvisioningError as Yn, getBootstrapMarkerKey as Yt, disableInstanceApiTermination as Z, ResourceUpdateNotSupportedError as Zn, validateAssetBucketName as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveUseCdkBootstrapAssets as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, AssetManifestLoader as an, withErrorHandling as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, CFN_TEMPLATE_BODY_LIMIT as bn, scrubResourceRecord as bt, replayFailedOperations as c, synthesisStatusMessage as cn, isThrottlingError as cr, configBooleanRefusal as ct, updatePartialReason as d, resolveApp as dn, replayWarn as dt, buildDockerImage as en, StateError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveAutoAssetStorage as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefaultAndSource as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveStateBucketWithDefault as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerStreaming as in, normalizeAwsError as ir, normalizeAwsTagsToCfn as it, bold as j, clearBucketRegionCache as jn, DagBuilder as jt, renderStatefulReason as k, AssemblyReader as kn, describeTypeWithThrottleRetry as kt, replayRollback as l, getDefaultStateBucketName as ln, markNonRetryable as lr, configStringRefusal as lt, withResourceDeadline as m, resolveSkipPrefix as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, getDockerCmd as nn, formatError as nr, refStateLookupFromResource as nt, planFailedOps as o, getDockerImageBySourceHash as on, isMarkedNonRetryable as or, assertRegionMatch as ot, deleteSkipReason as p, resolveCaptureObservedState as pn, requireConfigObject as pt, findActionableSilentDrops as q, NestedStackChildDirectDestroyError as qn, BOOTSTRAP_MARKER_PREFIX as qt, DeployEngine as r, runDockerForeground as rn, isCdkdError as rr, WAFv2WebACLProvider as rt, planRollback as s, Synthesizer as sn, isRetryableTransientError as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatDockerLoginError as tn, SynthesisError as tr, getAccountInfo as tt, updatePartialMessage as u, getLegacyStateBucketName as un, __exportAll as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, stateBucketExistenceConfirmed as vn, maskSecretsInText as vt, unsupportedFinalSnapshotError as w, uploadCfnTemplate as wn, s3BucketRegionalDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_URL_LIMIT as xn, s3BucketArn as xt, buildFinalSnapshotIdentifier as y, warnDeprecatedNoPrefixCliFlag as yn, redactSecretsForState as yt, exportAliasCollisionScrubWarning as z, ConfigError as zn, WorkGraph as zt };
-//# sourceMappingURL=deploy-engine-3Z7P1hKs.js.map
+export { IntrinsicFunctionResolver as $, StackHasActiveImportsError as $n, validateContainerRepoName as $t, formatResourceLine as A, AssemblyReader as An, describeTypeWithThrottleRetry as At, isExportAliasCollision as B, ConfigError as Bn, WorkGraph as Bt, refusesFinalSnapshot as C, MIGRATE_TMP_PREFIX as Cn, s3BucketDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, PARTITION_TABLE as Dn, applyRoleArnIfSet as Dt, extractDeploymentEventError as E, expectedOwnerParam as En, s3BucketWebsiteUrl as Et, red as F, getAwsClients as Fn, S3StateBackend as Ft, clearOnUpdateRemoval as G, LocalStartServiceError as Gn, escapeRegExp$1 as Gt, stateKeySecretExposure as H, DeployCancelledError as Hn, createAssetRedirectResolver as Ht, yellow as I, resetAwsClients as In, rebuildClientForBucketRegion as It, findSilentDropProperties as J, NestedStackChildDirectDestroyError as Jn, BOOTSTRAP_MARKER_PREFIX as Jt, ProviderRegistry as K, LockError as Kn, stripControlChars as Kt, collectDeclaredOutputNames as L, setAwsClients as Ln, shouldRetainResource as Lt, cyan as M, clearBucketRegionCache as Mn, DagBuilder as Mt, gray as N, resolveBucketRegion as Nn, TemplateParser as Nt, isStatefulRecreateTargetSync as O, canonicalizeRegion as On, DiffCalculator as Ot, green as P, AwsClients as Pn, LockManager as Pt, isTerminationProtectionPropagationError as Q, ResourceUpdateNotSupportedError as Qn, validateAssetBucketName as Qt, collectPublishedOutputNames as R, AssetError as Rn, AssetPublisher as Rt, isFinalSnapshotError as S, CFN_TEMPLATE_URL_LIMIT as Sn, s3BucketArn as St, makeCanonicalizePropertiesFn as T, uploadCfnTemplate as Tn, s3BucketRegionalDomainName as Tt, IAMRoleProvider as U, LocalInvokeBuildError as Un, loadPublishableAssetManifest as Ut, secretBearingStateKeyWarning as V, DependencyError as Vn, buildAssetRedirectMap as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalMigrateError as Wn, rewriteTemplateAssetReferences as Wt, slowCcOperationTimeoutMs as X, ProvisioningError as Xn, getBootstrapMarkerKey as Xt, CloudControlProvider as Y, PartialFailureError as Yn, ensureAssetStorage as Yt, disableInstanceApiTermination as Z, ResourceTimeoutError as Zn, parseBootstrapMarker as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveStateBucketWithDefaultAndSource as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, runDockerStreaming as an, normalizeAwsError as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, warnDeprecatedNoPrefixCliFlag as bn, redactSecretsForState as bt, replayFailedOperations as c, Synthesizer as cn, isRetryableTransientError as cr, configBooleanRefusal as ct, updatePartialReason as d, getLegacyStateBucketName as dn, __exportAll as dr, replayWarn as dt, buildDenyExternalAccessPolicy as en, StackTerminationProtectionError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveApp as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefault as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveSkipPrefix as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerForeground as in, isCdkdError as ir, normalizeAwsTagsToCfn as it, bold as j, processStackMessages as jn, withRetry as jt, renderStatefulReason as k, derivePartitionAndUrlSuffix as kn, INTRINSIC_KEYS as kt, replayRollback as l, synthesisStatusMessage as ln, isThrottlingError as lr, configStringRefusal as lt, withResourceDeadline as m, resolveCaptureObservedState as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatDockerLoginError as nn, SynthesisError as nr, refStateLookupFromResource as nt, planFailedOps as o, AssetManifestLoader as on, withErrorHandling as or, assertRegionMatch as ot, deleteSkipReason as p, resolveAutoAssetStorage as pn, requireConfigObject as pt, findActionableSilentDrops as q, MissingCdkCliError as qn, AssetModeResolver as qt, DeployEngine as r, getDockerCmd as rn, formatError as rr, WAFv2WebACLProvider as rt, planRollback as s, getDockerImageBySourceHash as sn, isMarkedNonRetryable as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDockerImage as tn, StateError as tr, getAccountInfo as tt, updatePartialMessage as u, getDefaultStateBucketName as un, markNonRetryable as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, resolveUseCdkBootstrapAssets as vn, createSecretMasker as vt, unsupportedFinalSnapshotError as w, findLargeInlineResources as wn, s3BucketDualStackDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_BODY_LIMIT as xn, scrubResourceRecord as xt, buildFinalSnapshotIdentifier as y, stateBucketExistenceConfirmed as yn, maskSecretsInText as yt, exportAliasCollisionScrubWarning as z, CdkdError as zn, stringifyValue as zt };
+//# sourceMappingURL=deploy-engine-Ce7kNQp2.js.map