@go-to-k/cdkd 0.284.59 → 0.284.60

package/dist/{deploy-engine-B6cbj8-j.js → deploy-engine-Cc6OYj-d.js}

@@ -1,5 +1,5 @@
 import { a as getLiveRenderer, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, l as applyDefaultNameForFallback, n as getLogger, p as looksLikeCdkdGeneratedName, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-Biow6J38.js";
+import { t as getCdkdVersion } from "./version-Dqo5kOZi.js";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
@@ -5833,6 +5833,110 @@ function getCdkdAssetBucketName(accountId, region) {
 	return `cdkd-assets-${accountId}-${region}`;
 }
 /**
+* Read a bucket's home region off an S3 error's response headers.
+*
+* S3 answers a cross-region request with `x-amz-bucket-region` on BOTH shapes
+* this module can meet, measured against real S3 on 2026-08-26 (issue
+* [#2240](https://github.com/go-to-k/cdkd/issues/2240)):
+*
+* - the `301` a `HeadBucket` returns for a bucket in another region, whose
+*   empty HEAD body the SDK turns into a synthetic `name: 'Unknown'` /
+*   `message: 'UnknownError'` (see `normalizeAwsError`), and
+* - the `409 BucketAlreadyOwnedByYou` a `CreateBucket` returns for a bucket
+*   this account owns elsewhere.
+*
+* The SDK lowercases header keys; the scan is case-insensitive anyway so a
+* test double spelling it canonically is still read.
+*/
+function readBucketRegionHeader(error) {
+	const headers = error?.$response?.headers;
+	if (!headers) return void 0;
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === "x-amz-bucket-region" && value) return value;
+}
+/**
+* Fold a `GetBucketLocation` `LocationConstraint` to a region name.
+*
+* The API answers with an EMPTY constraint for `us-east-1` and the legacy `EU`
+* alias for `eu-west-1`; every other region comes back verbatim.
+*/
+function bucketLocationToRegion(constraint) {
+	if (!constraint) return "us-east-1";
+	if (constraint === "EU") return "eu-west-1";
+	return constraint;
+}
+/**
+* Does this error mean "the bucket lives in another region"?
+*
+* Derived from the AWS SDK's own predicate, and deliberately WIDER -- not a
+* mirror of it. `@aws-sdk/middleware-sdk-s3`'s `regionRedirectMiddleware` fires
+* when `x-amz-bucket-region` is present AND the status is `301`, OR `400` with
+* either `IllegalLocationConstraintException` or a `HeadBucket` command. This
+* drops that inner conjunct and accepts ANY header-carrying `400`, because the
+* conjunct exists to decide whether the SDK should silently RETRY against
+* another region, while the only thing done here is REFUSE -- and a `400` that
+* carries a bucket region is a cross-region answer whatever raised it. The
+* widening is safe in the other direction too: a same-region `400` folds to
+* `actual === want` and falls through to a throw either way --
+* `normalizeAwsError` at the two `ensureAssetStorage` / `bootstrap-destroy`
+* sites, and the raw error at `verifyAssetStorageExists`, whose non-redirect
+* arm rethrows verbatim. It is never an adoption and never a skipped
+* teardown.
+*
+* A status-`301`-only test would MISS the `400` spelling entirely, on which the
+* guard silently would not fire.
+*/
+function isCrossRegionRedirect(error) {
+	const status = error?.$metadata?.httpStatusCode;
+	if (status === 301) return true;
+	return status === 400 && readBucketRegionHeader(error) !== void 0;
+}
+/**
+* Refuse an asset bucket this account owns that lives in a DIFFERENT region
+* (issue [#2240](https://github.com/go-to-k/cdkd/issues/2240)).
+*
+* `BucketAlreadyOwnedByYou` and a cross-region HeadBucket redirect are both
+* ACCOUNT-global ownership signals while a bucket is REGIONAL, so neither one
+* means "the bucket is in this region". The DEFAULT asset-bucket name embeds
+* the region (`getCdkdAssetBucketName`), which is why this looked structurally
+* unreachable — but that is only the default. `cdkd bootstrap --asset-bucket
+* <name>` takes a caller-chosen, region-free name, so bootstrapping two
+* regions under one custom name reaches every site below.
+*
+* Why REFUSE rather than follow the redirect: `bootstrap.ts` deliberately
+* re-points the STATE bucket at its own region via
+* `rebuildClientForBucketRegion`, because one state bucket serves the whole
+* account. Asset storage is the opposite — per-region by design, with the
+* marker, the publish path and the template rewrite all assuming the bucket
+* sits in the deploy region. Adopting a foreign-region bucket would publish
+* this region's assets into another region and apply this region's bucket
+* configuration (encryption, public-access block, deny-external-account
+* policy) there.
+*
+* Deliberately NOT `resolveBucketRegion` from `utils/aws-region-resolver.ts`:
+* that helper never throws and returns its `fallbackRegion` on a failed probe,
+* which would turn this fail-CLOSED guard into a fail-OPEN one. Both arms here
+* end in a refusal, including the one where the region cannot be determined.
+*/
+async function assertAssetBucketRegion(s3Client, bucketName, expectedRegion, accountId, cause) {
+	const want = canonicalizeRegion(expectedRegion);
+	const remedy = `Either bootstrap ${want} with an asset-bucket name unique to it ('cdkd bootstrap --region ${want} --asset-bucket <name>'), or run this against the bucket's own region.`;
+	let actual;
+	const fromHeader = readBucketRegionHeader(cause);
+	if (fromHeader) actual = canonicalizeRegion(fromHeader);
+	else try {
+		actual = canonicalizeRegion(bucketLocationToRegion((await s3Client.send(new GetBucketLocationCommand({
+			Bucket: bucketName,
+			ExpectedBucketOwner: accountId
+		}))).LocationConstraint));
+	} catch (probeError) {
+		const fromProbe = readBucketRegionHeader(probeError);
+		if (fromProbe) actual = canonicalizeRegion(fromProbe);
+		else throw new CdkdError(`Asset bucket '${bucketName}' is claimed by an existing bucket, but cdkd could not determine which region that bucket is in, so it cannot confirm it belongs to ${want}. Refusing to adopt it. (region probe failed: ${probeError instanceof Error ? probeError.message : String(probeError)}) ${remedy}`, "ASSET_STORAGE_FOREIGN_REGION_BUCKET", cause);
+	}
+	if (actual === want) return;
+	throw new CdkdError(`Asset bucket name '${bucketName}' resolves to a bucket in ${actual}, while this operation targets ${want}. S3 bucket names are globally unique, and both 'BucketAlreadyOwnedByYou' and a cross-region redirect report ACCOUNT ownership rather than the bucket's region, so cdkd cannot treat it as ${want}'s asset bucket. cdkd asset storage is per-region by design: adopting it would publish ${want}'s assets into ${actual} and apply ${want}'s bucket configuration there. ${remedy}`, "ASSET_STORAGE_FOREIGN_REGION_BUCKET", cause);
+}
+/**
 * Name of the cdkd-owned container-asset ECR repository for an
 * (account, region) pair. ECR repos are account+region scoped by ARN, so the
 * suffix is not strictly needed — the CDK-parallel shape keeps the future
@@ -5991,6 +6095,13 @@ async function verifyAssetStorageExists(marker, accountId, region, opts = {}) {
 			const err = error;
 			if (err.name === "NotFound" || err.name === "NoSuchBucket") throw new CdkdError(`cdkd asset storage is bootstrapped for region '${region}' but the asset bucket '${marker.assetBucket}' is missing. ${rebootstrapHint}`, "ASSET_STORAGE_MISSING");
 			if (err.$metadata?.httpStatusCode === 403) throw new CdkdError(`Asset bucket '${marker.assetBucket}' exists but is not owned by account ${accountId} (or access is denied). Refusing to use it. ${rebootstrapHint}`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
+			if (isCrossRegionRedirect(error)) {
+				await assertAssetBucketRegion(s3Client, marker.assetBucket, region, accountId, error);
+				throw normalizeAwsError(error, {
+					bucket: marker.assetBucket,
+					operation: "HeadBucket"
+				});
+			}
 			throw error;
 		}
 		try {
@@ -6060,7 +6171,13 @@ async function ensureAssetStorage(options) {
 	} catch (error) {
 		const err = error;
 		if (err.name === "NotFound" || err.name === "NoSuchBucket") {} else if (err.$metadata?.httpStatusCode === 403) throw new CdkdError(`Asset bucket name '${assetBucket}' is already taken by a bucket this account does not own (or access is denied). Refusing to adopt it — resolve the naming conflict before re-running 'cdkd bootstrap'.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
-		else throw normalizeAwsError(error, {
+		else if (isCrossRegionRedirect(error)) {
+			await assertAssetBucketRegion(s3Client, assetBucket, region, accountId, error);
+			throw normalizeAwsError(error, {
+				bucket: assetBucket,
+				operation: "HeadBucket"
+			});
+		} else throw normalizeAwsError(error, {
 			bucket: assetBucket,
 			operation: "HeadBucket"
 		});
@@ -6075,8 +6192,10 @@ async function ensureAssetStorage(options) {
 			logger.info(`✓ Created asset bucket: ${assetBucket}`);
 		} catch (error) {
 			const err = error;
-			if (err.name === "BucketAlreadyOwnedByYou") logger.info(`Asset bucket ${assetBucket} already exists`);
-			else if (err.name === "BucketAlreadyExists") throw new CdkdError(`Asset bucket name '${assetBucket}' is already taken by another AWS account. Refusing to adopt it — resolve the naming conflict before re-running 'cdkd bootstrap'.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
+			if (err.name === "BucketAlreadyOwnedByYou") {
+				await assertAssetBucketRegion(s3Client, assetBucket, region, accountId, error);
+				logger.info(`Asset bucket ${assetBucket} already exists`);
+			} else if (err.name === "BucketAlreadyExists") throw new CdkdError(`Asset bucket name '${assetBucket}' is already taken by another AWS account. Refusing to adopt it — resolve the naming conflict before re-running 'cdkd bootstrap'.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
 			else throw normalizeAwsError(error, {
 				bucket: assetBucket,
 				operation: "CreateBucket"
@@ -18498,7 +18617,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BkbyCmqe.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D9nlNFCU.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -29906,5 +30025,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { endCommandInterruptScope as $, processStackMessages as $n, exportNamesCarriedFrom as $t, renderStatefulReason as A, Synthesizer as An, withErrorHandling as Ar, isSingleDynamicReferenceToken as At, exportAliasCollisionScrubWarning as B, resolveUseCdkBootstrapAssets as Bn, s3BucketRegionalDomainName as Bt, isFinalSnapshotError as C, formatDockerLoginError as Cn, StackHasActiveImportsError as Cr, requireConfigString as Ct, extractDeploymentEventError as D, runDockerStreaming as Dn, formatError as Dr, createSecretMasker as Dt, makeCanonicalizePropertiesFn as E, runDockerForeground as En, SynthesisError as Er, TEMPLATE_SOURCED_RULES as Et, green as F, resolveAutoAssetStorage as Fn, __exportAll as Fr, classifyReplaySecretRegion as Ft, collectInlinePolicyNamesManagedBySiblings as G, MIGRATE_TMP_PREFIX as Gn, describeTypeWithThrottleRetry as Gt, secretBearingStateKeyWarning as H, warnDeprecatedNoPrefixCliFlag as Hn, applyRoleArnIfSet as Ht, red as I, resolveCaptureObservedState as In, producerRegionsFromState as It, findActionableSilentDrops as J, expectedOwnerParam as Jn, TemplateParser as Jt, clearOnUpdateRemoval as K, findLargeInlineResources as Kn, withRetry as Kt, yellow as L, resolveSkipPrefix as Ln, s3BucketArn as Lt, bold as M, getDefaultStateBucketName as Mn, isRetryableTransientError as Mr, maskSecretsInText as Mt, cyan as N, getLegacyStateBucketName as Nn, isThrottlingError as Nr, redactSecretsForState as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, AssetManifestLoader as On, isCdkdError as Or, dynamicReferenceTokens as Ot, gray as P, resolveApp as Pn, markNonRetryable as Pr, scrubResourceRecord as Pt, beginCommandInterruptScope as Q, AssemblyReader as Qn, rebuildClientForBucketRegion as Qt, collectDeclaredOutputNames as R, resolveStateBucketWithDefault as Rn, s3BucketDomainName as Rt, createPreDeleteFinalSnapshot as S, dockerSpawnEnvWithSensitive as Sn, ResourceUpdateNotSupportedError as Sr, requireConfigObject as St, unsupportedFinalSnapshotError as T, partitionSensitiveEnv as Tn, StateError as Tr, STATE_SOURCED_READBACK_RULES as Tt, stateKeySecretExposure as U, CFN_TEMPLATE_BODY_LIMIT as Un, DiffCalculator as Ut, isExportAliasCollision as V, stateBucketExistenceConfirmed as Vn, s3BucketWebsiteUrl as Vt, IAMRoleProvider as W, CFN_TEMPLATE_URL_LIMIT as Wn, INTRINSIC_KEYS as Wt, CUSTOM_RESOURCE_RESPONSE_PREFIX as X, canonicalizeRegion as Xn, displaySafe as Xt, findSilentDropProperties as Y, PARTITION_TABLE as Yn, LockManager as Yt, DEFAULT_STATE_PREFIX as Z, derivePartitionAndUrlSuffix as Zn, S3StateBackend as Zt, computeImplicitDeleteEdges as _, readBootstrapMarkerBody as _n, MissingCdkCliError as _r, configBooleanRefusal as _t, DeploymentEventsStore as a, WorkGraph as an, setAwsClients as ar, disableInstanceApiTermination as at, buildFinalSnapshotIdentifier as b, buildDenyExternalAccessPolicy as bn, ProvisioningError as br, replayWarn as bt, replayFailedOperations as c, loadPublishableAssetManifest as cn, ConfigError as cr, carriesDynamicReference as ct, updatePartialReason as d, stripControlChars as dn, DeployCancelledError as dr, refStateLookupFromResource as dt, importableOutputKeys as en, clearBucketRegionCache as er, interruptWatchListenerCount as et, UNSPECIFIED_SKIP_REASON as f, AssetModeResolver as fn, DynamicReferenceRegionAmbiguousError as fr, WAFv2WebACLProvider as ft, IMPLICIT_DELETE_DEPENDENCIES as g, parseBootstrapMarker as gn, LockError as gr, coerceCfnBoolean as gt, maskingRetryLogger as h, getBootstrapMarkerKey as hn, LocalStartServiceError as hr, assertRegionMatch as ht, DeploymentEventsReader as i, stringifyValue as in, resetAwsClients as ir, slowCcOperationTimeoutMs as it, formatResourceLine as j, synthesisStatusMessage as jn, isMarkedNonRetryable as jr, maskSecretsInError as jt, isStatefulRecreateTargetSync as k, getDockerImageBySourceHash as kn, normalizeAwsError as kr, errorCauseChain as kt, replayRollback as l, rewriteTemplateAssetReferences as ln, CrossAccountSecretRefusalError as lr, cfnRefValueFromPhysicalId as lt, withResourceDeadline as m, ensureAssetStorage as mn, LocalMigrateError as mr, resolveExplicitPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, shouldRetainResource as nn, AwsClients as nr, startInterruptWatch as nt, planFailedOps as o, buildAssetRedirectMap as on, AssetError as or, isTerminationProtectionPropagationError as ot, deleteSkipReason as p, BOOTSTRAP_MARKER_PREFIX as pn, LocalInvokeBuildError as pr, normalizeAwsTagsToCfn as pt, ProviderRegistry as q, uploadCfnTemplate as qn, DagBuilder as qt, DeployEngine as r, AssetPublisher as rn, getAwsClients as rr, CloudControlProvider as rt, planRollback as s, createAssetRedirectResolver as sn, CdkdError as sr, IntrinsicFunctionResolver as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, importableOutputs as tn, resolveBucketRegion as tr, isInterruptedWaitError as tt, updatePartialMessage as u, escapeRegExp$1 as un, DependencyError as ur, getAccountInfo as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, validateAssetBucketName as vn, NestedStackChildDirectDestroyError as vr, configStringRefusal as vt, refusesFinalSnapshot as w, getDockerCmd as wn, StackTerminationProtectionError as wr, STATE_SOURCED_CROSS_GENERATION_RULES as wt, ccRoutedFinalSnapshotError as x, buildDockerImage as xn, ResourceTimeoutError as xr, requireConfigArray as xt, PRE_DELETE_SNAPSHOT_TYPES as y, validateContainerRepoName as yn, PartialFailureError as yr, readConfigString as yt, collectPublishedOutputNames as z, resolveStateBucketWithDefaultAndSource as zn, s3BucketDualStackDomainName as zt };
-//# sourceMappingURL=deploy-engine-B6cbj8-j.js.map
+export { endCommandInterruptScope as $, derivePartitionAndUrlSuffix as $n, exportNamesCarriedFrom as $t, renderStatefulReason as A, AssetManifestLoader as An, isCdkdError as Ar, isSingleDynamicReferenceToken as At, exportAliasCollisionScrubWarning as B, resolveStateBucketWithDefault as Bn, s3BucketRegionalDomainName as Bt, isFinalSnapshotError as C, buildDockerImage as Cn, ResourceTimeoutError as Cr, requireConfigString as Ct, extractDeploymentEventError as D, partitionSensitiveEnv as Dn, StateError as Dr, createSecretMasker as Dt, makeCanonicalizePropertiesFn as E, getDockerCmd as En, StackTerminationProtectionError as Er, TEMPLATE_SOURCED_RULES as Et, green as F, getLegacyStateBucketName as Fn, isThrottlingError as Fr, classifyReplaySecretRegion as Ft, collectInlinePolicyNamesManagedBySiblings as G, CFN_TEMPLATE_BODY_LIMIT as Gn, describeTypeWithThrottleRetry as Gt, secretBearingStateKeyWarning as H, resolveUseCdkBootstrapAssets as Hn, applyRoleArnIfSet as Ht, red as I, resolveApp as In, markNonRetryable as Ir, producerRegionsFromState as It, findActionableSilentDrops as J, findLargeInlineResources as Jn, TemplateParser as Jt, clearOnUpdateRemoval as K, CFN_TEMPLATE_URL_LIMIT as Kn, withRetry as Kt, yellow as L, resolveAutoAssetStorage as Ln, __exportAll as Lr, s3BucketArn as Lt, bold as M, Synthesizer as Mn, withErrorHandling as Mr, maskSecretsInText as Mt, cyan as N, synthesisStatusMessage as Nn, isMarkedNonRetryable as Nr, redactSecretsForState as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, runDockerForeground as On, SynthesisError as Or, dynamicReferenceTokens as Ot, gray as P, getDefaultStateBucketName as Pn, isRetryableTransientError as Pr, scrubResourceRecord as Pt, beginCommandInterruptScope as Q, canonicalizeRegion as Qn, rebuildClientForBucketRegion as Qt, collectDeclaredOutputNames as R, resolveCaptureObservedState as Rn, s3BucketDomainName as Rt, createPreDeleteFinalSnapshot as S, buildDenyExternalAccessPolicy as Sn, ProvisioningError as Sr, requireConfigObject as St, unsupportedFinalSnapshotError as T, formatDockerLoginError as Tn, StackHasActiveImportsError as Tr, STATE_SOURCED_READBACK_RULES as Tt, stateKeySecretExposure as U, stateBucketExistenceConfirmed as Un, DiffCalculator as Ut, isExportAliasCollision as V, resolveStateBucketWithDefaultAndSource as Vn, s3BucketWebsiteUrl as Vt, IAMRoleProvider as W, warnDeprecatedNoPrefixCliFlag as Wn, INTRINSIC_KEYS as Wt, CUSTOM_RESOURCE_RESPONSE_PREFIX as X, expectedOwnerParam as Xn, displaySafe as Xt, findSilentDropProperties as Y, uploadCfnTemplate as Yn, LockManager as Yt, DEFAULT_STATE_PREFIX as Z, PARTITION_TABLE as Zn, S3StateBackend as Zt, computeImplicitDeleteEdges as _, isCrossRegionRedirect as _n, LocalStartServiceError as _r, configBooleanRefusal as _t, DeploymentEventsStore as a, WorkGraph as an, getAwsClients as ar, disableInstanceApiTermination as at, buildFinalSnapshotIdentifier as b, validateAssetBucketName as bn, NestedStackChildDirectDestroyError as br, replayWarn as bt, replayFailedOperations as c, loadPublishableAssetManifest as cn, AssetError as cr, carriesDynamicReference as ct, updatePartialReason as d, stripControlChars as dn, CrossAccountSecretRefusalError as dr, refStateLookupFromResource as dt, importableOutputKeys as en, AssemblyReader as er, interruptWatchListenerCount as et, UNSPECIFIED_SKIP_REASON as f, AssetModeResolver as fn, DependencyError as fr, WAFv2WebACLProvider as ft, IMPLICIT_DELETE_DEPENDENCIES as g, getBootstrapMarkerKey as gn, LocalMigrateError as gr, coerceCfnBoolean as gt, maskingRetryLogger as h, ensureAssetStorage as hn, LocalInvokeBuildError as hr, assertRegionMatch as ht, DeploymentEventsReader as i, stringifyValue as in, AwsClients as ir, slowCcOperationTimeoutMs as it, formatResourceLine as j, getDockerImageBySourceHash as jn, normalizeAwsError as jr, maskSecretsInError as jt, isStatefulRecreateTargetSync as k, runDockerStreaming as kn, formatError as kr, errorCauseChain as kt, replayRollback as l, rewriteTemplateAssetReferences as ln, CdkdError as lr, cfnRefValueFromPhysicalId as lt, withResourceDeadline as m, assertAssetBucketRegion as mn, DynamicReferenceRegionAmbiguousError as mr, resolveExplicitPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, shouldRetainResource as nn, clearBucketRegionCache as nr, startInterruptWatch as nt, planFailedOps as o, buildAssetRedirectMap as on, resetAwsClients as or, isTerminationProtectionPropagationError as ot, deleteSkipReason as p, BOOTSTRAP_MARKER_PREFIX as pn, DeployCancelledError as pr, normalizeAwsTagsToCfn as pt, ProviderRegistry as q, MIGRATE_TMP_PREFIX as qn, DagBuilder as qt, DeployEngine as r, AssetPublisher as rn, resolveBucketRegion as rr, CloudControlProvider as rt, planRollback as s, createAssetRedirectResolver as sn, setAwsClients as sr, IntrinsicFunctionResolver as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, importableOutputs as tn, processStackMessages as tr, isInterruptedWaitError as tt, updatePartialMessage as u, escapeRegExp$1 as un, ConfigError as ur, getAccountInfo as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, parseBootstrapMarker as vn, LockError as vr, configStringRefusal as vt, refusesFinalSnapshot as w, dockerSpawnEnvWithSensitive as wn, ResourceUpdateNotSupportedError as wr, STATE_SOURCED_CROSS_GENERATION_RULES as wt, ccRoutedFinalSnapshotError as x, validateContainerRepoName as xn, PartialFailureError as xr, requireConfigArray as xt, PRE_DELETE_SNAPSHOT_TYPES as y, readBootstrapMarkerBody as yn, MissingCdkCliError as yr, readConfigString as yt, collectPublishedOutputNames as z, resolveSkipPrefix as zn, s3BucketDualStackDomainName as zt };
+//# sourceMappingURL=deploy-engine-Cc6OYj-d.js.map