@go-to-k/cdkd 0.284.63 → 0.284.65

package/dist/{deploy-engine-B-RuozdO.js → deploy-engine-52VBVCWI.js}

@@ -1,5 +1,5 @@
 import { a as getLiveRenderer, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, l as applyDefaultNameForFallback, n as getLogger, p as looksLikeCdkdGeneratedName, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-Cmw63bLc.js";
+import { t as getCdkdVersion } from "./version-BtkYYOb6.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -18844,7 +18844,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B9V61Fbq.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CNwOmQGg.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -19878,9 +19878,147 @@ const DEFAULT_STATE_PREFIX = "cdkd";
 */
 const CUSTOM_RESOURCE_RESPONSE_PREFIX = "custom-resource-responses";
 
+//#endregion
+//#region src/provisioning/masked-retry-logger.ts
+/**
+* The masker a caller supplied, or the identity function when it supplied
+* none.
+*
+* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
+* mandates — `create()` / `update()` are also reached from the import path,
+* from `cdkd drift --revert`, and from tests, and a provider must not care
+* which caller it got. Centralised here so no call site re-spells the `??`
+* and accidentally makes the capability required.
+*/
+function maskerOrIdentity(maskSecrets) {
+	return maskSecrets ?? ((text) => text);
+}
+/**
+* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
+*
+* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
+* and dropping it would silence the give-up summary on the calling path only —
+* trading a disclosure for the reporting hole issue #2018 closed. It goes
+* through the SAME mask as `debug` precisely because it is the line that
+* survives a run without `--verbose`; forwarding it unmasked would defeat the
+* fence at a HIGHER log level than the one the fence was written for.
+*
+* `logger` is typed structurally rather than as the concrete `Logger` so this
+* module stays a leaf and a test can pass two spies. That matches the
+* precedent already in the tree (`buildMfaConfigRequest` in
+* `cognito-provider.ts` takes an injected `logger?: { warn }`).
+*/
+function createMaskedRetryLogger(logger, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	return {
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+/**
+* Depth cap for {@link maskDeep}.
+*
+* What it actually bounds is unbounded WORK on a pathologically deep bag — see
+* the rationale at the cap itself, which is the authority. It is NOT primarily
+* a cycle guard: a template-derived bag cannot be cyclic, so that justification
+* over-claims (issue #2176 security review). It does still terminate one, which
+* is why the walk is safe to share with a caller that might hand it something
+* other than a template bag.
+*
+* Deliberately generous. Every shape these warnings exist to describe is a
+* scalar, a list of scalars, or a small record, so the walk does not reach
+* depth 2 in practice.
+*/
+const MASK_WALK_MAX_DEPTH = 8;
+/**
+* What {@link maskDeep} substitutes for a subtree it declines to descend into.
+*
+* MUST equal `SECRET_MASK` in `src/deployment/secret-redaction.ts`. It is
+* spelled here rather than imported so this module keeps its single-import leaf
+* property (see the module note above); the two are fenced against drift by a
+* test that imports both.
+*/
+const MASK_WALK_DEPTH_CAP_MARKER = "***";
+/**
+* Mask every string LEAF and KEY of an arbitrary value, returning a structure
+* safe to `JSON.stringify` into a log line or an error message (issue
+* [#2176](https://github.com/go-to-k/cdkd/issues/2176)).
+*
+* THE ORDERING IS THE WHOLE POINT, and it is why masking the finished message
+* is not a substitute. `maskSecretsInText` matches by literal occurrence, so:
+*
+*  1. ESCAPING. `JSON.stringify` escapes `"`, `\` and newlines, so a secret
+*     containing any of them no longer OCCURS in the stringified text and a
+*     mask applied afterwards cannot find it. That is not an exotic case — it
+*     is every Secrets Manager JSON document, the commonest real secret shape.
+*     Measured on the pre-fix tree for #2176: a plaintext of
+*     `{"user":"admin","pw":"hunter2"}` interpolated as
+*     `${JSON.stringify(value)}` came through a message-level mask COMPLETELY
+*     unchanged, while masking the leaves first rendered it `"***"`.
+*  2. LENGTH. A finished message is always longer than the value inside it, so
+*     it can only ever reach `maskSecretsInText`'s SUBSTRING arm, which ignores
+*     needles below `MIN_NEEDLE_LENGTH` (4). Handing the masker each RAW leaf
+*     reaches the WHOLE-VALUE arm, which has no floor. Measured the same way: a
+*     3-character secret survived `Value 'abc' at 'pin' failed ...` intact.
+*
+* Neither pass subsumes the other, so providers do BOTH — this walk on the
+* value, and the assembled message through the masker as well. The masker is
+* idempotent, so the overlap is free.
+*
+* Keys are masked as well as values: `JSON.stringify` renders them into the
+* same line, so a resolved secret used as a map key would otherwise escape.
+*
+* WHY THIS LIVES HERE rather than as a private walk per provider. SIX
+* hand-rolled copies had already accumulated — `elbv2-provider.ts`,
+* `cognito-provider.ts`, `sns-topic-provider.ts`, `dynamodb-table-provider.ts`,
+* `dynamodb-globaltable-provider.ts` and `apigatewayv2-provider.ts` — and
+* `elbv2-provider.ts` carried the standing instruction that "a THIRD site is
+* the point at which this should move into `../masked-retry-logger.ts` ... and
+* all three converge on it". That trigger had fired and been missed twice over,
+* and the copies had already diverged exactly as predicted: FOUR of the six
+* carried NO depth cap at all.
+*
+* Worth recording how the last two were nearly missed AGAIN, because it is the
+* same failure one level up: the first sweep for this issue grepped for
+* `maskDeep` / `MASK_WALK_MAX_DEPTH` — the SPELLINGS the known copies used —
+* and the two survivors spell it `maskLeaf` / `maskLeafValue` with no named
+* constant. Grep for the SHAPE, not the name. These copies encode a security
+* contract, and a hardening applied to one silently leaves the others behind.
+*/
+function maskDeep(value, mask, depth = 0) {
+	if (typeof value === "string") return mask(value);
+	if (depth >= 8) return "***";
+	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
+	return value;
+}
+
 //#endregion
 //#region src/provisioning/providers/custom-resource-provider.ts
 /**
+* The DELETE path threads NO masker (issue #2178).
+*
+* `DeleteContext` carries no masker by the `SecretMaskingContext` contract — a
+* delete's payload is a physical id rather than a resolved property bag — so
+* there is no capability to thread here.
+*
+* This is deliberately `undefined` and NOT `maskerOrIdentity(undefined)`, which
+* is what it was until the review of this change. An identity function typed
+* `MaskerFn` is a masker that fences nothing, and issue
+* [#2007](https://github.com/go-to-k/cdkd/issues/2007) records why that is
+* WORSE than no masker at all: its presence stops the next author looking. The
+* critic now REFUSES an identity-bound masker (see
+* `scripts/check-provider-secret-mask.ts`), so this spelling is the only one
+* that both compiles and states the truth — and the message site it feeds is
+* recorded in that critic's `EXEMPT` list, where it is counted and re-audited
+* on every run rather than hidden inside the masked count.
+*
+* `src/types/resource.ts` requires the capability to be THREADED before a
+* delete-path message may claim to mask; retiring this constant is that work,
+* not a rename.
+*/
+const DELETE_PATH_UNMASKED = void 0;
+/**
 * The short `ResourceDeleteResult.reason` the no-properties DELETE arm reports
 * (issue [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
 *
@@ -20012,12 +20150,15 @@ function isCustomResourceResponsePayload(value) {
 /**
 * Parse Lambda response payload with type safety
 */
-function parseLambdaPayload(payloadBytes) {
+function parseLambdaPayload(payloadBytes, mask) {
 	if (!payloadBytes) return {};
 	const payloadString = Buffer.from(payloadBytes).toString();
 	if (!payloadString || payloadString === "null" || payloadString === "\"\"") return {};
 	const parsed = JSON.parse(payloadString);
-	if (!isCustomResourceResponsePayload(parsed)) throw new Error(`Invalid Lambda response payload format: ${JSON.stringify(parsed)}`);
+	if (!isCustomResourceResponsePayload(parsed)) {
+		if (mask === void 0) throw new Error(`Invalid Lambda response payload format: ${JSON.stringify(parsed)}`);
+		throw new Error(`Invalid Lambda response payload format: ${JSON.stringify(maskDeep(parsed, mask))}`);
+	}
 	return parsed;
 }
 /**
@@ -20683,7 +20824,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	/**
 	* Create a custom resource by invoking its Lambda handler
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating custom resource ${logicalId} (${resourceType})`);
 		const serviceToken = properties["ServiceToken"];
 		if (!serviceToken) throw new ProvisioningError(`ServiceToken is required for custom resource ${logicalId}`, resourceType, logicalId);
@@ -20697,7 +20838,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				LogicalResourceId: logicalId,
 				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties)
-			}));
+			}), maskerOrIdentity(context?.maskSecrets));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
 			const physicalId = cfnResponse.PhysicalResourceId || logicalId;
 			const attributes = cfnResponse.Data || {};
@@ -20714,7 +20855,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	/**
 	* Update a custom resource by invoking its Lambda handler
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating custom resource ${logicalId}: ${physicalId} (${resourceType})`);
 		const serviceToken = properties["ServiceToken"];
 		if (!serviceToken) throw new ProvisioningError(`ServiceToken is required for custom resource ${logicalId}`, resourceType, logicalId, physicalId);
@@ -20730,7 +20871,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties),
 				OldResourceProperties: this.stringifyProperties(previousProperties)
-			}));
+			}), maskerOrIdentity(context?.maskSecrets));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
 			const newPhysicalId = cfnResponse.PhysicalResourceId || physicalId;
 			const wasReplaced = newPhysicalId !== physicalId;
@@ -20781,7 +20922,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				PhysicalResourceId: physicalId,
 				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties)
-			}));
+			}), DELETE_PATH_UNMASKED);
 			if (cfnResponse.Status === "FAILED") {
 				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ('cdkd deploy' also accepts --allow-unaddressed, which forces exit 0; 'cdkd destroy' has no such flag.) ${DEPLOY_SKIP_CAVEAT}`);
 				return {
@@ -20879,7 +21020,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* (create / update throw; delete warns and returns `'skipped'` — issue
 	* #2054, which replaced its warn-and-continue).
 	*/
-	async invokeCustomResourceWithRetry(serviceToken, logicalId, operation, buildRequest) {
+	async invokeCustomResourceWithRetry(serviceToken, logicalId, operation, buildRequest, mask) {
 		const watch = startInterruptWatch(`Custom resource ${logicalId}`);
 		try {
 			const stackId = await this.resolveSyntheticStackId(logicalId);
@@ -20899,7 +21040,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 					this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
 					const sent = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation, () => {
 						delivered = true;
-					});
+					}, mask);
 					cfnResponse = sent.response;
 					logResult = sent.logResult;
 				} catch (error) {
@@ -21101,7 +21242,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* (the IAM-propagation class this arm exists for) means the handler never ran,
 	* and treating that as delivered would leave the reported failure single-shot.
 	*/
-	async sendRequest(serviceToken, request, responseKey, logicalId, operation, onDelivered) {
+	async sendRequest(serviceToken, request, responseKey, logicalId, operation, onDelivered, mask) {
 		if (this.isSnsServiceToken(serviceToken)) {
 			this.logger.debug(`ServiceToken is SNS topic, publishing to: ${serviceToken}`);
 			await this.publishToSns(serviceToken, request);
@@ -21112,7 +21253,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		const invokeResponse = await this.invokeLambda(serviceToken, request);
 		onDelivered();
 		return {
-			response: await this.getCustomResourceResponse(invokeResponse, responseKey, logicalId, operation),
+			response: await this.getCustomResourceResponse(invokeResponse, responseKey, logicalId, operation, mask),
 			...invokeResponse.LogResult === void 0 ? {} : { logResult: invokeResponse.LogResult }
 		};
 	}
@@ -21230,7 +21371,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* 2. If Lambda returned a payload with PhysicalResourceId → use it (simple handler)
 	* 3. Otherwise, poll S3 for the response (cfn-response via ResponseURL)
 	*/
-	async getCustomResourceResponse(lambdaResponse, responseKey, logicalId, operation) {
+	async getCustomResourceResponse(lambdaResponse, responseKey, logicalId, operation, mask) {
 		if (lambdaResponse.FunctionError) {
 			const errorPayload = lambdaResponse.Payload ? Buffer.from(lambdaResponse.Payload).toString() : "Unknown";
 			const logTail = decodeInvokeLogTail(lambdaResponse.LogResult);
@@ -21239,7 +21380,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		}
 		let hasDirectPayload = false;
 		try {
-			const payload = parseLambdaPayload(lambdaResponse.Payload);
+			const payload = parseLambdaPayload(lambdaResponse.Payload, mask);
 			if ("Status" in payload && (payload["Status"] === "SUCCESS" || payload["Status"] === "FAILED")) {
 				this.logger.debug(`Got direct cfn-response from Lambda for ${logicalId}`);
 				await this.cleanupResponseObject(responseKey);
@@ -25148,9 +25289,12 @@ function exportAliasCollisionWarning(outputKey, exportName) {
 * {@link collectDeclaredOutputNames}.
 */
 function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
-	const exposure = secretsPresentIn(exportName, secrets);
-	const shown = stripControlChars(exposure ? maskEveryOccurrence(exportName, exposure) : exportName);
-	return `Output ${stripControlChars(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
+	const mask = (name) => {
+		const exposure = secretsPresentIn(name, secrets);
+		return stripControlChars(exposure ? maskEveryOccurrence(name, exposure) : name);
+	};
+	const shown = mask(exportName);
+	return `Output ${mask(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
 }
 
 //#endregion
@@ -30399,5 +30543,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { beginCommandInterruptScope as $, PARTITION_TABLE as $n, S3StateBackend as $t, renderStatefulReason as A, runDockerForeground as An, SynthesisError as Ar, dynamicReferenceTokens as At, exportAliasCollisionScrubWarning as B, resolveCaptureObservedState as Bn, s3BucketDomainName as Bt, isFinalSnapshotError as C, validateContainerRepoName as Cn, PartialFailureError as Cr, requireConfigArray as Ct, extractDeploymentEventError as D, formatDockerLoginError as Dn, StackHasActiveImportsError as Dr, STATE_SOURCED_READBACK_RULES as Dt, makeCanonicalizePropertiesFn as E, dockerSpawnEnvWithSensitive as En, ResourceUpdateNotSupportedError as Er, STATE_SOURCED_CROSS_GENERATION_RULES as Et, green as F, synthesisStatusMessage as Fn, isMarkedNonRetryable as Fr, redactSecretsForState as Ft, IAMRoleProvider as G, stateBucketExistenceConfirmed as Gn, DiffCalculator as Gt, secretBearingStateKeyWarning as H, resolveStateBucketWithDefault as Hn, s3BucketRegionalDomainName as Ht, red as I, getDefaultStateBucketName as In, isRetryableTransientError as Ir, scrubResourceRecord as It, ProviderRegistry as J, CFN_TEMPLATE_URL_LIMIT as Jn, withRetry as Jt, collectInlinePolicyNamesManagedBySiblings as K, warnDeprecatedNoPrefixCliFlag as Kn, INTRINSIC_KEYS as Kt, yellow as L, getLegacyStateBucketName as Ln, isThrottlingError as Lr, classifyReplaySecretRegion as Lt, bold as M, AssetManifestLoader as Mn, isCdkdError as Mr, isSingleDynamicReferenceToken as Mt, cyan as N, getDockerImageBySourceHash as Nn, normalizeAwsError as Nr, maskSecretsInError as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, getDockerCmd as On, StackTerminationProtectionError as Or, TEMPLATE_SOURCED_RULES as Ot, gray as P, Synthesizer as Pn, withErrorHandling as Pr, maskSecretsInText as Pt, DEFAULT_STATE_PREFIX as Q, expectedOwnerParam as Qn, displaySafe as Qt, collectDeclaredOutputNames as R, resolveApp as Rn, markNonRetryable as Rr, producerRegionsFromState as Rt, createPreDeleteFinalSnapshot as S, validateAssetBucketName as Sn, NestedStackChildDirectDestroyError as Sr, replayWarn as St, unsupportedFinalSnapshotError as T, buildDockerImage as Tn, ResourceTimeoutError as Tr, requireConfigString as Tt, stateKeySecretExposure as U, resolveStateBucketWithDefaultAndSource as Un, s3BucketWebsiteUrl as Ut, isExportAliasCollision as V, resolveSkipPrefix as Vn, s3BucketDualStackDomainName as Vt, getCurrentResourceSecrets as W, resolveUseCdkBootstrapAssets as Wn, applyRoleArnIfSet as Wt, findSilentDropProperties as X, findLargeInlineResources as Xn, TemplateParser as Xt, findActionableSilentDrops as Y, MIGRATE_TMP_PREFIX as Yn, DagBuilder as Yt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Z, uploadCfnTemplate as Zn, LockManager as Zt, computeImplicitDeleteEdges as _, ensureAssetStorage as _n, LocalInvokeBuildError as _r, assertRegionMatch as _t, DeploymentEventsStore as a, AssetPublisher as an, resolveBucketRegion as ar, slowCcOperationTimeoutMs as at, buildFinalSnapshotIdentifier as b, parseBootstrapMarker as bn, LockError as br, configStringRefusal as bt, replayFailedOperations as c, buildAssetRedirectMap as cn, resetAwsClients as cr, IntrinsicFunctionResolver as ct, updatePartialReason as d, rewriteTemplateAssetReferences as dn, CdkdError as dr, getAccountInfo as dt, rebuildClientForBucketRegion as en, canonicalizeRegion as er, endCommandInterruptScope as et, UNSPECIFIED_SKIP_REASON as f, escapeRegExp$1 as fn, ConfigError as fr, parameterTypeMayLoseSecretIdentity as ft, IMPLICIT_DELETE_DEPENDENCIES as g, assertAssetBucketRegion as gn, DynamicReferenceRegionAmbiguousError as gr, resolveExplicitPhysicalId as gt, maskingRetryLogger as h, BOOTSTRAP_MARKER_PREFIX as hn, DeployCancelledError as hr, normalizeAwsTagsToCfn as ht, DeploymentEventsReader as i, shouldRetainResource as in, clearBucketRegionCache as ir, CloudControlProvider as it, formatResourceLine as j, runDockerStreaming as jn, formatError as jr, errorCauseChain as jt, isStatefulRecreateTargetSync as k, partitionSensitiveEnv as kn, StateError as kr, createSecretMasker as kt, replayRollback as l, createAssetRedirectResolver as ln, setAwsClients as lr, carriesDynamicReference as lt, withResourceDeadline as m, AssetModeResolver as mn, DependencyError as mr, WAFv2WebACLProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, importableOutputKeys as nn, AssemblyReader as nr, isInterruptedWaitError as nt, planFailedOps as o, stringifyValue as on, AwsClients as or, disableInstanceApiTermination as ot, deleteSkipReason as p, stripControlChars as pn, CrossAccountSecretRefusalError as pr, refStateLookupFromResource as pt, clearOnUpdateRemoval as q, CFN_TEMPLATE_BODY_LIMIT as qn, describeTypeWithThrottleRetry as qt, DeployEngine as r, importableOutputs as rn, processStackMessages as rr, startInterruptWatch as rt, planRollback as s, WorkGraph as sn, getAwsClients as sr, isTerminationProtectionPropagationError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, exportNamesCarriedFrom as tn, derivePartitionAndUrlSuffix as tr, interruptWatchListenerCount as tt, updatePartialMessage as u, loadPublishableAssetManifest as un, AssetError as ur, cfnRefValueFromPhysicalId as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, getBootstrapMarkerKey as vn, LocalMigrateError as vr, coerceCfnBoolean as vt, refusesFinalSnapshot as w, buildDenyExternalAccessPolicy as wn, ProvisioningError as wr, requireConfigObject as wt, ccRoutedFinalSnapshotError as x, readBootstrapMarkerBody as xn, MissingCdkCliError as xr, readConfigString as xt, PRE_DELETE_SNAPSHOT_TYPES as y, isCrossRegionRedirect as yn, LocalStartServiceError as yr, configBooleanRefusal as yt, collectPublishedOutputNames as z, resolveAutoAssetStorage as zn, __exportAll as zr, s3BucketArn as zt };
-//# sourceMappingURL=deploy-engine-B-RuozdO.js.map
+export { maskerOrIdentity as $, findLargeInlineResources as $n, TemplateParser as $t, renderStatefulReason as A, formatDockerLoginError as An, StackHasActiveImportsError as Ar, STATE_SOURCED_READBACK_RULES as At, exportAliasCollisionScrubWarning as B, getLegacyStateBucketName as Bn, isThrottlingError as Br, classifyReplaySecretRegion as Bt, isFinalSnapshotError as C, parseBootstrapMarker as Cn, LockError as Cr, configStringRefusal as Ct, extractDeploymentEventError as D, buildDenyExternalAccessPolicy as Dn, ProvisioningError as Dr, requireConfigObject as Dt, makeCanonicalizePropertiesFn as E, validateContainerRepoName as En, PartialFailureError as Er, requireConfigArray as Et, green as F, AssetManifestLoader as Fn, isCdkdError as Fr, isSingleDynamicReferenceToken as Ft, IAMRoleProvider as G, resolveStateBucketWithDefault as Gn, s3BucketRegionalDomainName as Gt, secretBearingStateKeyWarning as H, resolveAutoAssetStorage as Hn, __exportAll as Hr, s3BucketArn as Ht, red as I, getDockerImageBySourceHash as In, normalizeAwsError as Ir, maskSecretsInError as It, ProviderRegistry as J, stateBucketExistenceConfirmed as Jn, DiffCalculator as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveStateBucketWithDefaultAndSource as Kn, s3BucketWebsiteUrl as Kt, yellow as L, Synthesizer as Ln, withErrorHandling as Lr, maskSecretsInText as Lt, bold as M, partitionSensitiveEnv as Mn, StateError as Mr, createSecretMasker as Mt, cyan as N, runDockerForeground as Nn, SynthesisError as Nr, dynamicReferenceTokens as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDockerImage as On, ResourceTimeoutError as Or, requireConfigString as Ot, gray as P, runDockerStreaming as Pn, formatError as Pr, errorCauseChain as Pt, maskDeep as Q, MIGRATE_TMP_PREFIX as Qn, DagBuilder as Qt, collectDeclaredOutputNames as R, synthesisStatusMessage as Rn, isMarkedNonRetryable as Rr, redactSecretsForState as Rt, createPreDeleteFinalSnapshot as S, isCrossRegionRedirect as Sn, LocalStartServiceError as Sr, configBooleanRefusal as St, unsupportedFinalSnapshotError as T, validateAssetBucketName as Tn, NestedStackChildDirectDestroyError as Tr, replayWarn as Tt, stateKeySecretExposure as U, resolveCaptureObservedState as Un, s3BucketDomainName as Ut, isExportAliasCollision as V, resolveApp as Vn, markNonRetryable as Vr, producerRegionsFromState as Vt, getCurrentResourceSecrets as W, resolveSkipPrefix as Wn, s3BucketDualStackDomainName as Wt, findSilentDropProperties as X, CFN_TEMPLATE_BODY_LIMIT as Xn, describeTypeWithThrottleRetry as Xt, findActionableSilentDrops as Y, warnDeprecatedNoPrefixCliFlag as Yn, INTRINSIC_KEYS as Yt, createMaskedRetryLogger as Z, CFN_TEMPLATE_URL_LIMIT as Zn, withRetry as Zt, computeImplicitDeleteEdges as _, AssetModeResolver as _n, DependencyError as _r, WAFv2WebACLProvider as _t, DeploymentEventsStore as a, importableOutputKeys as an, AssemblyReader as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, ensureAssetStorage as bn, LocalInvokeBuildError as br, assertRegionMatch as bt, replayFailedOperations as c, AssetPublisher as cn, resolveBucketRegion as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, buildAssetRedirectMap as dn, resetAwsClients as dr, IntrinsicFunctionResolver as dt, LockManager as en, uploadCfnTemplate as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, createAssetRedirectResolver as fn, setAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, stripControlChars as gn, CrossAccountSecretRefusalError as gr, refStateLookupFromResource as gt, maskingRetryLogger as h, escapeRegExp$1 as hn, ConfigError as hr, parameterTypeMayLoseSecretIdentity as ht, DeploymentEventsReader as i, exportNamesCarriedFrom as in, derivePartitionAndUrlSuffix as ir, interruptWatchListenerCount as it, formatResourceLine as j, getDockerCmd as jn, StackTerminationProtectionError as jr, TEMPLATE_SOURCED_RULES as jt, isStatefulRecreateTargetSync as k, dockerSpawnEnvWithSensitive as kn, ResourceUpdateNotSupportedError as kr, STATE_SOURCED_CROSS_GENERATION_RULES as kt, replayRollback as l, stringifyValue as ln, AwsClients as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, rewriteTemplateAssetReferences as mn, CdkdError as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, S3StateBackend as nn, PARTITION_TABLE as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputs as on, processStackMessages as or, startInterruptWatch as ot, deleteSkipReason as p, loadPublishableAssetManifest as pn, AssetError as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveUseCdkBootstrapAssets as qn, applyRoleArnIfSet as qt, DeployEngine as r, rebuildClientForBucketRegion as rn, canonicalizeRegion as rr, endCommandInterruptScope as rt, planRollback as s, shouldRetainResource as sn, clearBucketRegionCache as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, displaySafe as tn, expectedOwnerParam as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, WorkGraph as un, getAwsClients as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, BOOTSTRAP_MARKER_PREFIX as vn, DeployCancelledError as vr, normalizeAwsTagsToCfn as vt, refusesFinalSnapshot as w, readBootstrapMarkerBody as wn, MissingCdkCliError as wr, readConfigString as wt, ccRoutedFinalSnapshotError as x, getBootstrapMarkerKey as xn, LocalMigrateError as xr, coerceCfnBoolean as xt, PRE_DELETE_SNAPSHOT_TYPES as y, assertAssetBucketRegion as yn, DynamicReferenceRegionAmbiguousError as yr, resolveExplicitPhysicalId as yt, collectPublishedOutputNames as z, getDefaultStateBucketName as zn, isRetryableTransientError as zr, scrubResourceRecord as zt };
+//# sourceMappingURL=deploy-engine-52VBVCWI.js.map