@go-to-k/cdkd 0.284.76 → 0.284.77

package/dist/{deploy-engine-Dm-MdFR-.js → deploy-engine-Ce3payPI.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-BMCefk9p.js";
+import { t as getCdkdVersion } from "./version-rsHq2qI3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -288,6 +288,83 @@ const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
 */
 const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
 /**
+* How far every `.cause` walk in this module reads.
+*
+* ONE constant rather than five literals, because the walks are only sound
+* together: {@link isMarkedNonRetryable} is what stops a deliberate refusal
+* being read as transient, so any walk that reads text FURTHER than the marker
+* walk creates a band where a refusal is legible but its marker is not.
+* {@link retryClassificationText} shipped at 10 against the marker's 5 for
+* exactly that reason, and the chain shape that makes the band reachable is
+* the one the code already cites -- a nested-stack failure grows one
+* `ProvisioningError` per level.
+*/
+const MAX_CAUSE_CHAIN_DEPTH = 5;
+/**
+* Stamped on an error whose own message deliberately WITHHOLDS text its
+* `cause` carries (issue [#2302](https://github.com/go-to-k/cdkd/issues/2302)).
+*
+* Distinct from {@link NON_RETRYABLE_MARKER} and orthogonal to it: this one
+* says nothing about whether the error should be retried, only that the
+* message a classifier would normally read is INCOMPLETE.
+*/
+const REDACTED_CAUSE_MARKER = Symbol.for("cdkd.redactedCause");
+/**
+* Declare that this error's message withholds text its `cause` carries, so the
+* message-based retry classifiers must read the CHAIN instead
+* (issue [#2302](https://github.com/go-to-k/cdkd/issues/2302)).
+*
+* cdkd's retry classifiers match by SUBSTRING over a message. That is sound
+* only while a wrapper copies its cause's text, which every wrapper did until
+* #2302 started reducing an AWS failure to its error CLASS -- S3 words its
+* `AccessDenied` as `User: arn:aws:sts::<account>:assumed-role/<role>/<session>
+* is not authorized to perform: ...`, and a THROWN message is captured into the
+* persisted `deployments/{runId}.jsonl` store. Redacting it also removed the
+* substrings the pattern table matches on: measured on `S3BucketProvider`,
+* `not authorized to perform` (retryable, on the DENSE IAM-propagation cadence)
+* and S3's `conflicting conditional operation` both went NON-retryable.
+*
+* Call it at every site that redacts, and only there. It is deliberately an
+* opt-in stamp rather than an unconditional chain read -- see
+* {@link retryClassificationText} for the measurement that forced that choice.
+*
+* Same non-extensible tolerance as {@link markNonRetryable}, for the same
+* reason: callers use it inline around the error they are about to throw, so a
+* `TypeError` here would replace the refusal with an unrelated crash. Losing
+* the stamp degrades to reading the top-level message, i.e. the pre-#2302
+* classification of a message that is now shorter -- worse, but not a crash.
+*/
+function markRedactedCause(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, REDACTED_CAUSE_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+/**
+* True when the error, or anything in its bounded `.cause` chain, was stamped
+* by {@link markRedactedCause}.
+*
+* Walked rather than read off the top link, because the redacting error is
+* itself wrapped further out: `deploy-engine.ts` re-wraps every provider
+* failure, so by the time a classifier sees it the stamp is one or more links
+* deep. Same {@link MAX_CAUSE_CHAIN_DEPTH} as the marker walk, which is what
+* lets {@link retryClassificationText} claim the two agree.
+*/
+function hasRedactedCause(error) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			if (current[REDACTED_CAUSE_MARKER] === true) return true;
+		}
+		current = current.cause;
+	}
+	return false;
+}
+/**
 * Mark a cdkd-authored refusal as terminal and return it, for
 * `throw markNonRetryable(new ProvisioningError(...))`.
 *
@@ -354,7 +431,7 @@ function markNonRetryable(error) {
 */
 function isMarkedNonRetryable(error) {
 	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
 		if (typeof current === "object" || typeof current === "function") {
 			if (current[NON_RETRYABLE_MARKER] === true) return true;
 		}
@@ -378,7 +455,7 @@ function isMarkedNonRetryable(error) {
 */
 function isThrottlingError(error) {
 	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
 		const name = current.name;
 		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
 		const status = current.$metadata?.httpStatusCode;
@@ -480,7 +557,7 @@ const TRANSIENT_SERVER_ERROR_STATUS_CODES = /* @__PURE__ */ new Set([
 */
 function isTransientServerError(error) {
 	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
 		const status = current.$metadata?.httpStatusCode;
 		if (status !== void 0 && TRANSIENT_SERVER_ERROR_STATUS_CODES.has(status)) return true;
 		current = current.cause;
@@ -531,7 +608,7 @@ function describeRetryClassificationSignals(error) {
 	let sawMetadata = false;
 	let metadataName;
 	let metadataRequestId;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
 		const name = current.name;
 		if (depth > 0 && typeof name === "string" && name !== "") deepestName = name;
 		const metadata = current.$metadata;
@@ -599,6 +676,62 @@ function isRetryableTransientError(error, message) {
 	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
 /**
+* The text every MESSAGE-based retry classifier should read: this error's own
+* message plus every message down its `cause` chain.
+*
+* Every classifier in this module that reads a message reads the TOP-LEVEL one,
+* and that was sound only while cdkd's wrappers copied their cause's text
+* verbatim -- which they did, everywhere, until issue
+* [#2302](https://github.com/go-to-k/cdkd/issues/2302). A wrapper on a THROWN
+* path may now deliberately WITHHOLD AWS's wording, because a thrown message is
+* captured into the persisted `deployments/{runId}.jsonl` store and S3's
+* `AccessDenied` names the caller's account, role and session. Measured on
+* `S3BucketProvider.create` before this function existed: the wrap turned
+* `not authorized to perform` (retryable, and on the DENSE IAM-propagation
+* cadence) and `conflicting conditional operation` (retryable) into
+* NON-retryable, i.e. the redaction silently removed a retry the deploy
+* depended on.
+*
+* This is the missing THIRD walk rather than a new idea: {@link
+* isMarkedNonRetryable} and {@link isThrottlingError} already walk the same
+* chain, for the same stated reason (cdkd wraps SDK errors routinely).
+*
+* It cannot resurrect a cdkd refusal: every consumer checks
+* {@link isMarkedNonRetryable} FIRST, that marker is itself chain-walked, and
+* both walks are bounded by the SAME {@link MAX_CAUSE_CHAIN_DEPTH}.
+*
+* It is a NO-OP for every error that has not opted in via
+* {@link markRedactedCause} -- which is every wrapper on `main` outside
+* #2302's redacting sites. An earlier revision justified itself with a wider
+* claim, that every wrapper on `main` COPIES its cause's message; that claim is
+* false (`custom-resource-provider.ts`'s `describeWaiterFailure` already
+* withholds the raw waiter payload, and it is not the only wrapper that does),
+* and it does not need to be true. The opt-in stamp makes the no-op a property
+* of the mechanism rather than of a survey.
+*
+* NEVER use the result as a LOG line or a thrown message: it is the union of
+* exactly the text the redaction exists to withhold. `retry.ts` keeps the
+* top-level message for its `warn` / `debug` output and uses this only to
+* classify.
+*/
+function retryClassificationText(error) {
+	const top = error instanceof Error ? error.message : String(error);
+	if (!hasRedactedCause(error)) return top;
+	const parts = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null && !seen.has(current); depth++) {
+		seen.add(current);
+		if (current instanceof Error) {
+			if (current.message) parts.push(current.message);
+		} else try {
+			parts.push(String(current));
+		} catch {}
+		current = current?.cause;
+	}
+	return parts.join("\n");
+}
+/**
 * True when the message is a just-created-IAM-entity propagation rejection
 * ({@link IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS}).
 *
@@ -5756,6 +5889,50 @@ var DockerAssetPublisher = class {
 	}
 };
 
+//#endregion
+//#region src/utils/aws-failure-text.ts
+/** Appended to a redacted summary so the withheld half is still reachable. */
+const VERBOSE_POINTER = "Re-run with --verbose for AWS's own message.";
+/**
+* Whether AWS wrote this failure's message.
+*
+* Keyed on the marker fields `@aws-sdk/*` errors carry through
+* `@smithy/smithy-client`'s `ServiceException` — `$metadata` on every
+* deserialized error, `$fault` on every modeled one, `$response` where a
+* middleware attached the raw response. Nothing under `src/` sets any of them,
+* so a match cannot be a cdkd-authored error.
+*
+* A transport-level failure (a socket timeout, a DNS error) can reach a caller
+* without `$metadata`, and that is the correct answer rather than a gap: those
+* messages are written by the HTTP layer and name a host, never a caller.
+*/
+function isAwsAuthoredFailure(error) {
+	const candidate = error;
+	return candidate.$metadata !== void 0 || candidate.$fault !== void 0 || candidate.$response !== void 0;
+}
+/**
+* Describe a caught failure for a thrown message. See {@link AwsFailureText}.
+*/
+function describeAwsFailure(error) {
+	if (error instanceof Error) {
+		if (!isAwsAuthoredFailure(error)) return {
+			summary: error.message,
+			detail: error.message,
+			redacted: false
+		};
+		return {
+			summary: `${error.name || "Error"}. ${VERBOSE_POINTER}`,
+			detail: error.message,
+			redacted: true
+		};
+	}
+	return {
+		summary: `a non-Error value of type ${typeof error}. ${VERBOSE_POINTER}`,
+		detail: String(error),
+		redacted: true
+	};
+}
+
 //#endregion
 //#region src/utils/deny-external-access-policy.ts
 /**
@@ -5945,7 +6122,11 @@ async function assertAssetBucketRegion(s3Client, bucketName, expectedRegion, acc
 	} catch (probeError) {
 		const fromProbe = readBucketRegionHeader(probeError);
 		if (fromProbe) actual = canonicalizeRegion(fromProbe);
-		else throw new CdkdError(`Asset bucket '${bucketName}' is claimed by an existing bucket, but cdkd could not determine which region that bucket is in, so it cannot confirm it belongs to ${want}. Refusing to adopt it. (region probe failed: ${probeError instanceof Error ? probeError.message : String(probeError)}) ${remedy}`, "ASSET_STORAGE_FOREIGN_REGION_BUCKET", cause);
+		else {
+			const failure = describeAwsFailure(probeError);
+			if (failure.redacted) getLogger().debug(`GetBucketLocation failed for asset bucket '${bucketName}' while confirming it belongs to ${want}: ${failure.detail}`);
+			throw new CdkdError(`Asset bucket '${bucketName}' is claimed by an existing bucket, but cdkd could not determine which region that bucket is in, so it cannot confirm it belongs to ${want}. Refusing to adopt it. (region probe failed: ${failure.summary}) ${remedy}`, "ASSET_STORAGE_FOREIGN_REGION_BUCKET", cause);
+		}
 	}
 	if (actual === want) return;
 	throw new CdkdError(`Asset bucket name '${bucketName}' resolves to a bucket in ${actual}, while this operation targets ${want}. S3 bucket names are globally unique, and both 'BucketAlreadyOwnedByYou' and a cross-region redirect report ACCOUNT ownership rather than the bucket's region, so cdkd cannot treat it as ${want}'s asset bucket. cdkd asset storage is per-region by design: adopting it would publish ${want}'s assets into ${actual} and apply ${want}'s bucket configuration there. ${remedy}`, "ASSET_STORAGE_FOREIGN_REGION_BUCKET", cause);
@@ -12235,11 +12416,12 @@ async function withRetry(operation, logicalId, opts = {}) {
 	} catch (error) {
 		lastError = error;
 		const message = error instanceof Error ? error.message : String(error);
+		const classifyText = retryClassificationText(error);
 		if (isMarkedNonRetryable(error)) throw error;
-		const retryable = opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message);
-		const propagation = defaultSchedule && isIamPropagationError(message);
+		const retryable = opts.isRetryable ? opts.isRetryable(classifyText, error) : isRetryableTransientError(error, classifyText);
+		const propagation = defaultSchedule && isIamPropagationError(classifyText);
 		if (propagation) sawPropagation = true;
-		const nameCooldown = defaultSchedule && !propagation && isNameCooldownError(message);
+		const nameCooldown = defaultSchedule && !propagation && isNameCooldownError(classifyText);
 		const attemptLimit = sawPropagation ? 26 : maxRetries;
 		if (!retryable || attempt >= attemptLimit) {
 			if (propagationRetries > 0 || serverErrorRetries > 0 || nameCooldownRetries > 0) {
@@ -19514,7 +19696,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BjebXXKD.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CDfupCgW.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -31398,5 +31580,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { maskerOrIdentity as $, MIGRATE_TMP_PREFIX as $n, redactSecretsForState as $t, renderStatefulReason as A, dockerSpawnEnvWithSensitive as An, ResourceUpdateNotSupportedError as Ar, classifyReplaySecretRegion as At, exportAliasCollisionScrubWarning as B, getDefaultStateBucketName as Bn, isRetryableTransientError as Br, describeTypeWithThrottleRetry as Bt, isFinalSnapshotError as C, isCrossRegionRedirect as Cn, LocalStartServiceError as Cr, configBooleanRefusal as Ct, extractDeploymentEventError as D, validateContainerRepoName as Dn, PartialFailureError as Dr, requireConfigArray as Dt, makeCanonicalizePropertiesFn as E, validateAssetBucketName as En, NestedStackChildDirectDestroyError as Er, replayWarn as Et, green as F, runDockerStreaming as Fn, formatError as Fr, s3BucketRegionalDomainName as Ft, IAMRoleProvider as G, resolveSkipPrefix as Gn, STATE_SOURCED_READBACK_RULES as Gt, secretBearingStateKeyWarning as H, resolveApp as Hn, markNonRetryable as Hr, DagBuilder as Ht, red as I, AssetManifestLoader as In, isCdkdError as Ir, s3BucketWebsiteUrl as It, ProviderRegistry as J, resolveUseCdkBootstrapAssets as Jn, dynamicReferenceTokens as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveStateBucketWithDefault as Kn, TEMPLATE_SOURCED_RULES as Kt, yellow as L, getDockerImageBySourceHash as Ln, normalizeAwsError as Lr, applyRoleArnIfSet as Lt, bold as M, getDockerCmd as Mn, StackTerminationProtectionError as Mr, s3BucketArn as Mt, cyan as N, partitionSensitiveEnv as Nn, StateError as Nr, s3BucketDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDenyExternalAccessPolicy as On, ProvisioningError as Or, requireConfigObject as Ot, gray as P, runDockerForeground as Pn, SynthesisError as Pr, s3BucketDualStackDomainName as Pt, maskDeep as Q, CFN_TEMPLATE_URL_LIMIT as Qn, maskSecretsInText as Qt, collectDeclaredOutputNames as R, Synthesizer as Rn, withErrorHandling as Rr, DiffCalculator as Rt, createPreDeleteFinalSnapshot as S, getBootstrapMarkerKey as Sn, LocalMigrateError as Sr, coerceCfnBoolean as St, unsupportedFinalSnapshotError as T, readBootstrapMarkerBody as Tn, MissingCdkCliError as Tr, readConfigString as Tt, stateKeySecretExposure as U, resolveAutoAssetStorage as Un, __exportAll as Ur, TemplateParser as Ut, isExportAliasCollision as V, getLegacyStateBucketName as Vn, isThrottlingError as Vr, withRetry as Vt, getCurrentResourceSecrets as W, resolveCaptureObservedState as Wn, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, findSilentDropProperties as X, warnDeprecatedNoPrefixCliFlag as Xn, isSingleDynamicReferenceToken as Xt, findActionableSilentDrops as Y, stateBucketExistenceConfirmed as Yn, errorCauseChain as Yt, createMaskedRetryLogger as Z, CFN_TEMPLATE_BODY_LIMIT as Zn, maskSecretsInError as Zt, computeImplicitDeleteEdges as _, stripControlChars as _n, CrossAccountSecretRefusalError as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, exportNamesCarriedFrom as an, derivePartitionAndUrlSuffix as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, assertAssetBucketRegion as bn, DynamicReferenceRegionAmbiguousError as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, shouldRetainResource as cn, clearBucketRegionCache as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, WorkGraph as dn, getAwsClients as dr, IntrinsicFunctionResolver as dt, scrubResourceRecord as en, findLargeInlineResources as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, buildAssetRedirectMap as fn, resetAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, escapeRegExp$1 as gn, ConfigError as gr, parameterTypeMayLoseSecretIdentity as gt, maskingRetryLogger as h, rewriteTemplateAssetReferences as hn, CdkdError as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, rebuildClientForBucketRegion as in, canonicalizeRegion as ir, interruptWatchListenerCount as it, formatResourceLine as j, formatDockerLoginError as jn, StackHasActiveImportsError as jr, producerRegionsFromState as jt, isStatefulRecreateTargetSync as k, buildDockerImage as kn, ResourceTimeoutError as kr, requireConfigString as kt, replayRollback as l, AssetPublisher as ln, resolveBucketRegion as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, loadPublishableAssetManifest as mn, AssetError as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, displaySafe as nn, expectedOwnerParam as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputKeys as on, AssemblyReader as or, startInterruptWatch as ot, deleteSkipReason as p, createAssetRedirectResolver as pn, setAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveStateBucketWithDefaultAndSource as qn, createSecretMasker as qt, DeployEngine as r, S3StateBackend as rn, PARTITION_TABLE as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputs as sn, processStackMessages as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockManager as tn, uploadCfnTemplate as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, stringifyValue as un, AwsClients as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, AssetModeResolver as vn, DependencyError as vr, WAFv2WebACLProvider as vt, refusesFinalSnapshot as w, parseBootstrapMarker as wn, LockError as wr, configStringRefusal as wt, ccRoutedFinalSnapshotError as x, ensureAssetStorage as xn, LocalInvokeBuildError as xr, assertRegionMatch as xt, PRE_DELETE_SNAPSHOT_TYPES as y, BOOTSTRAP_MARKER_PREFIX as yn, DeployCancelledError as yr, normalizeAwsTagsToCfn as yt, collectPublishedOutputNames as z, synthesisStatusMessage as zn, isMarkedNonRetryable as zr, INTRINSIC_KEYS as zt };
-//# sourceMappingURL=deploy-engine-Dm-MdFR-.js.map
+export { maskerOrIdentity as $, CFN_TEMPLATE_URL_LIMIT as $n, redactSecretsForState as $t, renderStatefulReason as A, buildDockerImage as An, ResourceTimeoutError as Ar, classifyReplaySecretRegion as At, exportAliasCollisionScrubWarning as B, synthesisStatusMessage as Bn, isMarkedNonRetryable as Br, describeTypeWithThrottleRetry as Bt, isFinalSnapshotError as C, isCrossRegionRedirect as Cn, LocalMigrateError as Cr, configBooleanRefusal as Ct, extractDeploymentEventError as D, validateContainerRepoName as Dn, NestedStackChildDirectDestroyError as Dr, requireConfigArray as Dt, makeCanonicalizePropertiesFn as E, validateAssetBucketName as En, MissingCdkCliError as Er, replayWarn as Et, green as F, runDockerForeground as Fn, SynthesisError as Fr, s3BucketRegionalDomainName as Ft, IAMRoleProvider as G, resolveCaptureObservedState as Gn, retryClassificationText as Gr, STATE_SOURCED_READBACK_RULES as Gt, secretBearingStateKeyWarning as H, getLegacyStateBucketName as Hn, isThrottlingError as Hr, DagBuilder as Ht, red as I, runDockerStreaming as In, formatError as Ir, s3BucketWebsiteUrl as It, ProviderRegistry as J, resolveStateBucketWithDefaultAndSource as Jn, dynamicReferenceTokens as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveSkipPrefix as Kn, __exportAll as Kr, TEMPLATE_SOURCED_RULES as Kt, yellow as L, AssetManifestLoader as Ln, isCdkdError as Lr, applyRoleArnIfSet as Lt, bold as M, formatDockerLoginError as Mn, StackHasActiveImportsError as Mr, s3BucketArn as Mt, cyan as N, getDockerCmd as Nn, StackTerminationProtectionError as Nr, s3BucketDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDenyExternalAccessPolicy as On, PartialFailureError as Or, requireConfigObject as Ot, gray as P, partitionSensitiveEnv as Pn, StateError as Pr, s3BucketDualStackDomainName as Pt, maskDeep as Q, CFN_TEMPLATE_BODY_LIMIT as Qn, maskSecretsInText as Qt, collectDeclaredOutputNames as R, getDockerImageBySourceHash as Rn, normalizeAwsError as Rr, DiffCalculator as Rt, createPreDeleteFinalSnapshot as S, getBootstrapMarkerKey as Sn, LocalInvokeBuildError as Sr, coerceCfnBoolean as St, unsupportedFinalSnapshotError as T, readBootstrapMarkerBody as Tn, LockError as Tr, readConfigString as Tt, stateKeySecretExposure as U, resolveApp as Un, markNonRetryable as Ur, TemplateParser as Ut, isExportAliasCollision as V, getDefaultStateBucketName as Vn, isRetryableTransientError as Vr, withRetry as Vt, getCurrentResourceSecrets as W, resolveAutoAssetStorage as Wn, markRedactedCause as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, findSilentDropProperties as X, stateBucketExistenceConfirmed as Xn, isSingleDynamicReferenceToken as Xt, findActionableSilentDrops as Y, resolveUseCdkBootstrapAssets as Yn, errorCauseChain as Yt, createMaskedRetryLogger as Z, warnDeprecatedNoPrefixCliFlag as Zn, maskSecretsInError as Zt, computeImplicitDeleteEdges as _, stripControlChars as _n, ConfigError as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, exportNamesCarriedFrom as an, canonicalizeRegion as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, assertAssetBucketRegion as bn, DeployCancelledError as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, shouldRetainResource as cn, processStackMessages as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, WorkGraph as dn, AwsClients as dr, IntrinsicFunctionResolver as dt, scrubResourceRecord as en, MIGRATE_TMP_PREFIX as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, buildAssetRedirectMap as fn, getAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, escapeRegExp$1 as gn, CdkdError as gr, parameterTypeMayLoseSecretIdentity as gt, maskingRetryLogger as h, rewriteTemplateAssetReferences as hn, AssetError as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, rebuildClientForBucketRegion as in, PARTITION_TABLE as ir, interruptWatchListenerCount as it, formatResourceLine as j, dockerSpawnEnvWithSensitive as jn, ResourceUpdateNotSupportedError as jr, producerRegionsFromState as jt, isStatefulRecreateTargetSync as k, describeAwsFailure as kn, ProvisioningError as kr, requireConfigString as kt, replayRollback as l, AssetPublisher as ln, clearBucketRegionCache as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, loadPublishableAssetManifest as mn, setAwsClients as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, displaySafe as nn, uploadCfnTemplate as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputKeys as on, derivePartitionAndUrlSuffix as or, startInterruptWatch as ot, deleteSkipReason as p, createAssetRedirectResolver as pn, resetAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveStateBucketWithDefault as qn, createSecretMasker as qt, DeployEngine as r, S3StateBackend as rn, expectedOwnerParam as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputs as sn, AssemblyReader as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockManager as tn, findLargeInlineResources as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, stringifyValue as un, resolveBucketRegion as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, AssetModeResolver as vn, CrossAccountSecretRefusalError as vr, WAFv2WebACLProvider as vt, refusesFinalSnapshot as w, parseBootstrapMarker as wn, LocalStartServiceError as wr, configStringRefusal as wt, ccRoutedFinalSnapshotError as x, ensureAssetStorage as xn, DynamicReferenceRegionAmbiguousError as xr, assertRegionMatch as xt, PRE_DELETE_SNAPSHOT_TYPES as y, BOOTSTRAP_MARKER_PREFIX as yn, DependencyError as yr, normalizeAwsTagsToCfn as yt, collectPublishedOutputNames as z, Synthesizer as zn, withErrorHandling as zr, INTRINSIC_KEYS as zt };
+//# sourceMappingURL=deploy-engine-Ce3payPI.js.map