@go-to-k/cdkd 0.284.82 → 0.284.84

package/dist/{deploy-engine-Dh4Jid_H.js → deploy-engine-Du2CDZop.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-D_b3uJus.js";
+import { t as getCdkdVersion } from "./version-BJFNb-b3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3868,6 +3868,168 @@ async function expectedOwnerParam(client) {
 	return owner ? { ExpectedBucketOwner: owner } : {};
 }
 
+//#endregion
+//#region src/state/s3-noncurrent-version-purge.ts
+/**
+* Parenthetical used when a caller names nothing.
+*
+* True of ANY object this function is pointed at, which is the bar for a
+* default here: a caller that forgets to describe its object must still emit a
+* warning that is correct, just less specific. It deliberately does not guess
+* at content.
+*/
+const DEFAULT_OBJECT_DESCRIPTION = "the body of an object cdkd has just reported as removed";
+/**
+* `objectDescription` for the custom-resource response sidecar.
+*
+* A SHARED CONSTANT rather than the same literal at both sites, for the reason
+* this whole module is shared: the provider's own `cleanupResponseObject` and
+* `cdkd gc`'s sweep of the abandoned placeholders delete the SAME object, so a
+* reader must not be able to tell from the warning which of the two produced
+* it. Two literals are how one of them drifts — and it is not hypothetical:
+* review probed it by editing `gc.ts`'s string alone and the suite stayed
+* green, because nothing tied the two together. One binding cannot drift, and
+* needs no test to say so.
+*/
+const CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION = "a custom-resource response object, which is the handler's full cfn-response body including `Data`";
+/**
+* `DeleteObjects` is capped at 1000 entries per call.
+*
+* DEFENCE IN DEPTH, and unreachable today: `stale` is accumulated from a
+* SINGLE `ListObjectVersions` page, whose `Versions` + `DeleteMarkers` are
+* capped at 1000 COMBINED by `MaxKeys`, so the chunking below never takes its
+* second iteration. It is kept because the invariant it guards ("never hand
+* DeleteObjects more than 1000") is one a future change accumulating across
+* pages would silently break.
+*
+* Mutation coverage of this constant is ASYMMETRIC, which is worth stating
+* because the obvious summary is wrong in one direction: RAISING it is green
+* (nothing ever reaches the second chunk, so a bigger ceiling changes
+* nothing), while LOWERING it to 500 is RED — the multi-page fixture's
+* thousand-entry pages then split and the asserted batch shape changes. So the
+* value is fenced from below and not from above.
+*/
+const DELETE_BATCH_SIZE = 1e3;
+/** How many failing keys the warning names before it truncates. */
+const MAX_NAMED_FAILURES = 5;
+/**
+* Label for a `DeleteObjects` error entry that carries no `Key`.
+*
+* S3 always populates it in practice; the point is that an unnameable failure
+* must still COUNT, because the alternative measured here was `failed.size`
+* reaching 0 and the whole warning disappearing.
+*
+* Each keyless entry gets its OWN slot (`<unknown key #1>`, `#2`, ...) rather
+* than sharing one. Collapsing them was defended as "the honest reading", but
+* it is honest about NAMING and not about COUNTING: N keyless failures then
+* reported `1 key(s)`, which is the same prefixes-not-keys under-count this
+* change was raised to fix, arriving through the branch that fixed it. One
+* slot per failure can over-count if S3 ever returns two entries for one
+* object, which is the direction that errs toward reporting too much.
+*
+* The slot name is SYNTHETIC and its uniqueness is not enforced: a real key
+* literally called `<unknown key #1>` would merge with the first keyless
+* entry and under-count by one. Unreachable here — every caller passes
+* `custom-resource-responses/<requestId>.json` — and stated rather than left
+* implied, because "the name cannot collide" is the kind of unstated
+* invariant this module exists to stop asserting.
+*/
+const UNKNOWN_KEY_PREFIX = "<unknown key #";
+/** Reason recorded when a page says it is truncated but names no next key. */
+const TRUNCATED_NO_MARKER = "listing reported IsTruncated with no NextKeyMarker; the walk stopped early and versions may remain";
+/** Record a per-key failure reason without losing an earlier one. */
+function recordFailure(failed, key, reason) {
+	const existing = failed.get(key);
+	if (existing) existing.push(reason);
+	else failed.set(key, [reason]);
+}
+const describe$1 = (error) => error instanceof Error ? error.message : String(error);
+async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {}) {
+	if (keys.length === 0) return;
+	const logger = options.logger ?? getLogger().child("s3-version-purge");
+	const requestFields = options.requestFields ?? {};
+	const wanted = new Set(keys);
+	const prefixes = options.listPrefix !== void 0 ? [options.listPrefix] : keys;
+	const failed = /* @__PURE__ */ new Map();
+	const unknown = { n: 0 };
+	for (const prefix of prefixes) try {
+		await purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown);
+	} catch (error) {
+		const affected = options.listPrefix !== void 0 ? keys : [prefix];
+		for (const key of affected) recordFailure(failed, key, describe$1(error));
+	}
+	if (failed.size > 0) {
+		const named = [...failed.entries()].slice(0, MAX_NAMED_FAILURES).map(([key, reasons]) => `${key} (${reasons.join("; ")})`);
+		const elided = failed.size - named.length;
+		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${bucket}. Their previous versions survive and remain readable via GetObject with a VersionId (${options.objectDescription ?? DEFAULT_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
+	}
+}
+/**
+* Paginate `ListObjectVersions` under one prefix and delete every returned
+* entry that is in `wanted` and is not the current version.
+*
+* Throws only when the LISTING fails; per-key delete failures are recorded in
+* `failed` and do not stop the walk.
+*
+* Safe on an UNVERSIONED bucket: S3 answers there with the single live object
+* carrying `VersionId: 'null'` and `IsLatest: true`, which the `IsLatest`
+* filter drops — so nothing is deleted and nothing throws. A `'null'` version
+* id is NOT filtered out on its own, because a bucket whose versioning was
+* SUSPENDED can carry a genuine noncurrent `'null'` version holding the body.
+*/
+async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown) {
+	let keyMarker;
+	let versionIdMarker;
+	do {
+		const resp = await s3Client.send(new ListObjectVersionsCommand({
+			Bucket: bucket,
+			...requestFields,
+			Prefix: prefix,
+			...keyMarker !== void 0 && { KeyMarker: keyMarker },
+			...versionIdMarker !== void 0 && { VersionIdMarker: versionIdMarker }
+		}));
+		const stale = [];
+		for (const entry of [...resp.Versions ?? [], ...resp.DeleteMarkers ?? []]) {
+			if (entry.Key === void 0 || !wanted.has(entry.Key)) continue;
+			if (entry.IsLatest === void 0) recordFailure(failed, entry.Key, `version ${entry.VersionId ?? "<unknown>"}: listing omitted IsLatest, so the entry was left alone rather than risk deleting a current version`);
+			if (entry.IsLatest !== false) continue;
+			if (!entry.VersionId) continue;
+			stale.push({
+				Key: entry.Key,
+				VersionId: entry.VersionId
+			});
+		}
+		for (let i = 0; i < stale.length; i += DELETE_BATCH_SIZE) {
+			const batch = stale.slice(i, i + DELETE_BATCH_SIZE);
+			try {
+				const deleted = await s3Client.send(new DeleteObjectsCommand({
+					Bucket: bucket,
+					...requestFields,
+					Delete: {
+						Objects: batch,
+						Quiet: true
+					}
+				}));
+				for (const err of deleted.Errors ?? []) {
+					const reason = `version ${err.VersionId ?? "<unknown>"}: ${err.Code ?? "Error"}` + (err.Message ? ` - ${err.Message}` : "");
+					if (err.Key !== void 0) recordFailure(failed, err.Key, reason);
+					else {
+						unknown.n += 1;
+						recordFailure(failed, `${UNKNOWN_KEY_PREFIX}${unknown.n}>`, reason);
+					}
+				}
+			} catch (error) {
+				for (const object of batch) recordFailure(failed, object.Key, describe$1(error));
+			}
+		}
+		if (resp.IsTruncated === true && resp.NextKeyMarker === void 0) {
+			for (const key of wanted) if (key.startsWith(prefix)) recordFailure(failed, key, TRUNCATED_NO_MARKER);
+		}
+		keyMarker = resp.IsTruncated === true ? resp.NextKeyMarker : void 0;
+		versionIdMarker = keyMarker !== void 0 ? resp.NextVersionIdMarker : void 0;
+	} while (keyMarker !== void 0);
+}
+
 //#endregion
 //#region src/cli/upload-cfn-template.ts
 /**
@@ -3900,8 +4062,9 @@ const MIGRATE_TMP_PREFIX = "cdkd-migrate-tmp";
 /**
 * Upload a CFn template body to the cdkd state bucket and return both a
 * virtual-hosted-style HTTPS URL CloudFormation can fetch via
-* `TemplateURL` and a `cleanup` callback that deletes the object (and
-* destroys the S3 client).
+* `TemplateURL` and a `cleanup` callback that deletes the object, PURGES its
+* noncurrent versions (the state bucket is versioned — see the callback), and
+* destroys the S3 client.
 *
 * The state bucket's actual region is resolved via `GetBucketLocation`
 * (cached per-process) so the upload client and the URL match the
@@ -3953,7 +4116,17 @@ async function uploadCfnTemplate(args) {
 				...await expectedOwnerParam(s3)
 			}));
 		} finally {
-			s3.destroy();
+			try {
+				await purgeNoncurrentKeyVersions(s3, bucket, [key], {
+					requestFields: await expectedOwnerParam(s3),
+					logger: getLogger(),
+					objectDescription: "the transient CloudFormation template body uploaded for this command"
+				});
+			} catch (purgeError) {
+				getLogger().warn(`Could not purge noncurrent versions of the transient template s3://${bucket}/${key}; its previous versions survive and remain readable via GetObject with a VersionId. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${purgeError instanceof Error ? purgeError.message : String(purgeError)}`);
+			} finally {
+				s3.destroy();
+			}
 		}
 	};
 	return {
@@ -7600,145 +7773,6 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	return replacement;
 }
 
-//#endregion
-//#region src/state/s3-noncurrent-version-purge.ts
-/**
-* `DeleteObjects` is capped at 1000 entries per call.
-*
-* DEFENCE IN DEPTH, and unreachable today: `stale` is accumulated from a
-* SINGLE `ListObjectVersions` page, whose `Versions` + `DeleteMarkers` are
-* capped at 1000 COMBINED by `MaxKeys`, so the chunking below never takes its
-* second iteration. It is kept because the invariant it guards ("never hand
-* DeleteObjects more than 1000") is one a future change accumulating across
-* pages would silently break.
-*
-* Mutation coverage of this constant is ASYMMETRIC, which is worth stating
-* because the obvious summary is wrong in one direction: RAISING it is green
-* (nothing ever reaches the second chunk, so a bigger ceiling changes
-* nothing), while LOWERING it to 500 is RED — the multi-page fixture's
-* thousand-entry pages then split and the asserted batch shape changes. So the
-* value is fenced from below and not from above.
-*/
-const DELETE_BATCH_SIZE = 1e3;
-/** How many failing keys the warning names before it truncates. */
-const MAX_NAMED_FAILURES = 5;
-/**
-* Label for a `DeleteObjects` error entry that carries no `Key`.
-*
-* S3 always populates it in practice; the point is that an unnameable failure
-* must still COUNT, because the alternative measured here was `failed.size`
-* reaching 0 and the whole warning disappearing.
-*
-* Each keyless entry gets its OWN slot (`<unknown key #1>`, `#2`, ...) rather
-* than sharing one. Collapsing them was defended as "the honest reading", but
-* it is honest about NAMING and not about COUNTING: N keyless failures then
-* reported `1 key(s)`, which is the same prefixes-not-keys under-count this
-* change was raised to fix, arriving through the branch that fixed it. One
-* slot per failure can over-count if S3 ever returns two entries for one
-* object, which is the direction that errs toward reporting too much.
-*
-* The slot name is SYNTHETIC and its uniqueness is not enforced: a real key
-* literally called `<unknown key #1>` would merge with the first keyless
-* entry and under-count by one. Unreachable here — every caller passes
-* `custom-resource-responses/<requestId>.json` — and stated rather than left
-* implied, because "the name cannot collide" is the kind of unstated
-* invariant this module exists to stop asserting.
-*/
-const UNKNOWN_KEY_PREFIX = "<unknown key #";
-/** Reason recorded when a page says it is truncated but names no next key. */
-const TRUNCATED_NO_MARKER = "listing reported IsTruncated with no NextKeyMarker; the walk stopped early and versions may remain";
-/** Record a per-key failure reason without losing an earlier one. */
-function recordFailure(failed, key, reason) {
-	const existing = failed.get(key);
-	if (existing) existing.push(reason);
-	else failed.set(key, [reason]);
-}
-const describe$1 = (error) => error instanceof Error ? error.message : String(error);
-async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {}) {
-	if (keys.length === 0) return;
-	const logger = options.logger ?? getLogger().child("s3-version-purge");
-	const requestFields = options.requestFields ?? {};
-	const wanted = new Set(keys);
-	const prefixes = options.listPrefix !== void 0 ? [options.listPrefix] : keys;
-	const failed = /* @__PURE__ */ new Map();
-	const unknown = { n: 0 };
-	for (const prefix of prefixes) try {
-		await purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown);
-	} catch (error) {
-		const affected = options.listPrefix !== void 0 ? keys : [prefix];
-		for (const key of affected) recordFailure(failed, key, describe$1(error));
-	}
-	if (failed.size > 0) {
-		const named = [...failed.entries()].slice(0, MAX_NAMED_FAILURES).map(([key, reasons]) => `${key} (${reasons.join("; ")})`);
-		const elided = failed.size - named.length;
-		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${bucket}. Their previous versions survive and remain readable via GetObject with a VersionId (for a custom-resource response object that is the handler's full response body, including \`Data\`). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
-	}
-}
-/**
-* Paginate `ListObjectVersions` under one prefix and delete every returned
-* entry that is in `wanted` and is not the current version.
-*
-* Throws only when the LISTING fails; per-key delete failures are recorded in
-* `failed` and do not stop the walk.
-*
-* Safe on an UNVERSIONED bucket: S3 answers there with the single live object
-* carrying `VersionId: 'null'` and `IsLatest: true`, which the `IsLatest`
-* filter drops — so nothing is deleted and nothing throws. A `'null'` version
-* id is NOT filtered out on its own, because a bucket whose versioning was
-* SUSPENDED can carry a genuine noncurrent `'null'` version holding the body.
-*/
-async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown) {
-	let keyMarker;
-	let versionIdMarker;
-	do {
-		const resp = await s3Client.send(new ListObjectVersionsCommand({
-			Bucket: bucket,
-			...requestFields,
-			Prefix: prefix,
-			...keyMarker !== void 0 && { KeyMarker: keyMarker },
-			...versionIdMarker !== void 0 && { VersionIdMarker: versionIdMarker }
-		}));
-		const stale = [];
-		for (const entry of [...resp.Versions ?? [], ...resp.DeleteMarkers ?? []]) {
-			if (entry.Key === void 0 || !wanted.has(entry.Key)) continue;
-			if (entry.IsLatest !== false) continue;
-			if (!entry.VersionId) continue;
-			stale.push({
-				Key: entry.Key,
-				VersionId: entry.VersionId
-			});
-		}
-		for (let i = 0; i < stale.length; i += DELETE_BATCH_SIZE) {
-			const batch = stale.slice(i, i + DELETE_BATCH_SIZE);
-			try {
-				const deleted = await s3Client.send(new DeleteObjectsCommand({
-					Bucket: bucket,
-					...requestFields,
-					Delete: {
-						Objects: batch,
-						Quiet: true
-					}
-				}));
-				for (const err of deleted.Errors ?? []) {
-					const reason = `version ${err.VersionId ?? "<unknown>"}: ${err.Code ?? "Error"}` + (err.Message ? ` - ${err.Message}` : "");
-					if (err.Key !== void 0) recordFailure(failed, err.Key, reason);
-					else {
-						unknown.n += 1;
-						recordFailure(failed, `${UNKNOWN_KEY_PREFIX}${unknown.n}>`, reason);
-					}
-				}
-			} catch (error) {
-				for (const object of batch) recordFailure(failed, object.Key, describe$1(error));
-			}
-		}
-		if (resp.IsTruncated === true && resp.NextKeyMarker === void 0) {
-			for (const key of wanted) if (key.startsWith(prefix)) recordFailure(failed, key, TRUNCATED_NO_MARKER);
-		}
-		keyMarker = resp.IsTruncated === true ? resp.NextKeyMarker : void 0;
-		versionIdMarker = keyMarker !== void 0 ? resp.NextVersionIdMarker : void 0;
-	} while (keyMarker !== void 0);
-}
-
 //#endregion
 //#region src/state/s3-state-backend.ts
 /**
@@ -8060,7 +8094,6 @@ var S3StateBackend = class {
 				}));
 				this.logger.debug(`Deleted legacy state for stack: ${stackName}`);
 			}
-			await this.deleteRollbackJournal(stackName, region);
 			this.logger.debug(`State deleted: ${stackName} (${region})`);
 		} catch (error) {
 			const normalized = normalizeAwsError(error, {
@@ -8068,6 +8101,8 @@ var S3StateBackend = class {
 				operation: "DeleteObject"
 			});
 			throw new StateError(`Failed to delete state for stack '${stackName}' (${region}): ${normalized.message}`, normalized);
+		} finally {
+			await this.deleteRollbackJournal(stackName, region);
 		}
 	}
 	/**
@@ -8314,7 +8349,8 @@ var S3StateBackend = class {
 				logger: this.logger
 			});
 		} catch (error) {
-			this.logger.warn(`Could not purge noncurrent versions of ${keys.length} key(s) in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+			const describing = options.objectDescription ? ` (${options.objectDescription})` : "";
+			this.logger.warn(`Could not purge noncurrent versions of ${keys.length} key(s) in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
 		}
 	}
 	/**
@@ -8387,19 +8423,48 @@ var S3StateBackend = class {
 	* Delete the stack's rollback journal object (idempotent). Called on the
 	* deploy success path, after a clean rollback, and via {@link deleteState}
 	* so `cdkd destroy` / `cdkd state destroy` sweep it too.
+	*
+	* TWO steps, and the second is not housekeeping (issue
+	* [#2346](https://github.com/go-to-k/cdkd/issues/2346) site 4). `cdkd
+	* bootstrap` turns VERSIONING ON for the state bucket, so the
+	* `DeleteObject` above only writes a DELETE MARKER and leaves every prior
+	* version of the journal readable through `GetObject` with a `VersionId`.
+	* The journal's `failedOperations[].attemptedProperties` is the PROPERTIES
+	* OF THE FAILED WRITE, verbatim — measured 2026-08-20 on
+	* `CdkdDeletionPolicySnapshotHeavyExample` as four surviving versions each
+	* carrying a literal `"MasterUserPassword": "Cdkdcf2f..."` after cdkd
+	* reported the state deleted (recorded in the `s3_stack_prefix` comment of
+	* `tests/integration/s3-versions.sh`, ~line 270). A
+	* delete-only cleanup therefore reports success while the credential stays
+	* retrievable by anyone holding `s3:GetObjectVersion`.
+	*
+	* Unlike `state.json` — whose noncurrent versions ARE the state-recovery
+	* capability versioning is enabled FOR, which is why {@link deleteState}
+	* deliberately does NOT purge — the journal is TRANSIENT by design: it
+	* exists only between a failed / interrupted deploy and its `cdkd
+	* rollback`. There is no recovery capability to weigh against the purge.
+	*
+	* The purge runs UNCONDITIONALLY, including on the arm where the delete
+	* failed. `purgeNoncurrentKeyVersions` filters on `IsLatest`, so a key
+	* whose delete failed keeps its current version intact and only its history
+	* goes — the worst case is that the object survives while its old bodies do
+	* not, which is the safe direction. Skipping the purge when the delete
+	* threw would leave every readable version behind with no warning at all,
+	* the same partial-failure gap `cdkd gc` closed with its `finally`.
 	*/
 	async deleteRollbackJournal(stackName, region) {
 		await this.ensureClientForBucket();
+		const key = this.getRollbackJournalKey(stackName, region);
 		try {
 			await this.s3Client.send(new DeleteObjectCommand({
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
-				Key: this.getRollbackJournalKey(stackName, region)
+				Key: key
 			}));
 		} catch (error) {
-			if (isNoSuchKey(error) || error.name === "NotFound") return;
-			this.logger.warn(`Failed to delete rollback journal for '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`);
+			if (!isNoSuchKey(error) && error.name !== "NotFound") this.logger.warn(`Failed to delete rollback journal for '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`);
 		}
+		await this.purgeNoncurrentVersions([key], { objectDescription: "the rollback journal, whose `failedOperations[].attemptedProperties` records the properties of the failed write verbatim" });
 	}
 	/**
 	* HeadObject probe — returns true on 200, false on NotFound. Other errors
@@ -14907,8 +14972,10 @@ function describe(value) {
 //#region src/provisioning/region-check.ts
 /**
 * Verify that the AWS client's region matches the region the resource is
-* expected to live in before treating a `NotFound` error as idempotent
-* delete success.
+* expected to live in — before treating a `NotFound` error as idempotent
+* delete success (`phase: 'not-found'`), or before issuing a mutating call
+* against a state-recorded physical id at all (`'pre-delete'` /
+* `'pre-update'`, issue #2301).
 *
 * Why: a destroy run with the wrong region would otherwise receive
 * `*NotFound` for every resource and silently strip them all from state,
@@ -14917,13 +14984,24 @@ function describe(value) {
 * `us-west-2` removed from state by a destroy that ran with a `us-east-1`
 * client.
 *
-* Behavior:
+* And a `NotFound` is not the only way that ends badly, which is what the
+* pre-flight phases add: many physical ids are names rather than ARNs, so the
+* same name usually EXISTS in the client's region too (the same stack deployed
+* twice, or cdkd's own `resource-name.ts` deriving an identical name from an
+* identical stack + logical id). Then the wrong-region call never errors — it
+* succeeds against the wrong resource. That path is unrecoverable on delete
+* and a misapplied configuration on update, and neither ever reaches the
+* `NotFound` branch this helper originally lived on.
+*
+* Behavior (identical in every phase):
 * - If `expectedRegion` is unset, this is a no-op (back-compat: existing
 *   idempotent semantics preserved for callers that have not been
-*   threaded with state region).
+*   threaded with state region). An EMPTY string counts as unset — a caller
+*   typed `region: string` can hand one over, and refusing on it would make
+*   this guard reject its own default.
 * - If `clientRegion` matches `expectedRegion`, returns silently.
 * - Otherwise throws `ProvisioningError` so the caller surfaces the
-*   mismatch instead of swallowing the NotFound.
+*   mismatch instead of swallowing the NotFound / issuing the call.
 *
 * @param clientRegion Region resolved from the AWS SDK client config
 *   (typically `await client.config.region()`).
@@ -14933,13 +15011,27 @@ function describe(value) {
 *   message and on the thrown ProvisioningError.
 * @param logicalId Logical ID of the resource, used in the error message
 *   and on the thrown ProvisioningError.
-* @param physicalId Optional physical ID, used in the error message and
-*   on the thrown ProvisioningError.
+* @param physicalId Optional physical ID, carried on the thrown
+*   ProvisioningError.
+* @param phase Which call is being guarded — see {@link RegionCheckPhase}.
+*   Defaults to the historical `'not-found'` so every pre-#2301 call site
+*   keeps its exact wording.
 */
-function assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, physicalId) {
+function assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, physicalId, phase = "not-found") {
 	if (!expectedRegion) return;
-	if (!clientRegion) throw new ProvisioningError(`Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region is unknown but stack state expects ${expectedRegion}. The resource may exist in ${expectedRegion} and would be silently removed from state if this NotFound were trusted.`, resourceType, logicalId, physicalId);
-	if (clientRegion !== expectedRegion) throw new ProvisioningError(`Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region ${clientRegion} does not match stack state region ${expectedRegion}. The resource likely still exists in ${expectedRegion}; rerun the destroy with the correct region (e.g. --region ${expectedRegion}).`, resourceType, logicalId, physicalId);
+	if (!clientRegion) throw new ProvisioningError(phase === "not-found" ? `Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region is unknown but stack state expects ${expectedRegion}. The resource may exist in ${expectedRegion} and would be silently removed from state if this NotFound were trusted.` : `Refusing to ${phaseVerb(phase)} ${logicalId} (${resourceType}): AWS client region is unknown but stack state records the resource in ${expectedRegion}. cdkd cannot confirm that the physical id recorded in state names the resource this client would act on, so the ${phaseVerb(phase)} is not issued. Point the AWS client at ${expectedRegion} (AWS_REGION or your AWS profile) and re-run.`, resourceType, logicalId, physicalId);
+	if (clientRegion !== expectedRegion) throw new ProvisioningError(phase === "not-found" ? `Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region ${clientRegion} does not match stack state region ${expectedRegion}. The resource likely still exists in ${expectedRegion}; rerun the destroy with the correct region (e.g. --region ${expectedRegion}).` : `Refusing to ${phaseVerb(phase)} ${logicalId} (${resourceType}): AWS client region ${clientRegion} does not match stack state region ${expectedRegion}. The physical id recorded in cdkd state names a resource in ${expectedRegion}, so this ${phaseVerb(phase)} would act on whatever carries that id in ${clientRegion} instead — which for a name-shaped physical id is a different resource that usually exists. Point the AWS client at ${expectedRegion} (AWS_REGION or your AWS profile) and re-run; when the run spans several regions at once (cdkd drift --all), select the stacks in one region per run, because no single client region is correct for all of them. If the recorded region is the wrong one, correct the state record (cdkd state show).`, resourceType, logicalId, physicalId);
+}
+/**
+* The operation a pre-flight phase is about to issue, for the message.
+*
+* `'not-found'` is EXCLUDED from the parameter type rather than mapped to a
+* verb: both call sites already sit in the `else` of a
+* `phase === 'not-found' ? ... : ...`, so an arm answering for it would be
+* unreachable, and an unreachable arm is a claim no test can hold to account.
+*/
+function phaseVerb(phase) {
+	return phase === "pre-update" ? "update" : "delete";
 }
 
 //#endregion
@@ -20413,8 +20505,9 @@ var CloudControlProvider = class {
 	/**
 	* Update a resource using Cloud Control API
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
+		await this.assertRecordedRegionAgainstClient("pre-update", context?.expectedRegion, resourceType, logicalId, physicalId);
 		try {
 			const cleanPreviousProperties = stringifyJsonProperties(resourceType, stripNullValues(previousProperties));
 			const cleanProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
@@ -20473,10 +20566,11 @@ var CloudControlProvider = class {
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
+		await this.assertRecordedRegionAgainstClient("pre-delete", context?.expectedRegion, resourceType, logicalId, physicalId);
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BoJz-x3Q.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BeELAzdu.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -20499,7 +20593,7 @@ var CloudControlProvider = class {
 		} catch (error) {
 			const err = error;
 			if (error instanceof CloudControlOperationFailedError && error.ccOperation === "DELETE" && error.ccErrorCode === "NotFound" || err.name === "ResourceNotFoundException" || err.message?.includes("does not exist") || err.message?.includes("not found") || err.message?.includes("NotFound")) {
-				assertRegionMatch(await this.cloudControlClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				await this.assertRecordedRegionAgainstClient("not-found", context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Resource ${logicalId} already deleted (not found), treating as success`);
 				return;
 			}
@@ -20513,15 +20607,77 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
+	* Refuse a Cloud Control call whose target region cannot be shown to be the
+	* one the state record was written in (issue #2301).
+	*
+	* The ONE place this comparison happens, for all three phases: the
+	* pre-flights at the top of `delete()` and `update()`, and the reactive
+	* `not-found` arm inside `delete()`'s catch block. They can therefore never
+	* disagree about what "unknown region" means, nor about how a region is
+	* SPELLED -- the second one was live before this became shared: the reactive
+	* arm compared raw while the pre-flight folded case, so one correct call
+	* could pass the first and be refused by the second. THREE inputs, THREE outcomes, and they are
+	* deliberately not two:
+	*
+	*  - NO recorded region (`undefined`, or an empty / whitespace-only string)
+	*    -> PROCEED, and do not even resolve the client region. This is the
+	*    guard's OWN default: a `version: 1` state record predates the
+	*    region-scoped key layout and carries no region at all, and callers
+	*    typed `region: string` (`deploy-engine.ts`'s `stackRegion`) can hand
+	*    over `''`. Refusing on the absence would break every ordinary
+	*    destroy / update of a pre-v2 record, which is the over-tightening
+	*    failure a one-directional fence never sees.
+	*  - A recorded region that MATCHES the client -> proceed silently. This is
+	*    the ordinary path and it must stay free of new refusals: the whole
+	*    fleet of same-region deletes and updates runs through here.
+	*  - A recorded region that DIFFERS, or a client region that cannot be
+	*    resolved at all -> REFUSE before issuing anything.
+	*
+	* The unresolvable-client-region arm is the one asymmetry worth naming:
+	* {@link CloudControlProvider.confirmDeleteTargetIdentity} PROCEEDS when it
+	* cannot establish a region, and this helper refuses. The two are answering
+	* different questions. That probe asks a remote service where a globally
+	* unique NAME lives, and a least-privilege role that was never granted
+	* `s3:GetBucketLocation` would be stranded by a refusal. Here the caller has
+	* positively recorded a region, the comparison is local and free, and a
+	* client that cannot say where it points cannot be shown to point at that
+	* region -- the same answer `assertRegionMatch` has always given on its
+	* `not-found` phase.
+	*
+	* The refusal is marked non-retryable because it is deterministic: both
+	* loops that wrap these calls -- the destroy runner's own attempt loop and
+	* the deploy engine's / rollback executor's `withRetry` -- would otherwise
+	* spend their full budget re-deriving the same verdict, which reads to a
+	* user as flaky AWS rather than as a refusal.
+	*/
+	async assertRecordedRegionAgainstClient(phase, expectedRegion, resourceType, logicalId, physicalId) {
+		const recordedRegion = canonicalizeRegion(expectedRegion?.trim());
+		if (recordedRegion === void 0 || recordedRegion === "") return;
+		let clientRegion;
+		try {
+			clientRegion = canonicalizeRegion((await this.cloudControlClient.config.region())?.trim());
+		} catch (error) {
+			this.logger.debug(`Could not resolve the Cloud Control client region before the ${phase} region check for ${logicalId} (${resourceType}): ${error instanceof Error ? error.message : String(error)}`);
+			clientRegion = void 0;
+		}
+		try {
+			assertRegionMatch(clientRegion, recordedRegion, resourceType, logicalId, physicalId, phase);
+		} catch (error) {
+			throw markNonRetryable(error);
+		}
+	}
+	/**
 	* Confirm that the resource `physicalId` names actually lives in the region
 	* this destroy is targeting, for the types in
 	* {@link CC_DELETE_IDENTITY_CHECKED_TYPES}. No-op for every other type.
 	*
 	* WHAT THIS GUARDS THAT `assertRegionMatch` DOES NOT
 	* ---------------------------------------------------
-	* The existing `assertRegionMatch` in the catch block below compares the
-	* CLIENT's region against the state's region, and only on the `NotFound`
-	* branch. Both halves miss this hazard. An `AWS::S3::Bucket` physical id is
+	* The `assertRegionMatch` comparison — which since issue #2301 runs both as
+	* an unconditional pre-flight and on the `NotFound` arm below — compares the
+	* CLIENT's region against the STATE's. That misses this hazard however often
+	* it runs: both of its inputs can agree while the bucket the physical id
+	* names sits somewhere else entirely. An `AWS::S3::Bucket` physical id is
 	* a GLOBALLY unique name, so a state record written before the issue #2227 /
 	* #2245 guards existed can name a bucket that is ours but lives elsewhere --
 	* a cdkd-GENERATED bucket name carries no region or account: for a name cdkd
@@ -23388,7 +23544,10 @@ var CustomResourceProvider = class CustomResourceProvider {
 		} catch (error) {
 			this.logger.debug(`Failed to delete custom-resource response object s3://${bucket}/${responseKey}; it remains as a current object. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
 		}
-		await purgeNoncurrentKeyVersions(this.s3Client, bucket, [responseKey], { logger: this.logger });
+		await purgeNoncurrentKeyVersions(this.s3Client, bucket, [responseKey], {
+			logger: this.logger,
+			objectDescription: CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION
+		});
 	}
 	/**
 	* Convert property values to strings for CloudFormation compatibility
@@ -29430,7 +29589,10 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					op.resourceType,
 					desiredProps ?? {},
 					currentProps ?? {},
-					{ maskSecrets: createSecretMasker(secrets) }
+					{
+						maskSecrets: createSecretMasker(secrets),
+						expectedRegion: ctx.region
+					}
 				], op.logicalId, logger, isInterrupted, secrets);
 				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
 				const rollbackPartial = updatePartialReason(revertResult);
@@ -29583,7 +29745,10 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						op.resourceType,
 						desiredProps ?? {},
 						attemptedProps ?? {},
-						{ maskSecrets: createSecretMasker(secrets) }
+						{
+							maskSecrets: createSecretMasker(secrets),
+							expectedRegion: ctx.region
+						}
 					], op.logicalId, logger, options.isInterrupted, secrets);
 					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
@@ -31889,7 +32054,10 @@ var DeployEngine = class {
 					let result;
 					let resultProvisionedBy = updateDecision.provisionedBy;
 					try {
-						result = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, updateProvider);
+						result = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps, {
+							maskSecrets: createSecretMasker(updateSecrets),
+							expectedRegion: this.stackRegion
+						})), logicalId, void 0, void 0, updateProvider);
 					} catch (updateError) {
 						const msg = updateError instanceof Error ? updateError.message : String(updateError);
 						const ccUnsupported = msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE");
@@ -31982,7 +32150,7 @@ var DeployEngine = class {
 					}), logicalId, 3, 5e3, deleteProvider);
 				} catch (deleteError) {
 					const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-					if (!isInterruptedWaitError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
+					if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
 					else throw deleteError;
 				}
 				const deleteSkipped = deleteSkipReason(deleteResult);
@@ -32390,5 +32558,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, ProvisioningError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, withErrorHandling as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, LocalInvokeBuildError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, MissingCdkCliError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LockError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StateError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, markRedactedCause as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isRetryableTransientError as Hr, withRetry as Ht, red as I, runDockerForeground as In, SynthesisError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, retryClassificationText as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, formatError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceUpdateNotSupportedError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, StackHasActiveImportsError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, NestedStackChildDirectDestroyError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackTerminationProtectionError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, isCdkdError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DynamicReferenceRegionAmbiguousError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalStartServiceError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isThrottlingError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, isMarkedNonRetryable as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, markNonRetryable as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, CdkdError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, PARTITION_TABLE as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, DependencyError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, AssemblyReader as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, resolveBucketRegion as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, AwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, AssetError as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, setAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, expectedOwnerParam as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ResourceTimeoutError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, PartialFailureError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, processStackMessages as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, resetAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, canonicalizeRegion as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, getAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, __exportAll as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, derivePartitionAndUrlSuffix as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, clearBucketRegionCache as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, ConfigError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalMigrateError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DeployCancelledError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, CrossAccountSecretRefusalError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, normalizeAwsError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-Dh4Jid_H.js.map
+export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, PartialFailureError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, normalizeAwsError as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, DynamicReferenceRegionAmbiguousError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, LockError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LocalStartServiceError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StackTerminationProtectionError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, markNonRetryable as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isMarkedNonRetryable as Hr, withRetry as Ht, red as I, runDockerForeground as In, StateError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, __exportAll as Jr, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, markRedactedCause as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, SynthesisError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceTimeoutError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, ResourceUpdateNotSupportedError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, MissingCdkCliError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackHasActiveImportsError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, formatError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DeployCancelledError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalMigrateError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isRetryableTransientError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, withErrorHandling as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, isThrottlingError as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, AssetError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, expectedOwnerParam as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, CrossAccountSecretRefusalError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, derivePartitionAndUrlSuffix as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, clearBucketRegionCache as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, resolveBucketRegion as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, setAwsClients as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, resetAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ProvisioningError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, NestedStackChildDirectDestroyError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, AssemblyReader as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, getAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, PARTITION_TABLE as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, AwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, retryClassificationText as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, canonicalizeRegion as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, processStackMessages as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, CdkdError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalInvokeBuildError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DependencyError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, ConfigError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, isCdkdError as zr, DiffCalculator as zt };
+//# sourceMappingURL=deploy-engine-Du2CDZop.js.map