@go-to-k/cdkd 0.285.14 → 0.285.16

package/dist/{deploy-engine-CA50haPO.js → deploy-engine-DuFUy9D0.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DP5kGlzj.js";
+import { t as getCdkdVersion } from "./version-C_ZRHikq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7927,6 +7927,140 @@ function parseRollbackJournal(bodyString, stackName) {
 	};
 }
 
+//#endregion
+//#region src/state/state-prefix.ts
+/**
+* The default S3 key prefix for cdkd state.
+*
+* Homed in the STATE layer rather than in `src/cli/commands/state-file-keys.ts`
+* (which re-exports it, so its four existing importers are unchanged) because
+* `src/state/lock-contention-message.ts` needs it to decide whether a recovery
+* hint should spell `--state-prefix` at all, and a `src/state/**` module
+* importing from `src/cli/commands/**` inverts the layering — the CLI sits
+* ABOVE the state layer in the 7-layer architecture, not below it.
+*
+* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
+* whole-bucket listings deliberately do not scope to it.
+*/
+const DEFAULT_STATE_PREFIX = "cdkd";
+/**
+* The state-bucket prefix `CustomResourceProvider` PUTs its response
+* placeholders under, one object per invocation
+* (`custom-resource-responses/{requestId}.json`).
+*
+* Homed here for the same layering reason as {@link DEFAULT_STATE_PREFIX}: the
+* PRODUCER is `src/provisioning/providers/custom-resource-provider.ts` and the
+* COLLECTOR is `src/cli/commands/gc.ts`, so a copy in either would be a copy
+* the other could drift from — and the two spellings would then disagree about
+* which objects exist, which is the only way a sweeper can miss the family it
+* was written for (issue #2052). `src/cli/commands/state-file-keys.ts`
+* re-exports it so gc reads it alongside the other state-key constants.
+*
+* Note this is only the DEFAULT: `ProviderRegistry` can be configured with a
+* different `responsePrefix`, so a sweep scoped to this value is a sweep of the
+* default layout. gc has no access to a non-default one — nothing persists it —
+* which is stated at the sweep's own call site rather than implied here.
+*/
+const CUSTOM_RESOURCE_RESPONSE_PREFIX = "custom-resource-responses";
+
+//#endregion
+//#region src/state/lock-contention-message.ts
+/**
+* The message every fail-fast lock-contention site raises.
+*
+* Issue #2161 made six commands throw on `acquireLock` returning `false`
+* instead of running under a foreign lock. Issue #2170 is the follow-up: the
+* message those sites raise asked the user to decide "is another process
+* active?" while printing none of the evidence that would answer it, and the
+* recovery command it suggested could resolve against the wrong AWS account.
+*
+* Both matter more than they look, because of WHICH locks reach this message.
+* `LockManager.acquireLock` reaps an EXPIRED foreign lock and retries, so a
+* `false` return means the lock is LIVE — in practice a running `cdkd deploy`.
+* The user who follows a bare `cdkd force-unlock <stack>` suggestion therefore
+* deletes a live owner's lock and reproduces issue #2161's harm by hand, which
+* is the outcome #2161 exists to prevent.
+*
+* Centralising the text here also settles the third finding: the nine sites
+* had drifted to three spellings (`for stack` / `for nested stack` /
+* `for nested-stack child`), so a user grepping CI logs for one of them found
+* two of three. `subject` now varies only the noun.
+*/
+/**
+* Stand-in for a value with nothing renderable left after sanitization. Named
+* rather than inlined so the message and the command-suppression branch cannot
+* disagree about what "unrenderable" looks like.
+*/
+const UNRENDERABLE = "<unrenderable>";
+/** Render `expiresIn` without implying more precision than a clock skew allows. */
+function formatRemaining(ms) {
+	if (!Number.isFinite(ms)) return "at an unknown time";
+	if (ms <= 0) return "already expired";
+	const minutes = Math.round(ms / 6e4);
+	if (minutes < 1) return "in under a minute";
+	return `in ~${minutes}m`;
+}
+function shellQuote(value) {
+	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* The `cdkd force-unlock ...` line, carrying every flag that decides which
+* lock object it resolves to.
+*/
+function buildForceUnlockCommand(stackName, region, recovery) {
+	const safeStack = displaySafe(stackName, { asciiOnly: true });
+	const stackIsExact = safeStack === stackName;
+	const safeRegion = region === void 0 ? void 0 : displaySafe(region, { asciiOnly: true });
+	if (!safeStack || safeRegion === "" || !stackIsExact || !(region === void 0 || safeRegion === region)) return "";
+	const parts = [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`];
+	if (recovery?.profile) parts.push(`--profile ${shellQuote(recovery.profile)}`);
+	if (recovery?.stateBucket) parts.push(`--state-bucket ${shellQuote(recovery.stateBucket)}`);
+	if (recovery?.statePrefix && recovery.statePrefix !== "cdkd") parts.push(`--state-prefix ${shellQuote(recovery.statePrefix)}`);
+	return parts.join(" ");
+}
+/**
+* The force-quit banner's recovery sentence.
+*
+* Exported so the two `destroy-runner.ts` banners do not each decide what to
+* say when {@link buildForceUnlockCommand} suppresses — a banner ending in a
+* bare `run: ` is the shape the review found, and two copies of the branch is
+* how the next one drifts. Returns a leading-space clause so the caller can
+* concatenate it unconditionally.
+*/
+function forceQuitRecoveryClause(stackName, region, recovery) {
+	const command = buildForceUnlockCommand(stackName, region, recovery);
+	return command ? ` If the next run reports a lock, run: ${command}` : " Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+}
+/**
+* Build the contention message, reading the holder's identity best-effort.
+*
+* The `getLockInfo` read is one GetObject and is deliberately NOT allowed to
+* fail the command: the caller is already on its way to throwing, and turning
+* a contention refusal into an S3 error would lose the reason. A failed or
+* absent read degrades to the evidence-free wording rather than to a crash.
+*/
+async function buildLockContentionMessage(args) {
+	const { lockManager, stackName, region, subject = "stack", recovery, heldClause, suffix } = args;
+	let held = heldClause ?? "another cdkd process holds it";
+	let sawHolder = false;
+	try {
+		const info = await lockManager.getLockInfo(stackName, region);
+		if (info) {
+			const operation = info.operation ? `, operation: ${displaySafe(info.operation)}` : "";
+			const expires = formatRemaining(info.expiresAt - Date.now());
+			const owner = displaySafe(info.owner);
+			const holder = owner ? `held by ${owner}${operation}` : `held by an unnamed holder`;
+			held = `${heldClause ? `${heldClause} — ` : ""}${holder}, expires ${expires}`;
+			if (owner) sawHolder = true;
+		}
+	} catch {}
+	const advice = sawHolder ? `That process is still running — wait for it to finish. Only if you are certain it is gone` : `Wait for it to finish, or if you are certain no other process is active`;
+	const recoveryCommand = buildForceUnlockCommand(stackName, region, recovery);
+	const head = `Could not acquire lock for ${subject} '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) — ${held}.` + (suffix ? ` ${suffix}` : "");
+	if (!recoveryCommand) return `${head} ${advice}. No recovery command can be shown: the name or region recorded for this lock contains characters that cannot be reproduced safely on a command line, so any command shown here would address a different lock — inspect the lock object directly.`;
+	return `${head} ${advice}, run: ${recoveryCommand}`;
+}
+
 //#endregion
 //#region src/utils/bucket-region-client.ts
 /**
@@ -8013,6 +8147,23 @@ const LEGACY_KEY_DEPTH = 2;
 /** The `version: 2` region-prefixed key. */
 const NEW_KEY_DEPTH = 3;
 /**
+* Does a legacy record classified by {@link LegacyStateProbe} belong to an
+* operation targeting `region`?
+*
+* Free function, and shared by both consumers on purpose: the delete sweep
+* needs the probe's KIND as well as this verdict (to warn when a record may
+* have been left behind), and duplicating the mapping at that call site is
+* how the two would drift apart again.
+*/
+function legacyProbeBelongsTo(probe, region) {
+	switch (probe.kind) {
+		case "region": return probe.region === region;
+		case "no-region": return true;
+		case "absent":
+		case "unreadable": return false;
+	}
+}
+/**
 * S3-based state backend using conditional writes for optimistic locking.
 *
 * State keys are region-scoped (`{prefix}/{stackName}/{region}/state.json`)
@@ -8178,7 +8329,7 @@ var S3StateBackend = class {
 		await this.ensureClientForBucket();
 		const newKey = this.getStateKey(stackName, region);
 		if (await this.headObject(newKey)) return true;
-		return this.legacyMatchesRegion(stackName, region);
+		return this.legacyBelongsToRegion(stackName, region);
 	}
 	/**
 	* Get state for a stack, transparently falling back to the legacy key.
@@ -8310,7 +8461,12 @@ var S3StateBackend = class {
 				...await this.ownerParam(),
 				Key: this.getStateKey(stackName, region)
 			}));
-			if (await this.legacyMatchesRegion(stackName, region)) {
+			const legacyProbe = await this.probeLegacyState(stackName);
+			if (legacyProbe.kind === "unreadable") {
+				const safeName = this.displayName(stackName);
+				this.logger.warn(`Could not read the legacy state record for '${safeName}' while cleaning up (${legacyProbe.reason}). If one exists it was left in place. Re-run with --verbose for the details.`);
+			}
+			if (legacyProbeBelongsTo(legacyProbe, region)) {
 				await this.s3Client.send(new DeleteObjectCommand({
 					Bucket: this.config.bucket,
 					...await this.ownerParam(),
@@ -8330,6 +8486,48 @@ var S3StateBackend = class {
 		}
 	}
 	/**
+	* Delete a legacy state file that names no region (issue #2537).
+	*
+	* `deleteState` cannot serve this case: it takes a region, keys the primary
+	* delete off it, and sweeps the legacy key only when that key's own `region`
+	* field matches. A `version: 1` blob whose body carries no `region` at all
+	* has nothing to match, so it falls through every branch there — which is
+	* how `cdkd state orphan` came to report a removal it never performed.
+	*
+	* Unconditional, and deliberately so — but NOT because the caller's ref
+	* proves the body names no region. `listStacks` derives that ref from
+	* `readLegacyRegion`, which also returns undefined on a swallowed 403 / 503
+	* / unparseable body, so a record that DOES name a region can surface
+	* region-less. The delete is still right there: the caller
+	* (`cdkd state orphan` with no `--stack-region`) means "every record for
+	* this name", and this key is one of them. A caller that means something
+	* narrower must not use this method.
+	*
+	* No rollback-journal sweep: journal keys exist only in the region-scoped
+	* layout (see `getRollbackJournalKey`), so a region-less record can have
+	* none.
+	*/
+	async deleteLegacyState(stackName) {
+		await this.ensureClientForBucket();
+		const key = this.getLegacyStateKey(stackName);
+		try {
+			const safeStack = displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
+			this.logger.debug(`Deleting legacy state: ${safeStack} (${displaySafe(key, { asciiOnly: true }) || "<unrenderable>"})`);
+			await this.s3Client.send(new DeleteObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key
+			}));
+			this.logger.debug(`Legacy state deleted: ${safeStack}`);
+		} catch (error) {
+			const normalized = normalizeAwsError(error, {
+				bucket: this.config.bucket,
+				operation: "DeleteObject"
+			});
+			throw new StateError(`Failed to delete legacy state for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}': ${normalized.message}`, normalized);
+		}
+	}
+	/**
 	* List all stacks with state in the bucket.
 	*
 	* Returns one `{stackName, region}` pair per state file. Both layouts
@@ -8708,29 +8906,85 @@ var S3StateBackend = class {
 		}
 	}
 	/**
-	* Read the legacy state's `region` field. Used for region matching during
-	* `stateExists` / `deleteState` and for assigning a region to legacy
-	* entries during `listStacks`.
+	* Read the legacy key and classify what is there — {@link LegacyStateProbe}
+	* says what each answer means and which consumer acts on it.
 	*/
-	async readLegacyRegion(stackName) {
+	/**
+	* A stack name safe to put in a log line. Names reach this class from S3
+	* key segments, which anyone able to write the bucket controls, so every
+	* message that renders one goes through here (issue #2170's class).
+	*/
+	displayName(stackName) {
+		return displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
+	}
+	async probeLegacyState(stackName) {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
 				Key: this.getLegacyStateKey(stackName)
 			}));
-			if (!response.Body) return void 0;
+			if (!response.Body) {
+				this.logger.debug(`Legacy state probe for '${this.displayName(stackName)}': response carried no body`);
+				return {
+					kind: "unreadable",
+					reason: "the response carried no body"
+				};
+			}
 			const bodyString = await response.Body.transformToString();
-			const state = JSON.parse(bodyString);
-			return typeof state.region === "string" ? state.region : void 0;
+			const raw = JSON.parse(bodyString).region;
+			if (!raw) return { kind: "no-region" };
+			if (typeof raw !== "string") {
+				this.logger.debug(`Legacy state probe for '${this.displayName(stackName)}': 'region' is ${typeof raw}, not a string`);
+				return {
+					kind: "unreadable",
+					reason: `its 'region' field is ${typeof raw}, not a string`
+				};
+			}
+			return {
+				kind: "region",
+				region: raw
+			};
 		} catch (error) {
-			if (isNoSuchKey(error)) return void 0;
-			this.logger.debug(`Could not read legacy state region for '${stackName}': ${error instanceof Error ? error.message : String(error)}`);
-			return;
+			if (isNoSuchKey(error)) return { kind: "absent" };
+			const { detail } = describeAwsFailure(error);
+			this.logger.debug(`Could not read legacy state region for '${this.displayName(stackName)}': ${displaySafe(detail, { asciiOnly: true }) || "<unrenderable>"}`);
+			return {
+				kind: "unreadable",
+				reason: displaySafe(error instanceof Error && error.name ? error.name : "an unknown error", { asciiOnly: true }) || "<unrenderable>"
+			};
 		}
 	}
-	async legacyMatchesRegion(stackName, region) {
-		return await this.readLegacyRegion(stackName) === region;
+	/**
+	* The region a legacy record should be listed under, or `undefined` when it
+	* names none / could not be read. Preserves `listStacks`'s behaviour across
+	* the {@link probeLegacyState} split.
+	*/
+	async readLegacyRegion(stackName) {
+		const probe = await this.probeLegacyState(stackName);
+		return probe.kind === "region" ? probe.region : void 0;
+	}
+	/**
+	* Whether an operation targeting `region` owns the legacy record — the
+	* DELETE-side counterpart of `tryGetLegacy`'s read gate, and issue #2550.
+	*
+	* The two must agree. `tryGetLegacy` accepts a body that names NO region
+	* from any region (`if (state.region && state.region !== region)` is false
+	* when the field is absent), so `cdkd destroy` reads such a record, deletes
+	* the AWS resources, and finishes. The old equality test here answered
+	* `undefined === 'us-east-1'` — false — so the record survived a successful
+	* destroy, kept appearing in `cdkd state list`, and the next deploy of that
+	* name planned updates against resources that were gone.
+	*
+	* `unreadable` is deliberately NOT treated as `no-region`: a 403, a 503 or a
+	* malformed body says nothing about who owns the record, and a read that
+	* failed must never authorise a delete. It collapsed into the same
+	* `undefined` as the other two before, which is why the one-line fix — make
+	* `undefined` match — was wrong: it would also have made `stateExists`
+	* report state for a stack that has none, since `absent` reads the same way.
+	*/
+	async legacyBelongsToRegion(stackName, region) {
+		return legacyProbeBelongsTo(await this.probeLegacyState(stackName), region);
 	}
 	/**
 	* Try to read the legacy `version: 1` state. Returns null when the legacy
@@ -16367,7 +16621,7 @@ function normalizeAwsTagsToCfn(tags) {
 * through `update()` and surface as a hard AWS rejection, so we sanitize
 * the wire-layer payload while keeping the read-side placeholder
 * intact. This is the Class 2 pattern from
-* `docs/provider-development.md § 3b`.
+* `docs/provider-rules.md#readcurrentstate-for-drift-detection`.
 */
 function sanitizeDescription(value) {
 	if (value === void 0 || value === null) return void 0;
@@ -22124,7 +22378,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BvIH9Ivw.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DoP-32eU.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -23309,42 +23563,6 @@ function interruptWatchListenerCount() {
 	return sharedSigintHandler === void 0 ? 0 : 1;
 }
 
-//#endregion
-//#region src/state/state-prefix.ts
-/**
-* The default S3 key prefix for cdkd state.
-*
-* Homed in the STATE layer rather than in `src/cli/commands/state-file-keys.ts`
-* (which re-exports it, so its four existing importers are unchanged) because
-* `src/state/lock-contention-message.ts` needs it to decide whether a recovery
-* hint should spell `--state-prefix` at all, and a `src/state/**` module
-* importing from `src/cli/commands/**` inverts the layering — the CLI sits
-* ABOVE the state layer in the 7-layer architecture, not below it.
-*
-* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
-* whole-bucket listings deliberately do not scope to it.
-*/
-const DEFAULT_STATE_PREFIX = "cdkd";
-/**
-* The state-bucket prefix `CustomResourceProvider` PUTs its response
-* placeholders under, one object per invocation
-* (`custom-resource-responses/{requestId}.json`).
-*
-* Homed here for the same layering reason as {@link DEFAULT_STATE_PREFIX}: the
-* PRODUCER is `src/provisioning/providers/custom-resource-provider.ts` and the
-* COLLECTOR is `src/cli/commands/gc.ts`, so a copy in either would be a copy
-* the other could drift from — and the two spellings would then disagree about
-* which objects exist, which is the only way a sweeper can miss the family it
-* was written for (issue #2052). `src/cli/commands/state-file-keys.ts`
-* re-exports it so gc reads it alongside the other state-key constants.
-*
-* Note this is only the DEFAULT: `ProviderRegistry` can be configured with a
-* different `responsePrefix`, so a sweep scoped to this value is a sweep of the
-* default layout. gc has no access to a non-default one — nothing persists it —
-* which is stated at the sweep's own call site rather than implied here.
-*/
-const CUSTOM_RESOURCE_RESPONSE_PREFIX = "custom-resource-responses";
-
 //#endregion
 //#region src/provisioning/masked-retry-logger.ts
 /**
@@ -27945,7 +28163,7 @@ function isCustomResource(resourceType) {
 * live value on removal. Route every optional mutable field of a
 * merge-semantics API through this helper, with `clearValue` set to the
 * property's CFn default or the SDK-documented clear sentinel — see
-* docs/provider-development.md §2a for the per-field checklist.
+* docs/provider-rules.md#update-removal-semantics-clear-on-removal for the per-field checklist.
 *
 * Returns `newValue` when present, the `clearValue` when the field was
 * present before and is now absent (removal), and `undefined` when it was
@@ -28962,9 +29180,16 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 *
 * To avoid an accidental data-loss footgun, cdkd refuses to recreate
 * any resource whose type is in {@link STATEFUL_TYPES} unless the user
-* ALSO passes `--force-stateful-recreation`. The two-flag protection
-* mirrors `--remove-protection`'s pattern (see
-* `src/cli/commands/destroy-runner.ts`).
+* ALSO passes `--force-stateful-recreation`. On the `--recreate-via-*`
+* and `--replace` opt-ins that is a two-flag protection, mirroring
+* `--remove-protection`'s pattern (see
+* `src/cli/commands/destroy-runner.ts`). It is NOT only that shape any
+* more: the guard also runs on replacement paths a plain `cdkd deploy`
+* reaches with no flag at all (a property-driven replacement, and the
+* update-failure fallback's Cloud Control trigger — issue [#2514]),
+* where `--force-stateful-recreation` is the ONLY flag involved. See
+* {@link isStatefulRecreateTargetForReplace} for the mid-deploy variant
+* those paths use.
 *
 * The list is hand-curated and intentionally **conservative**: every
 * type here carries user data that the AWS service does NOT
@@ -28972,18 +29197,78 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 * AWS service treats as ephemeral (e.g. Lambda Function, IAM Role)
 * are NOT in this list — recreate is cheap.
 *
-* Two entries are **conditionally stateful** — they only count when
-* the resource actually contains data:
+* Two entries carry a CONDITION instead of counting unconditionally.
+* The condition is what the guard evaluates; failing it is not a
+* finding that the resource holds no data (see the LogGroup note):
 *
 *   - `AWS::S3::Bucket`: empty buckets are safe to recreate. The
-*     deploy engine probes `s3:ListObjectsV2` at plan time and only
+*     deploy engine probes `s3:ListObjectVersions` at plan time and only
 *     refuses when the bucket has at least one object.
-*   - `AWS::Logs::LogGroup`: a log group with `RetentionInDays`
-*     undefined or zero is functionally ephemeral. The deploy engine
-*     refuses only when `RetentionInDays > 0`.
+*   - `AWS::Logs::LogGroup`: the deploy engine refuses only when
+*     `RetentionInDays > 0`. NOTE this is a KNOWN GAP, not a statement
+*     that the rest are empty: an unset or zero retention is CloudWatch
+*     Logs' "never expire", the most data-bearing setting there is, and
+*     `LogsLogGroupProvider` writes `0` for precisely that. Issue
+*     [#2558] tracks it; the predicate is left as-is here.
 *
 * Both conditional checks live in {@link isStatefulRecreateTarget};
 * the bare {@link STATEFUL_TYPES} set is the type-only first-cut.
+*
+* **Lower bound, enforced by a test** (issue [#2514]'s review round):
+* every type in `final-snapshot.ts`'s `ATOMIC_FINAL_SNAPSHOT_TYPES` ∪
+* `PRE_DELETE_SNAPSHOT_TYPES` must appear here. That union is the
+* CloudFormation-documented `DeletionPolicy: Snapshot`-capable list, and
+* CloudFormation permits the attribute exactly where deleting the resource
+* destroys data worth capturing first — so membership there is an
+* AWS-authored statement that the type is data-bearing. The types that were
+* in that union and NOT here (`AWS::Redshift::Cluster`,
+* `AWS::ElastiCache::ReplicationGroup`, `AWS::ElastiCache::CacheCluster`)
+* meant cdkd took a final snapshot before a `cdkd destroy` of them
+* while replacing them mid-deploy with no consent flag at all.
+* `tests/unit/provisioning/stateful-types.test.ts` pins the subset
+* relation so a future addition to either snapshot set cannot land without
+* the guard entry.
+*
+* The relation is deliberately ONE-directional: most data-bearing types
+* (S3, DynamoDB, LogGroup, ECR, …) have no snapshot API at all and
+* CloudFormation rejects `DeletionPolicy: Snapshot` on them, so this set is
+* a strict superset and the reverse containment would be wrong.
+*
+* **Second lower bound, also enforced by a test**: every resource type
+* registered to a provider whose `delete()` consults
+* `DeleteContext.forceDataDelete` must appear here. That field is set ONLY
+* by the replacement / recreate delete sites under
+* `--force-stateful-recreation`, so a provider reading it has already
+* declared its delete destroys user data — which makes the guard list's
+* agreement checkable rather than hand-curated.
+* `AWS::S3Express::DirectoryBucket` was the one type on the wrong side.
+*
+* **Third bound, and the first that reads the population the other two are
+* blind to** (issue [#2553]): both bounds above are derived from
+* `src/provisioning/providers/**` and `register-providers.ts`, so both can
+* only see types cdkd has an SDK PROVIDER for — 134 of them, against the
+* 1371 tier-2 types that have none and whose replacement routes through
+* Cloud Control's DELETE. That is the population issue [#2514] was filed
+* about, and until now it had never been swept.
+* `scripts/audit-stateful-candidates.ts` reads every tier-2 type's
+* CloudFormation registry schema and PROPOSES the ones that declare a
+* createOnly property (so a rename is a replacement a plain `cdkd deploy`
+* reaches with no flag) AND fire a data-bearing signal. Each proposal must
+* end up either on this list or in that script's `NOT_GUARDED` map with a
+* reason; `tests/unit/scripts/stateful-candidates.test.ts` fails on any that
+* is in neither, and on a `NOT_GUARDED` entry the derivation has stopped
+* proposing. Unlike the two bounds above the signals are HEURISTIC — no AWS
+* artifact states "deleting this destroys user data" — so this bound makes
+* the widening CHECKABLE rather than proven, which is the property a hand
+* pass over 1371 types could not have.
+*
+* Neither fence can see a provider whose delete destroys data with NO opt-in
+* at all — an unconditional empty (`S3TablesProvider.deleteTableBucket`,
+* `S3VectorsProvider.deleteVectorBucket`) or a plainly destructive API call
+* (`KMSProvider`'s `ScheduleKeyDeletion`,
+* `CodeCommitRepositoryProvider`'s `DeleteRepository`). Those types are
+* hand-added with the reason at the entry, and a provider added that way
+* should be reviewed for whether it wants a `forceDataDelete` gate too.
 */
 const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
@@ -28994,21 +29279,96 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::Neptune::DBCluster",
 	"AWS::DynamoDB::Table",
 	"AWS::DynamoDB::GlobalTable",
+	"AWS::Redshift::Cluster",
+	"AWS::ElastiCache::CacheCluster",
+	"AWS::ElastiCache::ReplicationGroup",
 	"AWS::EFS::FileSystem",
 	"AWS::FSx::FileSystem",
 	"AWS::S3::Bucket",
+	"AWS::S3Express::DirectoryBucket",
+	"AWS::S3Tables::TableBucket",
+	"AWS::S3Tables::Table",
+	"AWS::S3Tables::Namespace",
+	"AWS::S3Vectors::VectorBucket",
 	"AWS::ECR::Repository",
 	"AWS::EC2::Volume",
+	"AWS::EMR::Cluster",
 	"AWS::Kinesis::Stream",
 	"AWS::Elasticsearch::Domain",
 	"AWS::OpenSearchService::Domain",
 	"AWS::Cognito::UserPool",
 	"AWS::SecretsManager::Secret",
 	"AWS::SSM::Parameter",
+	"AWS::KMS::Key",
+	"AWS::KMS::ReplicaKey",
+	"AWS::CodeCommit::Repository",
 	"AWS::Glue::Database",
 	"AWS::Glue::Table",
 	"AWS::Logs::LogGroup",
-	"AWS::CloudFront::Distribution"
+	"AWS::CloudFront::Distribution",
+	"AWS::Cassandra::Table",
+	"AWS::DocDBElastic::Cluster",
+	"AWS::Lightsail::Database",
+	"AWS::Timestream::Database",
+	"AWS::Timestream::Table",
+	"AWS::Timestream::InfluxDBCluster",
+	"AWS::Timestream::InfluxDBInstance",
+	"AWS::ODB::CloudAutonomousVmCluster",
+	"AWS::ODB::CloudVmCluster",
+	"AWS::RedshiftServerless::Namespace",
+	"AWS::RedshiftServerless::Snapshot",
+	"AWS::NeptuneGraph::Graph",
+	"AWS::NeptuneGraph::GraphSnapshot",
+	"AWS::MemoryDB::Cluster",
+	"AWS::MemoryDB::MultiRegionCluster",
+	"AWS::ElastiCache::ServerlessCache",
+	"AWS::MSK::Cluster",
+	"AWS::MSK::ServerlessCluster",
+	"AWS::MSK::Channel",
+	"AWS::AmazonMQ::Broker",
+	"AWS::OSIS::Pipeline",
+	"AWS::KinesisVideo::Stream",
+	"AWS::Events::Archive",
+	"AWS::OpenSearchServerless::Collection",
+	"AWS::OpenSearchServerless::Index",
+	"AWS::OpenSearchServerless::CollectionIndex",
+	"AWS::Kendra::Index",
+	"AWS::QBusiness::Index",
+	"AWS::QBusiness::Application",
+	"AWS::Rekognition::Collection",
+	"AWS::Location::GeofenceCollection",
+	"AWS::S3Vectors::Index",
+	"AWS::Bedrock::KnowledgeBase",
+	"AWS::Bedrock::DataAutomationLibrary",
+	"AWS::Lightsail::Bucket",
+	"AWS::S3Outposts::Bucket",
+	"AWS::HealthImaging::Datastore",
+	"AWS::HealthLake::FHIRDatastore",
+	"AWS::SES::MailManagerArchive",
+	"AWS::WorkspacesInstances::Volume",
+	"AWS::IoTAnalytics::Channel",
+	"AWS::IoTAnalytics::Datastore",
+	"AWS::IoTAnalytics::Dataset",
+	"AWS::CodeArtifact::Domain",
+	"AWS::CodeArtifact::Repository",
+	"AWS::ECR::PublicRepository",
+	"AWS::Backup::BackupVault",
+	"AWS::Backup::LogicallyAirGappedBackupVault",
+	"AWS::EKS::Cluster",
+	"AWS::SageMaker::Cluster",
+	"AWS::SageMaker::Domain",
+	"AWS::Cases::Domain",
+	"AWS::CustomerProfiles::Domain",
+	"AWS::DataZone::Domain",
+	"AWS::CleanRooms::IdMappingTable",
+	"AWS::CleanRooms::IntermediateTable",
+	"AWS::CloudFront::KeyValueStore",
+	"AWS::Connect::DataTable",
+	"AWS::AppConfig::ConfigurationProfile",
+	"AWS::AIOps::InvestigationGroup",
+	"AWS::Rbin::Rule",
+	"AWS::SMSVOICE::PhoneNumber",
+	"AWS::SMSVOICE::SenderId"
 ]);
 /**
 * Multi-region resource types — `--recreate-via-cc-api` refuses these
@@ -29025,7 +29385,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::DynamoDB::GlobalTable"]);
 /**
 * Cheap, synchronous read of the resource's recorded properties only.
-* For `AWS::S3::Bucket` this returns `null` — the live `ListObjectsV2`
+* For `AWS::S3::Bucket` this returns `null` — the live `ListObjectVersions`
 * probe to distinguish empty buckets (safe to recreate) from
 * non-empty (data loss) lives in
 * `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
@@ -29048,17 +29408,26 @@ function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
 	return "always";
 }
 /**
-* Conservative variant for the `cdkd deploy --replace` mid-deploy guard.
+* Conservative variant for the deploy engine's mid-deploy guard sites, which
+* between them serve the paths below — only one of which is reached by a flag:
+*
+*   - property-driven replacement (an immutable / createOnly property changed
+*     in the template) — fires on a plain `cdkd deploy`, no flag;
+*   - the update-failure fallback's Cloud Control trigger (an
+*     `UnsupportedActionException` / "does not support UPDATE" rejection) —
+*     also no flag (issue [#2514]);
+*   - the same fallback's `--replace` trigger (an SDK provider's typed
+*     `ResourceUpdateNotSupportedError`).
 *
-* `--replace` catches a provider's immutable-update rejection while the deploy
-* is already in flight, so — unlike the `--recreate-via-*` pre-flight, which
+* All of them catch the rejection or classify the diff while the deploy is
+* already in flight, so — unlike the `--recreate-via-*` pre-flight, which
 * runs {@link probeStatefulRecreateTargetsAsync} (`s3:ListObjectVersions`) —
 * there is no opportunity to probe an `AWS::S3::Bucket`'s object count. The
 * sync check returns `null` for S3 (it defers to that async probe), which would
 * let a NON-EMPTY bucket be DELETE + CREATEd (data loss) without
 * `--force-stateful-recreation`. To stay fail-safe, treat a deferred S3 bucket
 * as stateful here: the user must pass `--force-stateful-recreation` to replace
-* ANY S3 bucket via `--replace`, empty or not. Every other type matches
+* ANY S3 bucket on any of those paths, empty or not. Every other type matches
 * {@link isStatefulRecreateTargetSync} exactly (the LogGroup retention check is
 * fully resolvable from recorded properties, so no conservatism is needed there).
 */
@@ -31039,7 +31408,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
 				recordNestedStackParameterExpressions(secrets, op.resourceType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
-				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
+				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and is NOT recovered by this rollback; the re-created resource starts empty.`);
 				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: prev.provisionedBy
@@ -33606,7 +33975,7 @@ var DeployEngine = class {
 						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
 						if (statefulReason && this.options.forceStatefulRecreation !== true) {
 							const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
-							throw new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED");
+							throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED"));
 						}
 					}
 					let replacementReason;
@@ -33749,9 +34118,10 @@ var DeployEngine = class {
 						const ccUnsupported = msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE");
 						const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && this.options.replace === true;
 						if (ccUnsupported || replaceOptIn) {
-							if (replaceOptIn) {
-								const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
-								if (statefulReason && this.options.forceStatefulRecreation !== true) throw new CdkdError(`--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED");
+							const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
+							if (statefulReason && this.options.forceStatefulRecreation !== true) {
+								const retainNote = updateReplacePolicy === "Retain" ? " Note: UpdateReplacePolicy: Retain does NOT protect this path — the replacement deletes the old resource regardless." : "";
+								throw markNonRetryable(new CdkdError((replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.` : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update.`) + retainNote, "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
 							}
 							this.logger.info(`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							const fallbackFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy);
@@ -34252,5 +34622,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { DEFAULT_STATE_PREFIX as $, resolveUseCdkBootstrapAssets as $n, retryClassificationText as $r, isSingleDynamicReferenceToken as $t, bold as A, validateAssetBucketName as An, LocalMigrateError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, runDockerStreaming as Bn, StackTerminationProtectionError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, BOOTSTRAP_MARKER_PREFIX as Cn, ConfigError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, isCrossRegionRedirect as Dn, DynamicReferenceRegionAmbiguousError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, getBootstrapMarkerKey as En, DeployCancelledError as Er, configStringRefusal as Et, yellow as F, dockerSpawnEnvWithSensitive as Fn, PartialFailureError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, getDefaultStateBucketName as Gn, normalizeAwsError as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, getDockerImageBySourceHash as Hn, SynthesisError as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, formatDockerLoginError as In, ProvisioningError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveAutoAssetStorage as Jn, isRetryableTransientError as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, getLegacyStateBucketName as Kn, withErrorHandling as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, getDockerCmd as Ln, ResourceTimeoutError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDenyExternalAccessPolicy as Mn, LockError as Mr, classifyReplaySecretRegion as Mt, green as N, describeAwsFailure as Nn, MissingCdkCliError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, parseBootstrapMarker as On, IntrinsicResolutionRefusalError as Or, replayWarn as Ot, red as P, buildDockerImage as Pn, NestedStackChildDirectDestroyError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, resolveStateBucketWithDefaultAndSource as Qn, markRedactedCause as Qr, errorCauseChain as Qt, exportAliasCollisionScrubWarning as R, partitionSensitiveEnv as Rn, ResourceUpdateNotSupportedError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, AssetModeResolver as Sn, CdkdError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, ensureAssetStorage as Tn, DependencyError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, Synthesizer as Un, formatError as Ur, withRetry as Ut, stateKeySecretExposure as V, AssetManifestLoader as Vn, StateError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, synthesisStatusMessage as Wn, isCdkdError as Wr, DagBuilder as Wt, maskDeep as X, resolveSkipPrefix as Xn, isTransientServerError as Xr, createSecretMasker as Xt, createMaskedRetryLogger as Y, resolveCaptureObservedState as Yn, isThrottlingError as Yr, carriesSecretMask as Yt, maskerOrIdentity as Z, resolveStateBucketWithDefault as Zn, markNonRetryable as Zr, dynamicReferenceTokens as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, createAssetRedirectResolver as _n, AwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, scrubResourceRecord as an, findLargeInlineResources as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, escapeRegExp$1 as bn, setAwsClients as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, rebuildClientForBucketRegion as cn, displaySafe as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, importableOutputs as dn, canonicalizeRegion as dr, isTerminationProtectionPropagationError as dt, __exportAll as ei, maskSecretsInError as en, stateBucketExistenceConfirmed as er, beginCommandInterruptScope as et, withResourceDeadline as f, shouldRetainResource as fn, derivePartitionAndUrlSuffix as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, buildAssetRedirectMap as gn, resolveBucketRegion as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, WorkGraph as hn, clearBucketRegionCache as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, redactSecretsForState as in, MIGRATE_TMP_PREFIX as ir, startInterruptWatch as it, cyan as j, validateContainerRepoName as jn, LocalStartServiceError as jr, requireConfigString as jt, formatResourceLine as k, readBootstrapMarkerBody as kn, LocalInvokeBuildError as kr, requireConfigArray as kt, replayRollback as l, exportNamesCarriedFrom as ln, expectedOwnerParam as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, stringifyValue as mn, processStackMessages as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, recordMaskOnlyValue as nn, CFN_TEMPLATE_BODY_LIMIT as nr, interruptWatchListenerCount as nt, planFailedOps as o, LockManager as on, uploadCfnTemplate as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, AssetPublisher as pn, AssemblyReader as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveApp as qn, isMarkedNonRetryable as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, recoverMaskedOutput as rn, CFN_TEMPLATE_URL_LIMIT as rr, isInterruptedWaitError as rt, planRollback as s, S3StateBackend as sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, maskSecretsInText as tn, warnDeprecatedNoPrefixCliFlag as tr, endCommandInterruptScope as tt, updatePartialMessage as u, importableOutputKeys as un, PARTITION_TABLE as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, loadPublishableAssetManifest as vn, getAwsClients as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, assertAssetBucketRegion as wn, CrossAccountSecretRefusalError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, stripControlChars as xn, AssetError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, rewriteTemplateAssetReferences as yn, resetAwsClients as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, runDockerForeground as zn, StackHasActiveImportsError as zr, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-CA50haPO.js.map
+export { endCommandInterruptScope as $, resolveCaptureObservedState as $n, isThrottlingError as $r, maskSecretsInText as $t, bold as A, getBootstrapMarkerKey as An, DeployCancelledError as Ar, classifyReplaySecretRegion as At, secretBearingStateKeyWarning as B, formatDockerLoginError as Bn, ProvisioningError as Br, describeTypeWithThrottleRetry as Bt, unsupportedFinalSnapshotError as C, rewriteTemplateAssetReferences as Cn, resetAwsClients as Cr, configBooleanRefusal as Ct, isStatefulRecreateTargetSync as D, BOOTSTRAP_MARKER_PREFIX as Dn, ConfigError as Dr, requireConfigArray as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, AssetModeResolver as En, CdkdError as Er, replayWarn as Et, yellow as F, validateContainerRepoName as Fn, LocalStartServiceError as Fr, s3BucketRegionalDomainName as Ft, clearOnUpdateRemoval as G, AssetManifestLoader as Gn, StateError as Gr, STATE_SOURCED_READBACK_RULES as Gt, getCurrentResourceSecrets as H, partitionSensitiveEnv as Hn, ResourceUpdateNotSupportedError as Hr, DagBuilder as Ht, collectDeclaredOutputNames as I, buildDenyExternalAccessPolicy as In, LockError as Ir, s3BucketWebsiteUrl as It, findSilentDropProperties as J, synthesisStatusMessage as Jn, isCdkdError as Jr, createSecretMasker as Jt, ProviderRegistry as K, getDockerImageBySourceHash as Kn, SynthesisError as Kr, TEMPLATE_SOURCED_RULES as Kt, collectPublishedOutputNames as L, describeAwsFailure as Ln, MissingCdkCliError as Lr, applyRoleArnIfSet as Lt, gray as M, parseBootstrapMarker as Mn, IntrinsicResolutionRefusalError as Mr, s3BucketArn as Mt, green as N, readBootstrapMarkerBody as Nn, LocalInvokeBuildError as Nr, s3BucketDomainName as Nt, renderStatefulReason as O, assertAssetBucketRegion as On, CrossAccountSecretRefusalError as Or, requireConfigObject as Ot, red as P, validateAssetBucketName as Pn, LocalMigrateError as Pr, s3BucketDualStackDomainName as Pt, beginCommandInterruptScope as Q, resolveAutoAssetStorage as Qn, isRetryableTransientError as Qr, maskSecretsInError as Qt, exportAliasCollisionScrubWarning as R, buildDockerImage as Rn, NestedStackChildDirectDestroyError as Rr, DiffCalculator as Rt, refusesFinalSnapshot as S, loadPublishableAssetManifest as Sn, getAwsClients as Sr, coerceCfnBoolean as St, extractDeploymentEventError as T, stripControlChars as Tn, AssetError as Tr, readConfigString as Tt, IAMRoleProvider as U, runDockerForeground as Un, StackHasActiveImportsError as Ur, TemplateParser as Ut, stateKeySecretExposure as V, getDockerCmd as Vn, ResourceTimeoutError as Vr, withRetry as Vt, collectInlinePolicyNamesManagedBySiblings as W, runDockerStreaming as Wn, StackTerminationProtectionError as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, maskDeep as X, getLegacyStateBucketName as Xn, withErrorHandling as Xr, errorCauseChain as Xt, createMaskedRetryLogger as Y, getDefaultStateBucketName as Yn, normalizeAwsError as Yr, dynamicReferenceTokens as Yt, maskerOrIdentity as Z, resolveApp as Zn, isMarkedNonRetryable as Zr, isSingleDynamicReferenceToken as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, AssetPublisher as _n, AssemblyReader as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, S3StateBackend as an, warnDeprecatedNoPrefixCliFlag as ar, UNSPECIFIED_SKIP_REASON as at, createPreDeleteFinalSnapshot as b, buildAssetRedirectMap as bn, resolveBucketRegion as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, buildForceUnlockCommand as cn, MIGRATE_TMP_PREFIX as cr, disableInstanceApiTermination as ct, updatePartialReason as d, CUSTOM_RESOURCE_RESPONSE_PREFIX as dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as dr, carriesDynamicReference as dt, isTransientServerError as ei, recordMaskOnlyValue as en, resolveSkipPrefix as er, interruptWatchListenerCount as et, withResourceDeadline as f, DEFAULT_STATE_PREFIX as fn, displaySafe as fr, cfnRefValueFromPhysicalId as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, shouldRetainResource as gn, derivePartitionAndUrlSuffix as gr, parameterTypeMayLoseSecretIdentity as gt, computeImplicitDeleteEdges as h, importableOutputs as hn, canonicalizeRegion as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, __exportAll as ii, LockManager as in, stateBucketExistenceConfirmed as ir, slowCcOperationTimeoutMs as it, cyan as j, isCrossRegionRedirect as jn, DynamicReferenceRegionAmbiguousError as jr, producerRegionsFromState as jt, formatResourceLine as k, ensureAssetStorage as kn, DependencyError as kr, requireConfigString as kt, replayRollback as l, buildLockContentionMessage as ln, findLargeInlineResources as lr, isTerminationProtectionPropagationError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, importableOutputKeys as mn, PARTITION_TABLE as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, markRedactedCause as ni, redactSecretsForState as nn, resolveStateBucketWithDefaultAndSource as nr, startInterruptWatch as nt, planFailedOps as o, rebuildClientForBucketRegion as on, CFN_TEMPLATE_BODY_LIMIT as or, deleteIndeterminateGuards as ot, maskingRetryLogger as p, exportNamesCarriedFrom as pn, expectedOwnerParam as pr, coerceParameterTypedValue as pt, findActionableSilentDrops as q, Synthesizer as qn, formatError as qr, carriesSecretMask as qt, DeployEngine as r, retryClassificationText as ri, scrubResourceRecord as rn, resolveUseCdkBootstrapAssets as rr, CloudControlProvider as rt, planRollback as s, UNRENDERABLE as sn, CFN_TEMPLATE_URL_LIMIT as sr, deleteSkipReason as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, markNonRetryable as ti, recoverMaskedOutput as tn, resolveStateBucketWithDefault as tr, isInterruptedWaitError as tt, updatePartialMessage as u, forceQuitRecoveryClause as un, uploadCfnTemplate as ur, IntrinsicFunctionResolver as ut, buildFinalSnapshotIdentifier as v, stringifyValue as vn, processStackMessages as vr, WAFv2WebACLProvider as vt, makeCanonicalizePropertiesFn as w, escapeRegExp$1 as wn, setAwsClients as wr, configStringRefusal as wt, isFinalSnapshotError as x, createAssetRedirectResolver as xn, AwsClients as xr, assertRegionMatch as xt, ccRoutedFinalSnapshotError as y, WorkGraph as yn, clearBucketRegionCache as yr, normalizeAwsTagsToCfn as yt, isExportAliasCollision as z, dockerSpawnEnvWithSensitive as zn, PartialFailureError as zr, INTRINSIC_KEYS as zt };
+//# sourceMappingURL=deploy-engine-DuFUy9D0.js.map