@go-to-k/cdkd 0.285.15 → 0.286.0

package/dist/{deploy-engine-DPh-XamZ.js → deploy-engine-DYYs56Gt.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-Dcdouqd3.js";
+import { t as getCdkdVersion } from "./version-Dkd6KwPz.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1394,38 +1394,6 @@ var LocalStartServiceError = class LocalStartServiceError extends CdkdError {
 	}
 };
 /**
-* Signals that the upstream `cdk` CLI is not available on PATH (or at
-* the override path passed via `--cdk-bin`). Surfaced from `cdkd migrate`
-* (#465 PR A) before any other work runs.
-*
-* The message includes the install hint `npm install -g aws-cdk@latest`
-* so users on a fresh machine see exactly how to recover.
-*/
-var MissingCdkCliError = class MissingCdkCliError extends CdkdError {
-	constructor(detail, cause) {
-		super(`${detail ?? "upstream 'cdk' CLI not found on PATH"}. 'cdkd migrate' shells out to the upstream aws-cdk CLI for L1 codegen — install it with 'npm install -g aws-cdk@latest' (or pass --cdk-bin <path>).`, "MISSING_CDK_CLI", cause);
-		this.name = "MissingCdkCliError";
-		Object.setPrototypeOf(this, MissingCdkCliError.prototype);
-	}
-};
-/**
-* Generic local-migrate orchestration failure (#465 PR A). Used by
-* `cdkd migrate` for pre-flight rejections (Custom Resource / nested
-* stack / non-terminal CFn stack state), output-dir collisions, and
-* `cdk migrate` subprocess failures whose underlying stderr is folded
-* into the error message. Exit code 2 (partial-failure family) because
-* some pre-flight failures leave the user with a partially-populated
-* output directory that's still useful for debugging.
-*/
-var LocalMigrateError = class LocalMigrateError extends CdkdError {
-	exitCode = 2;
-	constructor(message, cause) {
-		super(message, "LOCAL_MIGRATE_ERROR", cause);
-		this.name = "LocalMigrateError";
-		Object.setPrototypeOf(this, LocalMigrateError.prototype);
-	}
-};
-/**
 * CloudFormation macro / `Fn::Transform` expansion failure (#463).
 *
 * cdkd hands templates that declare `Transform: [...]` (or carry
@@ -22378,7 +22346,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CKEf903K.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D9Lc_ngz.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -29204,14 +29172,21 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 *   - `AWS::S3::Bucket`: empty buckets are safe to recreate. The
 *     deploy engine probes `s3:ListObjectVersions` at plan time and only
 *     refuses when the bucket has at least one object.
-*   - `AWS::Logs::LogGroup`: the deploy engine refuses only when
-*     `RetentionInDays > 0`. NOTE this is a KNOWN GAP, not a statement
-*     that the rest are empty: an unset or zero retention is CloudWatch
-*     Logs' "never expire", the most data-bearing setting there is, and
-*     `LogsLogGroupProvider` writes `0` for precisely that. Issue
-*     [#2558] tracks it; the predicate is left as-is here.
-*
-* Both conditional checks live in {@link isStatefulRecreateTarget};
+*   - `AWS::Logs::LogGroup`: a log group holding no log events is safe
+*     to recreate, and RETENTION IS NOT THE SIGNAL FOR THAT (issue
+*     [#2558]). An unset or zero `RetentionInDays` is CloudWatch Logs'
+*     "never expire" — the most data-bearing configuration the type
+*     has, and what `LogsLogGroupProvider` records `0` for — so reading
+*     it as "holds nothing" destroyed years of events on a plain
+*     `cdkd deploy`. A recorded `RetentionInDays > 0` still answers
+*     `has-retention` from the bag alone (a cheap positive, never
+*     probed away); every other bag DEFERS, exactly as the bucket does.
+*     The pre-flight resolves the deferral with a live
+*     `logs:DescribeLogStreams` probe (a log group with no stream can
+*     hold no event, since every event belongs to a stream); mid-deploy,
+*     where no probe can run, it resolves to `has-log-events`.
+*
+* Both conditional checks live in {@link isStatefulRecreateTargetSync};
 * the bare {@link STATEFUL_TYPES} set is the type-only first-cut.
 *
 * **Lower bound, enforced by a test** (issue [#2514]'s review round):
@@ -29243,6 +29218,25 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 * agreement checkable rather than hand-curated.
 * `AWS::S3Express::DirectoryBucket` was the one type on the wrong side.
 *
+* **Third bound, and the first that reads the population the other two are
+* blind to** (issue [#2553]): both bounds above are derived from
+* `src/provisioning/providers/**` and `register-providers.ts`, so both can
+* only see types cdkd has an SDK PROVIDER for — 134 of them, against the
+* 1371 tier-2 types that have none and whose replacement routes through
+* Cloud Control's DELETE. That is the population issue [#2514] was filed
+* about, and until now it had never been swept.
+* `scripts/audit-stateful-candidates.ts` reads every tier-2 type's
+* CloudFormation registry schema and PROPOSES the ones that declare a
+* createOnly property (so a rename is a replacement a plain `cdkd deploy`
+* reaches with no flag) AND fire a data-bearing signal. Each proposal must
+* end up either on this list or in that script's `NOT_GUARDED` map with a
+* reason; `tests/unit/scripts/stateful-candidates.test.ts` fails on any that
+* is in neither, and on a `NOT_GUARDED` entry the derivation has stopped
+* proposing. Unlike the two bounds above the signals are HEURISTIC — no AWS
+* artifact states "deleting this destroys user data" — so this bound makes
+* the widening CHECKABLE rather than proven, which is the property a hand
+* pass over 1371 types could not have.
+*
 * Neither fence can see a provider whose delete destroys data with NO opt-in
 * at all — an unconditional empty (`S3TablesProvider.deleteTableBucket`,
 * `S3VectorsProvider.deleteVectorBucket`) or a plainly destructive API call
@@ -29286,7 +29280,70 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::Glue::Database",
 	"AWS::Glue::Table",
 	"AWS::Logs::LogGroup",
-	"AWS::CloudFront::Distribution"
+	"AWS::CloudFront::Distribution",
+	"AWS::Cassandra::Table",
+	"AWS::DocDBElastic::Cluster",
+	"AWS::Lightsail::Database",
+	"AWS::Timestream::Database",
+	"AWS::Timestream::Table",
+	"AWS::Timestream::InfluxDBCluster",
+	"AWS::Timestream::InfluxDBInstance",
+	"AWS::ODB::CloudAutonomousVmCluster",
+	"AWS::ODB::CloudVmCluster",
+	"AWS::RedshiftServerless::Namespace",
+	"AWS::RedshiftServerless::Snapshot",
+	"AWS::NeptuneGraph::Graph",
+	"AWS::NeptuneGraph::GraphSnapshot",
+	"AWS::MemoryDB::Cluster",
+	"AWS::MemoryDB::MultiRegionCluster",
+	"AWS::ElastiCache::ServerlessCache",
+	"AWS::MSK::Cluster",
+	"AWS::MSK::ServerlessCluster",
+	"AWS::MSK::Channel",
+	"AWS::AmazonMQ::Broker",
+	"AWS::OSIS::Pipeline",
+	"AWS::KinesisVideo::Stream",
+	"AWS::Events::Archive",
+	"AWS::OpenSearchServerless::Collection",
+	"AWS::OpenSearchServerless::Index",
+	"AWS::OpenSearchServerless::CollectionIndex",
+	"AWS::Kendra::Index",
+	"AWS::QBusiness::Index",
+	"AWS::QBusiness::Application",
+	"AWS::Rekognition::Collection",
+	"AWS::Location::GeofenceCollection",
+	"AWS::S3Vectors::Index",
+	"AWS::Bedrock::KnowledgeBase",
+	"AWS::Bedrock::DataAutomationLibrary",
+	"AWS::Lightsail::Bucket",
+	"AWS::S3Outposts::Bucket",
+	"AWS::HealthImaging::Datastore",
+	"AWS::HealthLake::FHIRDatastore",
+	"AWS::SES::MailManagerArchive",
+	"AWS::WorkspacesInstances::Volume",
+	"AWS::IoTAnalytics::Channel",
+	"AWS::IoTAnalytics::Datastore",
+	"AWS::IoTAnalytics::Dataset",
+	"AWS::CodeArtifact::Domain",
+	"AWS::CodeArtifact::Repository",
+	"AWS::ECR::PublicRepository",
+	"AWS::Backup::BackupVault",
+	"AWS::Backup::LogicallyAirGappedBackupVault",
+	"AWS::EKS::Cluster",
+	"AWS::SageMaker::Cluster",
+	"AWS::SageMaker::Domain",
+	"AWS::Cases::Domain",
+	"AWS::CustomerProfiles::Domain",
+	"AWS::DataZone::Domain",
+	"AWS::CleanRooms::IdMappingTable",
+	"AWS::CleanRooms::IntermediateTable",
+	"AWS::CloudFront::KeyValueStore",
+	"AWS::Connect::DataTable",
+	"AWS::AppConfig::ConfigurationProfile",
+	"AWS::AIOps::InvestigationGroup",
+	"AWS::Rbin::Rule",
+	"AWS::SMSVOICE::PhoneNumber",
+	"AWS::SMSVOICE::SenderId"
 ]);
 /**
 * Multi-region resource types — `--recreate-via-cc-api` refuses these
@@ -29303,14 +29360,17 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::DynamoDB::GlobalTable"]);
 /**
 * Cheap, synchronous read of the resource's recorded properties only.
-* For `AWS::S3::Bucket` this returns `null` — the live `ListObjectVersions`
-* probe to distinguish empty buckets (safe to recreate) from
-* non-empty (data loss) lives in
+* TWO types return `null` meaning DEFER rather than "not stateful":
+* `AWS::S3::Bucket` always, and `AWS::Logs::LogGroup` whenever the
+* recorded bag does not already prove `has-retention`. The live probes
+* that resolve both deferrals (`ListObjectVersions` for the bucket,
+* `DescribeLogStreams` for the log group) live in
 * `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
-* (issue [#648]) and runs after this sync first-cut. Sync callers can
+* (issues [#648] / [#2558]) and run after this sync first-cut. Sync callers can
 * still treat `null` as "not stateful" — the deploy command does both
 * passes back-to-back; only callers that explicitly opt out of the
-* async probe need to assume conservative "stateful" semantics.
+* async probe need to assume conservative "stateful" semantics, which
+* is what {@link isStatefulRecreateTargetForReplace} exists to do.
 *
 * Returns the {@link StatefulReason} when the type is stateful (or
 * `null` for non-stateful types).
@@ -29340,19 +29400,25 @@ function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
 * All of them catch the rejection or classify the diff while the deploy is
 * already in flight, so — unlike the `--recreate-via-*` pre-flight, which
 * runs {@link probeStatefulRecreateTargetsAsync} (`s3:ListObjectVersions`) —
-* there is no opportunity to probe an `AWS::S3::Bucket`'s object count. The
-* sync check returns `null` for S3 (it defers to that async probe), which would
-* let a NON-EMPTY bucket be DELETE + CREATEd (data loss) without
-* `--force-stateful-recreation`. To stay fail-safe, treat a deferred S3 bucket
-* as stateful here: the user must pass `--force-stateful-recreation` to replace
-* ANY S3 bucket on any of those paths, empty or not. Every other type matches
-* {@link isStatefulRecreateTargetSync} exactly (the LogGroup retention check is
-* fully resolvable from recorded properties, so no conservatism is needed there).
+* there is no opportunity to probe an `AWS::S3::Bucket`'s object count, nor an
+* `AWS::Logs::LogGroup`'s log streams. The sync check returns `null` for both
+* deferrals, which would let a NON-EMPTY bucket — or a never-expiring log group
+* — be DELETE + CREATEd (data loss) without `--force-stateful-recreation`. To
+* stay fail-safe, both deferrals resolve to stateful here: the user must pass
+* `--force-stateful-recreation` to replace ANY S3 bucket, and any log group
+* whose recorded bag does not already prove `has-retention`, on any of those
+* paths — empty or not.
+*
+* The log group's arm is the one issue [#2558] added, and the reason it is
+* needed is that the old predicate treated "no retention recorded" as "holds
+* nothing" when it is CloudWatch Logs' never-expire. Every other type matches
+* {@link isStatefulRecreateTargetSync} exactly.
 */
 function isStatefulRecreateTargetForReplace(resourceType, recordedProperties) {
 	const sync = isStatefulRecreateTargetSync(resourceType, recordedProperties);
 	if (sync) return sync;
 	if (resourceType === "AWS::S3::Bucket") return "has-objects";
+	if (resourceType === "AWS::Logs::LogGroup") return "has-log-events";
 	return null;
 }
 /**
@@ -29365,6 +29431,7 @@ function renderStatefulReason(reason) {
 		case "always": return "destroy loses all data in the resource";
 		case "has-objects": return "S3 bucket is non-empty";
 		case "has-retention": return "log group retains data (RetentionInDays > 0)";
+		case "has-log-events": return "log group is not provably empty";
 		case null: return "(not stateful)";
 	}
 }
@@ -34540,5 +34607,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { endCommandInterruptScope as $, resolveCaptureObservedState as $n, isThrottlingError as $r, maskSecretsInText as $t, bold as A, getBootstrapMarkerKey as An, DeployCancelledError as Ar, classifyReplaySecretRegion as At, secretBearingStateKeyWarning as B, formatDockerLoginError as Bn, ProvisioningError as Br, describeTypeWithThrottleRetry as Bt, unsupportedFinalSnapshotError as C, rewriteTemplateAssetReferences as Cn, resetAwsClients as Cr, configBooleanRefusal as Ct, isStatefulRecreateTargetSync as D, BOOTSTRAP_MARKER_PREFIX as Dn, ConfigError as Dr, requireConfigArray as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, AssetModeResolver as En, CdkdError as Er, replayWarn as Et, yellow as F, validateContainerRepoName as Fn, LocalStartServiceError as Fr, s3BucketRegionalDomainName as Ft, clearOnUpdateRemoval as G, AssetManifestLoader as Gn, StateError as Gr, STATE_SOURCED_READBACK_RULES as Gt, getCurrentResourceSecrets as H, partitionSensitiveEnv as Hn, ResourceUpdateNotSupportedError as Hr, DagBuilder as Ht, collectDeclaredOutputNames as I, buildDenyExternalAccessPolicy as In, LockError as Ir, s3BucketWebsiteUrl as It, findSilentDropProperties as J, synthesisStatusMessage as Jn, isCdkdError as Jr, createSecretMasker as Jt, ProviderRegistry as K, getDockerImageBySourceHash as Kn, SynthesisError as Kr, TEMPLATE_SOURCED_RULES as Kt, collectPublishedOutputNames as L, describeAwsFailure as Ln, MissingCdkCliError as Lr, applyRoleArnIfSet as Lt, gray as M, parseBootstrapMarker as Mn, IntrinsicResolutionRefusalError as Mr, s3BucketArn as Mt, green as N, readBootstrapMarkerBody as Nn, LocalInvokeBuildError as Nr, s3BucketDomainName as Nt, renderStatefulReason as O, assertAssetBucketRegion as On, CrossAccountSecretRefusalError as Or, requireConfigObject as Ot, red as P, validateAssetBucketName as Pn, LocalMigrateError as Pr, s3BucketDualStackDomainName as Pt, beginCommandInterruptScope as Q, resolveAutoAssetStorage as Qn, isRetryableTransientError as Qr, maskSecretsInError as Qt, exportAliasCollisionScrubWarning as R, buildDockerImage as Rn, NestedStackChildDirectDestroyError as Rr, DiffCalculator as Rt, refusesFinalSnapshot as S, loadPublishableAssetManifest as Sn, getAwsClients as Sr, coerceCfnBoolean as St, extractDeploymentEventError as T, stripControlChars as Tn, AssetError as Tr, readConfigString as Tt, IAMRoleProvider as U, runDockerForeground as Un, StackHasActiveImportsError as Ur, TemplateParser as Ut, stateKeySecretExposure as V, getDockerCmd as Vn, ResourceTimeoutError as Vr, withRetry as Vt, collectInlinePolicyNamesManagedBySiblings as W, runDockerStreaming as Wn, StackTerminationProtectionError as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, maskDeep as X, getLegacyStateBucketName as Xn, withErrorHandling as Xr, errorCauseChain as Xt, createMaskedRetryLogger as Y, getDefaultStateBucketName as Yn, normalizeAwsError as Yr, dynamicReferenceTokens as Yt, maskerOrIdentity as Z, resolveApp as Zn, isMarkedNonRetryable as Zr, isSingleDynamicReferenceToken as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, AssetPublisher as _n, AssemblyReader as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, S3StateBackend as an, warnDeprecatedNoPrefixCliFlag as ar, UNSPECIFIED_SKIP_REASON as at, createPreDeleteFinalSnapshot as b, buildAssetRedirectMap as bn, resolveBucketRegion as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, buildForceUnlockCommand as cn, MIGRATE_TMP_PREFIX as cr, disableInstanceApiTermination as ct, updatePartialReason as d, CUSTOM_RESOURCE_RESPONSE_PREFIX as dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as dr, carriesDynamicReference as dt, isTransientServerError as ei, recordMaskOnlyValue as en, resolveSkipPrefix as er, interruptWatchListenerCount as et, withResourceDeadline as f, DEFAULT_STATE_PREFIX as fn, displaySafe as fr, cfnRefValueFromPhysicalId as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, shouldRetainResource as gn, derivePartitionAndUrlSuffix as gr, parameterTypeMayLoseSecretIdentity as gt, computeImplicitDeleteEdges as h, importableOutputs as hn, canonicalizeRegion as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, __exportAll as ii, LockManager as in, stateBucketExistenceConfirmed as ir, slowCcOperationTimeoutMs as it, cyan as j, isCrossRegionRedirect as jn, DynamicReferenceRegionAmbiguousError as jr, producerRegionsFromState as jt, formatResourceLine as k, ensureAssetStorage as kn, DependencyError as kr, requireConfigString as kt, replayRollback as l, buildLockContentionMessage as ln, findLargeInlineResources as lr, isTerminationProtectionPropagationError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, importableOutputKeys as mn, PARTITION_TABLE as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, markRedactedCause as ni, redactSecretsForState as nn, resolveStateBucketWithDefaultAndSource as nr, startInterruptWatch as nt, planFailedOps as o, rebuildClientForBucketRegion as on, CFN_TEMPLATE_BODY_LIMIT as or, deleteIndeterminateGuards as ot, maskingRetryLogger as p, exportNamesCarriedFrom as pn, expectedOwnerParam as pr, coerceParameterTypedValue as pt, findActionableSilentDrops as q, Synthesizer as qn, formatError as qr, carriesSecretMask as qt, DeployEngine as r, retryClassificationText as ri, scrubResourceRecord as rn, resolveUseCdkBootstrapAssets as rr, CloudControlProvider as rt, planRollback as s, UNRENDERABLE as sn, CFN_TEMPLATE_URL_LIMIT as sr, deleteSkipReason as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, markNonRetryable as ti, recoverMaskedOutput as tn, resolveStateBucketWithDefault as tr, isInterruptedWaitError as tt, updatePartialMessage as u, forceQuitRecoveryClause as un, uploadCfnTemplate as ur, IntrinsicFunctionResolver as ut, buildFinalSnapshotIdentifier as v, stringifyValue as vn, processStackMessages as vr, WAFv2WebACLProvider as vt, makeCanonicalizePropertiesFn as w, escapeRegExp$1 as wn, setAwsClients as wr, configStringRefusal as wt, isFinalSnapshotError as x, createAssetRedirectResolver as xn, AwsClients as xr, assertRegionMatch as xt, ccRoutedFinalSnapshotError as y, WorkGraph as yn, clearBucketRegionCache as yr, normalizeAwsTagsToCfn as yt, isExportAliasCollision as z, dockerSpawnEnvWithSensitive as zn, PartialFailureError as zr, INTRINSIC_KEYS as zt };
-//# sourceMappingURL=deploy-engine-DPh-XamZ.js.map
+export { beginCommandInterruptScope as $, resolveAutoAssetStorage as $n, isTransientServerError as $r, maskSecretsInError as $t, formatResourceLine as A, ensureAssetStorage as An, DependencyError as Ar, requireConfigString as At, isExportAliasCollision as B, dockerSpawnEnvWithSensitive as Bn, ResourceTimeoutError as Br, INTRINSIC_KEYS as Bt, unsupportedFinalSnapshotError as C, loadPublishableAssetManifest as Cn, getAwsClients as Cr, coerceCfnBoolean as Ct, isStatefulRecreateTargetForReplace as D, AssetModeResolver as Dn, CdkdError as Dr, replayWarn as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, stripControlChars as En, AssetError as Er, readConfigString as Et, red as F, validateAssetBucketName as Fn, LocalStartServiceError as Fr, s3BucketDualStackDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, runDockerStreaming as Gn, SynthesisError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, stateKeySecretExposure as H, getDockerCmd as Hn, StackHasActiveImportsError as Hr, withRetry as Ht, yellow as I, validateContainerRepoName as In, LockError as Ir, s3BucketRegionalDomainName as It, findActionableSilentDrops as J, Synthesizer as Jn, normalizeAwsError as Jr, carriesSecretMask as Jt, clearOnUpdateRemoval as K, AssetManifestLoader as Kn, formatError as Kr, STATE_SOURCED_READBACK_RULES as Kt, collectDeclaredOutputNames as L, buildDenyExternalAccessPolicy as Ln, NestedStackChildDirectDestroyError as Lr, s3BucketWebsiteUrl as Lt, cyan as M, isCrossRegionRedirect as Mn, DynamicReferenceRegionAmbiguousError as Mr, producerRegionsFromState as Mt, gray as N, parseBootstrapMarker as Nn, IntrinsicResolutionRefusalError as Nr, s3BucketArn as Nt, isStatefulRecreateTargetSync as O, BOOTSTRAP_MARKER_PREFIX as On, ConfigError as Or, requireConfigArray as Ot, green as P, readBootstrapMarkerBody as Pn, LocalInvokeBuildError as Pr, s3BucketDomainName as Pt, maskerOrIdentity as Q, resolveApp as Qn, isThrottlingError as Qr, isSingleDynamicReferenceToken as Qt, collectPublishedOutputNames as R, describeAwsFailure as Rn, PartialFailureError as Rr, applyRoleArnIfSet as Rt, refusesFinalSnapshot as S, createAssetRedirectResolver as Sn, AwsClients as Sr, assertRegionMatch as St, extractDeploymentEventError as T, escapeRegExp$1 as Tn, setAwsClients as Tr, configStringRefusal as Tt, getCurrentResourceSecrets as U, partitionSensitiveEnv as Un, StackTerminationProtectionError as Ur, DagBuilder as Ut, secretBearingStateKeyWarning as V, formatDockerLoginError as Vn, ResourceUpdateNotSupportedError as Vr, describeTypeWithThrottleRetry as Vt, IAMRoleProvider as W, runDockerForeground as Wn, StateError as Wr, TemplateParser as Wt, createMaskedRetryLogger as X, getDefaultStateBucketName as Xn, isMarkedNonRetryable as Xr, dynamicReferenceTokens as Xt, findSilentDropProperties as Y, synthesisStatusMessage as Yn, withErrorHandling as Yr, createSecretMasker as Yt, maskDeep as Z, getLegacyStateBucketName as Zn, isRetryableTransientError as Zr, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shouldRetainResource as _n, derivePartitionAndUrlSuffix as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, LockManager as an, stateBucketExistenceConfirmed as ar, slowCcOperationTimeoutMs as at, createPreDeleteFinalSnapshot as b, WorkGraph as bn, clearBucketRegionCache as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, UNRENDERABLE as cn, CFN_TEMPLATE_URL_LIMIT as cr, deleteSkipReason as ct, updatePartialReason as d, forceQuitRecoveryClause as dn, uploadCfnTemplate as dr, IntrinsicFunctionResolver as dt, markNonRetryable as ei, maskSecretsInText as en, resolveCaptureObservedState as er, endCommandInterruptScope as et, withResourceDeadline as f, CUSTOM_RESOURCE_RESPONSE_PREFIX as fn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as fr, carriesDynamicReference as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, importableOutputs as gn, canonicalizeRegion as gr, isUnboundTemplateParameter as gt, computeImplicitDeleteEdges as h, importableOutputKeys as hn, PARTITION_TABLE as hr, getAccountInfo as ht, DeploymentEventsReader as i, scrubResourceRecord as in, resolveUseCdkBootstrapAssets as ir, CloudControlProvider as it, bold as j, getBootstrapMarkerKey as jn, DeployCancelledError as jr, classifyReplaySecretRegion as jt, renderStatefulReason as k, assertAssetBucketRegion as kn, CrossAccountSecretRefusalError as kr, requireConfigObject as kt, replayRollback as l, buildForceUnlockCommand as ln, MIGRATE_TMP_PREFIX as lr, disableInstanceApiTermination as lt, IMPLICIT_DELETE_DEPENDENCIES as m, exportNamesCarriedFrom as mn, expectedOwnerParam as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, retryClassificationText as ni, recoverMaskedOutput as nn, resolveStateBucketWithDefault as nr, isInterruptedWaitError as nt, planFailedOps as o, S3StateBackend as on, warnDeprecatedNoPrefixCliFlag as or, UNSPECIFIED_SKIP_REASON as ot, maskingRetryLogger as p, DEFAULT_STATE_PREFIX as pn, displaySafe as pr, cfnRefValueFromPhysicalId as pt, ProviderRegistry as q, getDockerImageBySourceHash as qn, isCdkdError as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, __exportAll as ri, redactSecretsForState as rn, resolveStateBucketWithDefaultAndSource as rr, startInterruptWatch as rt, planRollback as s, rebuildClientForBucketRegion as sn, CFN_TEMPLATE_BODY_LIMIT as sr, deleteIndeterminateGuards as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, markRedactedCause as ti, recordMaskOnlyValue as tn, resolveSkipPrefix as tr, interruptWatchListenerCount as tt, updatePartialMessage as u, buildLockContentionMessage as un, findLargeInlineResources as ur, isTerminationProtectionPropagationError as ut, buildFinalSnapshotIdentifier as v, AssetPublisher as vn, AssemblyReader as vr, refStateLookupFromResource as vt, makeCanonicalizePropertiesFn as w, rewriteTemplateAssetReferences as wn, resetAwsClients as wr, configBooleanRefusal as wt, isFinalSnapshotError as x, buildAssetRedirectMap as xn, resolveBucketRegion as xr, resolveExplicitPhysicalId as xt, ccRoutedFinalSnapshotError as y, stringifyValue as yn, processStackMessages as yr, WAFv2WebACLProvider as yt, exportAliasCollisionScrubWarning as z, buildDockerImage as zn, ProvisioningError as zr, DiffCalculator as zt };
+//# sourceMappingURL=deploy-engine-DYYs56Gt.js.map