@go-to-k/cdkd 0.285.4 → 0.285.6

package/dist/{deploy-engine-3EmPzxSN.js → deploy-engine-BgpCWFvY.js}

@@ -1,6 +1,6 @@
-import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-Dz3Le2Pw.js";
+import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-DyTk5GeO.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-Dlq6xZAQ.js";
+import { t as getCdkdVersion } from "./version-De6foYg3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5525,8 +5525,13 @@ var FileAssetPublisher = class {
 * Output handling: stdout/stderr are collected in memory unconditionally so
 * `runDockerStreaming` can return them to the caller for error wrapping.
 * When the logger is at debug level (i.e. the user passed `--verbose`),
-* the chunks are ALSO mirrored to `process.stdout` / `process.stderr` so
-* the user sees live build progress.
+* the chunks are ALSO mirrored live so the user sees build progress —
+* stderr always to `process.stderr`, and stdout to `process.stdout` EXCEPT
+* while a command holds a payload reservation
+* ({@link isStdoutReservedForPayload}), where it joins the logger on stderr
+* so a child's diagnostics cannot land in the payload
+* ([#2410](https://github.com/go-to-k/cdkd/issues/2410)). The same
+* reservation redirects `spawnForeground`'s inherited fd 1 to fd 2.
 */
 /**
 * Return the docker-compatible CLI binary to invoke. Matches CDK CLI:
@@ -5573,7 +5578,8 @@ async function spawnStreaming(cmd, args, options = {}) {
 		const stderrChunks = [];
 		child.stdout.on("data", (chunk) => {
 			stdoutChunks.push(chunk);
-			if (streamLive) process.stdout.write(chunk);
+			if (streamLive) if (isStdoutReservedForPayload()) process.stderr.write(chunk);
+			else process.stdout.write(chunk);
 		});
 		child.stderr.on("data", (chunk) => {
 			stderrChunks.push(chunk);
@@ -5617,25 +5623,42 @@ async function spawnStreaming(cmd, args, options = {}) {
 * exit, so the caller can wrap with its own error class.
 *
 * Differs from {@link runDockerStreaming} in two ways:
-*   1. `stdio: 'inherit'` — output is NOT captured, so terminal control codes
-*      (color, progress bar overwrites) flow through unchanged. This is the
-*      load-bearing reason for the split: `docker pull`'s progress bars only
-*      animate properly when stdout is a real TTY connected to the parent.
+*   1. The child INHERITS descriptors — output is NOT captured, so terminal
+*      control codes (color, progress bar overwrites) flow through
+*      unchanged. That is the load-bearing reason for the split:
+*      `docker pull`'s progress bars only animate when the child writes to a
+*      real TTY rather than a pipe. Under a payload reservation the child's
+*      fd 1 is redirected to the parent's fd 2 rather than piped, precisely
+*      so it keeps a descriptor and not a pipe — though the animation then
+*      depends on STDERR being a terminal, and degrades to plain lines under
+*      `2> file` (issue
+*      [#2410](https://github.com/go-to-k/cdkd/issues/2410)).
 *   2. No `input` / `streamLive` options — inherit-mode has nothing to
 *      capture and nothing to mirror.
 *
-* Used by the `--verbose`-mode `docker pull` plumbing in `docker-runner.ts`
-* and `ecr-puller.ts` (visible layer progress). Non-verbose pulls go through
-* {@link runDockerStreaming} so stderr can be folded into the error message.
+* Used by the `docker pull` plumbing in `docker-runner.ts` and
+* `ecr-puller.ts`. Those two callers differ, and the difference matters
+* enough to state: `docker-runner.ts` reaches this only under `--verbose`,
+* while `ecr-puller.ts` runs it UNCONDITIONALLY, which is what made the
+* pre-#2410 stdout leak reachable with no flag at all. Non-verbose pulls in
+* `docker-runner.ts` go through {@link runDockerStreaming} instead, so
+* stderr can be folded into the error message.
 */
 async function runDockerForeground(args, options = {}) {
 	return spawnForeground(getDockerCmd(), args, options);
 }
 /**
-* Foreground (stdio-inherit) spawn — the inherit-mode counterpart to
+* Foreground (descriptor-inheriting) spawn — the inherit-mode counterpart to
 * {@link spawnStreaming}. Used by {@link runDockerForeground} for docker-CLI
 * subprocesses.
 *
+* "inherit" is not unqualified, and THIS is the function that qualifies it:
+* while a command holds a payload reservation
+* ({@link isStdoutReservedForPayload}) the child's fd 1 is redirected to the
+* parent's fd 2, so its output cannot land in the payload
+* ([#2410](https://github.com/go-to-k/cdkd/issues/2410)). stdin and stderr
+* are inherited either way. See the inline note at the `spawn` call.
+*
 * The ENOENT branch crafts a docker-specific install hint ("Install Docker
 * (or set CDK_DOCKER ...)"), so non-docker callers reusing this helper
 * would see a misleading error on missing-binary failures. Keep the binary
@@ -5648,7 +5671,11 @@ async function spawnForeground(cmd, args, options = {}) {
 		const child = spawn(cmd, args, {
 			cwd: options.cwd,
 			env,
-			stdio: "inherit"
+			stdio: isStdoutReservedForPayload() ? [
+				"inherit",
+				2,
+				"inherit"
+			] : "inherit"
 		});
 		child.once("error", (err) => {
 			if (err.code === "ENOENT") {
@@ -20218,6 +20245,151 @@ function isTerminationProtectionPropagationError(message) {
 	return /may not be terminated|disableApiTermination/i.test(message);
 }
 
+//#endregion
+//#region src/deployment/delete-outcome.ts
+/**
+* Shared helpers over {@link ResourceDeleteResult} — originally the deploy-side
+* consumption of it (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)), the twin of what
+* `src/cli/commands/destroy-runner.ts` does for `cdkd destroy`, and since issue
+* [#2301](https://github.com/go-to-k/cdkd/issues/2301) also the PRODUCER-side
+* `indeterminateGuards` constructor. Write and read live in one file on
+* purpose: the field's whole job is to survive a hop from a provider to a
+* recorder, and a sanitizer that does not sit beside its constructor is how
+* the two drift.
+*
+* Issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) gave
+* `ResourceProvider.delete` an optional return value whose `'skipped'` arm
+* means **the resource this result names was NOT destroyed and may still be
+* ALIVE**, and taught the destroy runner to report it. Every OTHER
+* `provider.delete(...)` call site — the deploy engine's template-DELETE
+* branch, its four replacement / recreate delete sites, and the five
+* `rollback-executor.ts` delete arms — discarded the value, so the same skip
+* printed as `deleted`, counted as `deleted`, and dropped the state record.
+*
+* **The module must stay a LEAF — no imports beyond the type, ever.** Same
+* reason as `src/provisioning/nested-stack-messages.ts`: both the deploy
+* engine and the rollback executor consume it, and those two already sit on a
+* dense import ring (engine -> executor -> provider registry -> every
+* provider). A helper that pulled anything else in would close it.
+*/
+/**
+* The `reason` of a `'skipped'` delete outcome, or `undefined` when the
+* provider reported a delete (`{ outcome: 'deleted' }` or the back-compat
+* `void` return ~80 providers still use).
+*
+* A function rather than an inline `result?.outcome === 'skipped'` test at
+* ten call sites so the back-compat `void` reading lives in ONE place: the
+* signature is `Promise<void | ResourceDeleteResult>`, so a caller that awaits
+* it holds `void | ResourceDeleteResult`, which TypeScript will happily let
+* you compare against nothing useful.
+*/
+function deleteSkipReason(result) {
+	if (!result || result.outcome !== "skipped") return void 0;
+	if (typeof result.reason !== "string") return UNSPECIFIED_SKIP_REASON;
+	const trimmed = result.reason.trim();
+	return trimmed === "" ? UNSPECIFIED_SKIP_REASON : trimmed;
+}
+/**
+* Stand-in for a `'skipped'` outcome whose producer supplied no `reason`.
+*
+* Deliberately says the cause is unknown rather than inventing one: the line
+* it renders on is the user's only signal that the resource survived, and a
+* fabricated cause would send them looking in the wrong place.
+*/
+const UNSPECIFIED_SKIP_REASON = "no reason reported by the provider";
+/**
+* The sentence every deploy-side skip renders, in the log line AND in the
+* `Error` the sites that must FAIL the resource throw.
+*
+* Wording rules, both load-bearing:
+*
+* 1. It says the resource was NOT deleted and MAY STILL EXIST. A skip issued
+*    no AWS call at every producer but `NestedStackProvider.delete`, so the
+*    old resource is presumed alive — which is the whole reason a replacement
+*    site cannot proceed to create its replacement beside it.
+* 2. It must NOT contain any phrase the callers' already-deleted classifiers
+*    substring-match (`does not exist` / `was not found` / `not found` /
+*    `No policy found` / `NoSuchEntity` / `NotFoundException` /
+*    `ResourceNotFoundException`). Reading a skip as "already gone" is exactly
+*    the mis-accounting this change exists to remove, and the deploy engine's
+*    DELETE branch and its update-not-supported fallback each carry such a
+*    classifier. The call sites additionally handle the skip OUTSIDE their
+*    `catch`, so a future `reason` carrying one of those phrases still cannot
+*    reach a classifier — belt and braces, because `reason` is provider text.
+*/
+function deleteSkippedMessage(logicalId, physicalId, reason, duringClause) {
+	return `cdkd could not address ${logicalId} (${physicalId}) ${duringClause}, so it was NOT deleted and may still exist: ${reason}`;
+}
+/**
+* Attach an {@link IndeterminateGuard} to whatever a delete arm was about to
+* return (issue [#2301](https://github.com/go-to-k/cdkd/issues/2301)).
+*
+* `undefined` in, `undefined` out when there is no guard to carry — so a
+* provider whose guard reached a verdict keeps returning the back-compat
+* `void` the ~80 providers that return it use, and nothing about the
+* existing shape changes on the hot path.
+*
+* A `'skipped'` result keeps its outcome and its `reason`: a guard that could
+* not answer and a delete that could not be addressed are independent facts,
+* and collapsing either into the other loses one of them.
+*/
+function withIndeterminateGuard(result, guard) {
+	if (!guard) return result;
+	const indeterminateGuards = [...Array.isArray(result?.indeterminateGuards) ? result.indeterminateGuards : [], guard];
+	if (result && result.outcome === "skipped") return {
+		...result,
+		indeterminateGuards
+	};
+	return {
+		...result ?? {},
+		outcome: "deleted",
+		indeterminateGuards
+	};
+}
+/**
+* The guards a delete result reports as INDETERMINATE — those that ran, could
+* not reach a verdict, and were therefore not enforced while cdkd proceeded
+* (issue [#2301](https://github.com/go-to-k/cdkd/issues/2301)). Empty for the
+* overwhelmingly common case, including the back-compat `void` return.
+*
+* Defensive in the same shape and for the same reason as
+* {@link deleteSkipReason}: the value crosses into a DURABLE record
+* (`deployments/*.jsonl`), providers are the least type-checked layer in the
+* repo (a hand-built test double, a future arm, a JS provider), and a
+* malformed entry must degrade to "not reported" rather than crash the delete
+* path or persist `guard: undefined`. `typeof` rather than `?.trim()` for the
+* same reason `deleteSkipReason` uses it — a non-string makes `.trim` itself
+* `undefined`, i.e. a TypeError thrown out of the very path this hardens.
+*
+* Entries whose `guard` or `reason` is missing / non-string / blank are
+* DROPPED rather than defaulted, which is the opposite of `deleteSkipReason`'s
+* choice and deliberately so: there a default is the user's only signal that a
+* live resource survived, so inventing `UNSPECIFIED_SKIP_REASON` beats
+* silence. Here a guard row with no guard id and no cause says only "something
+* somewhere was not checked", which cannot be acted on — and it would count
+* toward the destroy summary's tally, turning an unactionable row into a
+* number the operator has to chase.
+*/
+function deleteIndeterminateGuards(result) {
+	const raw = result?.indeterminateGuards;
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const entry of raw) {
+		if (!entry || typeof entry !== "object") continue;
+		const { guard, reason } = entry;
+		if (typeof guard !== "string" || typeof reason !== "string") continue;
+		const trimmedGuard = guard.trim();
+		const trimmedReason = reason.trim();
+		if (trimmedGuard === "" || trimmedReason === "") continue;
+		out.push({
+			guard: trimmedGuard,
+			reason: trimmedReason
+		});
+	}
+	return out;
+}
+
 //#endregion
 //#region src/provisioning/json-patch-generator.ts
 /**
@@ -20941,6 +21113,19 @@ function requiresCcDeleteIdentityCheck(resourceType) {
 	return CC_DELETE_IDENTITY_CHECKED_TYPES.has(resourceType);
 }
 /**
+* `IndeterminateGuard.guard` for the pre-flight identity confirmation above
+* (issue [#2301](https://github.com/go-to-k/cdkd/issues/2301)).
+*
+* Named for the GUARD, not for the type or the API it happens to probe today:
+* the value is persisted into `deployments/*.jsonl` and is therefore a user
+* contract, and the set it fires for is
+* {@link CC_DELETE_IDENTITY_CHECKED_TYPES} — a set that is expected to grow to
+* any type whose physical id is globally unique while its resource is
+* regional. `s3` / `get-bucket-location` in the id would go stale on the first
+* such addition, and a stale id cannot be corrected without breaking readers.
+*/
+const CC_DELETE_REGION_IDENTITY_GUARD = "cc-delete-region-identity";
+/**
 * The region a `GetBucketLocation` answer denotes, canonicalized.
 *
 * Two legacy wire shapes, both still returned, which is why this is a function
@@ -21152,11 +21337,11 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		await this.assertRecordedRegionAgainstClient("pre-delete", context?.expectedRegion, resourceType, logicalId, physicalId);
-		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
+		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-sRJzRAe_.js").then((n) => n.n);
-			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
+			const { ASGProvider } = await import("./asg-provider-DsyALMVT.js").then((n) => n.n);
+			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
 		if (isProtectedEc2Instance) await disableInstanceApiTermination(getAwsClients().ec2, physicalId, this.logger);
@@ -21174,13 +21359,13 @@ var CloudControlProvider = class {
 			this.logger.debug(`Delete request submitted for ${logicalId}, token: ${deleteResponse.ProgressEvent.RequestToken}`);
 			await this.waitForOperation(deleteResponse.ProgressEvent.RequestToken, logicalId, "DELETE", resourceType);
 			this.logger.debug(`Deleted resource ${logicalId}`);
-			return;
+			return withIndeterminateGuard(void 0, indeterminateGuard);
 		} catch (error) {
 			const err = error;
 			if (error instanceof CloudControlOperationFailedError && error.ccOperation === "DELETE" && error.ccErrorCode === "NotFound" || err.name === "ResourceNotFoundException" || err.message?.includes("does not exist") || err.message?.includes("not found") || err.message?.includes("NotFound")) {
 				await this.assertRecordedRegionAgainstClient("not-found", context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Resource ${logicalId} already deleted (not found), treating as success`);
-				return;
+				return withIndeterminateGuard(void 0, indeterminateGuard);
 			}
 			if (isProtectedEc2Instance && isTerminationProtectionPropagationError(err.message ?? "") && attempt < maxAttempts) {
 				this.logger.debug(`Cloud Control delete of ${logicalId} raced the DisableApiTermination flip-off (attempt ${attempt}/${maxAttempts}); re-flipping and retrying`);
@@ -21316,21 +21501,43 @@ var CloudControlProvider = class {
 	* indeterminate arm, which PROCEEDS. `src/utils/aws-region-resolver.ts`
 	* records the same finding, and the SDK-side guard re-learned it the
 	* expensive way.
+	*
+	* RETURN VALUE (issue #2301 item 3). `undefined` means the guard reached a
+	* verdict — it confirmed the region, or the type is unguarded, or the bucket
+	* is absent (a fourth outcome, not an indeterminate one, per the paragraph
+	* above). An {@link IndeterminateGuard} means it could NOT, and the caller
+	* must carry it out through `ResourceDeleteResult` so the destroy runner can
+	* persist a `RESOURCE_GUARD_INDETERMINATE` event. A MISMATCH still throws.
+	*
+	* The two indeterminate arms below produce THREE distinct `reason` texts,
+	* not two, and that is deliberate: the region-resolution arm falls THROUGH
+	* into the no-region warn, so before this change a client whose SDK region
+	* chain REJECTED was reported identically to one that was never asked. The
+	* remedies differ (fix the credential chain / pass `--region` vs. repair the
+	* state record), so the durable record — and the warn beside it — names
+	* which happened.
 	*/
 	async confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context) {
-		if (!requiresCcDeleteIdentityCheck(resourceType)) return;
+		if (!requiresCcDeleteIdentityCheck(resourceType)) return void 0;
 		const recordedRegion = context?.expectedRegion?.trim();
 		let expectedRegion = recordedRegion === void 0 || recordedRegion === "" ? void 0 : recordedRegion;
+		let clientRegionError;
 		if (expectedRegion === void 0) try {
 			const clientRegion = (await this.cloudControlClient.config.region())?.trim();
 			expectedRegion = clientRegion === void 0 || clientRegion === "" ? void 0 : clientRegion;
 		} catch (error) {
-			this.logger.debug(`Could not resolve the Cloud Control client region while confirming ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			const clientRegionFailure = describeAwsFailure(error);
+			clientRegionError = clientRegionFailure.summary;
+			this.logger.debug(`Could not resolve the Cloud Control client region while confirming ${physicalId}: ${clientRegionFailure.detail}`);
 			expectedRegion = void 0;
 		}
 		if (expectedRegion === void 0) {
-			this.logger.warn(`Could not confirm that ${resourceType} ${physicalId} (${logicalId}) is the resource this destroy targets: neither the stack state nor the AWS client reports a region. Proceeding with the delete.`);
-			return;
+			const reason = clientRegionError === void 0 ? `neither the stack state nor the AWS client reports a region` : `the stack state records no region and the AWS client's region could not be resolved: ${clientRegionError}`;
+			this.logger.warn(`Could not confirm that ${resourceType} ${physicalId} (${logicalId}) is the resource this destroy targets: ${reason.replace(/[.\s]+$/, "")}. Proceeding with the delete.`);
+			return {
+				guard: CC_DELETE_REGION_IDENTITY_GUARD,
+				reason
+			};
 		}
 		const wantRegion = canonicalizeRegion(expectedRegion);
 		let actualRegion;
@@ -21341,9 +21548,14 @@ var CloudControlProvider = class {
 				this.logger.debug(`Bucket ${physicalId} (${logicalId}) is already absent; leaving the delete to the Cloud Control idempotency path`);
 				return;
 			}
-			const reason = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Could not confirm which region S3 bucket ${physicalId} (${logicalId}) lives in before deleting it: ${reason}. S3 bucket names are globally unique, so cdkd cannot rule out that this name denotes a bucket in another region. Grant s3:GetBucketLocation on the bucket to enable the check. Proceeding with the delete.`);
-			return;
+			const failure = describeAwsFailure(error);
+			this.logger.debug(`s3:GetBucketLocation on ${physicalId} (${logicalId}) failed: ${failure.detail}`);
+			const summarySentence = failure.summary.replace(/[.\s]+$/, "");
+			this.logger.warn(`Could not confirm which region S3 bucket ${physicalId} (${logicalId}) lives in before deleting it: ${summarySentence}. S3 bucket names are globally unique, so cdkd cannot rule out that this name denotes a bucket in another region. Grant s3:GetBucketLocation on the bucket to enable the check. Proceeding with the delete.`);
+			return {
+				guard: CC_DELETE_REGION_IDENTITY_GUARD,
+				reason: `s3:GetBucketLocation on ${physicalId} could not be answered: ${failure.summary}`
+			};
 		}
 		if (actualRegion === wantRegion) {
 			this.logger.debug(`Confirmed S3 bucket ${physicalId} (${logicalId}) lives in ${wantRegion} before deleting it`);
@@ -29019,77 +29231,6 @@ async function withResourceDeadline(operation, opts) {
 	});
 }
 
-//#endregion
-//#region src/deployment/delete-outcome.ts
-/**
-* Deploy-side consumption of {@link ResourceDeleteResult} (issue
-* [#1762](https://github.com/go-to-k/cdkd/issues/1762)) — the twin of what
-* `src/cli/commands/destroy-runner.ts` does for `cdkd destroy`.
-*
-* Issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) gave
-* `ResourceProvider.delete` an optional return value whose `'skipped'` arm
-* means **the resource this result names was NOT destroyed and may still be
-* ALIVE**, and taught the destroy runner to report it. Every OTHER
-* `provider.delete(...)` call site — the deploy engine's template-DELETE
-* branch, its four replacement / recreate delete sites, and the five
-* `rollback-executor.ts` delete arms — discarded the value, so the same skip
-* printed as `deleted`, counted as `deleted`, and dropped the state record.
-*
-* **The module must stay a LEAF — no imports beyond the type, ever.** Same
-* reason as `src/provisioning/nested-stack-messages.ts`: both the deploy
-* engine and the rollback executor consume it, and those two already sit on a
-* dense import ring (engine -> executor -> provider registry -> every
-* provider). A helper that pulled anything else in would close it.
-*/
-/**
-* The `reason` of a `'skipped'` delete outcome, or `undefined` when the
-* provider reported a delete (`{ outcome: 'deleted' }` or the back-compat
-* `void` return ~80 providers still use).
-*
-* A function rather than an inline `result?.outcome === 'skipped'` test at
-* ten call sites so the back-compat `void` reading lives in ONE place: the
-* signature is `Promise<void | ResourceDeleteResult>`, so a caller that awaits
-* it holds `void | ResourceDeleteResult`, which TypeScript will happily let
-* you compare against nothing useful.
-*/
-function deleteSkipReason(result) {
-	if (!result || result.outcome !== "skipped") return void 0;
-	if (typeof result.reason !== "string") return UNSPECIFIED_SKIP_REASON;
-	const trimmed = result.reason.trim();
-	return trimmed === "" ? UNSPECIFIED_SKIP_REASON : trimmed;
-}
-/**
-* Stand-in for a `'skipped'` outcome whose producer supplied no `reason`.
-*
-* Deliberately says the cause is unknown rather than inventing one: the line
-* it renders on is the user's only signal that the resource survived, and a
-* fabricated cause would send them looking in the wrong place.
-*/
-const UNSPECIFIED_SKIP_REASON = "no reason reported by the provider";
-/**
-* The sentence every deploy-side skip renders, in the log line AND in the
-* `Error` the sites that must FAIL the resource throw.
-*
-* Wording rules, both load-bearing:
-*
-* 1. It says the resource was NOT deleted and MAY STILL EXIST. A skip issued
-*    no AWS call at every producer but `NestedStackProvider.delete`, so the
-*    old resource is presumed alive — which is the whole reason a replacement
-*    site cannot proceed to create its replacement beside it.
-* 2. It must NOT contain any phrase the callers' already-deleted classifiers
-*    substring-match (`does not exist` / `was not found` / `not found` /
-*    `No policy found` / `NoSuchEntity` / `NotFoundException` /
-*    `ResourceNotFoundException`). Reading a skip as "already gone" is exactly
-*    the mis-accounting this change exists to remove, and the deploy engine's
-*    DELETE branch and its update-not-supported fallback each carry such a
-*    classifier. The call sites additionally handle the skip OUTSIDE their
-*    `catch`, so a future `reason` carrying one of those phrases still cannot
-*    reach a classifier — belt and braces, because `reason` is provider text.
-*/
-function deleteSkippedMessage(logicalId, physicalId, reason, duringClause) {
-	return `cdkd could not address ${logicalId} (${physicalId}) ${duringClause}, so it was NOT deleted and may still exist: ${reason}`;
-}
-
 //#endregion
 //#region src/deployment/update-outcome.ts
 /**
@@ -33143,5 +33284,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, PartialFailureError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, normalizeAwsError as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, DynamicReferenceRegionAmbiguousError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, LockError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LocalStartServiceError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StackTerminationProtectionError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, isTransientServerError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isMarkedNonRetryable as Hr, withRetry as Ht, red as I, runDockerForeground as In, StateError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, retryClassificationText as Jr, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, markNonRetryable as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, SynthesisError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceTimeoutError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, ResourceUpdateNotSupportedError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, MissingCdkCliError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackHasActiveImportsError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, formatError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DeployCancelledError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalMigrateError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isRetryableTransientError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, withErrorHandling as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, isThrottlingError as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, __exportAll as Yr, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, AssetError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, expectedOwnerParam as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, CrossAccountSecretRefusalError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, derivePartitionAndUrlSuffix as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, clearBucketRegionCache as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, resolveBucketRegion as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, setAwsClients as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, resetAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ProvisioningError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, NestedStackChildDirectDestroyError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, AssemblyReader as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, getAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, PARTITION_TABLE as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, AwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, markRedactedCause as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, canonicalizeRegion as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, processStackMessages as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, CdkdError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalInvokeBuildError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DependencyError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, ConfigError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, isCdkdError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-3EmPzxSN.js.map
+export { DEFAULT_STATE_PREFIX as $, warnDeprecatedNoPrefixCliFlag as $n, maskSecretsInError as $t, bold as A, buildDenyExternalAccessPolicy as An, NestedStackChildDirectDestroyError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, getDockerImageBySourceHash as Bn, isCdkdError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, ensureAssetStorage as Cn, DeployCancelledError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, readBootstrapMarkerBody as Dn, LocalStartServiceError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, parseBootstrapMarker as En, LocalMigrateError as Er, configStringRefusal as Et, yellow as F, getDockerCmd as Fn, StackHasActiveImportsError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, resolveApp as Gn, isThrottlingError as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, synthesisStatusMessage as Hn, withErrorHandling as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, partitionSensitiveEnv as In, StackTerminationProtectionError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveSkipPrefix as Jn, markRedactedCause as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, resolveAutoAssetStorage as Kn, isTransientServerError as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, runDockerForeground as Ln, StateError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDockerImage as Mn, ProvisioningError as Mr, classifyReplaySecretRegion as Mt, green as N, dockerSpawnEnvWithSensitive as Nn, ResourceTimeoutError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, validateAssetBucketName as On, LockError as Or, replayWarn as Ot, red as P, formatDockerLoginError as Pn, ResourceUpdateNotSupportedError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, stateBucketExistenceConfirmed as Qn, isSingleDynamicReferenceToken as Qt, exportAliasCollisionScrubWarning as R, runDockerStreaming as Rn, SynthesisError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, assertAssetBucketRegion as Sn, DependencyError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, isCrossRegionRedirect as Tn, LocalInvokeBuildError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, getDefaultStateBucketName as Un, isMarkedNonRetryable as Ur, withRetry as Ut, stateKeySecretExposure as V, Synthesizer as Vn, normalizeAwsError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, getLegacyStateBucketName as Wn, isRetryableTransientError as Wr, DagBuilder as Wt, maskDeep as X, resolveStateBucketWithDefaultAndSource as Xn, __exportAll as Xr, dynamicReferenceTokens as Xt, createMaskedRetryLogger as Y, resolveStateBucketWithDefault as Yn, retryClassificationText as Yr, createSecretMasker as Yt, maskerOrIdentity as Z, resolveUseCdkBootstrapAssets as Zn, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, rewriteTemplateAssetReferences as _n, setAwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, S3StateBackend as an, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, AssetModeResolver as bn, ConfigError as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, importableOutputKeys as cn, canonicalizeRegion as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, AssetPublisher as dn, processStackMessages as dr, isTerminationProtectionPropagationError as dt, maskSecretsInText as en, CFN_TEMPLATE_BODY_LIMIT as er, beginCommandInterruptScope as et, withResourceDeadline as f, stringifyValue as fn, clearBucketRegionCache as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, loadPublishableAssetManifest as gn, resetAwsClients as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, createAssetRedirectResolver as hn, getAwsClients as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, displaySafe as in, uploadCfnTemplate as ir, startInterruptWatch as it, cyan as j, describeAwsFailure as jn, PartialFailureError as jr, requireConfigString as jt, formatResourceLine as k, validateContainerRepoName as kn, MissingCdkCliError as kr, requireConfigArray as kt, replayRollback as l, importableOutputs as ln, derivePartitionAndUrlSuffix as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildAssetRedirectMap as mn, AwsClients as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, scrubResourceRecord as nn, MIGRATE_TMP_PREFIX as nr, interruptWatchListenerCount as nt, planFailedOps as o, rebuildClientForBucketRegion as on, expectedOwnerParam as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, WorkGraph as pn, resolveBucketRegion as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveCaptureObservedState as qn, markNonRetryable as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, LockManager as rn, findLargeInlineResources as rr, isInterruptedWaitError as rt, planRollback as s, exportNamesCarriedFrom as sn, PARTITION_TABLE as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, redactSecretsForState as tn, CFN_TEMPLATE_URL_LIMIT as tr, endCommandInterruptScope as tt, updatePartialMessage as u, shouldRetainResource as un, AssemblyReader as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, escapeRegExp$1 as vn, AssetError as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, getBootstrapMarkerKey as wn, DynamicReferenceRegionAmbiguousError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, BOOTSTRAP_MARKER_PREFIX as xn, CrossAccountSecretRefusalError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, stripControlChars as yn, CdkdError as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, AssetManifestLoader as zn, formatError as zr, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-BgpCWFvY.js.map