@go-to-k/cdkd 0.285.5 → 0.285.7

package/dist/{deploy-engine-CSBoL-Az.js → deploy-engine-DmWPwiyQ.js}

@@ -1,6 +1,6 @@
-import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-Dz3Le2Pw.js";
+import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-DyTk5GeO.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-neBHYAq9.js";
+import { t as getCdkdVersion } from "./version-DlUEyyGa.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3880,6 +3880,44 @@ async function expectedOwnerParam(client) {
 	return owner ? { ExpectedBucketOwner: owner } : {};
 }
 
+//#endregion
+//#region src/utils/display-safe.ts
+/**
+* Make an untrusted value safe to render in a terminal or persist into a log.
+*
+* A LEAF module with no imports, and deliberately in `src/utils/` rather than
+* beside its first caller: issue [#2170](https://github.com/go-to-k/cdkd/issues/2170)'s
+* review found the same rule being widened BY HAND one module at a time and
+* missing an instance every round — the change sanitized 1 of 5 readers of
+* `LockInfo.owner`. One shared definition, imported by everything that renders
+* such a value, is what stops the next reader from inheriting nothing.
+*
+* The stripped class is wider than C0 + DEL, which a first cut used and which
+* misses every mechanism that actually forges a line:
+*
+* - `U+0085` (NEL) and the C1 range — xterm reads `U+009B` as CSI in UTF-8;
+* - `U+2028` / `U+2029` — this text is PERSISTED and re-rendered by JSON and
+*   web log viewers, where both are line terminators;
+* - `U+202A`-`U+202E` / `U+2066`-`U+2069` — the Trojan-Source bidi overrides
+*   and isolates, which visually REORDER the command being pasted.
+*
+* Known residual, recorded rather than implied away: the invisible formatters
+* (`U+200B`-`U+200D`, `U+FEFF`) and the bidi MARKS (`U+200E` / `U+200F` /
+* `U+061C`) survive, as do bare RTL letters, which no denylist can reach. All
+* of them can only make a rendered name differ visually from its bytes — the
+* command a user pastes still acts on exactly what is shown, and the blast
+* radius stays the attacker's own stack name.
+*
+* A caller whose value has a KNOWN ASCII charset (a stack name, an AWS region)
+* should pass `asciiOnly`, which is a positive allowlist and therefore has no
+* such residual at all.
+*/
+function displaySafe(value, opts) {
+	if (value === void 0 || value === null) return "";
+	const text = String(value);
+	return (opts?.asciiOnly ? text.replace(/[^ -~]/g, " ") : text.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g, " ")).trim();
+}
+
 //#endregion
 //#region src/state/s3-noncurrent-version-purge.ts
 /**
@@ -3971,7 +4009,7 @@ async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {})
 		for (const key of affected) recordFailure(failed, key, describe$1(error));
 	}
 	if (failed.size > 0) {
-		const named = [...failed.entries()].slice(0, MAX_NAMED_FAILURES).map(([key, reasons]) => `${key} (${reasons.join("; ")})`);
+		const named = [...failed.entries()].slice(0, MAX_NAMED_FAILURES).map(([key, reasons]) => displaySafe(`${key} (${reasons.join("; ")})`));
 		const elided = failed.size - named.length;
 		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${bucket}. Their previous versions survive and remain readable via GetObject with a VersionId (${options.objectDescription ?? DEFAULT_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
 	}
@@ -4023,6 +4061,7 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 					}
 				}));
 				for (const err of deleted.Errors ?? []) {
+					if (err.Code === "NoSuchVersion") continue;
 					const reason = `version ${err.VersionId ?? "<unknown>"}: ${err.Code ?? "Error"}` + (err.Message ? ` - ${err.Message}` : "");
 					if (err.Key !== void 0) recordFailure(failed, err.Key, reason);
 					else {
@@ -5525,8 +5564,13 @@ var FileAssetPublisher = class {
 * Output handling: stdout/stderr are collected in memory unconditionally so
 * `runDockerStreaming` can return them to the caller for error wrapping.
 * When the logger is at debug level (i.e. the user passed `--verbose`),
-* the chunks are ALSO mirrored to `process.stdout` / `process.stderr` so
-* the user sees live build progress.
+* the chunks are ALSO mirrored live so the user sees build progress —
+* stderr always to `process.stderr`, and stdout to `process.stdout` EXCEPT
+* while a command holds a payload reservation
+* ({@link isStdoutReservedForPayload}), where it joins the logger on stderr
+* so a child's diagnostics cannot land in the payload
+* ([#2410](https://github.com/go-to-k/cdkd/issues/2410)). The same
+* reservation redirects `spawnForeground`'s inherited fd 1 to fd 2.
 */
 /**
 * Return the docker-compatible CLI binary to invoke. Matches CDK CLI:
@@ -5573,7 +5617,8 @@ async function spawnStreaming(cmd, args, options = {}) {
 		const stderrChunks = [];
 		child.stdout.on("data", (chunk) => {
 			stdoutChunks.push(chunk);
-			if (streamLive) process.stdout.write(chunk);
+			if (streamLive) if (isStdoutReservedForPayload()) process.stderr.write(chunk);
+			else process.stdout.write(chunk);
 		});
 		child.stderr.on("data", (chunk) => {
 			stderrChunks.push(chunk);
@@ -5617,25 +5662,42 @@ async function spawnStreaming(cmd, args, options = {}) {
 * exit, so the caller can wrap with its own error class.
 *
 * Differs from {@link runDockerStreaming} in two ways:
-*   1. `stdio: 'inherit'` — output is NOT captured, so terminal control codes
-*      (color, progress bar overwrites) flow through unchanged. This is the
-*      load-bearing reason for the split: `docker pull`'s progress bars only
-*      animate properly when stdout is a real TTY connected to the parent.
+*   1. The child INHERITS descriptors — output is NOT captured, so terminal
+*      control codes (color, progress bar overwrites) flow through
+*      unchanged. That is the load-bearing reason for the split:
+*      `docker pull`'s progress bars only animate when the child writes to a
+*      real TTY rather than a pipe. Under a payload reservation the child's
+*      fd 1 is redirected to the parent's fd 2 rather than piped, precisely
+*      so it keeps a descriptor and not a pipe — though the animation then
+*      depends on STDERR being a terminal, and degrades to plain lines under
+*      `2> file` (issue
+*      [#2410](https://github.com/go-to-k/cdkd/issues/2410)).
 *   2. No `input` / `streamLive` options — inherit-mode has nothing to
 *      capture and nothing to mirror.
 *
-* Used by the `--verbose`-mode `docker pull` plumbing in `docker-runner.ts`
-* and `ecr-puller.ts` (visible layer progress). Non-verbose pulls go through
-* {@link runDockerStreaming} so stderr can be folded into the error message.
+* Used by the `docker pull` plumbing in `docker-runner.ts` and
+* `ecr-puller.ts`. Those two callers differ, and the difference matters
+* enough to state: `docker-runner.ts` reaches this only under `--verbose`,
+* while `ecr-puller.ts` runs it UNCONDITIONALLY, which is what made the
+* pre-#2410 stdout leak reachable with no flag at all. Non-verbose pulls in
+* `docker-runner.ts` go through {@link runDockerStreaming} instead, so
+* stderr can be folded into the error message.
 */
 async function runDockerForeground(args, options = {}) {
 	return spawnForeground(getDockerCmd(), args, options);
 }
 /**
-* Foreground (stdio-inherit) spawn — the inherit-mode counterpart to
+* Foreground (descriptor-inheriting) spawn — the inherit-mode counterpart to
 * {@link spawnStreaming}. Used by {@link runDockerForeground} for docker-CLI
 * subprocesses.
 *
+* "inherit" is not unqualified, and THIS is the function that qualifies it:
+* while a command holds a payload reservation
+* ({@link isStdoutReservedForPayload}) the child's fd 1 is redirected to the
+* parent's fd 2, so its output cannot land in the payload
+* ([#2410](https://github.com/go-to-k/cdkd/issues/2410)). stdin and stderr
+* are inherited either way. See the inline note at the `spawn` call.
+*
 * The ENOENT branch crafts a docker-specific install hint ("Install Docker
 * (or set CDK_DOCKER ...)"), so non-docker callers reusing this helper
 * would see a misleading error on missing-binary failures. Keep the binary
@@ -5648,7 +5710,11 @@ async function spawnForeground(cmd, args, options = {}) {
 		const child = spawn(cmd, args, {
 			cwd: options.cwd,
 			env,
-			stdio: "inherit"
+			stdio: isStdoutReservedForPayload() ? [
+				"inherit",
+				2,
+				"inherit"
+			] : "inherit"
 		});
 		child.once("error", (err) => {
 			if (err.code === "ENOENT") {
@@ -8665,44 +8731,6 @@ function isNoSuchKey(error) {
 	return error?.name === "NoSuchKey";
 }
 
-//#endregion
-//#region src/utils/display-safe.ts
-/**
-* Make an untrusted value safe to render in a terminal or persist into a log.
-*
-* A LEAF module with no imports, and deliberately in `src/utils/` rather than
-* beside its first caller: issue [#2170](https://github.com/go-to-k/cdkd/issues/2170)'s
-* review found the same rule being widened BY HAND one module at a time and
-* missing an instance every round — the change sanitized 1 of 5 readers of
-* `LockInfo.owner`. One shared definition, imported by everything that renders
-* such a value, is what stops the next reader from inheriting nothing.
-*
-* The stripped class is wider than C0 + DEL, which a first cut used and which
-* misses every mechanism that actually forges a line:
-*
-* - `U+0085` (NEL) and the C1 range — xterm reads `U+009B` as CSI in UTF-8;
-* - `U+2028` / `U+2029` — this text is PERSISTED and re-rendered by JSON and
-*   web log viewers, where both are line terminators;
-* - `U+202A`-`U+202E` / `U+2066`-`U+2069` — the Trojan-Source bidi overrides
-*   and isolates, which visually REORDER the command being pasted.
-*
-* Known residual, recorded rather than implied away: the invisible formatters
-* (`U+200B`-`U+200D`, `U+FEFF`) and the bidi MARKS (`U+200E` / `U+200F` /
-* `U+061C`) survive, as do bare RTL letters, which no denylist can reach. All
-* of them can only make a rendered name differ visually from its bytes — the
-* command a user pastes still acts on exactly what is shown, and the blast
-* radius stays the attacker's own stack name.
-*
-* A caller whose value has a KNOWN ASCII charset (a stack name, an AWS region)
-* should pass `asciiOnly`, which is a positive allowlist and therefore has no
-* such residual at all.
-*/
-function displaySafe(value, opts) {
-	if (value === void 0 || value === null) return "";
-	const text = String(value);
-	return (opts?.asciiOnly ? text.replace(/[^ -~]/g, " ") : text.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g, " ")).trim();
-}
-
 //#endregion
 //#region src/state/lock-manager.ts
 /**
@@ -8726,6 +8754,15 @@ const RENEWAL_TTL_FRACTION = 4;
 /** Floor, so a pathologically small TTL cannot spin the event loop. */
 const MIN_RENEWAL_INTERVAL_MS = 1e3;
 /**
+* What a surviving `lock.json` version holds, for the purge warning's
+* parenthetical.
+*
+* The helper makes this per-caller precisely so a reader chasing the warning is
+* told which object to go and inspect; `lock.json` is the one call site whose
+* content is NOT a secret, and saying so is more useful than a vague phrase.
+*/
+const LOCK_OBJECT_DESCRIPTION = "a stack lock heartbeat, which records the lock owner, its acquisition timestamp, its deadline and the operation name — no secret, but one row per renewal";
+/**
 * S3-based lock manager using conditional writes (If-None-Match)
 *
 * Implements distributed locking using S3's If-None-Match: "*" condition
@@ -8924,6 +8961,8 @@ var LockManager = class {
 							return false;
 						}
 						throw retryError;
+					} finally {
+						await this.purgeLockVersions(key, "reap");
 					}
 				}
 				return false;
@@ -9097,6 +9136,8 @@ var LockManager = class {
 				}
 			}
 			throw new LockError(`Failed to release lock for stack '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+		} finally {
+			await this.purgeLockVersions(this.getLockKey(stackName, region), "release");
 		}
 	}
 	/**
@@ -9160,12 +9201,17 @@ var LockManager = class {
 		const where = `${stackName}${region ? ` (${region})` : ""}`;
 		const lockInfo = await this.getLockInfo(stackName, region).catch(() => null);
 		this.logger.warn(lockInfo ? `Force releasing lock for stack: ${where}, owner: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expired: ${this.isLockExpired(lockInfo)}` : `Force releasing lock for stack: ${where} (no lock body read — absent or unparseable; deleting the object either way, since a lock cdkd cannot read is a lock nothing else can clear)`);
-		const held = this.heldLocks.get(this.getLockKey(stackName, region));
+		const key = this.getLockKey(stackName, region);
+		const held = this.heldLocks.get(key);
 		if (held) {
 			this.stopRenewal(held);
 			held.releasing = Promise.resolve();
 		}
-		await this.deleteLock(stackName, region);
+		try {
+			await this.deleteLock(stackName, region);
+		} finally {
+			await this.purgeLockVersions(key, "reap");
+		}
 	}
 	/**
 	* Internal method to delete the lock file from S3.
@@ -9175,6 +9221,17 @@ var LockManager = class {
 	* caller read or wrote. S3 evaluates the condition against the CURRENT
 	* version, which is the right unit here even on the versioned state bucket:
 	* the current version IS the live lock.
+	*
+	* EVERY CALLER MUST PAIR THIS WITH {@link purgeLockVersions} (issue
+	* [#2346](https://github.com/go-to-k/cdkd/issues/2346) site 5). The delete
+	* writes a DELETE MARKER on the versioned state bucket and leaves every
+	* prior body readable, so a delete on its own grows the key forever. The
+	* purge is NOT folded in here, for two reasons that are both per-call-site:
+	* the log level differs (see {@link LockPurgePath}), and the takeover path
+	* must purge AFTER its re-acquisition PUT rather than immediately after the
+	* delete. `tests/unit/state/lock-noncurrent-version-purge.test.ts` parses
+	* this file and fails if a caller of this method does not also call the
+	* purge, so a fifth call site cannot quietly skip it.
 	*/
 	async deleteLock(stackName, region, etag) {
 		await this.ensureClientForBucket();
@@ -9187,6 +9244,98 @@ var LockManager = class {
 		}));
 	}
 	/**
+	* Delete the lock key's NONCURRENT versions after a delete marker has been
+	* landed on it (issue [#2346](https://github.com/go-to-k/cdkd/issues/2346)
+	* site 5).
+	*
+	* ## Why the lock key needs this at all
+	*
+	* `cdkd bootstrap` turns VERSIONING ON for the state bucket, so
+	* {@link deleteLock} writes a delete marker and every earlier body stays
+	* readable through `GetObject` with a `VersionId`. Renewal writes one version
+	* every {@link MAX_RENEWAL_INTERVAL_MS} (2 minutes at the default 30-minute
+	* TTL, so a 30-minute deploy mints about fifteen), `deleteState` never
+	* sweeps the lock key, and nothing else ever did — so the chain was
+	* monotonic in stacks EVER deployed. 452 versions were measured on a single
+	* key. Nothing in a `LockInfo` is a secret, so this is bucket cost and
+	* listing noise rather than disclosure; it is still unbounded.
+	*
+	* ## Why the SHARED helper, and why that is safe on a lock
+	*
+	* A per-`VersionId` scheme (remember what this process minted, delete
+	* exactly that) was designed and REJECTED on review. Its hazards were all
+	* created by the mechanism: deleting one's OWN delete marker resurrects a
+	* stale lock whenever a batch partially fails, a per-id delete has no
+	* `IsLatest` guard so it can remove the CURRENT version on a refusal branch,
+	* a `"null"` version id under suspended versioning is a legal delete target,
+	* and the 1000-entry `DeleteObjects` cap forces a re-implementation of the
+	* shared helper's batching. The shared helper's `IsLatest` filter removes
+	* every one of them: it can never touch what is current, which is exactly
+	* the live lock — ours or anyone else's.
+	*
+	* That filter is also what makes it correct to run this from a `finally`,
+	* including on the arms where the delete was REFUSED. Purging noncurrent
+	* versions while our own lock is still the current one is harmless.
+	*
+	* ## Level, and the one UX regression this avoids
+	*
+	* The four sites already purging (rollback journal, bootstrap marker,
+	* transient template, custom-resource response) all warn, because what
+	* survives there may be a secret and they fire on rare paths. `lock.json` is
+	* neither: it holds no secret and `'release'` fires at the tail of EVERY
+	* mutating command. Inheriting WARN would mean a user on the pre-#2340
+	* four-action IAM policy starts seeing a warning after every single command,
+	* about bucket tidiness. Be precise about WHICH user that is: a principal
+	* missing `s3:ListBucketVersions` already gets a warn on every successful
+	* deploy from `deleteRollbackJournal`'s purge, so nothing changes for them.
+	* The one this split protects is the principal who HAS `ListBucketVersions`
+	* but lacks `s3:DeleteObjectVersion` — silent today, and newly noisy without
+	* it. So
+	* release-path failures go to `debug` and only the rare `'reap'` paths warn,
+	* which is the cost profile `docs/state-management.md` means by "only the
+	* cleanup paths that need them".
+	*
+	* A warn-once-per-process dedupe was the other option and is not taken, for
+	* the reason `s3-noncurrent-version-purge.ts` gives for rejecting one: it
+	* needs module-global state, which this repo has been bitten by under
+	* `--stack-concurrency > 1`.
+	*
+	* NEVER THROWS. The helper guarantees that for itself, but
+	* `ensureClientForBucket()` and `ownerParam()` sit outside it, so the wrap
+	* below is what makes the contract true. Only `ensureClientForBucket()` is a
+	* known rejector (`GetBucketLocation`); `ownerParam()` is NOT — an earlier
+	* revision claimed it reached STS, and `src/cli/upload-cfn-template.ts`
+	* records that as false, since `resolveExpectedBucketOwner` wraps every
+	* await and degrades to `undefined`. Naming an unproved mechanism is worse
+	* than naming none. The wrap stays because a caller-supplied logger can
+	* throw and because a future edit can add an awaited call here — the same
+	* reasoning as
+	* `S3StateBackend.purgeNoncurrentVersions`. It matters more here than there:
+	* every call site is a `finally`, and a throw from a `finally` REPLACES the
+	* `LockError` the release was raising. Nothing on this path is
+	* interrupt-aware (`LockManager` starts no interrupt watch and issues no
+	* `withRetry`), so there is no `InterruptedWaitError` for the swallow below
+	* to hide.
+	*/
+	async purgeLockVersions(key, path) {
+		const report = (message) => {
+			try {
+				if (path === "reap") this.logger.warn(message);
+				else this.logger.debug(message);
+			} catch {}
+		};
+		try {
+			await this.ensureClientForBucket();
+			await purgeNoncurrentKeyVersions(this.s3Client, this.config.bucket, [key], {
+				requestFields: await this.ownerParam(),
+				logger: { warn: report },
+				objectDescription: LOCK_OBJECT_DESCRIPTION
+			});
+		} catch (error) {
+			report(`Could not purge noncurrent versions of the lock key '${displaySafe(key)}' in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	/**
 	* Record a lock this process now holds and start renewing it.
 	*/
 	trackHeldLock(args) {
@@ -21313,7 +21462,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BBSPZtne.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B1EEjygi.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -33257,5 +33406,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { DEFAULT_STATE_PREFIX as $, warnDeprecatedNoPrefixCliFlag as $n, maskSecretsInError as $t, bold as A, buildDenyExternalAccessPolicy as An, NestedStackChildDirectDestroyError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, getDockerImageBySourceHash as Bn, isCdkdError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, ensureAssetStorage as Cn, DeployCancelledError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, readBootstrapMarkerBody as Dn, LocalStartServiceError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, parseBootstrapMarker as En, LocalMigrateError as Er, configStringRefusal as Et, yellow as F, getDockerCmd as Fn, StackHasActiveImportsError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, resolveApp as Gn, isThrottlingError as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, synthesisStatusMessage as Hn, withErrorHandling as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, partitionSensitiveEnv as In, StackTerminationProtectionError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveSkipPrefix as Jn, markRedactedCause as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, resolveAutoAssetStorage as Kn, isTransientServerError as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, runDockerForeground as Ln, StateError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDockerImage as Mn, ProvisioningError as Mr, classifyReplaySecretRegion as Mt, green as N, dockerSpawnEnvWithSensitive as Nn, ResourceTimeoutError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, validateAssetBucketName as On, LockError as Or, replayWarn as Ot, red as P, formatDockerLoginError as Pn, ResourceUpdateNotSupportedError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, stateBucketExistenceConfirmed as Qn, isSingleDynamicReferenceToken as Qt, exportAliasCollisionScrubWarning as R, runDockerStreaming as Rn, SynthesisError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, assertAssetBucketRegion as Sn, DependencyError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, isCrossRegionRedirect as Tn, LocalInvokeBuildError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, getDefaultStateBucketName as Un, isMarkedNonRetryable as Ur, withRetry as Ut, stateKeySecretExposure as V, Synthesizer as Vn, normalizeAwsError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, getLegacyStateBucketName as Wn, isRetryableTransientError as Wr, DagBuilder as Wt, maskDeep as X, resolveStateBucketWithDefaultAndSource as Xn, __exportAll as Xr, dynamicReferenceTokens as Xt, createMaskedRetryLogger as Y, resolveStateBucketWithDefault as Yn, retryClassificationText as Yr, createSecretMasker as Yt, maskerOrIdentity as Z, resolveUseCdkBootstrapAssets as Zn, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, rewriteTemplateAssetReferences as _n, setAwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, S3StateBackend as an, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, AssetModeResolver as bn, ConfigError as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, importableOutputKeys as cn, canonicalizeRegion as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, AssetPublisher as dn, processStackMessages as dr, isTerminationProtectionPropagationError as dt, maskSecretsInText as en, CFN_TEMPLATE_BODY_LIMIT as er, beginCommandInterruptScope as et, withResourceDeadline as f, stringifyValue as fn, clearBucketRegionCache as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, loadPublishableAssetManifest as gn, resetAwsClients as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, createAssetRedirectResolver as hn, getAwsClients as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, displaySafe as in, uploadCfnTemplate as ir, startInterruptWatch as it, cyan as j, describeAwsFailure as jn, PartialFailureError as jr, requireConfigString as jt, formatResourceLine as k, validateContainerRepoName as kn, MissingCdkCliError as kr, requireConfigArray as kt, replayRollback as l, importableOutputs as ln, derivePartitionAndUrlSuffix as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildAssetRedirectMap as mn, AwsClients as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, scrubResourceRecord as nn, MIGRATE_TMP_PREFIX as nr, interruptWatchListenerCount as nt, planFailedOps as o, rebuildClientForBucketRegion as on, expectedOwnerParam as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, WorkGraph as pn, resolveBucketRegion as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveCaptureObservedState as qn, markNonRetryable as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, LockManager as rn, findLargeInlineResources as rr, isInterruptedWaitError as rt, planRollback as s, exportNamesCarriedFrom as sn, PARTITION_TABLE as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, redactSecretsForState as tn, CFN_TEMPLATE_URL_LIMIT as tr, endCommandInterruptScope as tt, updatePartialMessage as u, shouldRetainResource as un, AssemblyReader as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, escapeRegExp$1 as vn, AssetError as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, getBootstrapMarkerKey as wn, DynamicReferenceRegionAmbiguousError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, BOOTSTRAP_MARKER_PREFIX as xn, CrossAccountSecretRefusalError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, stripControlChars as yn, CdkdError as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, AssetManifestLoader as zn, formatError as zr, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-CSBoL-Az.js.map
+export { DEFAULT_STATE_PREFIX as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInError as $t, bold as A, describeAwsFailure as An, NestedStackChildDirectDestroyError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, Synthesizer as Bn, isCdkdError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, getBootstrapMarkerKey as Cn, DeployCancelledError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, validateAssetBucketName as Dn, LocalStartServiceError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, readBootstrapMarkerBody as En, LocalMigrateError as Er, configStringRefusal as Et, yellow as F, partitionSensitiveEnv as Fn, StackHasActiveImportsError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, resolveAutoAssetStorage as Gn, isThrottlingError as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, getDefaultStateBucketName as Hn, withErrorHandling as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, runDockerForeground as In, StackTerminationProtectionError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveStateBucketWithDefault as Jn, markRedactedCause as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, resolveCaptureObservedState as Kn, isTransientServerError as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, runDockerStreaming as Ln, StateError as Lr, s3BucketRegionalDomainName as Lt, gray as M, dockerSpawnEnvWithSensitive as Mn, ProvisioningError as Mr, classifyReplaySecretRegion as Mt, green as N, formatDockerLoginError as Nn, ResourceTimeoutError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, validateContainerRepoName as On, LockError as Or, replayWarn as Ot, red as P, getDockerCmd as Pn, ResourceUpdateNotSupportedError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, warnDeprecatedNoPrefixCliFlag as Qn, isSingleDynamicReferenceToken as Qt, exportAliasCollisionScrubWarning as R, AssetManifestLoader as Rn, SynthesisError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, ensureAssetStorage as Sn, DependencyError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, parseBootstrapMarker as Tn, LocalInvokeBuildError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, getLegacyStateBucketName as Un, isMarkedNonRetryable as Ur, withRetry as Ut, stateKeySecretExposure as V, synthesisStatusMessage as Vn, normalizeAwsError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, resolveApp as Wn, isRetryableTransientError as Wr, DagBuilder as Wt, maskDeep as X, resolveUseCdkBootstrapAssets as Xn, __exportAll as Xr, dynamicReferenceTokens as Xt, createMaskedRetryLogger as Y, resolveStateBucketWithDefaultAndSource as Yn, retryClassificationText as Yr, createSecretMasker as Yt, maskerOrIdentity as Z, stateBucketExistenceConfirmed as Zn, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, escapeRegExp$1 as _n, setAwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, displaySafe as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, BOOTSTRAP_MARKER_PREFIX as bn, ConfigError as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, importableOutputs as cn, canonicalizeRegion as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, stringifyValue as dn, processStackMessages as dr, isTerminationProtectionPropagationError as dt, maskSecretsInText as en, CFN_TEMPLATE_URL_LIMIT as er, beginCommandInterruptScope as et, withResourceDeadline as f, WorkGraph as fn, clearBucketRegionCache as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, rewriteTemplateAssetReferences as gn, resetAwsClients as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, loadPublishableAssetManifest as hn, getAwsClients as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, S3StateBackend as in, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ir, startInterruptWatch as it, cyan as j, buildDockerImage as jn, PartialFailureError as jr, requireConfigString as jt, formatResourceLine as k, buildDenyExternalAccessPolicy as kn, MissingCdkCliError as kr, requireConfigArray as kt, replayRollback as l, shouldRetainResource as ln, derivePartitionAndUrlSuffix as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, createAssetRedirectResolver as mn, AwsClients as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, scrubResourceRecord as nn, findLargeInlineResources as nr, interruptWatchListenerCount as nt, planFailedOps as o, exportNamesCarriedFrom as on, expectedOwnerParam as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, buildAssetRedirectMap as pn, resolveBucketRegion as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveSkipPrefix as qn, markNonRetryable as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, LockManager as rn, uploadCfnTemplate as rr, isInterruptedWaitError as rt, planRollback as s, importableOutputKeys as sn, PARTITION_TABLE as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, redactSecretsForState as tn, MIGRATE_TMP_PREFIX as tr, endCommandInterruptScope as tt, updatePartialMessage as u, AssetPublisher as un, AssemblyReader as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, stripControlChars as vn, AssetError as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, isCrossRegionRedirect as wn, DynamicReferenceRegionAmbiguousError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, assertAssetBucketRegion as xn, CrossAccountSecretRefusalError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, AssetModeResolver as yn, CdkdError as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, getDockerImageBySourceHash as zn, formatError as zr, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-DmWPwiyQ.js.map