@go-to-k/cdkd 0.289.8 → 0.290.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DWnjHtUC.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DH53RtuA.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-BJxsQ7qM.js");
+	const { buildProgram } = await import("./program-DUmAMwgQ.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-zEwQVCh8.js → deploy-engine-C287P1jL.js}

@@ -1,6 +1,6 @@
 import { b as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, y as UNRENDERABLE } from "./logger-DTEUzYP_.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DWnjHtUC.js";
+import { t as getCdkdVersion } from "./version-DH53RtuA.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11401,7 +11401,10 @@ const sameGenerationBags = /* @__PURE__ */ new WeakSet();
 *   stored. On the no-change path the newly redacted bag is installed when
 *   the outputs CHANGED, and the previous `persistedOutputs` is kept
 *   otherwise; that previous bag is unmarked, which is the answer that arm
-*   wants.
+*   wants. When an output FAILED there, what is installed is either a fresh
+*   merge of this pass's values with the previous bag's carried ones (issue
+*   #2771), mixed provenance and never marked, or — when that merge refuses —
+*   the previous bag kept whole, unmarked as above.
 * - the update arm's no-change re-check — a marked `{ ...resolvedProps }`
 *   compared against the stored record so a stored token reads as a no-op.
 *   NOT installed; the object the provider is handed is the unmarked original.
@@ -28427,7 +28430,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D2lf-Qdo.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DVXRJSN_.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -35085,10 +35088,10 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 *
 * The deploy side (`DeployEngine.handleOutputResolutionFailure`, default arm)
 * warns, stores `undefined` for the key and moves on, so a re-resolved
-* `state.outputs` lacks it (the no-change path keeps the previous bag whole
-* when any output fails, so a key that resolved on an EARLIER deploy can keep
-* its value beside a record — the reader checks absence first and ignores the
-* record then). The diff side resolves outputs with `skipDynamicReferences`, so a
+* `state.outputs` lacks it (the no-change path keeps a failed key's STORED
+* value, go-to-k/cdkd#2771, so a key that resolved on an EARLIER deploy can
+* keep its value beside a record — the reader checks absence first and ignores
+* the record then). The diff side resolves outputs with `skipDynamicReferences`, so a
 * failure that happens INSIDE a secret lookup — a JSON key the secret does not
 * hold, a reference assembled from another secret's value — does not reproduce
 * there: the value assembles into its token, the key is absent from state, and
@@ -35169,10 +35172,10 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 * the writing binary's version is knowable and merely unstored: keeping it
 * beside the digest and un-binding on mismatch would close that one. All four
 * end the same way: the record keeps binding until the next deploy re-resolves
-* the output, and that deploy publishes the key — unless a SIBLING output is
-* still unresolved on a run with no resource change, where the engine keeps
-* the previous outputs bag wholesale and the key stays unpublished for a
-* further run (go-to-k/cdkd#2771, pre-existing and not introduced here).
+* the output, and that deploy publishes the key, a still-unresolved SIBLING
+* included, since the no-change path persists what resolved rather than
+* keeping the previous bag whole (go-to-k/cdkd#2771; the two shapes it still
+* keeps whole are in `src/deployment/no-change-outputs-merge.ts`).
 * Documented as the accepted limitation in `docs/cli-diff.md`; it is narrower
 * than the pre-#2740 behaviour, where the diff was wrong on EVERY run.
 *
@@ -35457,8 +35460,9 @@ function bindingSkippedOutputs(pristineTemplate, record, changedLogicalIds) {
 /**
 * Whether two records — either possibly absent — describe the same skipped
 * set with the same digests. The no-change deploy path persists on a
-* difference here: it is the ONLY save trigger for this field on that path,
-* because a skipped output switches the outputs-changed trigger off.
+* difference here: it is what saves this field when the outputs bag that save
+* would write is unchanged, which is the usual shape — a skipped output that
+* never had a stored value leaves the bag equal.
 */
 function skippedOutputsEqual(a, b) {
 	const aKeys = a === null || a === void 0 ? [] : Object.keys(a);
@@ -35467,6 +35471,96 @@ function skippedOutputsEqual(a, b) {
 	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && a?.[k] === b?.[k]);
 }
 
+//#endregion
+//#region src/deployment/no-change-outputs-merge.ts
+/**
+* True when `value` is a string carrying a SECRET-BEARING CloudFormation
+* dynamic reference: `{{resolve:secretsmanager:` or `{{resolve:ssm-secure:`,
+* the two spellings that are secret regardless of what they point at.
+*
+* A plain `{{resolve:ssm:...}}` is deliberately excluded. Per issue #1901 it is
+* classified by the parameter's TYPE, and a `String` / `StringList` parameter is
+* PUBLIC and legitimately persisted RESOLVED. Treating it as a signal would fire
+* on a perfectly ordinary record, and since `cdkd diff`'s legacy verdict is
+* record-WIDE, that would withhold every previous value in the stack and tell
+* the user to run `cdkd scrub`, which would find nothing to fix. The residual is
+* a pre-#1901 SecureString `ssm:` record, a strictly narrower gap than the false
+* positive this exclusion removes.
+*/
+function isSecretBearingReferenceString(value) {
+	if (typeof value !== "string") return false;
+	return value.includes("{{resolve:secretsmanager:") || value.includes("{{resolve:ssm-secure:");
+}
+/**
+* True when any TOP-LEVEL value of `bag` is itself a secret-bearing expression
+* string. Leaf granularity on purpose: a container holding an expression next
+* to a plaintext leaf is exactly the partially redacted residue `cdkd scrub`
+* admits it can leave, and it must not earn the exoneration. `null` is admitted
+* because a hand-edited state record can hold one where the type says a bag.
+*/
+function bagHoldsSecretExpression(bag) {
+	if (bag === void 0 || bag === null) return false;
+	return Object.values(bag).some((value) => isSecretBearingReferenceString(value));
+}
+function hasOwn(bag, key) {
+	return Object.prototype.hasOwnProperty.call(bag, key);
+}
+/**
+* Decide the bag the no-change path persists when `resolved` holds at least
+* one unresolved output. See the module doc for the three rules and the two
+* refusals.
+*/
+function mergeNoChangeOutputs(input) {
+	const { persisted, resolved, declaredOutputs, previousExportNames, resolvedExportNames } = input;
+	const failedKeys = Object.keys(resolved).filter((key) => resolved[key] === void 0);
+	const exportNameOf = (outputKey) => declaredOutputs !== void 0 && hasOwn(declaredOutputs, outputKey) ? declaredOutputs[outputKey]?.Export?.Name : void 0;
+	for (const outputKey of failedKeys) {
+		const exportName = exportNameOf(outputKey);
+		if (exportName !== null && typeof exportName === "object" && hasOwn(persisted, outputKey)) return {
+			kind: "kept",
+			reason: "intrinsic-export-name"
+		};
+	}
+	const outputs = Object.create(null);
+	for (const [key, value] of Object.entries(resolved)) if (value !== void 0) outputs[key] = value;
+	const carriedKeys = [];
+	const exportNames = [...resolvedExportNames];
+	const addExport = (name) => {
+		exportNames.push(name);
+	};
+	for (const outputKey of failedKeys) {
+		const exportName = exportNameOf(outputKey);
+		if (hasOwn(persisted, outputKey)) {
+			outputs[outputKey] = persisted[outputKey];
+			carriedKeys.push(outputKey);
+			if (exportName === outputKey && previousExportNames.has(outputKey)) addExport(outputKey);
+		}
+		if (typeof exportName !== "string") continue;
+		if (previousExportNames.has(exportName) && hasOwn(persisted, exportName) && !hasOwn(resolved, exportName) && !hasOwn(outputs, exportName)) {
+			outputs[exportName] = persisted[exportName];
+			carriedKeys.push(exportName);
+			addExport(exportName);
+		}
+	}
+	if (carriedKeys.length > 0 && bagHoldsSecretExpression(outputs) && !bagHoldsSecretExpression(persisted)) return {
+		kind: "kept",
+		reason: "mixed-generation"
+	};
+	return {
+		kind: "merged",
+		outputs,
+		exportNames,
+		carriedKeys
+	};
+}
+/** The sentence the deploy engine appends to its keep-whole warning. */
+function keptWholeReasonText(reason) {
+	switch (reason) {
+		case "intrinsic-export-name": return "An unresolved output declares an intrinsic Export.Name, so the export key it published before cannot be identified and carried.";
+		case "mixed-generation": return "Persisting only the outputs that resolved would put a redacted secret reference beside a carried value in a bag that held none, which would make that value read as redacted.";
+	}
+}
+
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 /**
@@ -38954,14 +39048,32 @@ var DeployEngine = class DeployEngine {
 				let persistedOutputs = currentState.outputs ?? {};
 				if (!this.options.dryRun) {
 					const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
-					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
-					const outputsChanged = !resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs);
-					const currentEffectiveExports = new Set(importableOutputKeys(currentState));
-					const resolvedExportSet = new Set(this.resolvedExportNames);
-					const exportSetChanged = !resolutionFailed && (currentEffectiveExports.size !== resolvedExportSet.size || [...resolvedExportSet].some((k) => !currentEffectiveExports.has(k)));
-					if (resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn("Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. A downstream Fn::ImportValue may fail until the next deploy.");
 					const observedRefresh = this.observedCaptureTasks.size > 0;
 					if (observedRefresh) await this.drainObservedCaptures(currentState.resources);
+					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
+					const currentEffectiveExports = new Set(importableOutputKeys(currentState));
+					let merge = resolutionFailed ? mergeNoChangeOutputs({
+						persisted: persistedOutputs,
+						resolved: resolvedOutputs,
+						declaredOutputs: effectiveTemplate.Outputs,
+						previousExportNames: currentEffectiveExports,
+						resolvedExportNames: this.resolvedExportNames
+					}) : void 0;
+					if (merge?.kind === "merged") {
+						for (const key of merge.carriedKeys) Reflect.deleteProperty(this.outputsTemplateSource, key);
+						if (merge.carriedKeys.length > 0 && !bagHoldsSecretExpression(persistedOutputs) && bagHoldsSecretExpression(this.redactOutputs(merge.outputs))) merge = {
+							kind: "kept",
+							reason: "mixed-generation"
+						};
+					}
+					if (merge?.kind === "kept") this.outputsSourceUsable = false;
+					const outputsToPersist = merge === void 0 ? resolvedOutputs : merge.kind === "merged" ? merge.outputs : persistedOutputs;
+					const exportNamesToPersist = merge === void 0 ? this.resolvedExportNames : merge.kind === "merged" ? merge.exportNames : void 0;
+					const outputsChanged = !outputMapsEqual(persistedOutputs, outputsToPersist);
+					const persistExportSet = new Set(exportNamesToPersist ?? []);
+					const exportSetChanged = exportNamesToPersist !== void 0 && (currentEffectiveExports.size !== persistExportSet.size || [...persistExportSet].some((k) => !currentEffectiveExports.has(k)));
+					if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} A downstream Fn::ImportValue may fail until the next deploy.`);
+					else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path, #2771)`);
 					const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 					if (observedRefresh || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged) try {
 						const refreshedState = {
@@ -38970,8 +39082,8 @@ var DeployEngine = class DeployEngine {
 							stackName: currentState.stackName,
 							resources: currentState.resources,
 							...orphansCarriedFrom(currentState),
-							outputs: outputsChanged ? resolvedOutputs : persistedOutputs,
-							...resolutionFailed ? exportNamesCarriedFrom(currentState) : { exportNames: [...this.resolvedExportNames] },
+							outputs: outputsChanged ? outputsToPersist : persistedOutputs,
+							...exportNamesToPersist === void 0 ? exportNamesCarriedFrom(currentState) : { exportNames: [...exportNamesToPersist] },
 							...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
 							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 							lastModified: Date.now()
@@ -40873,5 +40985,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { collectInlinePolicyNamesManagedBySiblings as $, buildDenyExternalAccessPolicy as $n, DynamicReferenceRegionAmbiguousError as $r, describeTypeWithThrottleRetry as $t, isStatefulRecreateTargetForReplace as A, exportNamesCarriedFrom as An, CFN_TEMPLATE_URL_LIMIT as Ar, coerceCfnBoolean as At, gray as B, createAssetRedirectResolver as Bn, processStackMessages as Br, classifyReplaySecretRegion as Bt, refusesFinalSnapshot as C, retryClassificationText as Ci, buildForceUnlockCommand as Cn, resolveSkipPrefix as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, shellQuote as Dn, stateBucketExistenceConfirmed as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, formatLockExpiry as En, resolveUseCdkBootstrapAssets as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, shouldRetainResource as Fn, expectedOwnerParam as Fr, readConfigString as Ft, collectPublishedOutputNames as G, assertAssetBucketRegion as Gn, resetAwsClients as Gr, s3BucketDualStackDomainName as Gt, red as H, rewriteTemplateAssetReferences as Hn, resolveBucketRegion as Hr, withSharedDrainBudget as Ht, toFiniteNumber as I, AssetPublisher as In, PARTITION_TABLE as Ir, replayWarn as It, secretBearing as J, isCrossRegionRedirect as Jn, CdkdError as Jr, applyRoleArnIfSet as Jt, exportAliasCollisionScrubWarning as K, ensureAssetStorage as Kn, setAwsClients as Kr, s3BucketRegionalDomainName as Kt, formatResourceLine as L, stringifyValue as Ln, canonicalizeRegion as Lr, requireConfigArray as Lt, renderStatefulReason as M, importableOutputs as Mn, findLargeInlineResources as Mr, configBooleanRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, orphansAfterRollback as Nn, uploadCfnTemplate as Nr, configIntegerRefusal as Nt, planOrphanAdoption as O, CUSTOM_RESOURCE_RESPONSE_PREFIX as On, warnDeprecatedNoPrefixCliFlag as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, orphansCarriedFrom as Pn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Pr, configStringRefusal as Pt, IAMRoleProvider as Q, validateContainerRepoName as Qn, DeployCancelledError as Qr, findSilentDropProperties as Qt, bold as R, WorkGraph as Rn, derivePartitionAndUrlSuffix as Rr, requireConfigObject as Rt, isFinalSnapshotError as S, markRedactedCause as Si, rebuildClientForBucketRegion as Sn, resolveCaptureObservedState as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, forceQuitRecoveryClause as Tn, resolveStateBucketWithDefaultAndSource as Tr, refStateLookupFromResource as Tt, yellow as U, AssetModeResolver as Un, AwsClients as Ur, s3BucketArn as Ut, green as V, loadPublishableAssetManifest as Vn, clearBucketRegionCache as Vr, producerRegionsFromState as Vt, collectDeclaredOutputNames as W, BOOTSTRAP_MARKER_PREFIX as Wn, getAwsClients as Wr, s3BucketDomainName as Wt, secretSafeKeyDisplay as X, readBootstrapMarkerBody as Xn, CrossAccountSecretRefusalError as Xr, INTRINSIC_KEYS as Xt, secretBearingStateKeyWarning as Y, parseBootstrapMarker as Yn, ConfigError as Yr, DiffCalculator as Yt, getCurrentResourceSecrets as Z, validateAssetBucketName as Zn, DependencyError as Zr, findActionableSilentDrops as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isMarkedNonRetryable as _i, recoverMaskedOutput as _n, synthesisStatusMessage as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, PartialFailureError as ai, STATE_SOURCED_READBACK_RULES as an, dockerSpawnEnvWithSensitive as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, isTransientServerError as bi, LockManager as bn, resolveApp as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, ResourceUpdateNotSupportedError as ci, createSecretMasker as cn, partitionSensitiveEnv as cr, interruptWatchListenerCount as ct, updatePartialReason as d, StateError as di, identityKeyFor as dn, runDockerStreaming as dr, CloudControlProvider as dt, IntrinsicResolutionRefusalError as ei, withRetry as en, describeAwsFailure as er, clearOnUpdateRemoval as et, withResourceDeadline as f, SynthesisError as fi, isSingleDynamicReferenceToken as fn, escapeRegExp$1 as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, withErrorHandling as gi, recordMaskOnlyValue as gn, Synthesizer as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, normalizeAwsError as hi, maskSecretsInText as hn, getDockerImageBySourceHash as hr, deleteSkipReason as ht, DeploymentEventsReader as i, NestedStackChildDirectDestroyError as ii, STATE_SOURCED_CROSS_GENERATION_RULES as in, describeDockerFailure as ir, maskDeep as it, isStatefulRecreateTargetSync as j, importableOutputKeys as jn, MIGRATE_TMP_PREFIX as jr, coerceCfnInteger as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, DEFAULT_STATE_PREFIX as kn, CFN_TEMPLATE_BODY_LIMIT as kr, assertRegionMatch as kt, replayRollback as l, StackHasActiveImportsError as li, dynamicReferenceTokens as ln, redactDockerArgvValues as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isCdkdError as mi, maskSecretsInError as mn, AssetManifestLoader as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LocalStartServiceError as ni, TemplateParser as nn, describeDockerCapturedOutput as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ProvisioningError as oi, TEMPLATE_SOURCED_RULES as on, formatDockerLoginError as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, formatError as pi, markSameGenerationBag as pn, stripControlChars as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, getBootstrapMarkerKey as qn, AssetError as qr, s3BucketWebsiteUrl as qt, DeployEngine as r, LockError as ri, STATE_SOURCED_BASELINE_RULES as rn, describeDockerExecFailure as rr, createMaskedRetryLogger as rt, planRollback as s, ResourceTimeoutError as si, carriesSecretMask as sn, getDockerCmd as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LocalInvokeBuildError as ti, DagBuilder as tn, buildDockerImage as tr, ProviderRegistry as tt, updatePartialMessage as u, StackTerminationProtectionError as ui, errorCauseChain as un, runDockerForeground as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isRetryableTransientError as vi, redactSecretsForState as vn, getDefaultStateBucketName as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, __exportAll as wi, buildLockContentionMessage as wn, resolveStateBucketWithDefault as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, markNonRetryable as xi, S3StateBackend as xn, resolveAutoAssetStorage as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, isThrottlingError as yi, scrubResourceRecord as yn, getLegacyStateBucketName as yr, carriesDynamicReference as yt, cyan as z, buildAssetRedirectMap as zn, AssemblyReader as zr, requireConfigString as zt };
-//# sourceMappingURL=deploy-engine-zEwQVCh8.js.map
+export { getCurrentResourceSecrets as $, validateAssetBucketName as $n, DependencyError as $r, findActionableSilentDrops as $t, planOrphanAdoption as A, CUSTOM_RESOURCE_RESPONSE_PREFIX as An, warnDeprecatedNoPrefixCliFlag as Ar, resolveExplicitPhysicalId as At, bold as B, WorkGraph as Bn, derivePartitionAndUrlSuffix as Br, requireConfigObject as Bt, createPreDeleteFinalSnapshot as C, markNonRetryable as Ci, S3StateBackend as Cn, resolveAutoAssetStorage as Cr, coerceParameterTypedValue as Ct, makeCanonicalizePropertiesFn as D, forceQuitRecoveryClause as Dn, resolveStateBucketWithDefaultAndSource as Dr, refStateLookupFromResource as Dt, unsupportedFinalSnapshotError as E, __exportAll as Ei, buildLockContentionMessage as En, resolveStateBucketWithDefault as Er, parameterTypeMayLoseSecretIdentity as Et, WARM_THROUGHPUT_MEMBERS as F, orphansAfterRollback as Fn, uploadCfnTemplate as Fr, configIntegerRefusal as Ft, yellow as G, AssetModeResolver as Gn, AwsClients as Gr, s3BucketArn as Gt, gray as H, createAssetRedirectResolver as Hn, processStackMessages as Hr, classifyReplaySecretRegion as Ht, coerceWarmThroughput as I, orphansCarriedFrom as In, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ir, configStringRefusal as It, exportAliasCollisionScrubWarning as J, ensureAssetStorage as Jn, setAwsClients as Jr, s3BucketRegionalDomainName as Jt, collectDeclaredOutputNames as K, BOOTSTRAP_MARKER_PREFIX as Kn, getAwsClients as Kr, s3BucketDomainName as Kt, isWarmThroughputDecrease as L, shouldRetainResource as Ln, expectedOwnerParam as Lr, readConfigString as Lt, isStatefulRecreateTargetForReplace as M, exportNamesCarriedFrom as Mn, CFN_TEMPLATE_URL_LIMIT as Mr, coerceCfnBoolean as Mt, isStatefulRecreateTargetSync as N, importableOutputKeys as Nn, MIGRATE_TMP_PREFIX as Nr, coerceCfnInteger as Nt, extractDeploymentEventError as O, formatLockExpiry as On, resolveUseCdkBootstrapAssets as Or, WAFv2WebACLProvider as Ot, renderStatefulReason as P, importableOutputs as Pn, findLargeInlineResources as Pr, configBooleanRefusal as Pt, secretSafeKeyDisplay as Q, readBootstrapMarkerBody as Qn, CrossAccountSecretRefusalError as Qr, INTRINSIC_KEYS as Qt, toFiniteNumber as R, AssetPublisher as Rn, PARTITION_TABLE as Rr, replayWarn as Rt, ccRoutedFinalSnapshotError as S, isTransientServerError as Si, LockManager as Sn, resolveApp as Sr, cfnRefValueFromPhysicalId as St, refusesFinalSnapshot as T, retryClassificationText as Ti, buildForceUnlockCommand as Tn, resolveSkipPrefix as Tr, isUnboundTemplateParameter as Tt, green as U, loadPublishableAssetManifest as Un, clearBucketRegionCache as Ur, producerRegionsFromState as Ut, cyan as V, buildAssetRedirectMap as Vn, AssemblyReader as Vr, requireConfigString as Vt, red as W, rewriteTemplateAssetReferences as Wn, resolveBucketRegion as Wr, withSharedDrainBudget as Wt, secretBearing as X, isCrossRegionRedirect as Xn, CdkdError as Xr, applyRoleArnIfSet as Xt, isExportAliasCollision as Y, getBootstrapMarkerKey as Yn, AssetError as Yr, s3BucketWebsiteUrl as Yt, secretBearingStateKeyWarning as Z, parseBootstrapMarker as Zn, ConfigError as Zr, DiffCalculator as Zt, isSecretBearingReferenceString as _, normalizeAwsError as _i, maskSecretsInText as _n, getDockerImageBySourceHash as _r, deleteSkipReason as _t, DeploymentEventsStore as a, LockError as ai, STATE_SOURCED_BASELINE_RULES as an, describeDockerExecFailure as ar, createMaskedRetryLogger as at, PRE_DELETE_SNAPSHOT_TYPES as b, isRetryableTransientError as bi, redactSecretsForState as bn, getDefaultStateBucketName as br, IntrinsicFunctionResolver as bt, replayFailedOperations as c, ProvisioningError as ci, TEMPLATE_SOURCED_RULES as cn, formatDockerLoginError as cr, beginCommandInterruptScope as ct, updatePartialReason as d, StackHasActiveImportsError as di, dynamicReferenceTokens as dn, redactDockerArgvValues as dr, isInterruptedWaitError as dt, DeployCancelledError as ei, findSilentDropProperties as en, validateContainerRepoName as er, IAMRoleProvider as et, withResourceDeadline as f, StackTerminationProtectionError as fi, errorCauseChain as fn, runDockerForeground as fr, startInterruptWatch as ft, bagHoldsSecretExpression as g, isCdkdError as gi, maskSecretsInError as gn, AssetManifestLoader as gr, deleteIndeterminateGuards as gt, computeImplicitDeleteEdges as h, formatError as hi, markSameGenerationBag as hn, stripControlChars as hr, UNSPECIFIED_SKIP_REASON as ht, DeploymentEventsReader as i, LocalStartServiceError as ii, TemplateParser as in, describeDockerCapturedOutput as ir, wouldReturnToSdkProvider as it, MULTI_REGION_RECREATE_BLOCKED_TYPES as j, DEFAULT_STATE_PREFIX as jn, CFN_TEMPLATE_BODY_LIMIT as jr, assertRegionMatch as jt, makeSiblingClaimReader as k, shellQuote as kn, stateBucketExistenceConfirmed as kr, normalizeAwsTagsToCfn as kt, replayRollback as l, ResourceTimeoutError as li, carriesSecretMask as ln, getDockerCmd as lr, endCommandInterruptScope as lt, IMPLICIT_DELETE_DEPENDENCIES as m, SynthesisError as mi, isSingleDynamicReferenceToken as mn, escapeRegExp$1 as mr, slowCcOperationTimeoutMs as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, IntrinsicResolutionRefusalError as ni, withRetry as nn, describeAwsFailure as nr, clearOnUpdateRemoval as nt, planFailedOps as o, NestedStackChildDirectDestroyError as oi, STATE_SOURCED_CROSS_GENERATION_RULES as on, describeDockerFailure as or, maskDeep as ot, maskingRetryLogger as p, StateError as pi, identityKeyFor as pn, runDockerStreaming as pr, CloudControlProvider as pt, collectPublishedOutputNames as q, assertAssetBucketRegion as qn, resetAwsClients as qr, s3BucketDualStackDomainName as qt, DeployEngine as r, LocalInvokeBuildError as ri, DagBuilder as rn, buildDockerImage as rr, ProviderRegistry as rt, planRollback as s, PartialFailureError as si, STATE_SOURCED_READBACK_RULES as sn, dockerSpawnEnvWithSensitive as sr, maskerOrIdentity as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DynamicReferenceRegionAmbiguousError as ti, describeTypeWithThrottleRetry as tn, buildDenyExternalAccessPolicy as tr, collectInlinePolicyNamesManagedBySiblings as tt, updatePartialMessage as u, ResourceUpdateNotSupportedError as ui, createSecretMasker as un, partitionSensitiveEnv as ur, interruptWatchListenerCount as ut, bindingSkippedOutputs as v, withErrorHandling as vi, recordMaskOnlyValue as vn, Synthesizer as vr, disableInstanceApiTermination as vt, isFinalSnapshotError as w, markRedactedCause as wi, rebuildClientForBucketRegion as wn, resolveCaptureObservedState as wr, getAccountInfo as wt, buildFinalSnapshotIdentifier as x, isThrottlingError as xi, scrubResourceRecord as xn, getLegacyStateBucketName as xr, carriesDynamicReference as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, isMarkedNonRetryable as yi, recoverMaskedOutput as yn, synthesisStatusMessage as yr, isTerminationProtectionPropagationError as yt, formatResourceLine as z, stringifyValue as zn, canonicalizeRegion as zr, requireConfigArray as zt };
+//# sourceMappingURL=deploy-engine-C287P1jL.js.map