@go-to-k/cdkd 0.290.12 → 0.290.13

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CEPJTaHl.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version--dVnQSTI.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-Cts1UWod.js");
+	const { buildProgram } = await import("./program-BDNXyKp5.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-e6ZxOr56.js → deploy-engine-omGpC16W.js}

@@ -1,6 +1,6 @@
 import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CEPJTaHl.js";
+import { t as getCdkdVersion } from "./version--dVnQSTI.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9133,6 +9133,53 @@ function shouldRetainResource(deletionPolicy) {
 	return deletionPolicy === "Retain" || deletionPolicy === "RetainExceptOnCreate";
 }
 /**
+* Can this container be read as the record map its type claims it is?
+*
+* THE single plain-object test behind every malformed-bag guard in the repo.
+* `parseStateBody` validates the root object and the schema version and
+* nothing inside, so a hand-edited or truncated record reaches a consumer with
+* `resources` / `outputs` / `attributes` / `properties` holding a string, a
+* list, a number or `null`. `Object.entries` walks a string or a list as
+* readily as a map, so either FABRICATES entries. `in` and `Object.hasOwn`
+* behave differently per shape and neither is a guard: `in` THROWS on a
+* string, a number and `null`, but ANSWERS on a list (`0 in [1,2]` and
+* `'length' in [1,2]` are both `true`), while `Object.hasOwn` ANSWERS on a
+* string and a list alike (`Object.hasOwn('abcdef', '0')` is `true`) and
+* throws ONLY on `null` / `undefined` — the one pair a `?? {}` upstream has
+* usually already absorbed, which is what makes it look like a guard. Do not
+* read a nearby `in` as already catching the list case. Widened past
+* `null` / `undefined` for
+* exactly that reason: `[]`, `5` and `"ab"` all survive `Object.entries` and
+* yield a bag that is empty or, for the string, absurd.
+*
+* WHY IT LIVES HERE rather than beside the guards that grew out of it. Its
+* first home was `src/state/malformed-resources-bag.ts`, which still re-exports
+* it so no importer moved; it came down to this module when
+* {@link importableOutputKeys} needed it (go-to-k/cdkd#3192). That helper sits
+* in `src/types/**`, the layer every other one imports and which imports
+* nothing itself, so the alternative — `src/types/state.ts` importing from
+* `src/state/**` — inverts the layering AND pulls that module's
+* `error-handler` / `display-safe` / `lock-contention-message` chain into the
+* one module the whole codebase depends on. Same move, same reason, as
+* `DEFAULT_STATE_PREFIX` in `src/state/state-prefix.ts`: home the leaf in the
+* layer that needs it, re-export from where it was.
+*
+* Spelling this test a second time at any call site is what the single export
+* exists to prevent: the copies could then drift, and the one that drifted
+* would fabricate again while looking guarded. Enumerate the consumers with
+* `grep -rn "isReadableBag" src/` rather than from a list here — three
+* successive enumerations of them, written by reasoning, came out incomplete.
+*
+* What it does NOT decide is whether a given container is malformed. That is a
+* per-container call, because ABSENCE means different things: an absent
+* `resources` bag is a defect, while an absent `outputs` bag is an ordinary
+* record `cdkd scrub` round-trips on purpose. Each caller pairs this predicate
+* with its own absence rule.
+*/
+function isReadableBag(container) {
+	return typeof container === "object" && container !== null && !Array.isArray(container);
+}
+/**
 * The keys of `state.outputs` an `Fn::ImportValue` may bind to (issue
 * [#2193](https://github.com/go-to-k/cdkd/issues/2193)) — THE predicate
 * behind "what does this stack export". Four readers used to answer that
@@ -9150,15 +9197,79 @@ function shouldRetainResource(deletionPolicy) {
 *
 * `outputs` is typed required but every consumer treats it as optional (a
 * state file may simply have none), so it is read defensively here too.
+*
+* ## Two FAIL-CLOSED arms for a malformed record (go-to-k/cdkd#3192)
+*
+* Both answer `[]` — "this record exports nothing" — and neither repairs the
+* record or throws. The reasoning is the same for both and is a property of
+* WHERE this function sits: it is a pure predicate with no stack name, no
+* region and no writer of its own, reached from the exports-index rebuild, the
+* deploy-time resolver's state scan, `cdkd diff`'s no-change merge and the
+* local-command loader. Throwing here would be the bare `TypeError`
+* go-to-k/cdkd#3018 set out to remove, renamed; and refusing the whole
+* operation over ONE foreign record would take every OTHER stack's
+* `Fn::ImportValue` down with it. Publishing nothing from a record whose
+* export set cannot be read is the only answer that fabricates nothing and
+* destroys nothing — the damaged record is left exactly as it is, for the
+* write-capable commands (`cdkd orphan` / `import` / `scrub`) to REFUSE by
+* name.
+*
+* 1. `outputs` is not a readable bag. `Object.keys('abcdef')` is
+*    `['0'...'5']`, so the pre-fix code published one fabricated export per
+*    CHARACTER into `cdkd/_index/<region>/exports.json` — the shared index
+*    every consumer's `Fn::ImportValue` binds against. {@link isReadableBag}
+*    is the test, so an ABSENT bag keeps answering `[]` exactly as the old
+*    `?? {}` did; no verdict moves on a healthy or an absent record.
+* 2. `exportNames` is present but not an array. `state.exportNames.filter(...)`
+*    threw `TypeError: state.exportNames.filter is not a function` on a
+*    hand-edited non-array or `null`, from `cdkd diff` among others. Falling
+*    back to the `undefined` arm instead would be fail-OPEN in the one
+*    direction #2193 exists to close — every plain Output name published as an
+*    export — so a corrupt set is read as an EMPTY set, not as an unknown one.
+*    A non-string element is dropped for the same reason: `Object.hasOwn` does
+*    not throw on one, it COERCES, so `exportNames: [0]` would otherwise
+*    publish the bag's `"0"` key. The filter is the identity on every healthy
+*    `string[]`.
 */
 function importableOutputKeys(state) {
-	const outputs = state.outputs ?? {};
+	if (!hasReadableExportSet(state)) return [];
+	const outputs = state.outputs;
 	if (state.exportNames === void 0) return Object.keys(outputs);
-	return state.exportNames.filter((name) => Object.hasOwn(outputs, name));
+	return state.exportNames.filter((name) => typeof name === "string" && Object.hasOwn(outputs, name));
+}
+/**
+* Whether {@link importableOutputKeys} can answer from this record at all —
+* the two fail-closed arms of its own doc, as ONE predicate a caller can ask
+* (issue go-to-k/cdkd#3192).
+*
+* It exists because `[]` is a real answer: a stack that exports nothing and a
+* record whose export set could not be read produce the identical empty list,
+* and a caller that must SAY which one it got cannot re-derive the difference
+* from the list. `ExportIndexStore`'s rebuild is that caller — a silent
+* fail-closed there would leave the next `Fn::ImportValue` miss naming the
+* consumer rather than the damaged producer record.
+*
+* ONE spelling shared with {@link importableOutputKeys}, which calls this
+* rather than repeating the two tests: a second copy could drift, and the copy
+* that drifted would report a record readable while the key list stayed empty,
+* or the reverse.
+*
+* `outputs` absent answers FALSE here, unlike
+* `malformed-resources-bag.ts`'s `hasReadableOutputs`, and the difference is
+* the QUESTION rather than a disagreement: that one asks "is this record
+* damaged" (an absent bag is an ordinary record), this one asks "can an export
+* set be read off it" (it cannot). A caller that must tell absent from damaged
+* tests for absence first, as the exports-index rebuild does.
+*/
+function hasReadableExportSet(state) {
+	if (!isReadableBag(state.outputs)) return false;
+	if (state.exportNames === void 0) return true;
+	if (!Array.isArray(state.exportNames)) return false;
+	return state.exportNames.length === 0 || state.exportNames.some((n) => typeof n === "string");
 }
 /** `state.outputs` narrowed to its {@link importableOutputKeys}. */
 function importableOutputs(state) {
-	const outputs = state.outputs ?? {};
+	const outputs = isReadableBag(state.outputs) ? state.outputs : {};
 	const picked = Object.create(null);
 	for (const name of importableOutputKeys(state)) picked[name] = outputs[name];
 	return picked;
@@ -29310,7 +29421,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Daqr0Ygq.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CpUSth0q.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -42039,5 +42150,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, ensureAssetStorage as $n, setAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, retryClassificationText as Ai, buildForceUnlockCommand as An, resolveSkipPrefix as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, orphansAfterRollback as Bn, uploadCfnTemplate as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, withErrorHandling as Ci, recordMaskOnlyValue as Cn, Synthesizer as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isTransientServerError as Di, LockManager as Dn, resolveApp as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isThrottlingError as Ei, scrubResourceRecord as En, getLegacyStateBucketName as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, warnDeprecatedNoPrefixCliFlag as Fr, resolveExplicitPhysicalId as Ft, gray as G, WorkGraph as Gn, derivePartitionAndUrlSuffix as Gr, requireConfigObject as Gt, formatResourceLine as H, shouldRetainResource as Hn, expectedOwnerParam as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, CFN_TEMPLATE_BODY_LIMIT as Ir, assertRegionMatch as It, yellow as J, loadPublishableAssetManifest as Jn, clearBucketRegionCache as Jr, producerRegionsFromState as Jt, green as K, buildAssetRedirectMap as Kn, AssemblyReader as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, CFN_TEMPLATE_URL_LIMIT as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, forceQuitRecoveryClause as Mn, resolveStateBucketWithDefaultAndSource as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, formatLockExpiry as Nn, resolveUseCdkBootstrapAssets as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, markNonRetryable as Oi, S3StateBackend as On, resolveAutoAssetStorage as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, stateBucketExistenceConfirmed as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, assertAssetBucketRegion as Qn, resetAwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, importableOutputKeys as Rn, MIGRATE_TMP_PREFIX as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, normalizeAwsError as Si, maskSecretsInText as Sn, getDockerImageBySourceHash as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, isRetryableTransientError as Ti, redactSecretsForState as Tn, getDefaultStateBucketName as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, AssetPublisher as Un, PARTITION_TABLE as Ur, replayWarn as Ut, toFiniteNumber as V, orphansCarriedFrom as Vn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Vr, configStringRefusal as Vt, cyan as W, stringifyValue as Wn, canonicalizeRegion as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, AssetModeResolver as Xn, AwsClients as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, rewriteTemplateAssetReferences as Yn, resolveBucketRegion as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, BOOTSTRAP_MARKER_PREFIX as Zn, getAwsClients as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, StackTerminationProtectionError as _i, errorCauseChain as _n, runDockerForeground as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, DeployCancelledError as ai, findSilentDropProperties as an, validateContainerRepoName as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, formatError as bi, markSameGenerationBag as bn, stripControlChars as br, deleteSkipReason as bt, replayFailedOperations as c, LocalInvokeBuildError as ci, DagBuilder as cn, buildDockerImage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, NestedStackChildDirectDestroyError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerFailure as dr, beginCommandInterruptScope as dt, AssetError as ei, s3BucketWebsiteUrl as en, getBootstrapMarkerKey as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, PartialFailureError as fi, STATE_SOURCED_READBACK_RULES as fn, dockerSpawnEnvWithSensitive as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, StackHasActiveImportsError as gi, dynamicReferenceTokens as gn, redactDockerArgvValues as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ResourceUpdateNotSupportedError as hi, createSecretMasker as hn, partitionSensitiveEnv as hr, startInterruptWatch as ht, DeploymentEventsReader as i, DependencyError as ii, findActionableSilentDrops as in, validateAssetBucketName as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, __exportAll as ji, buildLockContentionMessage as jn, resolveStateBucketWithDefault as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, markRedactedCause as ki, rebuildClientForBucketRegion as kn, resolveCaptureObservedState as kr, isUnboundTemplateParameter as kt, replayRollback as l, LocalStartServiceError as li, TemplateParser as ln, describeDockerCapturedOutput as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, ResourceTimeoutError as mi, carriesSecretMask as mn, getDockerCmd as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ConfigError as ni, DiffCalculator as nn, parseBootstrapMarker as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DynamicReferenceRegionAmbiguousError as oi, describeTypeWithThrottleRetry as on, buildDenyExternalAccessPolicy as or, ProviderRegistry as ot, maskingRetryLogger as p, ProvisioningError as pi, TEMPLATE_SOURCED_RULES as pn, formatDockerLoginError as pr, interruptWatchListenerCount as pt, red as q, createAssetRedirectResolver as qn, processStackMessages as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CrossAccountSecretRefusalError as ri, INTRINSIC_KEYS as rn, readBootstrapMarkerBody as rr, IAMRoleProvider as rt, planRollback as s, IntrinsicResolutionRefusalError as si, withRetry as sn, describeAwsFailure as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CdkdError as ti, applyRoleArnIfSet as tn, isCrossRegionRedirect as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LockError as ui, STATE_SOURCED_BASELINE_RULES as un, describeDockerExecFailure as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StateError as vi, identityKeyFor as vn, runDockerStreaming as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, isMarkedNonRetryable as wi, recoverMaskedOutput as wn, synthesisStatusMessage as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, isCdkdError as xi, maskSecretsInError as xn, AssetManifestLoader as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, SynthesisError as yi, isSingleDynamicReferenceToken as yn, escapeRegExp$1 as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputs as zn, findLargeInlineResources as zr, configBooleanRefusal as zt };
-//# sourceMappingURL=deploy-engine-e6ZxOr56.js.map
+export { secretBearing as $, BOOTSTRAP_MARKER_PREFIX as $n, getAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, markNonRetryable as Ai, buildForceUnlockCommand as An, resolveAutoAssetStorage as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, importableOutputs as Bn, MIGRATE_TMP_PREFIX as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, isCdkdError as Ci, recordMaskOnlyValue as Cn, AssetManifestLoader as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isRetryableTransientError as Di, LockManager as Dn, getDefaultStateBucketName as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isMarkedNonRetryable as Ei, scrubResourceRecord as En, synthesisStatusMessage as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, resolveUseCdkBootstrapAssets as Fr, resolveExplicitPhysicalId as Ft, gray as G, AssetPublisher as Gn, PARTITION_TABLE as Gr, requireConfigObject as Gt, formatResourceLine as H, orphansAfterRollback as Hn, uploadCfnTemplate as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, stateBucketExistenceConfirmed as Ir, assertRegionMatch as It, yellow as J, buildAssetRedirectMap as Jn, AssemblyReader as Jr, producerRegionsFromState as Jt, green as K, stringifyValue as Kn, canonicalizeRegion as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, warnDeprecatedNoPrefixCliFlag as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, retryClassificationText as Mi, forceQuitRecoveryClause as Mn, resolveSkipPrefix as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, __exportAll as Ni, formatLockExpiry as Nn, resolveStateBucketWithDefault as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, isThrottlingError as Oi, S3StateBackend as On, getLegacyStateBucketName as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, resolveStateBucketWithDefaultAndSource as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, AssetModeResolver as Qn, AwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, hasReadableExportSet as Rn, CFN_TEMPLATE_BODY_LIMIT as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, formatError as Si, maskSecretsInText as Sn, stripControlChars as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, withErrorHandling as Ti, redactSecretsForState as Tn, Synthesizer as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, orphansCarriedFrom as Un, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ur, replayWarn as Ut, toFiniteNumber as V, isReadableBag as Vn, findLargeInlineResources as Vr, configStringRefusal as Vt, cyan as W, shouldRetainResource as Wn, expectedOwnerParam as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, loadPublishableAssetManifest as Xn, clearBucketRegionCache as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, createAssetRedirectResolver as Yn, processStackMessages as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, rewriteTemplateAssetReferences as Zn, resolveBucketRegion as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, ResourceUpdateNotSupportedError as _i, errorCauseChain as _n, partitionSensitiveEnv as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as ai, findSilentDropProperties as an, readBootstrapMarkerBody as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, StateError as bi, markSameGenerationBag as bn, runDockerStreaming as br, deleteSkipReason as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ci, DagBuilder as cn, buildDenyExternalAccessPolicy as cr, createMaskedRetryLogger as ct, updatePartialReason as d, LocalStartServiceError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerCapturedOutput as dr, beginCommandInterruptScope as dt, resetAwsClients as ei, s3BucketWebsiteUrl as en, assertAssetBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, LockError as fi, STATE_SOURCED_READBACK_RULES as fn, describeDockerExecFailure as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, ResourceTimeoutError as gi, dynamicReferenceTokens as gn, getDockerCmd as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ProvisioningError as hi, createSecretMasker as hn, formatDockerLoginError as hr, startInterruptWatch as ht, DeploymentEventsReader as i, ConfigError as ii, findActionableSilentDrops as in, parseBootstrapMarker as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, markRedactedCause as ji, buildLockContentionMessage as jn, resolveCaptureObservedState as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, isTransientServerError as ki, rebuildClientForBucketRegion as kn, resolveApp as kr, isUnboundTemplateParameter as kt, replayRollback as l, IntrinsicResolutionRefusalError as li, TemplateParser as ln, describeAwsFailure as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, PartialFailureError as mi, carriesSecretMask as mn, dockerSpawnEnvWithSensitive as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as ni, DiffCalculator as nn, getBootstrapMarkerKey as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DependencyError as oi, describeTypeWithThrottleRetry as on, validateAssetBucketName as or, ProviderRegistry as ot, maskingRetryLogger as p, NestedStackChildDirectDestroyError as pi, TEMPLATE_SOURCED_RULES as pn, describeDockerFailure as pr, interruptWatchListenerCount as pt, red as q, WorkGraph as qn, derivePartitionAndUrlSuffix as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CdkdError as ri, INTRINSIC_KEYS as rn, isCrossRegionRedirect as rr, IAMRoleProvider as rt, planRollback as s, DeployCancelledError as si, withRetry as sn, validateContainerRepoName as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ti, applyRoleArnIfSet as tn, ensureAssetStorage as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LocalInvokeBuildError as ui, STATE_SOURCED_BASELINE_RULES as un, buildDockerImage as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StackHasActiveImportsError as vi, identityKeyFor as vn, redactDockerArgvValues as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, normalizeAwsError as wi, recoverMaskedOutput as wn, getDockerImageBySourceHash as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, SynthesisError as xi, maskSecretsInError as xn, escapeRegExp$1 as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, StackTerminationProtectionError as yi, isSingleDynamicReferenceToken as yn, runDockerForeground as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputKeys as zn, CFN_TEMPLATE_URL_LIMIT as zr, configBooleanRefusal as zt };
+//# sourceMappingURL=deploy-engine-omGpC16W.js.map