@go-to-k/cdkd 0.290.20 → 0.290.21

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BWqde8jF.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CGcB3KHZ.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-BIySan7n.js");
+	const { buildProgram } = await import("./program-BLyj1ijG.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-B93hsZ12.js → deploy-engine-KnCjibgq.js}

@@ -1,6 +1,6 @@
 import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BWqde8jF.js";
+import { t as getCdkdVersion } from "./version-CGcB3KHZ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -31729,7 +31729,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BCc1jFYX.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B8GAVns4.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -41625,9 +41625,11 @@ function deepEqualValue(a, b) {
 * escaping silently, so the authority on "where is this applied" is a grep the
 * test performs, not a number anybody has to maintain.
 */
-function crossStackReadsForPartialSave(previous, recordedImports, recordedOutputReads) {
-	const imports = unionCrossStackReads(previous.imports, recordedImports, (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${e.exportName}`);
-	const outputReads = unionCrossStackReads(previous.outputReads, recordedOutputReads, (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${e.outputName}`);
+function crossStackReadsForPartialSave(previous, recordedImports, recordedOutputReads, normalizeName) {
+	const importKey = (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${normalizeName(e.exportName)}`;
+	const outputReadKey = (e) => `${normalizeName(e.sourceStack)}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${normalizeName(e.outputName)}`;
+	const imports = unionCrossStackReads(previous.imports, recordedImports, importKey);
+	const outputReads = unionCrossStackReads(previous.outputReads, recordedOutputReads, outputReadKey);
 	return {
 		...imports.length > 0 && { imports },
 		...outputReads.length > 0 && { outputReads }
@@ -42041,7 +42043,13 @@ var DeployEngine = class DeployEngine {
 	* only outputs-substituted references: a literal output equal to a secret
 	* nothing resolved is not recorded, and is not touched.
 	*
-	* Run by every {@link redactOutputs} (issue
+	* Run by every {@link redactOutputs}, AND by
+	* {@link crossStackReadKeyNormalizer} (issue
+	* [#3289](https://github.com/go-to-k/cdkd/issues/3289)), which needs the
+	* same bag and runs BEFORE the persist walk. Calling it twice in one save
+	* is safe and MEASURED rather than assumed: the entry fold re-sets equal
+	* values, and `recordResolvedPair` leaves a pair alone when the plaintext
+	* is unchanged, so no CONFLICTING marker is invented. (issue
 	* [#2814](https://github.com/go-to-k/cdkd/issues/2814)), because a part the
 	* drain cap stopped waiting for records into its pass map LATE: a secret
 	* that arrives between the pass and the final save is then still a needle
@@ -42367,14 +42375,108 @@ var DeployEngine = class DeployEngine {
 				state: scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0)
 			};
 		});
+		const outputs = this.redactOutputs(state.outputs);
+		const crossStackReads = this.redactCrossStackReads(state);
 		return {
 			...state,
 			resources,
-			outputs: this.redactOutputs(state.outputs),
-			...orphans === void 0 ? {} : { orphans }
+			outputs,
+			...orphans === void 0 ? {} : { orphans },
+			...crossStackReads
 		};
 	}
 	/**
+	* Redact the TEMPLATE-DERIVED names in `state.imports` / `state.outputReads`
+	* (issue [#3289](https://github.com/go-to-k/cdkd/issues/3289)).
+	*
+	* Both lists rode the `...state` spread unredacted, so a reference whose name
+	* an `Fn::Sub` assembled around a resolved secret persisted that secret in
+	* plaintext, durably. The fields are NOT symmetric and the issue as filed
+	* named the wrong ones, so the provenance of each is stated here rather than
+	* left to be re-derived:
+	*
+	* - `imports[].exportName` IS template-derived (`resolveValue` on the
+	*   `Fn::ImportValue` argument), so it leaks. Its `sourceStack` /
+	*   `sourceRegion` are NOT: `recordImport` takes them from the exports index
+	*   entry or the state scan, i.e. from the producer's own record.
+	* - `outputReads[]` has TWO leaking fields: `outputName` AND `sourceStack`,
+	*   both `resolveValue` on `Fn::GetStackOutput` arguments. `sourceRegion` is
+	*   template-derived too but passes `isClientSafeRegion` before it can be
+	*   recorded, and it is read STRUCTURALLY (`producerRegionsFromState` keys a
+	*   secret-region decision on it), so it is deliberately left alone.
+	*
+	* REDACTION HAPPENS HERE, at the persist choke point, and must not move to
+	* record time: `crossStackReadsForPartialSave` / `unionCrossStackReads` dedup
+	* on `${sourceStack}\0${region}\0${name}`, so changing a value mid-run makes
+	* the union write BOTH spellings, and its first-seen-wins merge would keep
+	* whichever arrived first.
+	*
+	* `outputReads[].sourceStack` is both a leak and the literal match key
+	* `findDownstreamConsumers` compares against, so redacting it necessarily
+	* stops that match. That reader reports rather than drops — see
+	* `recreate-downstream-consumers.ts`; a consumer vanishing from a DATA-LOSS
+	* prompt is a worse failure than one it cannot name precisely.
+	*
+	* The union bag is every secret THIS deploy resolved, because a
+	* cross-stack reference can sit in a resource property (recorded per logical
+	* id) or in an Output (recorded in the outputs pass), and the entry carries
+	* no logical id to narrow it by.
+	*/
+	redactCrossStackReads(state) {
+		if (state.imports === void 0 && state.outputReads === void 0) return {};
+		const secrets = this.allRecordedSecrets();
+		const redact = (value) => redactSecretsForState(value, secrets);
+		return {
+			...state.imports === void 0 ? {} : { imports: state.imports.map((entry) => ({
+				...entry,
+				exportName: redact(entry.exportName)
+			})) },
+			...state.outputReads === void 0 ? {} : { outputReads: state.outputReads.map((entry) => ({
+				...entry,
+				sourceStack: redact(entry.sourceStack),
+				outputName: redact(entry.outputName)
+			})) }
+		};
+	}
+	/**
+	* The name normalizer `crossStackReadsForPartialSave` keys its union on
+	* (issue [#3289](https://github.com/go-to-k/cdkd/issues/3289)).
+	*
+	* It applies the SAME redaction the persist path applies, so a name this run
+	* holds in plaintext and the name the previous record holds redacted produce
+	* ONE key. Without it the union keeps both and the persist redaction makes
+	* them identical duplicates. The parameter's own doc carries the measurement.
+	*
+	* Returns identity when this deploy resolved no secret, which keeps the key
+	* byte-identical to the pre-#3289 one for every stack that has none.
+	*/
+	crossStackReadKeyNormalizer() {
+		this.absorbOutputsPassSecrets();
+		const secrets = this.allRecordedSecrets();
+		if (secrets.size === 0) return (name) => name;
+		return (name) => redactSecretsForState(name, secrets);
+	}
+	/**
+	* Every secret this deploy resolved, in one bag.
+	*
+	* `perResourceSecrets` is keyed by logical id and `outputSecrets` holds the
+	* outputs pass, which is the right scoping for a RECORD (a resource's own
+	* secrets redact that resource). A cross-stack read entry carries no logical
+	* id, so it has nothing to be scoped BY — the reference may have sat in any
+	* resource's property or in an Output.
+	*
+	* Over-redaction here is the safe direction and is bounded the same way the
+	* value scan always is: `MIN_NEEDLE_LENGTH` keeps a short plaintext from
+	* matching a substring, and an export name that genuinely equals another
+	* resource's secret is a name that should not be persisted either.
+	*/
+	allRecordedSecrets() {
+		const all = /* @__PURE__ */ new Map();
+		for (const bag of this.perResourceSecrets.values()) for (const [plaintext, expression] of bag) all.set(plaintext, expression);
+		for (const [plaintext, expression] of this.outputSecrets) all.set(plaintext, expression);
+		return all;
+	}
+	/**
 	* Stamp `parentStack` / `parentLogicalId` / `parentRegion` (schema v6+)
 	* onto a state object that's about to be saved, when this engine was
 	* constructed with `options.parentStackInfo` (= it's deploying a
@@ -42718,7 +42820,7 @@ var DeployEngine = class DeployEngine {
 							outputs: outputsChanged ? outputsToPersist : persistedOutputs,
 							...exportNamesToPersist === void 0 ? exportNamesCarriedFrom(currentState) : { exportNames: [...exportNamesToPersist] },
 							...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
-							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 							lastModified: Date.now()
 						};
 						const saveOptions = {};
@@ -42849,7 +42951,7 @@ var DeployEngine = class DeployEngine {
 						...exportNamesCarriedFrom(currentState),
 						...skippedOutputsCarriedFrom(currentState),
 						...orphansCarriedFrom(currentState),
-						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 						lastModified: Date.now()
 					};
 					const migrate = pendingMigration;
@@ -42983,7 +43085,7 @@ var DeployEngine = class DeployEngine {
 					...exportNamesCarriedFrom(currentState),
 					...skippedOutputsCarriedFrom(currentState),
 					...orphansCarriedFrom(currentState),
-					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 					lastModified: Date.now()
 				};
 				const migrate = pendingMigration;
@@ -43024,7 +43126,7 @@ var DeployEngine = class DeployEngine {
 					...exportNamesCarriedFrom(currentState),
 					...skippedOutputsCarriedFrom(currentState),
 					...orphansAfterRollback(currentState, rollbackOrphans),
-					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 					lastModified: Date.now()
 				};
 				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
@@ -43043,7 +43145,7 @@ var DeployEngine = class DeployEngine {
 						...exportNamesCarriedFrom(currentState),
 						...skippedOutputsCarriedFrom(currentState),
 						...orphansAfterRollback(currentState, rollbackOrphans),
-						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 						lastModified: Date.now()
 					};
 					await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
@@ -43116,7 +43218,7 @@ var DeployEngine = class DeployEngine {
 			...exportNamesCarriedFrom(currentState),
 			...skippedOutputsCarriedFrom(currentState),
 			...orphansCarriedFrom(currentState),
-			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
+			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 			lastModified: Date.now()
 		});
 		try {
@@ -43260,7 +43362,7 @@ var DeployEngine = class DeployEngine {
 			recordEvent: (event) => this.recordEvent(event),
 			finalSnapshotClients: this.options.finalSnapshotClients,
 			skipFinalSnapshot: this.options.skipFinalSnapshot,
-			importedProducerRegions: producerRegionsFromState(crossStackReadsForPartialSave(previousState, this.recordedImports, this.recordedOutputReads))
+			importedProducerRegions: producerRegionsFromState(crossStackReadsForPartialSave(previousState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()))
 		};
 	}
 	/**
@@ -44622,4 +44724,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, withErrorHandling as $i, LockManager as $n, getDefaultStateBucketName as $r, s3BucketArn as $t, extractDeploymentEventError as A, CdkdError as Ai, findActionableSilentDrops as An, parseBootstrapMarker as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, MalformedProducerRecordRefusalError as Bi, carriesSecretMask as Bn, dockerSpawnEnvWithSensitive as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, clearBucketRegionCache as Ci, refuseMalformedOutputs as Cn, rewriteTemplateAssetReferences as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, resetAwsClients as Di, repairMalformedOutputsForReadOnly as Dn, ensureAssetStorage as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, getAwsClients as Ei, refuseMalformedState as En, assertAssetBucketRegion as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DynamicReferenceRegionAmbiguousError as Fi, TemplateParser as Fn, describeAwsFailure as Fr, isSettledInstanceState as Ft, gray as G, ResourceUpdateNotSupportedError as Gi, isSingleDynamicReferenceToken as Gn, runDockerForeground as Gr, readConfigString as Gt, formatResourceLine as H, PartialFailureError as Hi, dynamicReferenceTokens as Hn, getDockerCmd as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, IntrinsicResolutionRefusalError as Ii, STATE_SOURCED_BASELINE_RULES as In, buildDockerImage as Ir, WAFv2WebACLProvider as It, yellow as J, StateError as Ji, maskSecretsInText as Jn, stripControlChars as Jr, requireConfigObject as Jt, green as K, StackHasActiveImportsError as Ki, markSameGenerationBag as Kn, runDockerStreaming as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, LocalInvokeBuildError as Li, STATE_SOURCED_CROSS_GENERATION_RULES as Ln, describeDockerCapturedOutput as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, CrossAccountSecretRefusalError as Mi, describeTypeWithThrottleRetry as Mn, validateAssetBucketName as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, DependencyError as Ni, withRetry as Nn, validateContainerRepoName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, setAwsClients as Oi, repairMalformedResourcePropertiesForReadOnly as On, getBootstrapMarkerKey as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, DeployCancelledError as Pi, DagBuilder as Pn, buildDenyExternalAccessPolicy as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, normalizeAwsError as Qi, scrubResourceRecord as Qn, synthesisStatusMessage as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, LocalStartServiceError as Ri, STATE_SOURCED_READBACK_RULES as Rn, describeDockerExecFailure as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, processStackMessages as Si, refuseMalformedNestedChildOutputs as Sn, loadPublishableAssetManifest as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AwsClients as Ti, refuseMalformedResourcesForDestroy as Tn, BOOTSTRAP_MARKER_PREFIX as Tr, carriesDynamicReference as Tt, bold as U, ProvisioningError as Ui, errorCauseChain as Un, partitionSensitiveEnv as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, NestedStackChildDirectDestroyError as Vi, createSecretMasker as Vn, formatDockerLoginError as Vr, coerceCfnInteger as Vt, cyan as W, ResourceTimeoutError as Wi, identityKeyFor as Wn, redactDockerArgvValues as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, formatError as Xi, recoverMaskedOutput as Xn, getDockerImageBySourceHash as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, SynthesisError as Yi, recordMaskOnlyValue as Yn, AssetManifestLoader as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, isCdkdError as Zi, redactSecretsForState as Zn, Synthesizer as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, expectedOwnerParam as _i, malformedRenderedContainersWarning as _n, AssetPublisher as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, markRedactedCause as aa, resolveStateBucketWithDefault as ai, applyCallerIdentityCredentials as an, formatLockExpiry as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, derivePartitionAndUrlSuffix as bi, malformedStateRefusalMessage as bn, buildAssetRedirectMap as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, stateBucketExistenceConfirmed as ci, INTRINSIC_KEYS as cn, DEFAULT_STATE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, CFN_TEMPLATE_URL_LIMIT as di, hasReadableResources as dn, importableOutputKeys as dr, beginCommandInterruptScope as dt, isMarkedNonRetryable as ea, getLegacyStateBucketName as ei, s3BucketDomainName as en, S3StateBackend as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, MIGRATE_TMP_PREFIX as fi, malformedExportNamesWarning as fn, importableOutputs as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, decodeListingKey as gi, malformedOutputsWarning as gn, shouldRetainResource as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as hi, malformedOutputsRefusalMessage as hn, orphansCarriedFrom as hr, startInterruptWatch as ht, DeploymentEventsReader as i, markNonRetryable as ia, resolveSkipPrefix as ii, applyRoleArnIfSet as in, forceQuitRecoveryClause as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, ConfigError as ji, findSilentDropProperties as jn, readBootstrapMarkerBody as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AssetError as ki, repairMalformedResourcesForReadOnly as kn, isCrossRegionRedirect as kr, getAccountInfo as kt, replayRollback as l, warnDeprecatedNoPrefixCliFlag as li, STATE_RESOURCES_MALFORMED as ln, exportNamesCarriedFrom as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, uploadCfnTemplate as mi, malformedLocalOutputsWarning as mn, orphansAfterRollback as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isThrottlingError as na, resolveAutoAssetStorage as ni, s3BucketRegionalDomainName as nn, buildForceUnlockCommand as nr, getCurrentResourceSecrets as nt, planFailedOps as o, retryClassificationText as oa, resolveStateBucketWithDefaultAndSource as oi, callerEnvCredentials as on, shellQuote as or, ProviderRegistry as ot, maskingRetryLogger as p, findLargeInlineResources as pi, malformedExportSourceWarning as pn, isReadableBag as pr, interruptWatchListenerCount as pt, red as q, StackTerminationProtectionError as qi, maskSecretsInError as qn, escapeRegExp$1 as qr, requireConfigArray as qt, DeployEngine as r, isTransientServerError as ra, resolveCaptureObservedState as ri, s3BucketWebsiteUrl as rn, buildLockContentionMessage as rr, IAMRoleProvider as rt, planRollback as s, __exportAll as sa, resolveUseCdkBootstrapAssets as si, DiffCalculator as sn, CUSTOM_RESOURCE_RESPONSE_PREFIX as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isRetryableTransientError as ta, resolveApp as ti, s3BucketDualStackDomainName as tn, rebuildClientForBucketRegion as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, CFN_TEMPLATE_BODY_LIMIT as ui, hasReadableOutputs as un, hasReadableExportSet as ur, maskerOrIdentity as ut, keptWholeReasonText as v, PARTITION_TABLE as vi, malformedResourcePropertiesWarning as vn, stringifyValue as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, resolveBucketRegion as wi, refuseMalformedOutputsForDestroy as wn, AssetModeResolver as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, AssemblyReader as xi, producerRecordKey as xn, createAssetRedirectResolver as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, canonicalizeRegion as yi, malformedResourcesWarning as yn, WorkGraph as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LockError as zi, TEMPLATE_SOURCED_RULES as zn, describeDockerFailure as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-B93hsZ12.js.map
+//# sourceMappingURL=deploy-engine-KnCjibgq.js.map