@go-to-k/cdkd 0.290.21 → 0.290.22

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CGcB3KHZ.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CpOEkAtB.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-BLyj1ijG.js");
+	const { buildProgram } = await import("./program-BKuJRiz3.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-KnCjibgq.js → deploy-engine-Dbmoo4FQ.js}

@@ -1,6 +1,6 @@
 import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CGcB3KHZ.js";
+import { t as getCdkdVersion } from "./version-CpOEkAtB.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -21389,6 +21389,39 @@ function stackClause(stackName, region) {
 	const where = region === void 0 ? "" : ` (${shellQuote(safeIdentifier(region))})`;
 	return `State for ${shellQuote(safeIdentifier(stackName))}${where}`;
 }
+/**
+* The DESTRUCTIVE remedy, built the way {@link inspectCommand} builds the
+* read-only one, and the region clause follows the SAME rule for two reasons
+* that pull in opposite directions.
+*
+* With a region in hand the flag is not decoration: `cdkd state orphan <stack>`
+* without it drops the record for that stack name in EVERY region, so omitting
+* it hands a stuck operator something wider than the message describes.
+*
+* With NO region the flag is worse than useless, and a placeholder is the worst
+* of the three: an absent region means a v1 record, which predates the
+* region-prefixed key layout, so `--stack-region <region>` selects no record at
+* all whatever the operator fills in. The bare command is the correct one
+* there, because such a record is not region-partitioned.
+*
+* With no trusted STACK the whole thing degrades to a template, as the inspect
+* command does — there is nothing to substitute.
+*
+* **It diverges from {@link malformedDestroyResourcesRefusalMessage}, which
+* keeps `cdkd state orphan` a template on purpose, and the difference is where
+* the identity comes from.** That builder is reached with a record-derived
+* REGION (`state.region ?? ctx.baseRegion` in `destroy-runner.ts`) -- its stack
+* name is the caller's, so the region alone is what would aim a destructive
+* command using a value the record supplied. This one is reached only with the caller's
+* synthesized stack and `pickStackRegion`'s answer, so substituting is safe and
+* omitting the region is the wider action. Two opposite precedents in one
+* module; neither is the general rule.
+*/
+function dropRecordCommand(stackName, region) {
+	if (stackName === void 0 || stackName === "") return "cdkd state orphan <stack> --stack-region <region>";
+	const flag = region === void 0 || region === "" ? "" : ` --stack-region ${shellQuote(safeIdentifier(region))}`;
+	return `cdkd state orphan ${shellQuote(safeIdentifier(stackName))}${flag}`;
+}
 /** The remedy command {@link stackClause}'s message ends on. */
 function inspectCommand(stackName, region) {
 	if (stackName === void 0) return "cdkd state show <stack> --stack-region <region> --json";
@@ -21463,12 +21496,19 @@ function unreadableResourcePropertyBags(state) {
 *
 * Deliberately NOT folded into {@link refuseMalformedState}, for the reason
 * {@link unreadableResourcePropertyBags} gives: that predicate answers a
-* question about the record ROOT, and its four callers (`cdkd scrub`,
-* `import`, `orphan`, `rollback`) have made no decision about this one. Three
-* of them do not compare properties at all, and `cdkd rollback` replays a
-* journal rather than diffing, so an unrelated broken bag would stop the
-* command documented as the way to UNWIND a stack whose state is already
-* suspect. This rule is OPT-IN, taken by the flow that COMPARES the bag.
+* question about the record ROOT, and its callers have each had to make their
+* own decision about this one. `cdkd rollback` replays a journal rather than
+* diffing, so an unrelated broken bag would stop the command documented as the
+* way to UNWIND a stack whose state is already suspect; `cdkd scrub` and
+* `cdkd import` do not compare properties at all.
+*
+* **The rule is OPT-IN PER CALLER, not "whoever COMPARES the bag"**, and an
+* earlier revision of this sentence said the latter — which go-to-k/cdkd#3318
+* falsified within two lanes. `cdkd orphan` compares nothing and still opts in
+* through {@link refuseMalformedResourcePropertiesForOrphan}, because it SAVES
+* the bag; what each caller owes is an answer to "what would I do with a map I
+* cannot read", and comparison is only one way to owe one. Do not read this
+* paragraph as licence to delete a call from a caller that does not diff.
 */
 function refuseMalformedResourceProperties(state, stackName, region) {
 	const unreadable = unreadableResourcePropertyBags(state);
@@ -21575,7 +21615,7 @@ function namedPropertyBagsClause(stackName, region, logicalIds) {
 /**
 * The text {@link refuseMalformedResourceProperties} raises.
 *
-* `stackName` / `region` are the CALLER's resolved identity or nothing at all;
+* `rawStackName` / `rawRegion` are the CALLER's resolved identity or nothing at all;
 * {@link stackClause} is the authority for why this one may be handed neither.
 *
 * **It must be true under `cdkd deploy --dry-run` as well**, and the first
@@ -21604,6 +21644,155 @@ function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds
 	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a DELETE and re-create of resources the template did not change, and reading the bag as empty produces that same verdict rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack with those maps read as EMPTY and warns that it did. Inspect the record with: ${inspectCommand(stackName, region)}`;
 }
 /**
+* The `cdkd orphan` refusal text for the per-entry `properties` container
+* (issue [#3318](https://github.com/go-to-k/cdkd/issues/3318)).
+*
+* A SECOND `properties` refusal beside
+* {@link malformedResourcePropertiesRefusalMessage}, for the reason every
+* split in this module is its own: that text describes the DIFF's verdict —
+* "a DELETE and re-create of resources the template did not change" — which
+* `cdkd orphan` never computes. It runs no diff at all.
+*
+* **And the harm here is NOT the laundering the module's other write-capable
+* refusals describe.** Measured 2026-09-17 through the real
+* `rewriteResourceReferences` over an `AWS::S3::Bucket` record: `rewriteValue`
+* returns a non-object verbatim, so a stored `"abcdef"` comes back as
+* `"abcdef"`, a `5` as `5`, a `null` as `null`, and an ABSENT bag stays absent
+* once `JSON.stringify` drops it. Nothing is fabricated and no evidence is
+* replaced — so {@link malformedOutputsRefusalMessage}'s "saved back as a
+* well-formed six-key map" sentence, true one container over, would be FALSE
+* here and must not be borrowed.
+*
+* What it DOES share is {@link namedPropertyBagsClause}, which carries a
+* diff-shaped sentence of its own ("a create-only property among them is a
+* REPLACEMENT of the live resource"). That is not a contradiction and is not
+* an oversight: the shared clause describes what the RECORD is, and the reason
+* an operator must care is precisely that a later `cdkd deploy` / `cdkd diff`
+* reaches that verdict. What this text must not do — and what its fence pins —
+* is claim that verdict as its OWN, since `cdkd orphan` computes no diff.
+*
+* What IS at stake is the command's own job. `cdkd orphan` exists to leave the
+* record deployable: it rewrites every surviving sibling's `Ref` /
+* `Fn::GetAtt` / `Fn::Sub` reference to an orphan so the next deploy neither
+* re-creates the orphan nor fails on a stale reference. Over a map it cannot
+* read it cannot do that and cannot say it did not. A scalar bag presents no
+* reference to find, so the `--force`-less hard fail on unresolvable
+* references can never fire for one; a LIST bag is the one unreadable shape
+* `rewriteValue` DOES walk (measured: a stored `[{"Ref":"<orphan>"}]` came
+* back as `["<physicalId>"]` with one row in the audit table), so its rewrites
+* are reported into a container that is still not a map. Either way the
+* command takes a lock, saves, and reports success over a record left in
+* exactly the state `cdkd deploy` REFUSES
+* ({@link malformedResourcePropertiesRefusalMessage}) and `cdkd diff` previews
+* as a replacement — one command after the evidence was last in cdkd's hands.
+*
+* **The refusal is SCOPED to the records the save would KEEP, so orphaning the
+* DAMAGED record itself still works** —
+* {@link refuseMalformedResourcePropertiesForOrphan} is handed the ids being
+* removed and never names one. Compare
+* `malformedDestroyResourcesRefusalMessage`, which has to point at a different
+* COMMAND for its way out because a destroy keeps every record it reads.
+*
+* **But that in-command way out is CONDITIONAL, and the text must say so.**
+* `cdkd orphan` addresses resources only through the `aws:cdk:path` index of
+* the SYNTHESIZED template (`resolveConstructPaths` →
+* `buildCdkPathIndex`), so an id the CDK app no longer declares — a record
+* left behind when the construct was deleted, or one a hand edit invented —
+* can never enter the orphan set for ANY invocation. The exemption therefore
+* cannot reach it, and an earlier revision of this text nonetheless told the
+* operator to "orphan the damaged record ITSELF" unconditionally: an
+* instruction that dies on `Construct path '...' not found in template`, which
+* is the misstating-the-remedy class this module's own notes record (security
+* review of go-to-k/cdkd#3318). The remedy is now stated with its condition and
+* the two unconditional ways out beside it — hand repair, and
+* `cdkd state orphan <stack>`, which needs no CDK app and drops the whole
+* record with the live resources left standing.
+*
+* So the recovery-path objection is answered for the common case by the
+* exemption and for the rest by naming commands that do not depend on the
+* template. What this does NOT claim is that `cdkd orphan` stays usable on a
+* stack holding a template-less torn record: it does not, exactly as
+* `cdkd deploy` does not (go-to-k/cdkd#3191). A state-keyed escape hatch
+* (`--orphan-logical-id`, addressing a record by its state key rather than by
+* a construct path) was considered in the same review and DECLINED: it is a new
+* mutating CLI surface whose only job is to route around a record the operator
+* must repair or drop anyway, and `cdkd state orphan <stack>` already removes
+* such a record with no CDK app and no new flag.
+*
+* It must be true under `--dry-run` as well, and it is: the guard sits at the
+* load, far above the `if (options.dryRun)` return. Refusing there is
+* {@link malformedResourcePropertiesRefusalMessage}'s call for the same
+* reason — a plausible rewrite audit table followed by a refusal the moment
+* the flag comes off is the worst arm of all.
+*
+* `rawStackName` / `rawRegion` are the CALLER's resolved identity — the synthesized
+* stack name and the region `pickStackRegion` settled on, never the record's
+* own unvalidated self-report. See {@link stackClause}.
+*/
+function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+	const stackName = rawStackName === "" ? void 0 : rawStackName;
+	const region = rawRegion === "" ? void 0 : rawRegion;
+	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES. No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with '${dropRecordCommand(stackName, region)}', which leaves the live AWS resources standing. A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two. Inspect the record with: ${inspectCommand(stackName, region)}`;
+}
+/**
+* For `cdkd orphan`: refuse a record whose SURVIVING resource entries carry a
+* `properties` bag that cannot be read (issue
+* [#3318](https://github.com/go-to-k/cdkd/issues/3318)).
+*
+* A separate call from {@link refuseMalformedResourceProperties} rather than a
+* flag on it, for the reason {@link refuseMalformedOutputsForDestroy} is
+* separate from {@link refuseMalformedOutputs}: the refusal a user sees must
+* describe what THIS command would have done with the bag, and
+* {@link malformedOrphanResourcePropertiesRefusalMessage} records how far the
+* two consequences diverge.
+*
+* `removedLogicalIds` is the orphan set — the ids this run is dropping from
+* `state.resources`. They are EXCLUDED from the verdict because the save
+* cannot persist a record it is deleting, and because refusing on one would
+* break the recovery path the refusal is otherwise meant to preserve.
+*
+* **It covers `state.resources` ONLY, and the save keeps more than that.**
+* `rewriteResourceReferences` spreads `carriedState`, so `state.orphans[]` —
+* rollback-orphaned records each holding a whole `ResourceState`
+* (go-to-k/cdkd#2934) — rides through untouched, and
+* {@link unreadableResourcePropertyBags} never walks it. A torn bag parked
+* there is therefore still saved, and `computeStackDiff` splices those records
+* into `state.resources` on the next preview. Stated rather than implied,
+* because "the records the save would KEEP" reads wider than what this scans:
+* the gap is go-to-k/cdkd#3344, filed rather than folded in because the remedy
+* differs — an entry in that container has no construct path, so the message's
+* third way out is meaningless for it.
+*
+* **A surviving ENTRY that is not a map is the other gap, and it DOES launder.**
+* This scan asks whether a resource's `properties` is readable; it never asks
+* whether the resource RECORD is. `isReadableBag('abcdef')` is false, so a
+* string entry is skipped here, and then `rewriteResourceReferences`'s
+* `{ ...resource }` spreads it into per-character keys — the record is SAVED as
+* `{"0":"a",…,"dependencies":[]}` and the run reports success. A number entry
+* saves as `{"dependencies":[]}`, a record with no `physicalId`. So the
+* refusal's own text, which says a torn `properties` map is persisted verbatim
+* rather than reshaped, is true of the container it scans and NOT of the one
+* above it.
+*
+* That gap is NOT go-to-k/cdkd#3202's as filed — that issue records only the
+* `null`-entry `TypeError` — and NOT open PR go-to-k/cdkd#3226's, whose file
+* list carries neither `orphan.ts` nor `orphan-rewriter.ts`. A lane closing
+* either one leaves this open, which is why it is named here rather than
+* deferred to them by reference. Filed as go-to-k/cdkd#3350.
+*
+* CALL IT AT THE LOAD, beside {@link refuseMalformedState} and
+* {@link refuseMalformedOutputs}, above `rewriteResourceReferences` — the
+* placement rule {@link repairMalformedResourcesForReadOnly}'s note records.
+* The orphan set is resolved from the synthesized template before the state is
+* loaded, so nothing forces this call any lower.
+*/
+function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, stackName, region) {
+	const removed = new Set(removedLogicalIds);
+	const unreadable = unreadableResourcePropertyBags(state).filter((id) => !removed.has(id));
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedOrphanResourcePropertiesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED);
+}
+/**
 * The warning a caller of {@link repairMalformedResourcePropertiesForReadOnly}
 * emits.
 */
@@ -31729,7 +31918,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B8GAVns4.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DTzndMHB.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -44723,5 +44912,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, withErrorHandling as $i, LockManager as $n, getDefaultStateBucketName as $r, s3BucketArn as $t, extractDeploymentEventError as A, CdkdError as Ai, findActionableSilentDrops as An, parseBootstrapMarker as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, MalformedProducerRecordRefusalError as Bi, carriesSecretMask as Bn, dockerSpawnEnvWithSensitive as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, clearBucketRegionCache as Ci, refuseMalformedOutputs as Cn, rewriteTemplateAssetReferences as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, resetAwsClients as Di, repairMalformedOutputsForReadOnly as Dn, ensureAssetStorage as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, getAwsClients as Ei, refuseMalformedState as En, assertAssetBucketRegion as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DynamicReferenceRegionAmbiguousError as Fi, TemplateParser as Fn, describeAwsFailure as Fr, isSettledInstanceState as Ft, gray as G, ResourceUpdateNotSupportedError as Gi, isSingleDynamicReferenceToken as Gn, runDockerForeground as Gr, readConfigString as Gt, formatResourceLine as H, PartialFailureError as Hi, dynamicReferenceTokens as Hn, getDockerCmd as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, IntrinsicResolutionRefusalError as Ii, STATE_SOURCED_BASELINE_RULES as In, buildDockerImage as Ir, WAFv2WebACLProvider as It, yellow as J, StateError as Ji, maskSecretsInText as Jn, stripControlChars as Jr, requireConfigObject as Jt, green as K, StackHasActiveImportsError as Ki, markSameGenerationBag as Kn, runDockerStreaming as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, LocalInvokeBuildError as Li, STATE_SOURCED_CROSS_GENERATION_RULES as Ln, describeDockerCapturedOutput as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, CrossAccountSecretRefusalError as Mi, describeTypeWithThrottleRetry as Mn, validateAssetBucketName as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, DependencyError as Ni, withRetry as Nn, validateContainerRepoName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, setAwsClients as Oi, repairMalformedResourcePropertiesForReadOnly as On, getBootstrapMarkerKey as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, DeployCancelledError as Pi, DagBuilder as Pn, buildDenyExternalAccessPolicy as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, normalizeAwsError as Qi, scrubResourceRecord as Qn, synthesisStatusMessage as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, LocalStartServiceError as Ri, STATE_SOURCED_READBACK_RULES as Rn, describeDockerExecFailure as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, processStackMessages as Si, refuseMalformedNestedChildOutputs as Sn, loadPublishableAssetManifest as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AwsClients as Ti, refuseMalformedResourcesForDestroy as Tn, BOOTSTRAP_MARKER_PREFIX as Tr, carriesDynamicReference as Tt, bold as U, ProvisioningError as Ui, errorCauseChain as Un, partitionSensitiveEnv as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, NestedStackChildDirectDestroyError as Vi, createSecretMasker as Vn, formatDockerLoginError as Vr, coerceCfnInteger as Vt, cyan as W, ResourceTimeoutError as Wi, identityKeyFor as Wn, redactDockerArgvValues as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, formatError as Xi, recoverMaskedOutput as Xn, getDockerImageBySourceHash as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, SynthesisError as Yi, recordMaskOnlyValue as Yn, AssetManifestLoader as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, isCdkdError as Zi, redactSecretsForState as Zn, Synthesizer as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, expectedOwnerParam as _i, malformedRenderedContainersWarning as _n, AssetPublisher as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, markRedactedCause as aa, resolveStateBucketWithDefault as ai, applyCallerIdentityCredentials as an, formatLockExpiry as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, derivePartitionAndUrlSuffix as bi, malformedStateRefusalMessage as bn, buildAssetRedirectMap as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, stateBucketExistenceConfirmed as ci, INTRINSIC_KEYS as cn, DEFAULT_STATE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, CFN_TEMPLATE_URL_LIMIT as di, hasReadableResources as dn, importableOutputKeys as dr, beginCommandInterruptScope as dt, isMarkedNonRetryable as ea, getLegacyStateBucketName as ei, s3BucketDomainName as en, S3StateBackend as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, MIGRATE_TMP_PREFIX as fi, malformedExportNamesWarning as fn, importableOutputs as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, decodeListingKey as gi, malformedOutputsWarning as gn, shouldRetainResource as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as hi, malformedOutputsRefusalMessage as hn, orphansCarriedFrom as hr, startInterruptWatch as ht, DeploymentEventsReader as i, markNonRetryable as ia, resolveSkipPrefix as ii, applyRoleArnIfSet as in, forceQuitRecoveryClause as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, ConfigError as ji, findSilentDropProperties as jn, readBootstrapMarkerBody as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AssetError as ki, repairMalformedResourcesForReadOnly as kn, isCrossRegionRedirect as kr, getAccountInfo as kt, replayRollback as l, warnDeprecatedNoPrefixCliFlag as li, STATE_RESOURCES_MALFORMED as ln, exportNamesCarriedFrom as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, uploadCfnTemplate as mi, malformedLocalOutputsWarning as mn, orphansAfterRollback as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isThrottlingError as na, resolveAutoAssetStorage as ni, s3BucketRegionalDomainName as nn, buildForceUnlockCommand as nr, getCurrentResourceSecrets as nt, planFailedOps as o, retryClassificationText as oa, resolveStateBucketWithDefaultAndSource as oi, callerEnvCredentials as on, shellQuote as or, ProviderRegistry as ot, maskingRetryLogger as p, findLargeInlineResources as pi, malformedExportSourceWarning as pn, isReadableBag as pr, interruptWatchListenerCount as pt, red as q, StackTerminationProtectionError as qi, maskSecretsInError as qn, escapeRegExp$1 as qr, requireConfigArray as qt, DeployEngine as r, isTransientServerError as ra, resolveCaptureObservedState as ri, s3BucketWebsiteUrl as rn, buildLockContentionMessage as rr, IAMRoleProvider as rt, planRollback as s, __exportAll as sa, resolveUseCdkBootstrapAssets as si, DiffCalculator as sn, CUSTOM_RESOURCE_RESPONSE_PREFIX as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isRetryableTransientError as ta, resolveApp as ti, s3BucketDualStackDomainName as tn, rebuildClientForBucketRegion as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, CFN_TEMPLATE_BODY_LIMIT as ui, hasReadableOutputs as un, hasReadableExportSet as ur, maskerOrIdentity as ut, keptWholeReasonText as v, PARTITION_TABLE as vi, malformedResourcePropertiesWarning as vn, stringifyValue as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, resolveBucketRegion as wi, refuseMalformedOutputsForDestroy as wn, AssetModeResolver as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, AssemblyReader as xi, producerRecordKey as xn, createAssetRedirectResolver as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, canonicalizeRegion as yi, malformedResourcesWarning as yn, WorkGraph as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LockError as zi, TEMPLATE_SOURCED_RULES as zn, describeDockerFailure as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-KnCjibgq.js.map
+export { secretBearing as $, normalizeAwsError as $i, scrubResourceRecord as $n, synthesisStatusMessage as $r, s3BucketArn as $t, extractDeploymentEventError as A, AssetError as Ai, repairMalformedResourcesForReadOnly as An, isCrossRegionRedirect as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, LockError as Bi, TEMPLATE_SOURCED_RULES as Bn, describeDockerFailure as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, processStackMessages as Ci, refuseMalformedOutputs as Cn, loadPublishableAssetManifest as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, getAwsClients as Di, refuseMalformedState as Dn, assertAssetBucketRegion as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, AwsClients as Ei, refuseMalformedResourcesForDestroy as En, BOOTSTRAP_MARKER_PREFIX as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DeployCancelledError as Fi, DagBuilder as Fn, buildDenyExternalAccessPolicy as Fr, isSettledInstanceState as Ft, gray as G, ResourceTimeoutError as Gi, identityKeyFor as Gn, redactDockerArgvValues as Gr, readConfigString as Gt, formatResourceLine as H, NestedStackChildDirectDestroyError as Hi, createSecretMasker as Hn, formatDockerLoginError as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, DynamicReferenceRegionAmbiguousError as Ii, TemplateParser as In, describeAwsFailure as Ir, WAFv2WebACLProvider as It, yellow as J, StackTerminationProtectionError as Ji, maskSecretsInError as Jn, escapeRegExp$1 as Jr, requireConfigObject as Jt, green as K, ResourceUpdateNotSupportedError as Ki, isSingleDynamicReferenceToken as Kn, runDockerForeground as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, IntrinsicResolutionRefusalError as Li, STATE_SOURCED_BASELINE_RULES as Ln, buildDockerImage as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, ConfigError as Mi, findSilentDropProperties as Mn, readBootstrapMarkerBody as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, CrossAccountSecretRefusalError as Ni, describeTypeWithThrottleRetry as Nn, validateAssetBucketName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, resetAwsClients as Oi, repairMalformedOutputsForReadOnly as On, ensureAssetStorage as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, DependencyError as Pi, withRetry as Pn, validateContainerRepoName as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, isCdkdError as Qi, redactSecretsForState as Qn, Synthesizer as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, LocalInvokeBuildError as Ri, STATE_SOURCED_CROSS_GENERATION_RULES as Rn, describeDockerCapturedOutput as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, AssemblyReader as Si, refuseMalformedNestedChildOutputs as Sn, createAssetRedirectResolver as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, resolveBucketRegion as Ti, refuseMalformedResourcePropertiesForOrphan as Tn, AssetModeResolver as Tr, carriesDynamicReference as Tt, bold as U, PartialFailureError as Ui, dynamicReferenceTokens as Un, getDockerCmd as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, MalformedProducerRecordRefusalError as Vi, carriesSecretMask as Vn, dockerSpawnEnvWithSensitive as Vr, coerceCfnInteger as Vt, cyan as W, ProvisioningError as Wi, errorCauseChain as Wn, partitionSensitiveEnv as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, SynthesisError as Xi, recordMaskOnlyValue as Xn, AssetManifestLoader as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, StateError as Yi, maskSecretsInText as Yn, stripControlChars as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, formatError as Zi, recoverMaskedOutput as Zn, getDockerImageBySourceHash as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, decodeListingKey as _i, malformedRenderedContainersWarning as _n, shouldRetainResource as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, markNonRetryable as aa, resolveSkipPrefix as ai, applyCallerIdentityCredentials as an, forceQuitRecoveryClause as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, canonicalizeRegion as bi, malformedStateRefusalMessage as bn, WorkGraph as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, __exportAll as ca, resolveUseCdkBootstrapAssets as ci, INTRINSIC_KEYS as cn, CUSTOM_RESOURCE_RESPONSE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, CFN_TEMPLATE_BODY_LIMIT as di, hasReadableResources as dn, hasReadableExportSet as dr, beginCommandInterruptScope as dt, withErrorHandling as ea, getDefaultStateBucketName as ei, s3BucketDomainName as en, LockManager as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, CFN_TEMPLATE_URL_LIMIT as fi, malformedExportNamesWarning as fn, importableOutputKeys as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gi, malformedOutputsWarning as gn, orphansCarriedFrom as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, uploadCfnTemplate as hi, malformedOutputsRefusalMessage as hn, orphansAfterRollback as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isTransientServerError as ia, resolveCaptureObservedState as ii, applyRoleArnIfSet as in, buildLockContentionMessage as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, CdkdError as ji, findActionableSilentDrops as jn, parseBootstrapMarker as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, setAwsClients as ki, repairMalformedResourcePropertiesForReadOnly as kn, getBootstrapMarkerKey as kr, getAccountInfo as kt, replayRollback as l, stateBucketExistenceConfirmed as li, STATE_RESOURCES_MALFORMED as ln, DEFAULT_STATE_PREFIX as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, findLargeInlineResources as mi, malformedLocalOutputsWarning as mn, isReadableBag as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as na, resolveApp as ni, s3BucketRegionalDomainName as nn, rebuildClientForBucketRegion as nr, getCurrentResourceSecrets as nt, planFailedOps as o, markRedactedCause as oa, resolveStateBucketWithDefault as oi, callerEnvCredentials as on, formatLockExpiry as or, ProviderRegistry as ot, maskingRetryLogger as p, MIGRATE_TMP_PREFIX as pi, malformedExportSourceWarning as pn, importableOutputs as pr, interruptWatchListenerCount as pt, red as q, StackHasActiveImportsError as qi, markSameGenerationBag as qn, runDockerStreaming as qr, requireConfigArray as qt, DeployEngine as r, isThrottlingError as ra, resolveAutoAssetStorage as ri, s3BucketWebsiteUrl as rn, buildForceUnlockCommand as rr, IAMRoleProvider as rt, planRollback as s, retryClassificationText as sa, resolveStateBucketWithDefaultAndSource as si, DiffCalculator as sn, shellQuote as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isMarkedNonRetryable as ta, getLegacyStateBucketName as ti, s3BucketDualStackDomainName as tn, S3StateBackend as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, warnDeprecatedNoPrefixCliFlag as ui, hasReadableOutputs as un, exportNamesCarriedFrom as ur, maskerOrIdentity as ut, keptWholeReasonText as v, expectedOwnerParam as vi, malformedResourcePropertiesWarning as vn, AssetPublisher as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, clearBucketRegionCache as wi, refuseMalformedOutputsForDestroy as wn, rewriteTemplateAssetReferences as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, derivePartitionAndUrlSuffix as xi, producerRecordKey as xn, buildAssetRedirectMap as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, PARTITION_TABLE as yi, malformedResourcesWarning as yn, stringifyValue as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LocalStartServiceError as zi, STATE_SOURCED_READBACK_RULES as zn, describeDockerExecFailure as zr, assertRegionMatch as zt };
+//# sourceMappingURL=deploy-engine-Dbmoo4FQ.js.map