@go-to-k/cdkd 0.290.27 → 0.290.28

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CWpPiHCn.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-B2-UuEte.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-dYPgGoOv.js");
+	const { buildProgram } = await import("./program-C1iVGcxJ.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-CA70_Rji.js → deploy-engine-CcFbq2q8.js}

@@ -1,6 +1,6 @@
-import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-CkHVgzLx.js";
+import { C as displayIdent, S as UNRENDERABLE, T as truncateCodePoints, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displaySafe, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-6LP1UiFA.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CWpPiHCn.js";
+import { t as getCdkdVersion } from "./version-B2-UuEte.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9979,14 +9979,47 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 	const safeStack = displaySafe(stackName, { asciiOnly: true });
 	const stackIsExact = safeStack === stackName;
 	const safeRegion = region === void 0 ? void 0 : displaySafe(region, { asciiOnly: true });
-	if (!safeStack || safeRegion === "" || !stackIsExact || !(region === void 0 || safeRegion === region)) return "";
+	const regionIsExact = region === void 0 || safeRegion === region;
+	const safeRecovery = {
+		profile: sanitizeRecoveryValue(recovery?.profile),
+		stateBucket: sanitizeRecoveryValue(recovery?.stateBucket),
+		statePrefix: sanitizeRecoveryValue(recovery?.statePrefix)
+	};
+	const recoveryIsExact = Object.values(safeRecovery).every((v) => v.exact);
+	if (!safeStack || safeRegion === "" || !stackIsExact || !regionIsExact || !recoveryIsExact) return "";
 	const parts = [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`];
-	if (recovery?.profile) parts.push(`--profile ${shellQuote(recovery.profile)}`);
-	if (recovery?.stateBucket) parts.push(`--state-bucket ${shellQuote(recovery.stateBucket)}`);
-	if (recovery?.statePrefix && recovery.statePrefix !== "cdkd") parts.push(`--state-prefix ${shellQuote(recovery.statePrefix)}`);
+	if (safeRecovery.profile.text) parts.push(`--profile ${shellQuote(safeRecovery.profile.text)}`);
+	if (safeRecovery.stateBucket.text) parts.push(`--state-bucket ${shellQuote(safeRecovery.stateBucket.text)}`);
+	if (safeRecovery.statePrefix.text && safeRecovery.statePrefix.text !== "cdkd") parts.push(`--state-prefix ${shellQuote(safeRecovery.statePrefix.text)}`);
 	return parts.join(" ");
 }
 /**
+* Sanitize ONE {@link LockRecoveryContext} fragment and report whether that
+* changed it.
+*
+* One helper for all three rather than three spellings, for the reason
+* `display-safe.ts`'s own header gives: this rule was widened BY HAND, one
+* value at a time, and missed an instance every round — go-to-k/cdkd#3377
+* named `--profile`, and the fix for it shipped with `--state-bucket` and
+* `--state-prefix` still raw on the next two lines. A fourth fragment added
+* later calls this and inherits both halves.
+*
+* ABSENT stays absent: `''` is returned for it, which every caller's `if`
+* treats as "emit nothing", and `exact` is true because there was nothing to
+* alter.
+*/
+function sanitizeRecoveryValue(value) {
+	if (value === void 0) return {
+		text: "",
+		exact: true
+	};
+	const text = displaySafe(value);
+	return {
+		text,
+		exact: text === value
+	};
+}
+/**
 * What to say INSTEAD of a `cdkd force-unlock ...` line when
 * {@link buildForceUnlockCommand} suppresses.
 *
@@ -9997,7 +10030,25 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 * how the next one drifts. Byte-identical to what `forceQuitRecoveryClause`
 * emitted before the extraction; its callers see no change.
 */
-const UNREPRODUCIBLE_LOCK_CLAUSE = "Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+/**
+* The VALUES `buildForceUnlockCommand` can suppress on, as one noun phrase.
+*
+* Extracted because the enumeration had reached THREE spellings and they had
+* already drifted -- go-to-k/cdkd#3377 gave the guard three more values while
+* two of the three sentences still said "the name or region", so a user whose
+* PROFILE carried an ESC was told their STACK NAME was unrenderable
+* (go-to-k/cdkd#3390 rounds 1 and 2 found one copy each). That is the exact
+* divergence this module was created to end, reproduced inside the module and
+* at one of its call sites.
+*
+* A growing list cannot be kept in step by hand across three sentences, so it
+* is one binding and the sentences interpolate it. Keep it in step with the
+* guard in {@link buildForceUnlockCommand}; the per-word assertion in
+* `tests/unit/state/lock-contention-message.test.ts` is what notices if it
+* falls behind.
+*/
+const UNREPRODUCIBLE_LOCK_VALUES = "the name, region, profile, state bucket or state prefix";
+const UNREPRODUCIBLE_LOCK_CLAUSE = `Inspect the lock object directly: ${UNREPRODUCIBLE_LOCK_VALUES} recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.`;
 /**
 * The force-quit banner's recovery sentence.
 *
@@ -10037,7 +10088,7 @@ async function buildLockContentionMessage(args) {
 	const advice = sawHolder ? `That process is still running — wait for it to finish. Only if you are certain it is gone` : `Wait for it to finish, or if you are certain no other process is active`;
 	const recoveryCommand = buildForceUnlockCommand(stackName, region, recovery);
 	const head = `Could not acquire lock for ${subject} '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) — ${held}.` + (suffix ? ` ${suffix}` : "");
-	if (!recoveryCommand) return `${head} ${advice}. No recovery command can be shown: the name or region recorded for this lock contains characters that cannot be reproduced safely on a command line, so any command shown here would address a different lock — inspect the lock object directly.`;
+	if (!recoveryCommand) return `${head} ${advice}. No recovery command can be shown: ${UNREPRODUCIBLE_LOCK_VALUES} recorded for this lock contains characters that cannot be reproduced safely on a command line, so any command shown here would address a different lock — inspect the lock object directly.`;
 	return `${head} ${advice}, run: ${recoveryCommand}`;
 }
 
@@ -32425,7 +32476,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dn1f0SJi.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DiZsq-4k.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -45436,5 +45487,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, formatError as $i, recordMaskOnlyValue as $n, getDockerImageBySourceHash as $r, s3BucketArn as $t, extractDeploymentEventError as A, resetAwsClients as Ai, refuseMalformedState as An, assertAssetBucketRegion as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, LocalInvokeBuildError as Bi, STATE_SOURCED_BASELINE_RULES as Bn, describeDockerCapturedOutput as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, derivePartitionAndUrlSuffix as Ci, producerRecordKey as Cn, WorkGraph as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, resolveBucketRegion as Di, refuseMalformedOutputsForDestroy as Dn, rewriteTemplateAssetReferences as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, clearBucketRegionCache as Ei, refuseMalformedOutputs as En, loadPublishableAssetManifest as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, CrossAccountSecretRefusalError as Fi, findSilentDropProperties as Fn, readBootstrapMarkerBody as Fr, isSettledInstanceState as Ft, gray as G, PartialFailureError as Gi, createSecretMasker as Gn, getDockerCmd as Gr, readConfigString as Gt, formatResourceLine as H, LockError as Hi, STATE_SOURCED_READBACK_RULES as Hn, describeDockerFailure as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, DependencyError as Ii, describeTypeWithThrottleRetry as In, validateAssetBucketName as Ir, WAFv2WebACLProvider as It, yellow as J, ResourceUpdateNotSupportedError as Ji, identityKeyFor as Jn, runDockerForeground as Jr, requireConfigObject as Jt, green as K, ProvisioningError as Ki, dynamicReferenceTokens as Kn, partitionSensitiveEnv as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DeployCancelledError as Li, withRetry as Ln, validateContainerRepoName as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, AssetError as Mi, repairMalformedResourcePropertiesForReadOnly as Mn, getBootstrapMarkerKey as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, CdkdError as Ni, repairMalformedResourcesForReadOnly as Nn, isCrossRegionRedirect as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, AwsClients as Oi, refuseMalformedResourcePropertiesForOrphan as On, AssetModeResolver as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, ConfigError as Pi, findActionableSilentDrops as Pn, parseBootstrapMarker as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, SynthesisError as Qi, maskSecretsInText as Qn, AssetManifestLoader as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, DynamicReferenceRegionAmbiguousError as Ri, DagBuilder as Rn, buildDenyExternalAccessPolicy as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, canonicalizeRegion as Si, malformedStateRefusalMessage as Sn, stringifyValue as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, processStackMessages as Ti, refuseMalformedNestedChildOutputs as Tn, createAssetRedirectResolver as Tr, carriesDynamicReference as Tt, bold as U, MalformedProducerRecordRefusalError as Ui, TEMPLATE_SOURCED_RULES as Un, dockerSpawnEnvWithSensitive as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LocalStartServiceError as Vi, STATE_SOURCED_CROSS_GENERATION_RULES as Vn, describeDockerExecFailure as Vr, coerceCfnInteger as Vt, cyan as W, NestedStackChildDirectDestroyError as Wi, carriesSecretMask as Wn, formatDockerLoginError as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StackTerminationProtectionError as Xi, markSameGenerationBag as Xn, escapeRegExp$1 as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, StackHasActiveImportsError as Yi, isSingleDynamicReferenceToken as Yn, runDockerStreaming as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, StateError as Zi, maskSecretsInError as Zn, stripControlChars as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, uploadCfnTemplate as _i, malformedOutputsRefusalMessage as _n, isReadableBag as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isThrottlingError as aa, resolveAutoAssetStorage as ai, AWS_CREDENTIAL_ENV_KEYS as an, rebuildClientForBucketRegion as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, expectedOwnerParam as bi, malformedResourcePropertiesWarning as bn, shouldRetainResource as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, markRedactedCause as ca, resolveStateBucketWithDefault as ci, envCredentialsAreAssumedRole as cn, forceQuitRecoveryClause as cr, createMaskedRetryLogger as ct, updatePartialReason as d, safeStringify$1 as da, stateBucketExistenceConfirmed as di, STATE_RESOURCES_MALFORMED as dn, CUSTOM_RESOURCE_RESPONSE_PREFIX as dr, beginCommandInterruptScope as dt, isCdkdError as ea, Synthesizer as ei, s3BucketDomainName as en, recoverMaskedOutput as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, __exportAll as fa, warnDeprecatedNoPrefixCliFlag as fi, hasReadableOutputs as fn, DEFAULT_STATE_PREFIX as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, findLargeInlineResources as gi, malformedLocalOutputsWarning as gn, importableOutputs as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, MIGRATE_TMP_PREFIX as hi, malformedExportSourceWarning as hn, importableOutputKeys as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isRetryableTransientError as ia, resolveApp as ii, applyRoleArnIfSet as in, S3StateBackend as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, setAwsClients as ji, repairMalformedOutputsForReadOnly as jn, ensureAssetStorage as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, getAwsClients as ki, refuseMalformedResourcesForDestroy as kn, BOOTSTRAP_MARKER_PREFIX as kr, getAccountInfo as kt, replayRollback as l, retryClassificationText as la, resolveStateBucketWithDefaultAndSource as li, DiffCalculator as ln, formatLockExpiry as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CFN_TEMPLATE_URL_LIMIT as mi, malformedExportNamesWarning as mn, hasReadableExportSet as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, withErrorHandling as na, getDefaultStateBucketName as ni, s3BucketRegionalDomainName as nn, scrubResourceRecord as nr, getCurrentResourceSecrets as nt, planFailedOps as o, isTransientServerError as oa, resolveCaptureObservedState as oi, applyCallerIdentityCredentials as on, buildForceUnlockCommand as or, ProviderRegistry as ot, maskingRetryLogger as p, CFN_TEMPLATE_BODY_LIMIT as pi, hasReadableResources as pn, exportNamesCarriedFrom as pr, interruptWatchListenerCount as pt, red as q, ResourceTimeoutError as qi, errorCauseChain as qn, redactDockerArgvValues as qr, requireConfigArray as qt, DeployEngine as r, isMarkedNonRetryable as ra, getLegacyStateBucketName as ri, s3BucketWebsiteUrl as rn, LockManager as rr, IAMRoleProvider as rt, planRollback as s, markNonRetryable as sa, resolveSkipPrefix as si, callerEnvCredentials as sn, buildLockContentionMessage as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, normalizeAwsError as ta, synthesisStatusMessage as ti, s3BucketDualStackDomainName as tn, redactSecretsForState as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, describeAwsFailure as ua, resolveUseCdkBootstrapAssets as ui, INTRINSIC_KEYS as un, shellQuote as ur, maskerOrIdentity as ut, keptWholeReasonText as v, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as vi, malformedOutputsWarning as vn, orphansAfterRollback as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, AssemblyReader as wi, refuseDivergentRecordRegionForDestroy as wn, buildAssetRedirectMap as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, PARTITION_TABLE as xi, malformedResourcesWarning as xn, AssetPublisher as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, decodeListingKey as yi, malformedRenderedContainersWarning as yn, orphansCarriedFrom as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, IntrinsicResolutionRefusalError as zi, TemplateParser as zn, buildDockerImage as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-CA70_Rji.js.map
+export { secretBearing as $, SynthesisError as $i, recordMaskOnlyValue as $n, AssetManifestLoader as $r, s3BucketArn as $t, extractDeploymentEventError as A, getAwsClients as Ai, refuseMalformedState as An, BOOTSTRAP_MARKER_PREFIX as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, IntrinsicResolutionRefusalError as Bi, STATE_SOURCED_BASELINE_RULES as Bn, buildDockerImage as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, canonicalizeRegion as Ci, producerRecordKey as Cn, stringifyValue as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, clearBucketRegionCache as Di, refuseMalformedOutputsForDestroy as Dn, loadPublishableAssetManifest as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, processStackMessages as Ei, refuseMalformedOutputs as En, createAssetRedirectResolver as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, ConfigError as Fi, findSilentDropProperties as Fn, parseBootstrapMarker as Fr, isSettledInstanceState as Ft, gray as G, NestedStackChildDirectDestroyError as Gi, createSecretMasker as Gn, formatDockerLoginError as Gr, readConfigString as Gt, formatResourceLine as H, LocalStartServiceError as Hi, STATE_SOURCED_READBACK_RULES as Hn, describeDockerExecFailure as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, CrossAccountSecretRefusalError as Ii, describeTypeWithThrottleRetry as In, readBootstrapMarkerBody as Ir, WAFv2WebACLProvider as It, yellow as J, ResourceTimeoutError as Ji, identityKeyFor as Jn, redactDockerArgvValues as Jr, requireConfigObject as Jt, green as K, PartialFailureError as Ki, dynamicReferenceTokens as Kn, getDockerCmd as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DependencyError as Li, withRetry as Ln, validateAssetBucketName as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, setAwsClients as Mi, repairMalformedResourcePropertiesForReadOnly as Mn, ensureAssetStorage as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, AssetError as Ni, repairMalformedResourcesForReadOnly as Nn, getBootstrapMarkerKey as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, resolveBucketRegion as Oi, refuseMalformedResourcePropertiesForOrphan as On, rewriteTemplateAssetReferences as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CdkdError as Pi, findActionableSilentDrops as Pn, isCrossRegionRedirect as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, StateError as Qi, maskSecretsInText as Qn, stripControlChars as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, DeployCancelledError as Ri, DagBuilder as Rn, validateContainerRepoName as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, PARTITION_TABLE as Si, malformedStateRefusalMessage as Sn, AssetPublisher as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AssemblyReader as Ti, refuseMalformedNestedChildOutputs as Tn, buildAssetRedirectMap as Tr, carriesDynamicReference as Tt, bold as U, LockError as Ui, TEMPLATE_SOURCED_RULES as Un, describeDockerFailure as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LocalInvokeBuildError as Vi, STATE_SOURCED_CROSS_GENERATION_RULES as Vn, describeDockerCapturedOutput as Vr, coerceCfnInteger as Vt, cyan as W, MalformedProducerRecordRefusalError as Wi, carriesSecretMask as Wn, dockerSpawnEnvWithSensitive as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StackHasActiveImportsError as Xi, markSameGenerationBag as Xn, runDockerStreaming as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, ResourceUpdateNotSupportedError as Yi, isSingleDynamicReferenceToken as Yn, runDockerForeground as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, StackTerminationProtectionError as Zi, maskSecretsInError as Zn, escapeRegExp$1 as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, findLargeInlineResources as _i, malformedOutputsRefusalMessage as _n, importableOutputs as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isRetryableTransientError as aa, resolveApp as ai, AWS_CREDENTIAL_ENV_KEYS as an, rebuildClientForBucketRegion as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, decodeListingKey as bi, malformedResourcePropertiesWarning as bn, orphansCarriedFrom as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, markNonRetryable as ca, resolveSkipPrefix as ci, envCredentialsAreAssumedRole as cn, buildLockContentionMessage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, describeAwsFailure as da, resolveUseCdkBootstrapAssets as di, STATE_RESOURCES_MALFORMED as dn, shellQuote as dr, beginCommandInterruptScope as dt, formatError as ea, getDockerImageBySourceHash as ei, s3BucketDomainName as en, recoverMaskedOutput as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, safeStringify$1 as fa, stateBucketExistenceConfirmed as fi, hasReadableOutputs as fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, MIGRATE_TMP_PREFIX as gi, malformedLocalOutputsWarning as gn, importableOutputKeys as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CFN_TEMPLATE_URL_LIMIT as hi, malformedExportSourceWarning as hn, hasReadableExportSet as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isMarkedNonRetryable as ia, getLegacyStateBucketName as ii, applyRoleArnIfSet as in, S3StateBackend as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, resetAwsClients as ji, repairMalformedOutputsForReadOnly as jn, assertAssetBucketRegion as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AwsClients as ki, refuseMalformedResourcesForDestroy as kn, AssetModeResolver as kr, getAccountInfo as kt, replayRollback as l, markRedactedCause as la, resolveStateBucketWithDefault as li, DiffCalculator as ln, forceQuitRecoveryClause as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CFN_TEMPLATE_BODY_LIMIT as mi, malformedExportNamesWarning as mn, exportNamesCarriedFrom as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, normalizeAwsError as na, synthesisStatusMessage as ni, s3BucketRegionalDomainName as nn, scrubResourceRecord as nr, getCurrentResourceSecrets as nt, planFailedOps as o, isThrottlingError as oa, resolveAutoAssetStorage as oi, applyCallerIdentityCredentials as on, UNREPRODUCIBLE_LOCK_CLAUSE as or, ProviderRegistry as ot, maskingRetryLogger as p, __exportAll as pa, warnDeprecatedNoPrefixCliFlag as pi, hasReadableResources as pn, DEFAULT_STATE_PREFIX as pr, interruptWatchListenerCount as pt, red as q, ProvisioningError as qi, errorCauseChain as qn, partitionSensitiveEnv as qr, requireConfigArray as qt, DeployEngine as r, withErrorHandling as ra, getDefaultStateBucketName as ri, s3BucketWebsiteUrl as rn, LockManager as rr, IAMRoleProvider as rt, planRollback as s, isTransientServerError as sa, resolveCaptureObservedState as si, callerEnvCredentials as sn, buildForceUnlockCommand as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isCdkdError as ta, Synthesizer as ti, s3BucketDualStackDomainName as tn, redactSecretsForState as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, retryClassificationText as ua, resolveStateBucketWithDefaultAndSource as ui, INTRINSIC_KEYS as un, formatLockExpiry as ur, maskerOrIdentity as ut, keptWholeReasonText as v, uploadCfnTemplate as vi, malformedOutputsWarning as vn, isReadableBag as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, derivePartitionAndUrlSuffix as wi, refuseDivergentRecordRegionForDestroy as wn, WorkGraph as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, expectedOwnerParam as xi, malformedResourcesWarning as xn, shouldRetainResource as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as yi, malformedRenderedContainersWarning as yn, orphansAfterRollback as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, DynamicReferenceRegionAmbiguousError as zi, TemplateParser as zn, buildDenyExternalAccessPolicy as zr, assertRegionMatch as zt };
+//# sourceMappingURL=deploy-engine-CcFbq2q8.js.map