@go-to-k/cdkd 0.290.34 → 0.290.36

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CpyoQ3PO.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BYmXwLpd.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-Dh1J573K.js");
+	const { buildProgram } = await import("./program-DcMcqr70.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-efiVJ-rX.js → deploy-engine-tX_-qy5a.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CpyoQ3PO.js";
+import { t as getCdkdVersion } from "./version-BYmXwLpd.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9473,6 +9473,14 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	10
 ];
 /**
+* Whether `record` carries a baseline refusal no in-place UPDATE may clear.
+* Requires the marker AND the reason: a reason with no marker is not a state
+* any writer produces, and honouring it would invent a refusal.
+*/
+function hasUnverifiableParameterRefusal(record) {
+	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
+}
+/**
 * Returns true when a recorded `DeletionPolicy` should prevent cdkd from
 * deleting the underlying AWS resource. `Retain` and `RetainExceptOnCreate`
 * both keep the resource around; `Delete` / `Snapshot` / undefined all
@@ -33135,7 +33143,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BTxYWlwu.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DWY8_Kn4.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -44429,7 +44437,7 @@ var DeployEngine = class DeployEngine {
 				resource
 			});
 		}
-		if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused (issue #2944): their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline; a NO_CHANGE deploy does not.`);
+		if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused (issue #2944): their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
 		if (candidates.length === 0) return;
 		const allSiblings = {};
 		for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
@@ -45783,6 +45791,7 @@ var DeployEngine = class DeployEngine {
 						} else throw updateError;
 					}
 					if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+					const keepsParameterRefusal = !(result.wasReplaced === true && result.physicalId !== currentResource.physicalId) && hasUnverifiableParameterRefusal(currentResource);
 					const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
 					this.registerNoEchoAttributes(logicalId, {
 						...carriedAttributes && { attributes: carriedAttributes },
@@ -45796,10 +45805,15 @@ var DeployEngine = class DeployEngine {
 						...carriedAttributes && { attributes: carriedAttributes },
 						...dependencies && dependencies.length > 0 && { dependencies },
 						...this.extractTemplateAttributes(template, logicalId),
-						provisionedBy: resultProvisionedBy
+						provisionedBy: resultProvisionedBy,
+						...keepsParameterRefusal && {
+							observedBaselineRefused: true,
+							observedBaselineRefusalReason: "unverifiable-parameter"
+						}
 					};
-					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-					this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
+					if (keepsParameterRefusal) this.logger.debug(`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
+					const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
+					if (!keepsParameterRefusal) this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
 					const updatePartial = updatePartialReason(result);
 					if (counts) {
 						if (updatePartial !== void 0) counts.updatePartial++;
@@ -46506,5 +46520,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { isExportAliasCollision as $, StateError as $i, maskSecretsInText as $n, stripControlChars as $r, withSharedDrainBudget as $t, makeCanonicalizePropertiesFn as A, AwsClients as Ai, refuseMalformedResourcesForDestroy as An, AssetModeResolver as Ar, getAccountInfo as At, isWarmThroughputDecrease as B, DynamicReferenceRegionAmbiguousError as Bi, TemplateParser as Bn, buildDenyExternalAccessPolicy as Br, assertRegionMatch as Bt, PRE_DELETE_SNAPSHOT_TYPES as C, PARTITION_TABLE as Ci, malformedStateRefusalMessage as Cn, AssetPublisher as Cr, disableInstanceApiTermination as Ct, isFinalSnapshotError as D, processStackMessages as Di, refuseMalformedOutputs as Dn, createAssetRedirectResolver as Dr, carriesFetchableDynamicReference as Dt, createPreDeleteFinalSnapshot as E, AssemblyReader as Ei, refuseMalformedNestedChildOutputs as En, buildAssetRedirectMap as Er, carriesDynamicReference as Et, isStatefulRecreateTargetForReplace as F, CdkdError as Fi, findActionableSilentDrops as Fn, isCrossRegionRedirect as Fr, refStateLookupFromResource as Ft, cyan as G, MalformedProducerRecordRefusalError as Gi, carriesSecretMask as Gn, dockerSpawnEnvWithSensitive as Gr, configStringRefusal as Gt, toFiniteNumber as H, LocalInvokeBuildError as Hi, STATE_SOURCED_CROSS_GENERATION_RULES as Hn, describeDockerCapturedOutput as Hr, coerceCfnInteger as Ht, isStatefulRecreateTargetSync as I, ConfigError as Ii, findSilentDropProperties as In, parseBootstrapMarker as Ir, isSettledInstanceState as It, red as J, ProvisioningError as Ji, errorCauseChain as Jn, partitionSensitiveEnv as Jr, requireConfigArray as Jt, gray as K, NestedStackChildDirectDestroyError as Ki, createSecretMasker as Kn, formatDockerLoginError as Kr, readConfigString as Kt, renderStatefulReason as L, CrossAccountSecretRefusalError as Li, describeTypeWithThrottleRetry as Ln, readBootstrapMarkerBody as Lr, WAFv2WebACLProvider as Lt, makeSiblingClaimReader as M, resetAwsClients as Mi, repairMalformedOutputsForReadOnly as Mn, assertAssetBucketRegion as Mr, isNamelessDynamicReferenceError as Mt, planOrphanAdoption as N, setAwsClients as Ni, repairMalformedResourcePropertiesForReadOnly as Nn, ensureAssetStorage as Nr, isUnboundTemplateParameter as Nt, refusesFinalSnapshot as O, clearBucketRegionCache as Oi, refuseMalformedOutputsForDestroy as On, loadPublishableAssetManifest as Or, cfnRefValueFromPhysicalId as Ot, MULTI_REGION_RECREATE_BLOCKED_TYPES as P, AssetError as Pi, repairMalformedResourcesForReadOnly as Pn, getBootstrapMarkerKey as Pr, parameterTypeMayLoseSecretIdentity as Pt, exportAliasCollisionScrubWarning as Q, StackTerminationProtectionError as Qi, maskSecretsInError as Qn, escapeRegExp$1 as Qr, producerRegionsFromState as Qt, WARM_THROUGHPUT_MEMBERS as R, DependencyError as Ri, withRetry as Rn, validateAssetBucketName as Rr, normalizeAwsTagsToCfn as Rt, ATOMIC_FINAL_SNAPSHOT_TYPES as S, expectedOwnerParam as Si, malformedResourcesWarning as Sn, shouldRetainResource as Sr, deleteSkipReason as St, ccRoutedFinalSnapshotError as T, derivePartitionAndUrlSuffix as Ti, refuseDivergentRecordRegionForDestroy as Tn, WorkGraph as Tr, IntrinsicFunctionResolver as Tt, formatResourceLine as U, LocalStartServiceError as Ui, STATE_SOURCED_READBACK_RULES as Un, describeDockerExecFailure as Ur, configBooleanRefusal as Ut, toCfnInteger as V, IntrinsicResolutionRefusalError as Vi, STATE_SOURCED_BASELINE_RULES as Vn, buildDockerImage as Vr, coerceCfnBoolean as Vt, bold as W, LockError as Wi, TEMPLATE_SOURCED_RULES as Wn, describeDockerFailure as Wr, configIntegerRefusal as Wt, collectDeclaredOutputNames as X, ResourceUpdateNotSupportedError as Xi, isSingleDynamicReferenceToken as Xn, runDockerForeground as Xr, requireConfigString as Xt, yellow as Y, ResourceTimeoutError as Yi, identityKeyFor as Yn, redactDockerArgvValues as Yr, requireConfigObject as Yt, collectPublishedOutputNames as Z, StackHasActiveImportsError as Zi, markSameGenerationBag as Zn, runDockerStreaming as Zr, classifyReplaySecretRegion as Zt, bagHoldsSecretExpression as _, MIGRATE_TMP_PREFIX as _i, malformedLocalOutputsWarning as _n, importableOutputKeys as _r, CloudControlProvider as _t, DeploymentEventsStore as a, isMarkedNonRetryable as aa, getLegacyStateBucketName as ai, applyRoleArnIfSet as an, S3StateBackend as ar, collectInlinePolicyNamesManagedBySiblings as at, mergeNoChangeOutputs as b, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as bi, malformedRenderedContainersWarning as bn, orphansAfterRollback as br, UNSPECIFIED_SKIP_REASON as bt, replayFailedOperations as c, isTransientServerError as ca, resolveCaptureObservedState as ci, callerEnvCredentials as cn, buildForceUnlockCommand as cr, wouldReturnToSdkProvider as ct, updatePartialMessage as d, retryClassificationText as da, resolveStateBucketWithDefaultAndSource as di, INTRINSIC_KEYS as dn, formatLockExpiry as dr, maskerOrIdentity as dt, SynthesisError as ea, AssetManifestLoader as ei, s3BucketArn as en, recordMaskOnlyValue as er, secretBearing as et, updatePartialReason as f, describeAwsFailure as fa, resolveUseCdkBootstrapAssets as fi, STATE_RESOURCES_MALFORMED as fn, shellQuote as fr, beginCommandInterruptScope as ft, computeImplicitDeleteEdges as g, CFN_TEMPLATE_URL_LIMIT as gi, malformedExportSourceWarning as gn, hasReadableExportSet as gr, startInterruptWatch as gt, IMPLICIT_DELETE_DEPENDENCIES as h, CFN_TEMPLATE_BODY_LIMIT as hi, malformedExportNamesWarning as hn, exportNamesCarriedFrom as hr, isInterruptedWaitError as ht, DeploymentEventsReader as i, withErrorHandling as ia, getDefaultStateBucketName as ii, s3BucketWebsiteUrl as in, LockManager as ir, IAMRoleProvider as it, extractDeploymentEventError as j, getAwsClients as ji, refuseMalformedState as jn, BOOTSTRAP_MARKER_PREFIX as jr, isImpossibleEmptyStoredAttribute as jt, unsupportedFinalSnapshotError as k, resolveBucketRegion as ki, refuseMalformedResourcePropertiesForOrphan as kn, rewriteTemplateAssetReferences as kr, coerceParameterTypedValue as kt, replayRollback as l, markNonRetryable as la, resolveSkipPrefix as li, envCredentialsAreAssumedRole as ln, buildLockContentionMessage as lr, createMaskedRetryLogger as lt, maskingRetryLogger as m, __exportAll as ma, warnDeprecatedNoPrefixCliFlag as mi, hasReadableResources as mn, DEFAULT_STATE_PREFIX as mr, interruptWatchListenerCount as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as na, Synthesizer as ni, s3BucketDualStackDomainName as nn, redactSecretsForState as nr, secretSafeKeyDisplay as nt, planFailedOps as o, isRetryableTransientError as oa, resolveApp as oi, AWS_CREDENTIAL_ENV_KEYS as on, rebuildClientForBucketRegion as or, clearOnUpdateRemoval as ot, withResourceDeadline as p, safeStringify$1 as pa, stateBucketExistenceConfirmed as pi, hasReadableOutputs as pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as pr, endCommandInterruptScope as pt, green as q, PartialFailureError as qi, dynamicReferenceTokens as qn, getDockerCmd as qr, replayWarn as qt, DeployEngine as r, normalizeAwsError as ra, synthesisStatusMessage as ri, s3BucketRegionalDomainName as rn, scrubResourceRecord as rr, getCurrentResourceSecrets as rt, planRollback as s, isThrottlingError as sa, resolveAutoAssetStorage as si, applyCallerIdentityCredentials as sn, UNREPRODUCIBLE_LOCK_CLAUSE as sr, ProviderRegistry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as ta, getDockerImageBySourceHash as ti, s3BucketDomainName as tn, recoverMaskedOutput as tr, secretBearingStateKeyWarning as tt, resolveReplacementOldType as u, markRedactedCause as ua, resolveStateBucketWithDefault as ui, DiffCalculator as un, forceQuitRecoveryClause as ur, maskDeep as ut, isSecretBearingReferenceString as v, findLargeInlineResources as vi, malformedOutputsRefusalMessage as vn, importableOutputs as vr, isWaitAbandonedError as vt, buildFinalSnapshotIdentifier as w, canonicalizeRegion as wi, producerRecordKey as wn, stringifyValue as wr, isTerminationProtectionPropagationError as wt, bindingSkippedOutputs as x, decodeListingKey as xi, malformedResourcePropertiesWarning as xn, orphansCarriedFrom as xr, deleteIndeterminateGuards as xt, keptWholeReasonText as y, uploadCfnTemplate as yi, malformedOutputsWarning as yn, isReadableBag as yr, slowCcOperationTimeoutMs as yt, coerceWarmThroughput as z, DeployCancelledError as zi, DagBuilder as zn, validateContainerRepoName as zr, resolveExplicitPhysicalId as zt };
-//# sourceMappingURL=deploy-engine-efiVJ-rX.js.map
+export { isExportAliasCollision as $, StackHasActiveImportsError as $i, maskSecretsInText as $n, escapeRegExp$1 as $r, withSharedDrainBudget as $t, makeCanonicalizePropertiesFn as A, clearBucketRegionCache as Ai, refuseMalformedResourcesForDestroy as An, rewriteTemplateAssetReferences as Ar, getAccountInfo as At, isWarmThroughputDecrease as B, DependencyError as Bi, TemplateParser as Bn, validateContainerRepoName as Br, assertRegionMatch as Bt, PRE_DELETE_SNAPSHOT_TYPES as C, decodeListingKey as Ci, malformedStateRefusalMessage as Cn, shouldRetainResource as Cr, disableInstanceApiTermination as Ct, isFinalSnapshotError as D, derivePartitionAndUrlSuffix as Di, refuseMalformedOutputs as Dn, buildAssetRedirectMap as Dr, carriesFetchableDynamicReference as Dt, createPreDeleteFinalSnapshot as E, canonicalizeRegion as Ei, refuseMalformedNestedChildOutputs as En, WorkGraph as Er, carriesDynamicReference as Et, isStatefulRecreateTargetForReplace as F, setAwsClients as Fi, findActionableSilentDrops as Fn, getBootstrapMarkerKey as Fr, refStateLookupFromResource as Ft, cyan as G, LocalStartServiceError as Gi, carriesSecretMask as Gn, describeDockerFailure as Gr, configStringRefusal as Gt, toFiniteNumber as H, DynamicReferenceRegionAmbiguousError as Hi, STATE_SOURCED_CROSS_GENERATION_RULES as Hn, buildDockerImage as Hr, coerceCfnInteger as Ht, isStatefulRecreateTargetSync as I, AssetError as Ii, findSilentDropProperties as In, isCrossRegionRedirect as Ir, isSettledInstanceState as It, red as J, NestedStackChildDirectDestroyError as Ji, errorCauseChain as Jn, getDockerCmd as Jr, requireConfigArray as Jt, gray as K, LockError as Ki, createSecretMasker as Kn, dockerSpawnEnvWithSensitive as Kr, readConfigString as Kt, renderStatefulReason as L, CdkdError as Li, describeTypeWithThrottleRetry as Ln, parseBootstrapMarker as Lr, WAFv2WebACLProvider as Lt, makeSiblingClaimReader as M, AwsClients as Mi, repairMalformedOutputsForReadOnly as Mn, BOOTSTRAP_MARKER_PREFIX as Mr, isNamelessDynamicReferenceError as Mt, planOrphanAdoption as N, getAwsClients as Ni, repairMalformedResourcePropertiesForReadOnly as Nn, assertAssetBucketRegion as Nr, isUnboundTemplateParameter as Nt, refusesFinalSnapshot as O, AssemblyReader as Oi, refuseMalformedOutputsForDestroy as On, createAssetRedirectResolver as Or, cfnRefValueFromPhysicalId as Ot, MULTI_REGION_RECREATE_BLOCKED_TYPES as P, resetAwsClients as Pi, repairMalformedResourcesForReadOnly as Pn, ensureAssetStorage as Pr, parameterTypeMayLoseSecretIdentity as Pt, exportAliasCollisionScrubWarning as Q, ResourceUpdateNotSupportedError as Qi, maskSecretsInError as Qn, runDockerStreaming as Qr, producerRegionsFromState as Qt, WARM_THROUGHPUT_MEMBERS as R, ConfigError as Ri, withRetry as Rn, readBootstrapMarkerBody as Rr, normalizeAwsTagsToCfn as Rt, ATOMIC_FINAL_SNAPSHOT_TYPES as S, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Si, malformedResourcesWarning as Sn, orphansCarriedFrom as Sr, deleteSkipReason as St, ccRoutedFinalSnapshotError as T, PARTITION_TABLE as Ti, refuseDivergentRecordRegionForDestroy as Tn, stringifyValue as Tr, IntrinsicFunctionResolver as Tt, formatResourceLine as U, IntrinsicResolutionRefusalError as Ui, STATE_SOURCED_READBACK_RULES as Un, describeDockerCapturedOutput as Ur, configBooleanRefusal as Ut, toCfnInteger as V, DeployCancelledError as Vi, STATE_SOURCED_BASELINE_RULES as Vn, buildDenyExternalAccessPolicy as Vr, coerceCfnBoolean as Vt, bold as W, LocalInvokeBuildError as Wi, TEMPLATE_SOURCED_RULES as Wn, describeDockerExecFailure as Wr, configIntegerRefusal as Wt, collectDeclaredOutputNames as X, ProvisioningError as Xi, isSingleDynamicReferenceToken as Xn, redactDockerArgvValues as Xr, requireConfigString as Xt, yellow as Y, PartialFailureError as Yi, identityKeyFor as Yn, partitionSensitiveEnv as Yr, requireConfigObject as Yt, collectPublishedOutputNames as Z, ResourceTimeoutError as Zi, markSameGenerationBag as Zn, runDockerForeground as Zr, classifyReplaySecretRegion as Zt, bagHoldsSecretExpression as _, CFN_TEMPLATE_BODY_LIMIT as _i, malformedLocalOutputsWarning as _n, hasUnverifiableParameterRefusal as _r, CloudControlProvider as _t, DeploymentEventsStore as a, normalizeAwsError as aa, getDefaultStateBucketName as ai, applyRoleArnIfSet as an, S3StateBackend as ar, collectInlinePolicyNamesManagedBySiblings as at, mergeNoChangeOutputs as b, findLargeInlineResources as bi, malformedRenderedContainersWarning as bn, isReadableBag as br, UNSPECIFIED_SKIP_REASON as bt, replayFailedOperations as c, isRetryableTransientError as ca, resolveAutoAssetStorage as ci, callerEnvCredentials as cn, buildForceUnlockCommand as cr, wouldReturnToSdkProvider as ct, updatePartialMessage as d, markNonRetryable as da, resolveStateBucketWithDefault as di, INTRINSIC_KEYS as dn, formatLockExpiry as dr, maskerOrIdentity as dt, StackTerminationProtectionError as ea, stripControlChars as ei, s3BucketArn as en, recordMaskOnlyValue as er, secretBearing as et, updatePartialReason as f, markRedactedCause as fa, resolveStateBucketWithDefaultAndSource as fi, STATE_RESOURCES_MALFORMED as fn, shellQuote as fr, beginCommandInterruptScope as ft, computeImplicitDeleteEdges as g, __exportAll as ga, ssmResolvedValueType as gi, malformedExportSourceWarning as gn, hasReadableExportSet as gr, startInterruptWatch as gt, IMPLICIT_DELETE_DEPENDENCIES as h, safeStringify$1 as ha, warnDeprecatedNoPrefixCliFlag as hi, malformedExportNamesWarning as hn, exportNamesCarriedFrom as hr, isInterruptedWaitError as ht, DeploymentEventsReader as i, isCdkdError as ia, synthesisStatusMessage as ii, s3BucketWebsiteUrl as in, LockManager as ir, IAMRoleProvider as it, extractDeploymentEventError as j, resolveBucketRegion as ji, refuseMalformedState as jn, AssetModeResolver as jr, isImpossibleEmptyStoredAttribute as jt, unsupportedFinalSnapshotError as k, processStackMessages as ki, refuseMalformedResourcePropertiesForOrphan as kn, loadPublishableAssetManifest as kr, coerceParameterTypedValue as kt, replayRollback as l, isThrottlingError as la, resolveCaptureObservedState as li, envCredentialsAreAssumedRole as ln, buildLockContentionMessage as lr, createMaskedRetryLogger as lt, maskingRetryLogger as m, describeAwsFailure as ma, stateBucketExistenceConfirmed as mi, hasReadableResources as mn, DEFAULT_STATE_PREFIX as mr, interruptWatchListenerCount as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, SynthesisError as na, getDockerImageBySourceHash as ni, s3BucketDualStackDomainName as nn, redactSecretsForState as nr, secretSafeKeyDisplay as nt, planFailedOps as o, withErrorHandling as oa, getLegacyStateBucketName as oi, AWS_CREDENTIAL_ENV_KEYS as on, rebuildClientForBucketRegion as or, clearOnUpdateRemoval as ot, withResourceDeadline as p, retryClassificationText as pa, resolveUseCdkBootstrapAssets as pi, hasReadableOutputs as pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as pr, endCommandInterruptScope as pt, green as q, MalformedProducerRecordRefusalError as qi, dynamicReferenceTokens as qn, formatDockerLoginError as qr, replayWarn as qt, DeployEngine as r, formatError as ra, Synthesizer as ri, s3BucketRegionalDomainName as rn, scrubResourceRecord as rr, getCurrentResourceSecrets as rt, planRollback as s, isMarkedNonRetryable as sa, resolveApp as si, applyCallerIdentityCredentials as sn, UNREPRODUCIBLE_LOCK_CLAUSE as sr, ProviderRegistry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StateError as ta, AssetManifestLoader as ti, s3BucketDomainName as tn, recoverMaskedOutput as tr, secretBearingStateKeyWarning as tt, resolveReplacementOldType as u, isTransientServerError as ua, resolveSkipPrefix as ui, DiffCalculator as un, forceQuitRecoveryClause as ur, maskDeep as ut, isSecretBearingReferenceString as v, CFN_TEMPLATE_URL_LIMIT as vi, malformedOutputsRefusalMessage as vn, importableOutputKeys as vr, isWaitAbandonedError as vt, buildFinalSnapshotIdentifier as w, expectedOwnerParam as wi, producerRecordKey as wn, AssetPublisher as wr, isTerminationProtectionPropagationError as wt, bindingSkippedOutputs as x, uploadCfnTemplate as xi, malformedResourcePropertiesWarning as xn, orphansAfterRollback as xr, deleteIndeterminateGuards as xt, keptWholeReasonText as y, MIGRATE_TMP_PREFIX as yi, malformedOutputsWarning as yn, importableOutputs as yr, slowCcOperationTimeoutMs as yt, coerceWarmThroughput as z, CrossAccountSecretRefusalError as zi, DagBuilder as zn, validateAssetBucketName as zr, resolveExplicitPhysicalId as zt };
+//# sourceMappingURL=deploy-engine-tX_-qy5a.js.map