@go-to-k/cdkd 0.290.36 → 0.290.37

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BYmXwLpd.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-COEQwjCP.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-DcMcqr70.js");
+	const { buildProgram } = await import("./program-CUOo1x11.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-tX_-qy5a.js → deploy-engine-pVC4fG22.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BYmXwLpd.js";
+import { t as getCdkdVersion } from "./version-COEQwjCP.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9481,6 +9481,15 @@ function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
 }
 /**
+* Whether `record` carries a marker with NO reason this binary knows — written
+* by an older cdkd, cause unknown. The one caller-side question is whether to read it
+* fail closed; see `observedBaselineRefusalReason`'s doc.
+*/
+function hasReasonlessBaselineRefusal(record) {
+	const reason = record?.observedBaselineRefusalReason;
+	return record?.observedBaselineRefused === true && reason !== "unverifiable-parameter" && reason !== "incomplete-resolution";
+}
+/**
 * Returns true when a recorded `DeletionPolicy` should prevent cdkd from
 * deleting the underlying AWS resource. `Retain` and `RetainExceptOnCreate`
 * both keep the resource around; `Delete` / `Snapshot` / undefined all
@@ -33143,7 +33152,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DWY8_Kn4.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CXLgFrPg.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -40123,6 +40132,294 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
+//#endregion
+//#region src/analyzer/parameter-dependence.ts
+/**
+* The PARAMETER-DEPENDENCE WALK: which resources of a raw template depend on
+* which template parameters (issues
+* [#2854](https://github.com/go-to-k/cdkd/issues/2854),
+* [#3468](https://github.com/go-to-k/cdkd/issues/3468)).
+*
+* Pure template analysis with two consumers that must agree: `cdkd import`'s
+* ARM 4 (`src/cli/commands/import-deployed-parameters.ts` supplies the
+* divergent parameter set from `DescribeStacks`) and `cdkd deploy`'s reading of
+* a REASON-LESS `observedBaselineRefused` marker, which has no deployed values
+* at all and therefore treats every declared parameter as divergent
+* ({@link resourcesNamingDeclaredParameter}). It lives in this layer because
+* `src/deployment` may not import from `src/cli`.
+*
+* TAINT THROUGH ANOTHER RESOURCE'S ATTRIBUTES IS FOLLOWED within one stack: the
+* walk records the target of every `Fn::GetAtt` / `${A.Attr}`, and the refused
+* set is closed over those targets. A plain `Ref` of a resource is NOT
+* followed: it yields the physical id, and a secret used as a resource NAME is
+* already disclosed by the identifier itself.
+*/
+/**
+* Every intrinsic the dependence walk knows how to read. An `Fn::`-prefixed
+* key OUTSIDE this list is unclassifiable: it may name a parameter in a way
+* the generic recursion cannot see, so the walk fails closed on it.
+*/
+const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::GetAtt",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If",
+	"Fn::Equals",
+	"Fn::And",
+	"Fn::Or",
+	"Fn::Not",
+	"Fn::ImportValue",
+	"Fn::GetStackOutput",
+	"Fn::FindInMap",
+	"Fn::Base64",
+	"Fn::GetAZs",
+	"Fn::Cidr"
+]);
+/** `${Name}` / `${Name.Attr}` in an `Fn::Sub` string; `${!Literal}` is an escape. */
+const SUB_VARIABLE = /\$\{([^!}][^}]*)\}/g;
+/**
+* Which names (parameters, but also resources and pseudo parameters — the
+* caller intersects with the divergent set) the RAW `Properties` of a resource
+* depend on, plus its resource-level `Condition`.
+*
+* Generic by design: instead of modelling each intrinsic's argument grammar it
+* recurses into EVERY value, so a `Ref` nested in an `Fn::Join` / `Fn::Select`
+* / `Fn::Split` operand, an `Fn::FindInMap` key, or an `Fn::Sub` variable-map
+* value is found without being named. Only the three forms that name something
+* by BARE STRING need their own arm: `Ref`, `Fn::Sub`'s template text, and a
+* condition name (`Fn::If`'s first argument, and `Condition` inside the
+* `Conditions` section), which is followed transitively through
+* `template.Conditions`.
+*
+* May throw `RangeError` on a bag deeper than the call stack; the caller wraps
+* it fail-closed, like the discard walk beside it.
+*/
+function collectParameterDependencies(properties, resourceCondition, template) {
+	const names = /* @__PURE__ */ new Set();
+	const attributeTargets = /* @__PURE__ */ new Set();
+	const visitedConditions = /* @__PURE__ */ new Set();
+	let unclassifiable = false;
+	const conditions = template.Conditions !== null && typeof template.Conditions === "object" ? template.Conditions : {};
+	const followCondition = (name) => {
+		if (typeof name !== "string") {
+			unclassifiable = true;
+			return;
+		}
+		if (visitedConditions.has(name)) return;
+		visitedConditions.add(name);
+		if (!Object.hasOwn(conditions, name)) {
+			unclassifiable = true;
+			return;
+		}
+		walk(conditions[name], true);
+	};
+	const walk = (node, inConditions) => {
+		if (node === null || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const element of node) walk(element, inConditions);
+			return;
+		}
+		for (const [key, value] of Object.entries(node)) {
+			if (key === "Ref") {
+				if (typeof value === "string") names.add(value);
+				else unclassifiable = true;
+				continue;
+			}
+			if (key === "Fn::Sub") {
+				const text = Array.isArray(value) ? value[0] : value;
+				if (typeof text !== "string" || Array.isArray(value) && value.length !== 2) unclassifiable = true;
+				else for (const match of text.matchAll(SUB_VARIABLE)) {
+					const variable = (match[1] ?? "").trim();
+					names.add(variable);
+					const dot = variable.indexOf(".");
+					if (dot > 0) {
+						names.add(variable.slice(0, dot));
+						attributeTargets.add(variable.slice(0, dot));
+					}
+				}
+				if (Array.isArray(value)) walk(value[1], inConditions);
+				continue;
+			}
+			if (key === "Fn::GetAtt") {
+				const target = Array.isArray(value) ? value[0] : value;
+				if (typeof target === "string") {
+					const dot = target.indexOf(".");
+					const logicalId = Array.isArray(value) || dot <= 0 ? target : target.slice(0, dot);
+					names.add(logicalId);
+					attributeTargets.add(logicalId);
+				} else unclassifiable = true;
+				walk(value, inConditions);
+				continue;
+			}
+			if (key === "Fn::If") {
+				if (Array.isArray(value) && value.length === 3) {
+					followCondition(value[0]);
+					walk(value[1], inConditions);
+					walk(value[2], inConditions);
+				} else unclassifiable = true;
+				continue;
+			}
+			if (key === "Condition" && inConditions) {
+				followCondition(value);
+				continue;
+			}
+			if (key.startsWith("Fn::") && !KNOWN_INTRINSICS.has(key)) unclassifiable = true;
+			walk(value, inConditions);
+		}
+	};
+	walk(properties, false);
+	if (resourceCondition !== void 0) followCondition(resourceCondition);
+	return {
+		names,
+		attributeTargets,
+		unclassifiable
+	};
+}
+/**
+* The divergent parameters that ANYTHING in the template names. A declared
+* parameter nothing names cannot have shaped a resource — and CDK's
+* `BootstrapVersion` is exactly that on every default-synthesized stack: SSM
+* typed, never bound by the resolver because nothing references it, hence
+* always "divergent". Left in, it would arm the unclassifiable-shape refusal on
+* stacks whose every real parameter is proven.
+*
+* "Names" is the UNION of this module's walk and `TemplateParser`'s reference
+* scan — the same scan the resolver uses to decide an SSM-typed parameter is
+* unreferenced — so the two cannot disagree about `BootstrapVersion`. An
+* unclassifiable shape does NOT keep the whole set here: CloudFormation names a
+* parameter only through `Ref`, `Fn::Sub` text or a condition, and the generic
+* recursion reads those inside any intrinsic, known or not. A walk that THROWS
+* keeps the whole set (fail closed).
+*/
+function reachableDivergentParameters(template, divergent, rawBags) {
+	if (divergent.size === 0) return /* @__PURE__ */ new Set();
+	try {
+		const roots = [
+			rawBags,
+			template.Resources,
+			template.Outputs,
+			template.Conditions
+		];
+		const named = new Set(collectParameterDependencies(roots, void 0, template).names);
+		const parser = new TemplateParser();
+		for (const root of roots) {
+			if (root === null || typeof root !== "object") continue;
+			for (const name of parser.extractReferences(root)) named.add(name);
+		}
+		return new Set([...divergent].filter((name) => named.has(name)));
+	} catch {
+		return new Set(divergent);
+	}
+}
+/** Whether any DECLARED parameter is named by anything in the template. */
+function namesAnyDeclaredParameter(template) {
+	const declared = template.Parameters;
+	if (declared === null || typeof declared !== "object") return false;
+	const names = new Set(Object.keys(declared));
+	return names.size > 0 && reachableDivergentParameters(template, names, []).size > 0;
+}
+/**
+* The per-stack ARM 4 verdict. Each resource is judged on its TEMPLATE
+* definition (`Properties` + `Condition`) AND on the raw bag the state record
+* carries, unioned: a record preserved by a selective merge holds a previous
+* run's RESOLVED literal (`Value: 'CHANGEME'`), which names no parameter, so
+* judging it on the state bag alone would leave nothing to carry to the
+* freshly imported resource that reads its attribute. Template resources that
+* are not in state at all are judged too, for the same reason.
+*
+* Seeds are direct dependents and unclassifiable bags (a bag that cannot be
+* read cannot be vouched for, and neither can what reads its attributes); the
+* refused set is then closed over ATTRIBUTE reads, to a fixpoint.
+*/
+function computeParameterTaint(template, stateBags, divergent) {
+	const refused = /* @__PURE__ */ new Set();
+	const unclassifiable = /* @__PURE__ */ new Set();
+	const parametersHit = /* @__PURE__ */ new Set();
+	if (divergent.size === 0) return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+	const templateResources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : {};
+	const readers = /* @__PURE__ */ new Map();
+	for (const logicalId of /* @__PURE__ */ new Set([...Object.keys(templateResources), ...stateBags.keys()])) {
+		const definition = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+		const record = definition !== null && typeof definition === "object" ? definition : {};
+		try {
+			const dependencies = collectParameterDependencies([record["Properties"], stateBags.get(logicalId)], record["Condition"], template);
+			readers.set(logicalId, new Set(dependencies.attributeTargets));
+			const hits = [...dependencies.names].filter((name) => divergent.has(name));
+			for (const name of hits) parametersHit.add(name);
+			if (hits.length > 0) refused.add(logicalId);
+			else if (dependencies.unclassifiable) {
+				refused.add(logicalId);
+				unclassifiable.add(logicalId);
+			}
+		} catch {
+			refused.add(logicalId);
+			unclassifiable.add(logicalId);
+		}
+	}
+	for (let grew = refused.size > 0; grew;) {
+		grew = false;
+		for (const [logicalId, targets] of readers) {
+			if (refused.has(logicalId)) continue;
+			if (![...targets].some((target) => refused.has(target))) continue;
+			refused.add(logicalId);
+			grew = true;
+		}
+	}
+	return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+}
+/**
+* The reading of a REASON-LESS `observedBaselineRefused` marker (issue
+* [#3468](https://github.com/go-to-k/cdkd/issues/3468)): which resources'
+* TEMPLATE definitions name a declared parameter, judged with NO deployed
+* values at hand — so every declared parameter anything names is divergent.
+* The answer is {@link computeParameterTaint}'s whole refused set: direct
+* dependents, unclassifiable bags, and attribute readers of either. Pseudo
+* parameters never count (the hit test intersects with DECLARED names) and
+* neither does a parameter nothing names, CDK's Rules-only `BootstrapVersion`
+* included.
+*
+* AN UNCLASSIFIABLE BAG COUNTS ONLY WHEN SOME DECLARED PARAMETER IS NAMED
+* SOMEWHERE in the template, exactly as in ARM 4, and deliberately: this set
+* has to cover what an older import's ARM 4 can have marked ON TEMPLATE
+* EVIDENCE (ARM 4 also read the state bags; a deploy's are resolved literals,
+* so they are not read here), and ARM 4 never ran on a template in which
+* nothing names a declared parameter. Counting the
+* bag regardless would make an old refusal of the other class sticky on every
+* CDK stack (each declares `BootstrapVersion`) and protect nothing.
+*
+* FAILS CLOSED, and never throws: a missing or unreadable template, a
+* `Resources` section that is not an object, or a walk that throws answers
+* `true` for every logical id, and says so in `failedClosed` — a cause CLASS,
+* never a template value or an error message. Absent from a readable
+* template's `Resources` answers `false` — that resource is being removed, and
+* a DELETE reads no baseline.
+*/
+function resourcesNamingDeclaredParameter(template) {
+	const everything = (failedClosed) => Object.assign(() => true, { failedClosed });
+	try {
+		if (template === void 0 || template === null || typeof template !== "object") return everything("unreadable-template");
+		const resources = template.Resources;
+		if (resources === null || typeof resources !== "object" || Array.isArray(resources)) return everything("unreadable-template");
+		const parameters = template.Parameters;
+		if (parameters !== void 0 && (parameters === null || typeof parameters !== "object" || Array.isArray(parameters))) return everything("unreadable-template");
+		const divergent = reachableDivergentParameters(template, new Set(Object.keys(parameters ?? {})), []);
+		const refused = computeParameterTaint(template, /* @__PURE__ */ new Map(), divergent).refused;
+		return Object.assign((logicalId) => refused.has(logicalId), { failedClosed: void 0 });
+	} catch {
+		return everything("walk-threw");
+	}
+}
+
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
 /**
@@ -44400,6 +44697,47 @@ var DeployEngine = class DeployEngine {
 		return Object.keys(siblings).length > 0 ? { siblings } : void 0;
 	}
 	/**
+	* Issue [#3468](https://github.com/go-to-k/cdkd/issues/3468) — the
+	* fail-closed reading of a REASON-LESS `observedBaselineRefused` marker.
+	*
+	* cdkd 0.290.35 wrote unverifiable-parameter refusals with no reason, so an
+	* absent reason cannot be read as "an UPDATE may clear it". A reason-less
+	* marker on a resource whose TEMPLATE definition names a declared parameter
+	* is stamped `'unverifiable-parameter'` here, IN MEMORY, once, before the
+	* diff: every later arm (the in-place rebuild, the metadata-only spread, the
+	* NO_CHANGE carry, the auto-refresh) then sees the explicit form and needs
+	* no rule of its own, and whatever this deploy saves holds it — the record
+	* heals into the form later binaries read directly. Nothing is saved FOR the
+	* stamp: a deploy that writes no state (`--dry-run`, no changes) re-derives
+	* it next time.
+	*
+	* The template is the RAW one `deploy()` was handed (a nested child engine
+	* gets its own), which is what the dependence walk needs. A template that
+	* cannot be read, or a walk that throws, stamps every reason-less marker
+	* (`resourcesNamingDeclaredParameter` fails closed). A record whose logical
+	* id the template no longer defines is being DELETED and is left alone.
+	*
+	* The RECORD object is replaced, not mutated (a per-record alias taken
+	* before this line keeps what was loaded); the container is updated in
+	* place, which is what lets every later reader of it see the stamp.
+	*/
+	stampReasonlessParameterRefusals(stateResources, template) {
+		let namesParameter;
+		let stamped = 0;
+		for (const [logicalId, resource] of Object.entries(stateResources)) {
+			if (!hasReasonlessBaselineRefusal(resource)) continue;
+			namesParameter ??= resourcesNamingDeclaredParameter(template);
+			if (!namesParameter(logicalId)) continue;
+			stateResources[logicalId] = {
+				...resource,
+				observedBaselineRefusalReason: "unverifiable-parameter"
+			};
+			stamped++;
+		}
+		if (namesParameter?.failedClosed !== void 0) this.logger.debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
+		if (stamped > 0) this.logger.debug(`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
+	}
+	/**
 	* Kick off `provider.readCurrentState` for every resource in the
 	* loaded state that lacks `observedProperties` (e.g. state written
 	* by a pre-v3 binary, or a v3 record where a NO_CHANGE-skipped
@@ -44509,6 +44847,7 @@ var DeployEngine = class DeployEngine {
 					this.logger.info(failedOnly ? `A previous deploy of '${stackName}' failed and was automatically rolled back. The failed resource may be partially applied — run 'cdkd rollback ${stackName} --revert-failed' to revert it, or continue deploying to fix forward (a successful deploy clears this note).` : `A previous deploy of '${stackName}' failed or was interrupted. Run 'cdkd rollback ${stackName}' to revert it, or continue deploying to fix forward.`);
 				}
 			} catch {}
+			this.stampReasonlessParameterRefusals(currentState.resources, template);
 			this.kickOffAutoRefreshObservedProperties(currentState.resources);
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
 			const outputsDigestSource = structuredClone({
@@ -44527,6 +44866,7 @@ var DeployEngine = class DeployEngine {
 			const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
 			const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 			const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
+			if (Object.keys(orphanPlan.adopted).length > 0) this.stampReasonlessParameterRefusals(currentState.resources, template);
 			const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
 			const resourceTypes = new Set(Object.values(effectiveTemplate.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
 			this.providerRegistry.validateResourceTypes(resourceTypes);
@@ -46520,5 +46860,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { isExportAliasCollision as $, StackHasActiveImportsError as $i, maskSecretsInText as $n, escapeRegExp$1 as $r, withSharedDrainBudget as $t, makeCanonicalizePropertiesFn as A, clearBucketRegionCache as Ai, refuseMalformedResourcesForDestroy as An, rewriteTemplateAssetReferences as Ar, getAccountInfo as At, isWarmThroughputDecrease as B, DependencyError as Bi, TemplateParser as Bn, validateContainerRepoName as Br, assertRegionMatch as Bt, PRE_DELETE_SNAPSHOT_TYPES as C, decodeListingKey as Ci, malformedStateRefusalMessage as Cn, shouldRetainResource as Cr, disableInstanceApiTermination as Ct, isFinalSnapshotError as D, derivePartitionAndUrlSuffix as Di, refuseMalformedOutputs as Dn, buildAssetRedirectMap as Dr, carriesFetchableDynamicReference as Dt, createPreDeleteFinalSnapshot as E, canonicalizeRegion as Ei, refuseMalformedNestedChildOutputs as En, WorkGraph as Er, carriesDynamicReference as Et, isStatefulRecreateTargetForReplace as F, setAwsClients as Fi, findActionableSilentDrops as Fn, getBootstrapMarkerKey as Fr, refStateLookupFromResource as Ft, cyan as G, LocalStartServiceError as Gi, carriesSecretMask as Gn, describeDockerFailure as Gr, configStringRefusal as Gt, toFiniteNumber as H, DynamicReferenceRegionAmbiguousError as Hi, STATE_SOURCED_CROSS_GENERATION_RULES as Hn, buildDockerImage as Hr, coerceCfnInteger as Ht, isStatefulRecreateTargetSync as I, AssetError as Ii, findSilentDropProperties as In, isCrossRegionRedirect as Ir, isSettledInstanceState as It, red as J, NestedStackChildDirectDestroyError as Ji, errorCauseChain as Jn, getDockerCmd as Jr, requireConfigArray as Jt, gray as K, LockError as Ki, createSecretMasker as Kn, dockerSpawnEnvWithSensitive as Kr, readConfigString as Kt, renderStatefulReason as L, CdkdError as Li, describeTypeWithThrottleRetry as Ln, parseBootstrapMarker as Lr, WAFv2WebACLProvider as Lt, makeSiblingClaimReader as M, AwsClients as Mi, repairMalformedOutputsForReadOnly as Mn, BOOTSTRAP_MARKER_PREFIX as Mr, isNamelessDynamicReferenceError as Mt, planOrphanAdoption as N, getAwsClients as Ni, repairMalformedResourcePropertiesForReadOnly as Nn, assertAssetBucketRegion as Nr, isUnboundTemplateParameter as Nt, refusesFinalSnapshot as O, AssemblyReader as Oi, refuseMalformedOutputsForDestroy as On, createAssetRedirectResolver as Or, cfnRefValueFromPhysicalId as Ot, MULTI_REGION_RECREATE_BLOCKED_TYPES as P, resetAwsClients as Pi, repairMalformedResourcesForReadOnly as Pn, ensureAssetStorage as Pr, parameterTypeMayLoseSecretIdentity as Pt, exportAliasCollisionScrubWarning as Q, ResourceUpdateNotSupportedError as Qi, maskSecretsInError as Qn, runDockerStreaming as Qr, producerRegionsFromState as Qt, WARM_THROUGHPUT_MEMBERS as R, ConfigError as Ri, withRetry as Rn, readBootstrapMarkerBody as Rr, normalizeAwsTagsToCfn as Rt, ATOMIC_FINAL_SNAPSHOT_TYPES as S, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Si, malformedResourcesWarning as Sn, orphansCarriedFrom as Sr, deleteSkipReason as St, ccRoutedFinalSnapshotError as T, PARTITION_TABLE as Ti, refuseDivergentRecordRegionForDestroy as Tn, stringifyValue as Tr, IntrinsicFunctionResolver as Tt, formatResourceLine as U, IntrinsicResolutionRefusalError as Ui, STATE_SOURCED_READBACK_RULES as Un, describeDockerCapturedOutput as Ur, configBooleanRefusal as Ut, toCfnInteger as V, DeployCancelledError as Vi, STATE_SOURCED_BASELINE_RULES as Vn, buildDenyExternalAccessPolicy as Vr, coerceCfnBoolean as Vt, bold as W, LocalInvokeBuildError as Wi, TEMPLATE_SOURCED_RULES as Wn, describeDockerExecFailure as Wr, configIntegerRefusal as Wt, collectDeclaredOutputNames as X, ProvisioningError as Xi, isSingleDynamicReferenceToken as Xn, redactDockerArgvValues as Xr, requireConfigString as Xt, yellow as Y, PartialFailureError as Yi, identityKeyFor as Yn, partitionSensitiveEnv as Yr, requireConfigObject as Yt, collectPublishedOutputNames as Z, ResourceTimeoutError as Zi, markSameGenerationBag as Zn, runDockerForeground as Zr, classifyReplaySecretRegion as Zt, bagHoldsSecretExpression as _, CFN_TEMPLATE_BODY_LIMIT as _i, malformedLocalOutputsWarning as _n, hasUnverifiableParameterRefusal as _r, CloudControlProvider as _t, DeploymentEventsStore as a, normalizeAwsError as aa, getDefaultStateBucketName as ai, applyRoleArnIfSet as an, S3StateBackend as ar, collectInlinePolicyNamesManagedBySiblings as at, mergeNoChangeOutputs as b, findLargeInlineResources as bi, malformedRenderedContainersWarning as bn, isReadableBag as br, UNSPECIFIED_SKIP_REASON as bt, replayFailedOperations as c, isRetryableTransientError as ca, resolveAutoAssetStorage as ci, callerEnvCredentials as cn, buildForceUnlockCommand as cr, wouldReturnToSdkProvider as ct, updatePartialMessage as d, markNonRetryable as da, resolveStateBucketWithDefault as di, INTRINSIC_KEYS as dn, formatLockExpiry as dr, maskerOrIdentity as dt, StackTerminationProtectionError as ea, stripControlChars as ei, s3BucketArn as en, recordMaskOnlyValue as er, secretBearing as et, updatePartialReason as f, markRedactedCause as fa, resolveStateBucketWithDefaultAndSource as fi, STATE_RESOURCES_MALFORMED as fn, shellQuote as fr, beginCommandInterruptScope as ft, computeImplicitDeleteEdges as g, __exportAll as ga, ssmResolvedValueType as gi, malformedExportSourceWarning as gn, hasReadableExportSet as gr, startInterruptWatch as gt, IMPLICIT_DELETE_DEPENDENCIES as h, safeStringify$1 as ha, warnDeprecatedNoPrefixCliFlag as hi, malformedExportNamesWarning as hn, exportNamesCarriedFrom as hr, isInterruptedWaitError as ht, DeploymentEventsReader as i, isCdkdError as ia, synthesisStatusMessage as ii, s3BucketWebsiteUrl as in, LockManager as ir, IAMRoleProvider as it, extractDeploymentEventError as j, resolveBucketRegion as ji, refuseMalformedState as jn, AssetModeResolver as jr, isImpossibleEmptyStoredAttribute as jt, unsupportedFinalSnapshotError as k, processStackMessages as ki, refuseMalformedResourcePropertiesForOrphan as kn, loadPublishableAssetManifest as kr, coerceParameterTypedValue as kt, replayRollback as l, isThrottlingError as la, resolveCaptureObservedState as li, envCredentialsAreAssumedRole as ln, buildLockContentionMessage as lr, createMaskedRetryLogger as lt, maskingRetryLogger as m, describeAwsFailure as ma, stateBucketExistenceConfirmed as mi, hasReadableResources as mn, DEFAULT_STATE_PREFIX as mr, interruptWatchListenerCount as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, SynthesisError as na, getDockerImageBySourceHash as ni, s3BucketDualStackDomainName as nn, redactSecretsForState as nr, secretSafeKeyDisplay as nt, planFailedOps as o, withErrorHandling as oa, getLegacyStateBucketName as oi, AWS_CREDENTIAL_ENV_KEYS as on, rebuildClientForBucketRegion as or, clearOnUpdateRemoval as ot, withResourceDeadline as p, retryClassificationText as pa, resolveUseCdkBootstrapAssets as pi, hasReadableOutputs as pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as pr, endCommandInterruptScope as pt, green as q, MalformedProducerRecordRefusalError as qi, dynamicReferenceTokens as qn, formatDockerLoginError as qr, replayWarn as qt, DeployEngine as r, formatError as ra, Synthesizer as ri, s3BucketRegionalDomainName as rn, scrubResourceRecord as rr, getCurrentResourceSecrets as rt, planRollback as s, isMarkedNonRetryable as sa, resolveApp as si, applyCallerIdentityCredentials as sn, UNREPRODUCIBLE_LOCK_CLAUSE as sr, ProviderRegistry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StateError as ta, AssetManifestLoader as ti, s3BucketDomainName as tn, recoverMaskedOutput as tr, secretBearingStateKeyWarning as tt, resolveReplacementOldType as u, isTransientServerError as ua, resolveSkipPrefix as ui, DiffCalculator as un, forceQuitRecoveryClause as ur, maskDeep as ut, isSecretBearingReferenceString as v, CFN_TEMPLATE_URL_LIMIT as vi, malformedOutputsRefusalMessage as vn, importableOutputKeys as vr, isWaitAbandonedError as vt, buildFinalSnapshotIdentifier as w, expectedOwnerParam as wi, producerRecordKey as wn, AssetPublisher as wr, isTerminationProtectionPropagationError as wt, bindingSkippedOutputs as x, uploadCfnTemplate as xi, malformedResourcePropertiesWarning as xn, orphansAfterRollback as xr, deleteIndeterminateGuards as xt, keptWholeReasonText as y, MIGRATE_TMP_PREFIX as yi, malformedOutputsWarning as yn, importableOutputs as yr, slowCcOperationTimeoutMs as yt, coerceWarmThroughput as z, CrossAccountSecretRefusalError as zi, DagBuilder as zn, validateAssetBucketName as zr, resolveExplicitPhysicalId as zt };
-//# sourceMappingURL=deploy-engine-tX_-qy5a.js.map
+export { yellow as $, NestedStackChildDirectDestroyError as $i, identityKeyFor as $n, getDockerCmd as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PARTITION_TABLE as Ai, refuseMalformedNestedChildOutputs as An, stringifyValue as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, setAwsClients as Bi, findSilentDropProperties as Bn, getBootstrapMarkerKey as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CFN_TEMPLATE_URL_LIMIT as Ci, malformedOutputsWarning as Cn, importableOutputKeys as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Di, malformedStateRefusalMessage as Dn, orphansCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, uploadCfnTemplate as Ei, malformedResourcesWarning as En, orphansAfterRollback as Er, deleteSkipReason as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fi, refuseMalformedState as Fn, rewriteTemplateAssetReferences as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, DependencyError as Gi, STATE_SOURCED_BASELINE_RULES as Gn, validateContainerRepoName as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, CdkdError as Hi, withRetry as Hn, parseBootstrapMarker as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ii, repairMalformedOutputsForReadOnly as In, AssetModeResolver as Ir, isNamelessDynamicReferenceError as It, bold as J, IntrinsicResolutionRefusalError as Ji, TEMPLATE_SOURCED_RULES as Jn, describeDockerCapturedOutput as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, DeployCancelledError as Ki, STATE_SOURCED_CROSS_GENERATION_RULES as Kn, buildDenyExternalAccessPolicy as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, AwsClients as Li, repairMalformedResourcePropertiesForReadOnly as Ln, BOOTSTRAP_MARKER_PREFIX as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, derivePartitionAndUrlSuffix as Mi, refuseMalformedOutputsForDestroy as Mn, buildAssetRedirectMap as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, AssemblyReader as Ni, refuseMalformedResourcePropertiesForOrphan as Nn, createAssetRedirectResolver as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, decodeListingKey as Oi, producerRecordKey as On, shouldRetainResource as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, processStackMessages as Pi, refuseMalformedResourcesForDestroy as Pn, loadPublishableAssetManifest as Pr, getAccountInfo as Pt, red as Q, MalformedProducerRecordRefusalError as Qi, errorCauseChain as Qn, formatDockerLoginError as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ri, repairMalformedResourcesForReadOnly as Rn, assertAssetBucketRegion as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CFN_TEMPLATE_BODY_LIMIT as Si, malformedOutputsRefusalMessage as Sn, hasUnverifiableParameterRefusal as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, findLargeInlineResources as Ti, malformedResourcePropertiesWarning as Tn, isReadableBag as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, ConfigError as Ui, DagBuilder as Un, readBootstrapMarkerBody as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, AssetError as Vi, describeTypeWithThrottleRetry as Vn, isCrossRegionRedirect as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, CrossAccountSecretRefusalError as Wi, TemplateParser as Wn, validateAssetBucketName as Wr, assertRegionMatch as Wt, gray as X, LocalStartServiceError as Xi, createSecretMasker as Xn, describeDockerFailure as Xr, readConfigString as Xt, cyan as Y, LocalInvokeBuildError as Yi, carriesSecretMask as Yn, describeDockerExecFailure as Yr, configStringRefusal as Yt, green as Z, LockError as Zi, dynamicReferenceTokens as Zn, dockerSpawnEnvWithSensitive as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, markRedactedCause as _a, resolveStateBucketWithDefaultAndSource as _i, hasReadableOutputs as _n, CUSTOM_RESOURCE_RESPONSE_PREFIX as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, StackTerminationProtectionError as aa, stripControlChars as ai, s3BucketDomainName as an, recoverMaskedOutput as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, safeStringify$1 as ba, warnDeprecatedNoPrefixCliFlag as bi, malformedExportSourceWarning as bn, hasReadableExportSet as br, startInterruptWatch as bt, replayFailedOperations as c, formatError as ca, Synthesizer as ci, s3BucketWebsiteUrl as cn, LockManager as cr, IAMRoleProvider as ct, updatePartialMessage as d, withErrorHandling as da, getLegacyStateBucketName as di, applyCallerIdentityCredentials as dn, UNREPRODUCIBLE_LOCK_CLAUSE as dr, ProviderRegistry as dt, PartialFailureError as ea, partitionSensitiveEnv as ei, requireConfigString as en, isSingleDynamicReferenceToken as er, collectDeclaredOutputNames as et, updatePartialReason as f, isMarkedNonRetryable as fa, resolveApp as fi, callerEnvCredentials as fn, buildForceUnlockCommand as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, markNonRetryable as ga, resolveStateBucketWithDefault as gi, STATE_RESOURCES_MALFORMED as gn, shellQuote as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, isTransientServerError as ha, resolveSkipPrefix as hi, INTRINSIC_KEYS as hn, formatLockExpiry as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, StackHasActiveImportsError as ia, escapeRegExp$1 as ii, s3BucketArn as in, recordMaskOnlyValue as ir, secretBearing as it, isFinalSnapshotError as j, canonicalizeRegion as ji, refuseMalformedOutputs as jn, WorkGraph as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, expectedOwnerParam as ki, refuseDivergentRecordRegionForDestroy as kn, AssetPublisher as kr, IntrinsicFunctionResolver as kt, replayRollback as l, isCdkdError as la, synthesisStatusMessage as li, applyRoleArnIfSet as ln, S3StateBackend as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, isThrottlingError as ma, resolveCaptureObservedState as mi, DiffCalculator as mn, forceQuitRecoveryClause as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceTimeoutError as na, runDockerForeground as ni, producerRegionsFromState as nn, maskSecretsInError as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, StateError as oa, AssetManifestLoader as oi, s3BucketDualStackDomainName as on, redactSecretsForState as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, isRetryableTransientError as pa, resolveAutoAssetStorage as pi, envCredentialsAreAssumedRole as pn, buildLockContentionMessage as pr, createMaskedRetryLogger as pt, formatResourceLine as q, DynamicReferenceRegionAmbiguousError as qi, STATE_SOURCED_READBACK_RULES as qn, buildDockerImage as qr, configBooleanRefusal as qt, DeployEngine as r, ResourceUpdateNotSupportedError as ra, runDockerStreaming as ri, withSharedDrainBudget as rn, maskSecretsInText as rr, isExportAliasCollision as rt, planRollback as s, SynthesisError as sa, getDockerImageBySourceHash as si, s3BucketRegionalDomainName as sn, scrubResourceRecord as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ProvisioningError as ta, redactDockerArgvValues as ti, classifyReplaySecretRegion as tn, markSameGenerationBag as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, normalizeAwsError as ua, getDefaultStateBucketName as ui, AWS_CREDENTIAL_ENV_KEYS as un, rebuildClientForBucketRegion as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, retryClassificationText as va, resolveUseCdkBootstrapAssets as vi, hasReadableResources as vn, DEFAULT_STATE_PREFIX as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, MIGRATE_TMP_PREFIX as wi, malformedRenderedContainersWarning as wn, importableOutputs as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, __exportAll as xa, ssmResolvedValueType as xi, malformedLocalOutputsWarning as xn, hasReasonlessBaselineRefusal as xr, CloudControlProvider as xt, keptWholeReasonText as y, describeAwsFailure as ya, stateBucketExistenceConfirmed as yi, malformedExportNamesWarning as yn, exportNamesCarriedFrom as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as zi, findActionableSilentDrops as zn, ensureAssetStorage as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-pVC4fG22.js.map