@go-to-k/cdkd 0.290.37 → 0.290.38

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-COEQwjCP.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BeHfM5ow.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-CUOo1x11.js");
+	const { buildProgram } = await import("./program-Br4uc31m.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-pVC4fG22.js → deploy-engine-BdYBI1uT.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-COEQwjCP.js";
+import { t as getCdkdVersion } from "./version-BeHfM5ow.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15055,7 +15055,10 @@ function positionListByCrossStackSource(bag, source, secrets) {
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
-			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
+			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) {
+				if (!spanNamesResolvableService(bag)) return redactSecretsForState(bag, secrets);
+				return secrets.get(bag) ?? bag;
+			}
 			return source;
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
@@ -15176,7 +15179,8 @@ function subtreeHasDynamicReference(value) {
 * compiling a pattern per string leaf at the persist choke point, which walks
 * every record. Do NOT call `.exec` / `.test` on this constant — those DO
 * advance `lastIndex`, which is exactly why the shared instance is safe only
-* for `.match`.
+* for `.match`. (ONE site does, `resolvableReferenceSpans`, and it resets
+* `lastIndex` to 0 in the statement after the `exec`.)
 *
 * Widening it changes one answer, in the SAFE direction for BOTH readers.
 *
@@ -15665,6 +15669,57 @@ const SECRET_BEARING_REFERENCE_PREFIXES = [
 	"{{resolve:ssm:"
 ];
 /**
+* Does this complete `{{resolve:...}}` token name a service cdkd RESOLVES?
+*
+* The value scan spares a needle match lying inside a token, so that a
+* plaintext coinciding with a real reference's own text is not spliced into
+* it (issue #1935). That protection is owed to a REFERENCE only. A token of
+* any other service is left in place by the resolver, so text inside it is
+* ordinary persisted text, and a recorded plaintext there must be redacted
+* (issue [#2743](https://github.com/go-to-k/cdkd/issues/2743)).
+*/
+function spanNamesResolvableService(token) {
+	return SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => token.startsWith(prefix));
+}
+/**
+* The spans of `value` the value scan must not splice a needle into: every
+* complete token of a resolvable service.
+*
+* Two scans, unioned. The ordinary one ({@link dynamicReferenceSpans}) is
+* LEFTMOST, so behind an opener of an unresolvable service it reports one
+* outer span and never sees a REAL reference nested in it — which is exactly
+* the text this module writes when it redacts `{{resolve:<plaintext>}}` to
+* `{{resolve:{{resolve:secretsmanager:...}}}}`. Dropping that outer span
+* alone would leave the nested reference unprotected, and a later pass whose
+* map holds a needle occurring in the reference's own text (`password` is an
+* ordinary JSON key AND an ordinary secret value) would splice into it, again
+* on every pass. The second scan starts only at a resolvable-service opener,
+* so it finds the nested reference — and keeps it only when it is an
+* expression of the pass's own map (see the loop).
+*
+* On a leaf with no unresolvable-service opener the two scans report the same
+* spans, so every leaf issue #1935 protects is answered exactly as before.
+*/
+function resolvableReferenceSpans(value, vouchedExpressions) {
+	const spans = dynamicReferenceSpans(value).filter((span) => spanNamesResolvableService(value.slice(span.start, span.end)));
+	const starts = new Set(spans.map((span) => span.start));
+	for (const prefix of SECRET_BEARING_REFERENCE_PREFIXES) for (let at = value.indexOf(prefix); at >= 0; at = value.indexOf(prefix, at + 1)) {
+		if (starts.has(at)) continue;
+		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = at;
+		const match = DYNAMIC_REFERENCE_TOKEN_SCAN.exec(value);
+		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
+		if (match?.index !== at) continue;
+		const end = at + match[0].length;
+		if (!vouchedExpressions.has(value.slice(at, end))) continue;
+		spans.push({
+			start: at,
+			end
+		});
+		starts.add(at);
+	}
+	return spans;
+}
+/**
 * The prefixes whose SPELLING settles secret-ness, with no lookup and no
 * inference — the subset of {@link SECRET_BEARING_REFERENCE_PREFIXES} that
 * {@link expressionSecretIsInferred} treats as certain.
@@ -16069,7 +16124,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 */
 function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
 	if (typeof value === "string") {
-		if (isSingleDynamicReferenceToken(value) || sourceLiterals.has(value)) return value;
+		if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value) || sourceLiterals.has(value)) return value;
 		if (value === "") return value;
 		return mark ? POSITION_UNCERTIFIED : "***";
 	}
@@ -16371,6 +16426,16 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	*   security review, and the reason the rule is one predicate over the whole
 	*   leaf rather than a split.
 	* - **disjoint from every span** -> REPLACED. The ordinary embedded secret.
+	* - **inside a span whose service cdkd does not resolve** -> REPLACED (issue
+	*   [#2743](https://github.com/go-to-k/cdkd/issues/2743)). Such a span is not
+	*   a reference: `{{resolve:<plaintext>}}` is what an `Fn::Sub` putting a
+	*   resolved secret in the SERVICE position assembled, and sparing it
+	*   persisted the plaintext. The result, `{{resolve:{{resolve:...}}}}`, is
+	*   garbage but not plaintext, the same trade as the stray-opener residual
+	*   below; the REAL reference nested in it is protected again
+	*   ({@link resolvableReferenceSpans}). The cost: an untainted look-alike
+	*   token whose text coincides with a recorded secret is rewritten like any
+	*   other text, and a replay then sends the rewritten literal.
 	*
 	* Scanning the WHOLE leaf in ONE pass is also what preserves what needle
 	* PRECEDENCE there is. {@link buildNeedleRegex} sorts alternatives
@@ -16399,8 +16464,9 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	*   PLAINTEXT behind two characters any string can contain.
 	* - **a later `}}` anywhere in the leaf** -> the opener and that `}}` form
 	*   ONE span swallowing everything between them, so a needle in that region
-	*   is KEPT — the only shape where this rule redacts LESS than the code it
-	*   replaced. Narrow but real, and the reachable carrier is named rather than
+	*   is KEPT when the opener spells a resolvable service (`{{resolve:ssm:`
+	*   ...; any other opener is the unresolvable-service row above) — the only
+	*   shape where this rule redacts LESS than the code it replaced. Narrow but real, and the reachable carrier is named rather than
 	*   waved at: the resolver shares this grammar, so such a leaf could not have
 	*   resolved on the deploy path, which leaves an `observedProperties`
 	*   READBACK (arbitrary text from AWS) as the way one arrives.
@@ -16411,8 +16477,10 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	* contradicting this change's own "not repaired, not made worse" property.
 	* So the residual is documented, not fixed.
 	*/
+	let vouched;
+	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
 	const scanLeaf = (value, needles) => {
-		const spans = isDynamicReferenceString(value) ? dynamicReferenceSpans(value) : [];
+		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
 		return value.replace(needles, (match, offset) => {
 			const end = offset + match.length;
 			if (spans.some((span) => span.start <= offset && end <= span.end && (span.start !== offset || span.end !== end))) return match;
@@ -16423,7 +16491,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		if (typeof value === "string") {
 			const whole = wholeValueExpr(value);
 			if (whole !== void 0) return whole;
-			if (isSingleDynamicReferenceToken(value)) return value;
+			if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return value;
 			if (!regex) return value;
 			regex.lastIndex = 0;
 			if (!regex.test(value)) return value;
@@ -27774,7 +27842,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	/** Recursively resolve a value. */
 	async resolveValue(value, context) {
 		if (typeof value !== "object" || value === null) {
-			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
+			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveTemplateLeafReferences(value, context);
 			return value;
 		}
 		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending))).filter((v) => v !== AWS_NO_VALUE);
@@ -31082,7 +31150,30 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	displayLeaf(value, context) {
 		return this.displayMasked(this.logTextOfLeaf(value, context), context);
 	}
+	/**
+	* Resolve the dynamic references of a PERSISTED string leaf: text read back
+	* out of a state record, a rollback journal or a producer stack's outputs.
+	* That is what every caller of this method hands it (`cdkd drift`, the
+	* rollback replay, `cdkd scrub`'s per-token delegation, the cross-stack
+	* re-resolution); a TEMPLATE leaf goes through {@link resolve}, which takes
+	* {@link resolveTemplateLeafReferences}.
+	*
+	* The distinction is load-bearing for ONE arm (issue #2743). A token of a
+	* service cdkd does not resolve is REFUSED on the template route when it
+	* holds a secret, because leaving it would send that secret to AWS for the
+	* first time. Persisted text is different on both counts: AWS already holds
+	* it, so refusing buys no confidentiality, and the refusal is DETERMINISTIC
+	* there -- a journal `previousState` holding `{{resolve:<plaintext>}}` beside
+	* the reference that resolves to it would fail its rollback op on every
+	* retry, where replaying the literal is a correct no-op. So this entry point
+	* keeps the warn-and-leave for every such token, and the value scan redacts
+	* whatever is persisted afterwards.
+	*/
 	async resolveDynamicReferences(value, context) {
+		return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
+	}
+	/** A TEMPLATE string leaf: the refusing route (see {@link resolveDynamicReferences}). */
+	async resolveTemplateLeafReferences(value, context) {
 		return (await this.resolveDynamicReferencesWithLogTwin(value, value, context)).result;
 	}
 	/**
@@ -31105,7 +31196,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* NEEDLE match that straddles a masked span, which is why the log lines go
 	* through `logTwinText` rather than masking the twin alone.
 	*/
-	async resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited) {
+	async resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited, persistedText = false) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
 		let twin = logTwin;
@@ -31136,7 +31227,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
 						tokenLogText,
 						nameLogText
-					});
+					}, persistedText);
 					result = result.replace(fullMatch, () => foreign.result);
 					twin = twin.replace(fullMatch, () => foreign.twin);
 					const [delegated] = foreign.substitutions;
@@ -31200,6 +31291,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					isSecret = true;
 					resolved = param.value;
 				} else {
+					if (!persistedText && (tokenLogText !== fullMatch || this.maskNeedlesForLog(fullMatch, context) !== fullMatch)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: its service is not one cdkd resolves (secretsmanager, ssm, ssm-secure), and the reference was assembled from a secret value, so leaving it as written would send that value to AWS and record it in state in the clear.`));
 					this.logger.warn(this.displayMasked(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
 					complete = false;
 					continue;
@@ -33152,7 +33244,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CXLgFrPg.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B70ujDSS.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -46861,4 +46953,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { yellow as $, NestedStackChildDirectDestroyError as $i, identityKeyFor as $n, getDockerCmd as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PARTITION_TABLE as Ai, refuseMalformedNestedChildOutputs as An, stringifyValue as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, setAwsClients as Bi, findSilentDropProperties as Bn, getBootstrapMarkerKey as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CFN_TEMPLATE_URL_LIMIT as Ci, malformedOutputsWarning as Cn, importableOutputKeys as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Di, malformedStateRefusalMessage as Dn, orphansCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, uploadCfnTemplate as Ei, malformedResourcesWarning as En, orphansAfterRollback as Er, deleteSkipReason as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fi, refuseMalformedState as Fn, rewriteTemplateAssetReferences as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, DependencyError as Gi, STATE_SOURCED_BASELINE_RULES as Gn, validateContainerRepoName as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, CdkdError as Hi, withRetry as Hn, parseBootstrapMarker as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ii, repairMalformedOutputsForReadOnly as In, AssetModeResolver as Ir, isNamelessDynamicReferenceError as It, bold as J, IntrinsicResolutionRefusalError as Ji, TEMPLATE_SOURCED_RULES as Jn, describeDockerCapturedOutput as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, DeployCancelledError as Ki, STATE_SOURCED_CROSS_GENERATION_RULES as Kn, buildDenyExternalAccessPolicy as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, AwsClients as Li, repairMalformedResourcePropertiesForReadOnly as Ln, BOOTSTRAP_MARKER_PREFIX as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, derivePartitionAndUrlSuffix as Mi, refuseMalformedOutputsForDestroy as Mn, buildAssetRedirectMap as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, AssemblyReader as Ni, refuseMalformedResourcePropertiesForOrphan as Nn, createAssetRedirectResolver as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, decodeListingKey as Oi, producerRecordKey as On, shouldRetainResource as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, processStackMessages as Pi, refuseMalformedResourcesForDestroy as Pn, loadPublishableAssetManifest as Pr, getAccountInfo as Pt, red as Q, MalformedProducerRecordRefusalError as Qi, errorCauseChain as Qn, formatDockerLoginError as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ri, repairMalformedResourcesForReadOnly as Rn, assertAssetBucketRegion as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CFN_TEMPLATE_BODY_LIMIT as Si, malformedOutputsRefusalMessage as Sn, hasUnverifiableParameterRefusal as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, findLargeInlineResources as Ti, malformedResourcePropertiesWarning as Tn, isReadableBag as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, ConfigError as Ui, DagBuilder as Un, readBootstrapMarkerBody as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, AssetError as Vi, describeTypeWithThrottleRetry as Vn, isCrossRegionRedirect as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, CrossAccountSecretRefusalError as Wi, TemplateParser as Wn, validateAssetBucketName as Wr, assertRegionMatch as Wt, gray as X, LocalStartServiceError as Xi, createSecretMasker as Xn, describeDockerFailure as Xr, readConfigString as Xt, cyan as Y, LocalInvokeBuildError as Yi, carriesSecretMask as Yn, describeDockerExecFailure as Yr, configStringRefusal as Yt, green as Z, LockError as Zi, dynamicReferenceTokens as Zn, dockerSpawnEnvWithSensitive as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, markRedactedCause as _a, resolveStateBucketWithDefaultAndSource as _i, hasReadableOutputs as _n, CUSTOM_RESOURCE_RESPONSE_PREFIX as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, StackTerminationProtectionError as aa, stripControlChars as ai, s3BucketDomainName as an, recoverMaskedOutput as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, safeStringify$1 as ba, warnDeprecatedNoPrefixCliFlag as bi, malformedExportSourceWarning as bn, hasReadableExportSet as br, startInterruptWatch as bt, replayFailedOperations as c, formatError as ca, Synthesizer as ci, s3BucketWebsiteUrl as cn, LockManager as cr, IAMRoleProvider as ct, updatePartialMessage as d, withErrorHandling as da, getLegacyStateBucketName as di, applyCallerIdentityCredentials as dn, UNREPRODUCIBLE_LOCK_CLAUSE as dr, ProviderRegistry as dt, PartialFailureError as ea, partitionSensitiveEnv as ei, requireConfigString as en, isSingleDynamicReferenceToken as er, collectDeclaredOutputNames as et, updatePartialReason as f, isMarkedNonRetryable as fa, resolveApp as fi, callerEnvCredentials as fn, buildForceUnlockCommand as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, markNonRetryable as ga, resolveStateBucketWithDefault as gi, STATE_RESOURCES_MALFORMED as gn, shellQuote as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, isTransientServerError as ha, resolveSkipPrefix as hi, INTRINSIC_KEYS as hn, formatLockExpiry as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, StackHasActiveImportsError as ia, escapeRegExp$1 as ii, s3BucketArn as in, recordMaskOnlyValue as ir, secretBearing as it, isFinalSnapshotError as j, canonicalizeRegion as ji, refuseMalformedOutputs as jn, WorkGraph as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, expectedOwnerParam as ki, refuseDivergentRecordRegionForDestroy as kn, AssetPublisher as kr, IntrinsicFunctionResolver as kt, replayRollback as l, isCdkdError as la, synthesisStatusMessage as li, applyRoleArnIfSet as ln, S3StateBackend as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, isThrottlingError as ma, resolveCaptureObservedState as mi, DiffCalculator as mn, forceQuitRecoveryClause as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceTimeoutError as na, runDockerForeground as ni, producerRegionsFromState as nn, maskSecretsInError as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, StateError as oa, AssetManifestLoader as oi, s3BucketDualStackDomainName as on, redactSecretsForState as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, isRetryableTransientError as pa, resolveAutoAssetStorage as pi, envCredentialsAreAssumedRole as pn, buildLockContentionMessage as pr, createMaskedRetryLogger as pt, formatResourceLine as q, DynamicReferenceRegionAmbiguousError as qi, STATE_SOURCED_READBACK_RULES as qn, buildDockerImage as qr, configBooleanRefusal as qt, DeployEngine as r, ResourceUpdateNotSupportedError as ra, runDockerStreaming as ri, withSharedDrainBudget as rn, maskSecretsInText as rr, isExportAliasCollision as rt, planRollback as s, SynthesisError as sa, getDockerImageBySourceHash as si, s3BucketRegionalDomainName as sn, scrubResourceRecord as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ProvisioningError as ta, redactDockerArgvValues as ti, classifyReplaySecretRegion as tn, markSameGenerationBag as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, normalizeAwsError as ua, getDefaultStateBucketName as ui, AWS_CREDENTIAL_ENV_KEYS as un, rebuildClientForBucketRegion as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, retryClassificationText as va, resolveUseCdkBootstrapAssets as vi, hasReadableResources as vn, DEFAULT_STATE_PREFIX as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, MIGRATE_TMP_PREFIX as wi, malformedRenderedContainersWarning as wn, importableOutputs as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, __exportAll as xa, ssmResolvedValueType as xi, malformedLocalOutputsWarning as xn, hasReasonlessBaselineRefusal as xr, CloudControlProvider as xt, keptWholeReasonText as y, describeAwsFailure as ya, stateBucketExistenceConfirmed as yi, malformedExportNamesWarning as yn, exportNamesCarriedFrom as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as zi, findActionableSilentDrops as zn, ensureAssetStorage as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-pVC4fG22.js.map
+//# sourceMappingURL=deploy-engine-BdYBI1uT.js.map