@go-to-k/cdkd 0.290.40 → 0.290.42

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CEKVu0mE.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-Divizw1k.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-BmtaBtO_.js");
+	const { buildProgram } = await import("./program-HtHlEaZm.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-DJxLBuTb.js → deploy-engine-C1dgx124.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BkcLg0jL.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-D-2HeLmd.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CEKVu0mE.js";
+import { t as getCdkdVersion } from "./version-Divizw1k.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4411,6 +4411,141 @@ function decodeListingKey(value) {
 	}
 }
 
+//#endregion
+//#region src/state/record-keys.ts
+/**
+* The ONE encoding anything that identifies a producer-side thing by a pair of
+* runtime strings goes through — a warned-once `Set`, a dedupe `Set`, a
+* memoization `Map`, a tree's node index.
+*
+* An import-free LEAF, the same shape as `src/utils/display-safe.ts` and
+* `src/utils/parameter-types.ts`, and that is load-bearing rather than tidy:
+* the consumers span the `cli`, `state` and `deployment` layers, and one of
+* them — `src/cli/commands/state-list-tree.ts` — is deliberately kept with NO
+* imports at all so the tree-building logic is unit-testable without mocking
+* anything. These functions previously lived in `malformed-resources-bag.ts`,
+* which reaches `error-handler` / `display-safe` / `lock-contention-message`,
+* and that module still RE-EXPORTS them so no existing importer moved.
+*
+* ENCODED, not separated. Issue
+* [#3308](https://github.com/go-to-k/cdkd/issues/3308) is the measurement
+* behind that and issue [#3323](https://github.com/go-to-k/cdkd/issues/3323)
+* is the one that found how far the class ran. Both halves of every key here
+* are attacker-influenced, and a separator only NARROWS a collision: with a
+* NUL separator, stack `Evil<NUL>us-east-1` in `ap-northeast-1` and stack
+* `Evil` in region `us-east-1<NUL>ap-northeast-1` produce the SAME key.
+*
+* `JSON.stringify` of a two-element array is injective over string pairs: the
+* quoting escapes anything that could imitate the separator, so no planted
+* value can produce another pair's key.
+*
+* **What a collision COSTS is per SITE, not a property of the key, and a note
+* here once claimed otherwise** — "one dropped warning LINE, never a wrong
+* resolution". That held for the two warned-once sets it was written for and
+* is false at three `cdkd scrub` sites, where a collision is a wrong ANSWER
+* feeding the pre-pass that decides whether a producer still holds plaintext.
+* Do not restore the narrower sentence: it reads as a licence to leave a
+* separator at a site nobody has re-checked.
+*
+* **Whether a separator was EVER injective is also per site**, because it
+* depends on each half's PROVENANCE. A half read out of an S3 key segment
+* cannot carry a NUL — measured on go-to-k/cdkd#3323, S3 refuses to store such
+* a key — so a key whose LEFT half is a segment splits uniquely at the FIRST
+* NUL. **The rule is two-sided and the dual is easy to miss**: a NUL-free
+* RIGHT half splits uniquely at the LAST one, which is what actually held at
+* one of the sites here. A half read out of a TEMPLATE or a state body is
+* gated by neither.
+*
+* Do not settle a site by asking whether the SEPARATOR is storable. That
+* question was asked twice on go-to-k/cdkd#3323 and gave the wrong answer both
+* times, in opposite directions. Encoding removes the need to ask at all,
+* which is why it is the fix rather than a wider separator.
+*/
+/** The ONE spelling of the encoding, private so no caller can re-derive it. */
+function injectivePairKey(first, second) {
+	return JSON.stringify([first, second]);
+}
+/**
+* The same rule for a key of MORE than two parts.
+*
+* The named wrappers above stay, because a `(stack, region)` record and a
+* `(stack, export)` coordinate are things worth naming. This one is for the
+* keys that are just a tuple — an idempotency-token memo key, a resource-pair
+* edge — where a name would add nothing and a positional list is the honest
+* shape. It is exported rather than private for the same reason the two are:
+* so a call site can adopt the rule without re-spelling the encoding
+* (go-to-k/cdkd#3496).
+*
+* `number` is accepted because several of these tuples carry one, and
+* stringifying at the call site would put the coercion back where a caller can
+* get it wrong. `JSON.stringify` distinguishes `1` from `"1"`, so a mixed
+* tuple stays injective across the two.
+*
+* KNOWN HOLE in that, recorded rather than guarded: `NaN`, `Infinity` and
+* `-Infinity` all stringify to `null`, so those three collapse onto one key
+* and onto a literal `null`. No call site passes one — every numeric argument
+* today is a literal bound (`64`, `32`) — and a runtime refusal would turn a
+* key builder into a throwing path for a value that cannot arrive. Check this
+* note before passing a COMPUTED number.
+*
+* Note what this does to a DIGEST that hashes the result: the encoded string
+* carries no raw control character at all — `JSON.stringify` escapes a NUL to
+* the six-character text `\u0000` — so a hash input that separates this key
+* from its neighbours with a NUL is injective too, without the separator
+* having to be chosen carefully.
+*/
+function injectiveKey(...parts) {
+	return JSON.stringify(parts);
+}
+/**
+* The prefix every {@link injectiveKey} OF TWO OR MORE PARTS whose first part
+* is `first` begins with. The arity matters and an earlier revision of this
+* line omitted it: a ONE-part key ends with a bracket where this prefix ends
+* with a comma, so it does not match one. Both call sites build two parts.
+*
+* It exists for the one reader shape an encoded key otherwise breaks: a cache that
+* evicts by scanning its keys for a leading component.
+*
+* DERIVED from the same encoder rather than spelled again, and that is the
+* whole point. go-to-k/cdkd#3496's first cut encoded three provider caches and
+* left `invalidateAttributeCache` testing the OLD `<physicalId>:` prefix, so
+* the scan matched nothing and every post-update `Fn::GetAtt` read the
+* pre-update value — silently, with every gate green. A prefix computed here
+* cannot drift from the key computed two functions up.
+*
+* Exact, not a heuristic: `JSON.stringify([first])` quotes and escapes `first`,
+* so replacing its closing `]` with `,` yields a string no OTHER first part can
+* begin with. Deriving it by searching the encoded key for a comma would NOT
+* be exact — a comma inside the value is not escaped by JSON.
+*/
+function injectiveKeyPrefix(first) {
+	return JSON.stringify([first]).slice(0, -1) + ",";
+}
+/**
+* The key for a state RECORD: the `(stackName, region)` pair that names one
+* `state.json`.
+*/
+function producerRecordKey(stackName, region) {
+	return injectivePairKey(stackName, region);
+}
+/**
+* The key for a producer COORDINATE: a `(stack, export-or-output name)` pair,
+* used by `cdkd scrub`'s re-export chain walk and its per-coordinate verdict
+* cache.
+*
+* A separate NAME because the subject is a different thing — a coordinate is
+* not a record, and a call site reading `producerRecordKey(stack, exportName)`
+* would say something false. ONE implementation, though, which is the property
+* the "one spelling" rule is actually about: two names over one implementation
+* cannot drift, two implementations can.
+*
+* An `exportName` is REDACTED on the way into state
+* (`StateImportEntry`'s JSDoc), so this half may hold any string at all.
+*/
+function producerCoordinateKey(stackName, exportOrOutputName) {
+	return injectivePairKey(stackName, exportOrOutputName);
+}
+
 //#endregion
 //#region src/state/s3-replication-purge-gap.ts
 /**
@@ -4730,7 +4865,7 @@ async function runProbe(s3Client, bucket, requestFields) {
 	}
 }
 function probe(s3Client, bucket, requestFields) {
-	const key = `${bucket}\u0000${requestFields.ExpectedBucketOwner ?? ""}`;
+	const key = injectiveKey(bucket, requestFields.ExpectedBucketOwner ?? "");
 	const cached = replicationProbeCache.get(key);
 	if (cached) return cached;
 	const pending = runProbe(s3Client, bucket, requestFields).then((result) => {
@@ -4790,11 +4925,7 @@ async function warnIfPurgeIsReplicated(s3Client, bucket, keys, options = {}) {
 		const covered = result.rules.filter((rule) => keys.some((key) => key.startsWith(rule.prefix)));
 		if (covered.length === 0) return;
 		const destinations = [...new Set(covered.map((rule) => rule.enabled ? rule.destination : `${rule.destination} (rule currently Disabled -- it stops FUTURE replication, not what it already copied)`))].sort();
-		const warnKey = [
-			bucket,
-			options.objectDescription ?? "",
-			...destinations
-		].join("\0");
+		const warnKey = injectiveKey(bucket, options.objectDescription ?? "", ...destinations);
 		if (warnedWarnings.has(warnKey)) {
 			emitDebug(`S3 replication on s3://${safeBucket} still covers purged keys (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}); already reported once this run for ${destinations.map((d) => displaySafe(d, { asciiOnly: true })).join(", ")}.`);
 			return;
@@ -10677,7 +10808,7 @@ var S3StateBackend = class {
 					if (segments.length === NEW_KEY_DEPTH) {
 						const [stackName, region] = segments;
 						if (!stackName || !region) continue;
-						const dedupeKey = `${stackName}\0${region}`;
+						const dedupeKey = producerRecordKey(stackName, region);
 						if (!seen.has(dedupeKey)) {
 							seen.add(dedupeKey);
 							refs.push({
@@ -10691,7 +10822,7 @@ var S3StateBackend = class {
 						const [stackName] = segments;
 						if (!stackName) continue;
 						const region = await this.readLegacyRegion(stackName);
-						const dedupeKey = `${stackName}\0${region ?? ""}`;
+						const dedupeKey = producerRecordKey(stackName, region ?? "");
 						if (!seen.has(dedupeKey)) {
 							seen.add(dedupeKey);
 							refs.push({
@@ -12796,10 +12927,17 @@ function recordedExpressionsOf(secrets) {
 * the shape PR #2415 was forced to WITHDRAW (`provenPublicExpressions`,
 * residual #2425): keyed on a value alone, one stack's answer is served to
 * another stack's identically-spelled read. Here the key names the producer
-* stack, its region and the output — so a hit is served only to a resolution
-* that asked for that exact output of that exact stack, i.e. to precisely the
-* reader that would have received the plaintext before this feature existed.
-* Nothing is widened.
+* stack, its region and the output — so a hit is served to a resolution that
+* asked for that output of that stack, i.e. to the reader that would have
+* received the plaintext before this feature existed.
+*
+* `precisely`, in an earlier revision, overstated it. The key is
+* NUL-SEPARATED rather than encoded, and the halves are not all
+* charset-constrained, so a forged coordinate CAN collide with another's
+* key — see {@link maskedOutputKey} for why that is left standing and what
+* would change the answer (go-to-k/cdkd#3496). The bound that does hold is
+* the one above it: whoever can forge such a coordinate can already aim at
+* the real one, so nothing is widened by the collision either.
 *
 * A RECOVERED VALUE IS STILL SECRET, and every reader re-registers it as a
 * mask-only needle in its OWN bag before using it — the recovery hands back the
@@ -12832,11 +12970,23 @@ const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
 /**
 * Separator for the composite keys {@link crossStackSourceKey} builds.
 *
-* A NUL rather than a printable character because no AWS export name, stack
-* name, output name, region or role ARN can contain one, so no two distinct
-* source leaves can spell a single key. A printable separator (`:` / `|`) does
-* occur inside a real export name — CDK's own convention is
+* A NUL rather than a printable character: a printable separator (`:` / `|`)
+* does occur inside a real export name — CDK's own convention is
 * `Stack:ExportName` — which would let one leaf's key be read as another's.
+*
+* **It does NOT follow that no two distinct source leaves can spell a single
+* key, and this note asserted that for a while** (go-to-k/cdkd#3496). The
+* reason given was that no AWS export name, stack name, output name, region or
+* role ARN can contain a NUL — a claim about what AWS ACCEPTS, while these
+* halves are TEMPLATE literals read straight out of the intrinsic. A hand-written
+* template can put a NUL in any of them.
+*
+* What makes the key safe is not injectivity but what happens on a collision:
+* the association store POISONS a slot recorded against a differing
+* (expression, plaintext) pair rather than overwriting it, and the scope is a
+* `WeakMap` on the pass's own bag. So a forged key degrades to a REFUSAL, never
+* to one leaf's expression being served for another's. Keep that property if
+* this separator is ever revisited; it, not the charset, is the guarantee.
 */
 const CROSS_STACK_KEY_SEPARATOR = "\0";
 /** A non-empty literal string, or `undefined` for anything else. */
@@ -17070,7 +17220,7 @@ function extractLambdaVpcDeleteDeps(resources) {
 		for (const targetId of targets) {
 			if (targetId === lambdaId) continue;
 			if (!(targetId in resources)) continue;
-			const key = `${lambdaId}\u0000${targetId}`;
+			const key = injectiveKey(lambdaId, targetId);
 			if (seen.has(key)) continue;
 			seen.add(key);
 			edges.push({
@@ -22654,36 +22804,6 @@ function malformedResourcePropertiesWarning(stackName, region, logicalIds) {
 	return `${namedPropertyBagsClause(stackName, region, logicalIds)} Continuing with those maps EMPTY: what these records are stored as holding is NOT what this preview compares against. Where the template still declares the resource, every property it declares previews as an addition and a create-only one as a replacement; where it no longer declares it, the DELETE row shows an empty previous side instead of the stored one. Do NOT run 'cdkd deploy' against this record — it REFUSES on the same defect rather than acting on this preview. See the stored values with: ${inspectCommand(stackName, region)}`;
 }
 /**
-* The key a warned-once-per-record `Set` uses to identify a producer RECORD.
-*
-* ONE spelling, shared by `scrub.ts`'s cross-stack pre-pass and
-* `local-state-loader.ts`'s `Fn::GetStackOutput` reader, because two spellings
-* of one rule is how nine sites stay right and the tenth drifts — the same
-* reason every predicate in this module is here rather than at its call sites.
-*
-* ENCODED, not separated, and issue
-* [#3308](https://github.com/go-to-k/cdkd/issues/3308) is the measurement
-* behind that. Both sites previously joined the two halves with a NUL, which
-* NARROWS the collision without closing it: a stack name is read out of an S3
-* key and is exactly as attacker-controlled as the `outputs` bag, so it can
-* carry a NUL too — `tests/unit/cli/commands/scrub-malformed-and-nameless.test.ts`
-* already plants one. Measured: with a NUL separator, stack `Evil<NUL>us-east-1`
-* in `ap-northeast-1` and stack `Evil` in region `us-east-1<NUL>ap-northeast-1`
-* produce the SAME key, so whichever is warned about second is silently not
-* warned about at all.
-*
-* `JSON.stringify` of a two-element array is injective over string pairs: the
-* quoting escapes anything that could imitate the separator, so no planted name
-* can produce another pair's key.
-*
-* The consequence of a collision is one dropped warning LINE, never a wrong
-* resolution — both records are still read as empty and both reads still miss.
-* That is why this is worth one shared helper rather than a larger mechanism.
-*/
-function producerRecordKey(stackName, region) {
-	return JSON.stringify([stackName, region]);
-}
-/**
 * How many unreadable logical ids a message names before summarizing. Read by
 * every builder that names ids — the refusal below, `namedEntriesClause` and
 * `malformedOrphanRecordsWarning` — so "the refusal below" was the count of
@@ -27760,7 +27880,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	cachedDynamicReferences = /* @__PURE__ */ new Map();
 	/**
-	* `<parameter name>\u0000<reported Type>` pairs this resolver has already
+	* `(parameter name, reported Type)` pairs this resolver has already
 	* warned about (issue #1933 review).
 	*
 	* Keyed on the PAIR rather than the name alone: two different anomalous types
@@ -30378,7 +30498,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* contract as {@link lookupCfnExport}.
 	*/
 	async lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
-		const cacheKey = `${region}\0${stackName}`;
+		const cacheKey = injectiveKey(region, stackName);
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
 			fetch = this.fetchCfnStackOutputs(stackName, region);
@@ -31877,8 +31997,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${loggedParameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
-		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
-			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
+		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(parameterName, String(paramType)))) {
+			this.warnedUnrecognizedSsmTypes.add(injectiveKey(parameterName, String(paramType)));
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
 			this.logger.warn(`SSM parameter '${loggedParameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
@@ -33563,7 +33683,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DPTeR_IT.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Cms9Daqn.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -47271,5 +47391,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, CrossAccountSecretRefusalError as $i, TemplateParser as $n, validateAssetBucketName as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, __exportAll as Aa, ssmResolvedValueType as Ai, malformedResourcePropertiesWarning as An, hasReasonlessBaselineRefusal as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, canonicalizeRegion as Bi, refuseMalformedResourcesForDestroy as Bn, WorkGraph as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, isThrottlingError as Ca, resolveCaptureObservedState as Ci, malformedExportSourceWarning as Cn, forceQuitRecoveryClause as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, retryClassificationText as Da, resolveUseCdkBootstrapAssets as Di, malformedOutputsWarning as Dn, DEFAULT_STATE_PREFIX as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, markRedactedCause as Ea, resolveStateBucketWithDefaultAndSource as Ei, malformedOutputsRefusalMessage as En, CUSTOM_RESOURCE_RESPONSE_PREFIX as Er, deleteSkipReason as Et, extractDeploymentEventError as F, uploadCfnTemplate as Fi, refuseMalformedNestedChildOutputs as Fn, orphansAfterRollback as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, resolveBucketRegion as Gi, repairMalformedResourcesForReadOnly as Gn, AssetModeResolver as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, AssemblyReader as Hi, repairMalformedOutputsForReadOnly as Hn, createAssetRedirectResolver as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ii, refuseMalformedOutputs as In, orphansCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, resetAwsClients as Ji, findActionableSilentDrops as Jn, ensureAssetStorage as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, AwsClients as Ki, safeRegion as Kn, BOOTSTRAP_MARKER_PREFIX as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, decodeListingKey as Li, refuseMalformedOutputsForDestroy as Ln, shouldRetainResource as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, CFN_TEMPLATE_URL_LIMIT as Mi, malformedStateRefusalMessage as Mn, importableOutputKeys as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MIGRATE_TMP_PREFIX as Ni, producerRecordKey as Nn, importableOutputs as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, describeAwsFailure as Oa, stateBucketExistenceConfirmed as Oi, malformedRenderedContainersWarning as On, exportNamesCarriedFrom as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, findLargeInlineResources as Pi, refuseDivergentRecordRegionForDestroy as Pn, isReadableBag as Pr, getAccountInfo as Pt, red as Q, ConfigError as Qi, DagBuilder as Qn, readBootstrapMarkerBody as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, expectedOwnerParam as Ri, refuseMalformedResourceEntries as Rn, AssetPublisher as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, isRetryableTransientError as Sa, resolveAutoAssetStorage as Si, malformedExportNamesWarning as Sn, buildLockContentionMessage as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, markNonRetryable as Ta, resolveStateBucketWithDefault as Ti, malformedOrphanRecordsWarning as Tn, shellQuote as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, processStackMessages as Ui, repairMalformedResourceEntriesForReadOnly as Un, loadPublishableAssetManifest as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, derivePartitionAndUrlSuffix as Vi, refuseMalformedState as Vn, buildAssetRedirectMap as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, clearBucketRegionCache as Wi, repairMalformedResourcePropertiesForReadOnly as Wn, rewriteTemplateAssetReferences as Wr, assertRegionMatch as Wt, gray as X, AssetError as Xi, describeTypeWithThrottleRetry as Xn, isCrossRegionRedirect as Xr, readConfigString as Xt, cyan as Y, setAwsClients as Yi, findSilentDropProperties as Yn, getBootstrapMarkerKey as Yr, configStringRefusal as Yt, green as Z, CdkdError as Zi, withRetry as Zn, parseBootstrapMarker as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, formatError as _a, Synthesizer as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, LockManager as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, LocalStartServiceError as aa, describeDockerFailure as ai, s3BucketDomainName as an, createSecretMasker as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, withErrorHandling as ba, getLegacyStateBucketName as bi, hasReadableResources as bn, UNREPRODUCIBLE_LOCK_CLAUSE as br, startInterruptWatch as bt, replayFailedOperations as c, NestedStackChildDirectDestroyError as ca, getDockerCmd as ci, s3BucketWebsiteUrl as cn, identityKeyFor as cr, IAMRoleProvider as ct, updatePartialMessage as d, ResourceTimeoutError as da, runDockerForeground as di, applyCallerIdentityCredentials as dn, maskSecretsInError as dr, ProviderRegistry as dt, DependencyError as ea, validateContainerRepoName as ei, requireConfigString as en, STATE_SOURCED_BASELINE_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, ResourceUpdateNotSupportedError as fa, runDockerStreaming as fi, callerEnvCredentials as fn, maskSecretsInText as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, SynthesisError as ga, getDockerImageBySourceHash as gi, STATE_RESOURCES_MALFORMED as gn, scrubResourceRecord as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, StateError as ha, AssetManifestLoader as hi, INTRINSIC_KEYS as hn, redactSecretsForState as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, LocalInvokeBuildError as ia, describeDockerExecFailure as ii, s3BucketArn as in, carriesSecretMask as ir, secretBearing as it, isFinalSnapshotError as j, CFN_TEMPLATE_BODY_LIMIT as ji, malformedResourcesWarning as jn, hasUnverifiableParameterRefusal as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, safeStringify$1 as ka, warnDeprecatedNoPrefixCliFlag as ki, malformedResourceEntriesWarning as kn, hasReadableExportSet as kr, IntrinsicFunctionResolver as kt, replayRollback as l, PartialFailureError as la, partitionSensitiveEnv as li, applyRoleArnIfSet as ln, isSingleDynamicReferenceToken as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, StackTerminationProtectionError as ma, stripControlChars as mi, DiffCalculator as mn, recoverMaskedOutput as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DynamicReferenceRegionAmbiguousError as na, buildDockerImage as ni, producerRegionsFromState as nn, STATE_SOURCED_READBACK_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, LockError as oa, dockerSpawnEnvWithSensitive as oi, s3BucketDualStackDomainName as on, dynamicReferenceTokens as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, StackHasActiveImportsError as pa, escapeRegExp$1 as pi, envCredentialsAreAssumedRole as pn, recordMaskOnlyValue as pr, createMaskedRetryLogger as pt, formatResourceLine as q, getAwsClients as qi, safeStackName as qn, assertAssetBucketRegion as qr, configBooleanRefusal as qt, DeployEngine as r, IntrinsicResolutionRefusalError as ra, describeDockerCapturedOutput as ri, withSharedDrainBudget as rn, TEMPLATE_SOURCED_RULES as rr, isExportAliasCollision as rt, planRollback as s, MalformedProducerRecordRefusalError as sa, formatDockerLoginError as si, s3BucketRegionalDomainName as sn, errorCauseChain as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DeployCancelledError as ta, buildDenyExternalAccessPolicy as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_CROSS_GENERATION_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, ProvisioningError as ua, redactDockerArgvValues as ui, AWS_CREDENTIAL_ENV_KEYS as un, markSameGenerationBag as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, isCdkdError as va, synthesisStatusMessage as vi, displayLogicalId as vn, S3StateBackend as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isTransientServerError as wa, resolveSkipPrefix as wi, malformedLocalOutputsWarning as wn, formatLockExpiry as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, isMarkedNonRetryable as xa, resolveApp as xi, isReadableResourceEntry as xn, buildForceUnlockCommand as xr, CloudControlProvider as xt, keptWholeReasonText as y, normalizeAwsError as ya, getDefaultStateBucketName as yi, hasReadableOutputs as yn, rebuildClientForBucketRegion as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, PARTITION_TABLE as zi, refuseMalformedResourcePropertiesForOrphan as zn, stringifyValue as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-DJxLBuTb.js.map
+export { yellow as $, AssetError as $i, STATE_SOURCED_BASELINE_RULES as $n, validateContainerRepoName as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, retryClassificationText as Aa, CFN_TEMPLATE_BODY_LIMIT as Ai, malformedResourcePropertiesWarning as An, hasUnverifiableParameterRefusal as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, decodeListingKey as Bi, refuseMalformedState as Bn, buildAssetRedirectMap as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, withErrorHandling as Ca, resolveSkipPrefix as Ci, malformedExportSourceWarning as Cn, formatLockExpiry as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, isTransientServerError as Da, stateBucketExistenceConfirmed as Di, malformedOutputsWarning as Dn, exportNamesCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, isThrottlingError as Ea, resolveUseCdkBootstrapAssets as Ei, malformedOutputsRefusalMessage as En, DEFAULT_STATE_PREFIX as Er, deleteSkipReason as Et, extractDeploymentEventError as F, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Fi, refuseMalformedOutputs as Fn, orphansCarriedFrom as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, AssemblyReader as Gi, safeRegion as Gn, BOOTSTRAP_MARKER_PREFIX as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, PARTITION_TABLE as Hi, repairMalformedResourceEntriesForReadOnly as Hn, loadPublishableAssetManifest as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, injectiveKey as Ii, refuseMalformedOutputsForDestroy as In, shouldRetainResource as Ir, isNamelessDynamicReferenceError as It, bold as J, resolveBucketRegion as Ji, findSilentDropProperties as Jn, getBootstrapMarkerKey as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, processStackMessages as Ki, safeStackName as Kn, assertAssetBucketRegion as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, injectiveKeyPrefix as Li, refuseMalformedResourceEntries as Ln, AssetPublisher as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, safeStringify$1 as Ma, MIGRATE_TMP_PREFIX as Mi, malformedStateRefusalMessage as Mn, importableOutputs as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, __exportAll as Na, findLargeInlineResources as Ni, refuseDivergentRecordRegionForDestroy as Nn, isReadableBag as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, markNonRetryable as Oa, warnDeprecatedNoPrefixCliFlag as Oi, malformedRenderedContainersWarning as On, hasReadableExportSet as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, uploadCfnTemplate as Pi, refuseMalformedNestedChildOutputs as Pn, orphansAfterRollback as Pr, getAccountInfo as Pt, red as Q, setAwsClients as Qi, TemplateParser as Qn, validateAssetBucketName as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, producerCoordinateKey as Ri, refuseMalformedResourcePropertiesForOrphan as Rn, stringifyValue as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, normalizeAwsError as Sa, resolveCaptureObservedState as Si, malformedExportNamesWarning as Sn, forceQuitRecoveryClause as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, isRetryableTransientError as Ta, resolveStateBucketWithDefaultAndSource as Ti, malformedOrphanRecordsWarning as Tn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, canonicalizeRegion as Ui, repairMalformedResourcePropertiesForReadOnly as Un, rewriteTemplateAssetReferences as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, expectedOwnerParam as Vi, repairMalformedOutputsForReadOnly as Vn, createAssetRedirectResolver as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, derivePartitionAndUrlSuffix as Wi, repairMalformedResourcesForReadOnly as Wn, AssetModeResolver as Wr, assertRegionMatch as Wt, gray as X, getAwsClients as Xi, withRetry as Xn, parseBootstrapMarker as Xr, readConfigString as Xt, cyan as Y, AwsClients as Yi, describeTypeWithThrottleRetry as Yn, isCrossRegionRedirect as Yr, configStringRefusal as Yt, green as Z, resetAwsClients as Zi, DagBuilder as Zn, readBootstrapMarkerBody as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, StackTerminationProtectionError as _a, synthesisStatusMessage as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, S3StateBackend as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, DynamicReferenceRegionAmbiguousError as aa, dockerSpawnEnvWithSensitive as ai, s3BucketDomainName as an, dynamicReferenceTokens as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, formatError as ba, resolveApp as bi, hasReadableResources as bn, buildForceUnlockCommand as br, startInterruptWatch as bt, replayFailedOperations as c, LocalStartServiceError as ca, partitionSensitiveEnv as ci, s3BucketWebsiteUrl as cn, isSingleDynamicReferenceToken as cr, IAMRoleProvider as ct, updatePartialMessage as d, NestedStackChildDirectDestroyError as da, runDockerStreaming as di, applyCallerIdentityCredentials as dn, maskSecretsInText as dr, ProviderRegistry as dt, CdkdError as ea, buildDenyExternalAccessPolicy as ei, requireConfigString as en, STATE_SOURCED_CROSS_GENERATION_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, PartialFailureError as fa, escapeRegExp$1 as fi, callerEnvCredentials as fn, recordMaskOnlyValue as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, StackHasActiveImportsError as ga, Synthesizer as gi, STATE_RESOURCES_MALFORMED as gn, LockManager as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, ResourceUpdateNotSupportedError as ha, getDockerImageBySourceHash as hi, INTRINSIC_KEYS as hn, scrubResourceRecord as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, DeployCancelledError as ia, describeDockerFailure as ii, s3BucketArn as in, createSecretMasker as ir, secretBearing as it, isFinalSnapshotError as j, describeAwsFailure as ja, CFN_TEMPLATE_URL_LIMIT as ji, malformedResourcesWarning as jn, importableOutputKeys as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, markRedactedCause as ka, ssmResolvedValueType as ki, malformedResourceEntriesWarning as kn, hasReasonlessBaselineRefusal as kr, IntrinsicFunctionResolver as kt, replayRollback as l, LockError as la, redactDockerArgvValues as li, applyRoleArnIfSet as ln, markSameGenerationBag as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, ResourceTimeoutError as ma, AssetManifestLoader as mi, DiffCalculator as mn, redactSecretsForState as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CrossAccountSecretRefusalError as na, describeDockerCapturedOutput as ni, producerRegionsFromState as nn, TEMPLATE_SOURCED_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, IntrinsicResolutionRefusalError as oa, formatDockerLoginError as oi, s3BucketDualStackDomainName as on, errorCauseChain as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, ProvisioningError as pa, stripControlChars as pi, envCredentialsAreAssumedRole as pn, recoverMaskedOutput as pr, createMaskedRetryLogger as pt, formatResourceLine as q, clearBucketRegionCache as qi, findActionableSilentDrops as qn, ensureAssetStorage as qr, configBooleanRefusal as qt, DeployEngine as r, DependencyError as ra, describeDockerExecFailure as ri, withSharedDrainBudget as rn, carriesSecretMask as rr, isExportAliasCollision as rt, planRollback as s, LocalInvokeBuildError as sa, getDockerCmd as si, s3BucketRegionalDomainName as sn, identityKeyFor as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ConfigError as ta, buildDockerImage as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_READBACK_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, MalformedProducerRecordRefusalError as ua, runDockerForeground as ui, AWS_CREDENTIAL_ENV_KEYS as un, maskSecretsInError as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, StateError as va, getDefaultStateBucketName as vi, displayLogicalId as vn, rebuildClientForBucketRegion as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isMarkedNonRetryable as wa, resolveStateBucketWithDefault as wi, malformedLocalOutputsWarning as wn, shellQuote as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, isCdkdError as xa, resolveAutoAssetStorage as xi, isReadableResourceEntry as xn, buildLockContentionMessage as xr, CloudControlProvider as xt, keptWholeReasonText as y, SynthesisError as ya, getLegacyStateBucketName as yi, hasReadableOutputs as yn, UNREPRODUCIBLE_LOCK_CLAUSE as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, producerRecordKey as zi, refuseMalformedResourcesForDestroy as zn, WorkGraph as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-C1dgx124.js.map