@go-to-k/cdkd 0.290.49 → 0.291.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-usurnP89.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-kDWCn_Jq.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-DGTp7UIn.js");
+	const { buildProgram } = await import("./program-Cs7N6T4j.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-Cs0cRQIM.js → deploy-engine-9CxYEFh_.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-usurnP89.js";
+import { t as getCdkdVersion } from "./version-kDWCn_Jq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3097,6 +3097,33 @@ function namesTheSameDirectory(bound, candidate) {
 	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
 }
 /**
+* The escape verdict for an assembly-supplied path WITHOUT throwing, taking
+* whichever arm the value's own shape calls for.
+*
+* `resolveAssemblyPath` answers for a RELATIVE value and
+* {@link absoluteAssemblyPathEscape} for an ABSOLUTE one, and a caller that
+* only wants to WARN would otherwise branch on `path.isAbsolute` and call
+* both itself. Three sites already do exactly that
+* ([#3532](https://github.com/go-to-k/cdkd/issues/3532)'s two asset resolvers,
+* which must also THROW and so keep their own spelling), and the fourth —
+* [#3497](https://github.com/go-to-k/cdkd/issues/3497)'s BuildKit
+* passthroughs — has nothing to throw and a dozen values to judge. This is the
+* one spelling for that case.
+*
+* `base` is what a relative value resolves against; `bound` is what the result
+* must stay inside. They differ for a Stage. Returns `undefined` when the
+* value is fine, including when it names `bound` itself, which
+* {@link namesTheSameDirectory} answers — an asset path legitimately names a
+* directory and a caller that WARNS has no reason to complain about the
+* assembly root.
+*/
+function assemblyPathEscape(base, bound, candidate) {
+	if (path.isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
+	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
+	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
+	return resolved;
+}
+/**
 * The shared tail of every containment refusal: what the value resolved to,
 * what it escaped, and why that means the assembly is not CDK-generated. Each
 * call site supplies its own subject ("Stack 'X' has templateFile='...' which
@@ -8705,6 +8732,251 @@ function describeDockerCapturedOutput(error, args, fallback) {
 	return redactDockerArgvInText(capturedStreamText(error, "stderr") || capturedStreamText(error, "stdout") || fallback, args);
 }
 
+//#endregion
+//#region src/assets/docker-cache-option.ts
+/**
+* Render a `DockerCacheOption` as the `--cache-from` / `--cache-to` value
+* BuildKit receives.
+*
+* Its own LEAF module, imported by both `docker-build.ts` (which pushes it
+* into the argv) and `manifest-passthrough-warnings.ts` (which judges it).
+* Not because those two form a cycle — `docker-build.ts` imports the warnings
+* module and not the reverse — but because the helper belongs to NEITHER: it
+* is the shared definition of what BuildKit will be handed, and keeping it in
+* the builder would make the judge import the thing it judges.
+*
+* **It is the one spelling on purpose, and the reason is a defect**
+* ([#3497](https://github.com/go-to-k/cdkd/issues/3497)): the warning layer
+* used to walk `option.params` STRUCTURALLY while the argv is this
+* concatenation, and neither `,` nor `=` is quoted here. A manifest could
+* therefore inject CSV through a field the walk did not treat as a path —
+* `type: 'local,dest=/home/victim/.ssh'` with no params at all renders
+* `--cache-to type=local,dest=/home/victim/.ssh`, a host WRITE that produced
+* no warning because `params` was empty. Judging the rendered STRING closes
+* that by construction: whatever BuildKit parses is what cdkd parsed.
+*/
+function cacheOptionToFlag(option) {
+	let flag = `type=${option.type}`;
+	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
+	return flag;
+}
+
+//#endregion
+//#region src/assets/manifest-passthrough-warnings.ts
+/**
+* Every candidate host path in a buildx option value.
+*
+* **Uniform, and over-inclusive on purpose.** Three review rounds found this
+* parser short in three different ways — `dest=` only (missing the
+* `--output=<path>` shorthand), case-sensitive `src` (missing `source=` and
+* `SRC=`), and a per-entry `=` requirement (missing every key after the first
+* in `--ssh k=./a.key,/home/victim/.ssh/id_rsa`). Each fix was a new special
+* case, and the next round found the next gap. So the rule is now one rule:
+* **a part with a key yields its value, a part without one yields itself**,
+* for every field. An over-inclusive candidate costs at most a warning about
+* a string that was never a path — and a value that is not a path resolves
+* inside the build context and is dropped before anything is printed.
+*
+* `write` is true only for an explicit `dest=`, or when the caller says the
+* whole field is a write target (`dockerOutputs`, whose bare-path form IS a
+* destination). It is NOT inferred from the field name: `cacheFrom` can carry
+* a `dest=` and `cacheTo` a `src=`.
+*
+* KNOWN INCOMPLETE, recorded rather than built, and this list is the whole of
+* what is left "safe by argument" in this module — four of five review rounds
+* broke something that lived in that category, so it is written down instead:
+*
+* - buildx parses these as CSV, so a quoted value containing a comma
+*   (`dest="/tmp/a,b"`) is split wrongly here and its path is missed.
+* - the keyed rule takes `src` / `source` / `dest`, the documented spellings
+*   that make BuildKit open a file. An UNDOCUMENTED alias, or a NEW key in a
+*   future buildx, would slip past it, where the earlier take-every-key rule
+*   would have caught it — that rule was given up because it cost live false
+*   positives on `ref=` / `scope=` / `env=` at an ordinary project layout.
+*   What was audited, per backend: `--secret` opens a file only through
+*   `src` / `source` (`env` is a variable NAME); every `--output` exporter
+*   only through `dest` (`name`, `push`, `compression*`, `annotation.*`,
+*   `store`, the docker exporter's `context` are not paths); `--cache-to` and
+*   `--cache-from` only under `type=local` (`registry`, `s3`, `azblob`, `gha`
+*   reach the network or take inline values). For the CACHE flags alone there
+*   is a second enumeration to keep in step: `src/utils/docker-cmd.ts`'s
+*   `ARGV_PARAM_LIST_LOCATOR_PARAMS`, consulted under `ARGV_PARAM_LIST_FLAGS`
+*   (`--cache-from` / `--cache-to`), lists the same backends for the
+*   redaction side and agrees — **update both or neither.** `--secret` and
+*   `--output` have no counterpart there, so a new exporter key is judged
+*   here and nowhere else.
+* - a leading or trailing SPACE is trimmed here and is NOT trimmed by buildx
+*   or by Go's CSV reader, so ` ../../x` is a directory literally named
+*   `" .."` to the kernel while cdkd judges the trimmed spelling. It can only
+*   OVER-warn, which is why it is recorded rather than removed.
+*
+* Both misses cost a WARNING, never a refusal, which is the whole reason
+* neither is worth a CSV parser or a wider net.
+*
+* Tolerant by construction: an unparseable value yields nothing rather than
+* throwing. This module only ever ADDS a warning and must never be why a
+* legitimate build fails.
+*/
+function candidateHostPaths(value, opts) {
+	const out = [];
+	for (const part of value.split(",")) {
+		const eq = part.indexOf("=");
+		if (eq < 0) {
+			const bare = part.trim();
+			if (bare.length > 0) out.push({
+				path: bare,
+				write: opts.bareIsWrite
+			});
+			continue;
+		}
+		const key = part.slice(0, eq).trim().toLowerCase();
+		const v = part.slice(eq + 1).trim();
+		if (v.length === 0) continue;
+		if (key !== "src" && key !== "source" && key !== "dest") continue;
+		out.push({
+			path: v,
+			write: key === "dest"
+		});
+	}
+	return out;
+}
+/** Every host path this source hands to BuildKit, with where it came from. */
+function hostPathsOf(source) {
+	const refs = [];
+	if (source.dockerFile) refs.push({
+		field: "dockerFile",
+		where: "dockerFile",
+		path: source.dockerFile,
+		write: false
+	});
+	for (const [k, v] of Object.entries(source.dockerBuildContexts ?? {})) {
+		const rendered = `${k}=${v}`;
+		const contextPath = rendered.slice(rendered.indexOf("=") + 1).trim();
+		if (contextPath.length === 0) continue;
+		refs.push({
+			field: "dockerBuildContexts",
+			where: k,
+			path: contextPath,
+			write: false
+		});
+	}
+	const ssh = source.dockerBuildSsh ?? "";
+	const sshEq = ssh.indexOf("=");
+	(sshEq < 0 ? [] : ssh.slice(sshEq + 1).split(",")).forEach((entry, i) => {
+		const p = entry.trim();
+		if (p.length > 0) refs.push({
+			field: "dockerBuildSsh",
+			where: String(i),
+			path: p,
+			write: false
+		});
+	});
+	for (const [k, v] of Object.entries(source.dockerBuildSecrets ?? {})) for (const { path: p, write } of candidateHostPaths(`id=${k},${v}`, { bareIsWrite: false })) refs.push({
+		field: "dockerBuildSecrets",
+		where: k,
+		path: p,
+		write
+	});
+	(source.cacheFrom ?? []).forEach((c, i) => {
+		for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(c), { bareIsWrite: false })) refs.push({
+			field: "cacheFrom",
+			where: String(i),
+			path: p,
+			write
+		});
+	});
+	if (source.cacheTo) for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(source.cacheTo), { bareIsWrite: false })) refs.push({
+		field: "cacheTo",
+		where: "cacheTo",
+		path: p,
+		write
+	});
+	(source.dockerOutputs ?? []).forEach((o, i) => {
+		for (const { path: p, write } of candidateHostPaths(o, { bareIsWrite: true })) refs.push({
+			field: "dockerOutputs",
+			where: String(i),
+			path: p,
+			write
+		});
+	});
+	return refs;
+}
+/**
+* Warn for each BuildKit passthrough whose host path leaves the assembly.
+*
+* `base` is the build context directory (what a relative value resolves
+* against); `bound` is the app's outdir.
+*/
+function warnEscapingBuildKitPaths(source, base, bound) {
+	const logger = getLogger().child("assets");
+	const contextNarrows = assemblyPathEscape(base, base, resolve$1(bound)) !== void 0;
+	for (const ref of hostPathsOf(source)) {
+		if (!ref.write && contextNarrows && assemblyPathEscape(base, base, ref.path) === void 0) continue;
+		const escape = assemblyPathEscape(base, bound, ref.path);
+		if (escape === void 0) continue;
+		const verb = ref.write ? "WRITE to" : "read";
+		logger.warn(`Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `['${displaySafe(ref.where)}']`) + ` names a host path outside the assembly, which ${renderAssemblyPathEscape(escape, bound, "load", `cdkd will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`)}`);
+	}
+}
+/**
+* Warn that a manifest-chosen command line is about to run on the host.
+*
+* **This is the one the decision singles out**, and it is not a containment
+* question: `source.executable` is an arbitrary argv cdkd spawns, so no path
+* check applies and no value of it is "safe". It breaks the reasonable
+* expectation that `-a <dir>` runs no code from the assembly, and nothing said
+* so before. Rendered through `redactDockerArgvValues`, because a build script
+* wrapping `docker build` carries the very `--build-arg` pairs the rest of
+* this layer masks.
+*/
+function warnManifestExecutable(executable) {
+	const [cmd, ...rest] = executable;
+	const logger = getLogger().child("assets");
+	logger.debug(`source.executable argv: ${redactDockerArgvValues([...executable]).join(" ")}`);
+	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: '${displaySafe(cmd ?? "")}'` + (rest.length > 0 ? ` (with ${rest.length} argument(s); --verbose shows them)` : "") + ". cdkd runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means deploying from a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.");
+}
+/**
+* One set per KIND rather than one set of composite keys. A `${kind}` + NUL +
+* `${name}` key would be a multi-part NUL-joined string, which this repo
+* fences as a record-key shape — and it is not one: it never leaves the
+* process, is never persisted, and a collision would suppress one duplicate
+* warning line. Two sets carry the same information with nothing to classify.
+*/
+const warnedDestinations = {
+	bucket: /* @__PURE__ */ new Set(),
+	repository: /* @__PURE__ */ new Set()
+};
+/**
+* Warn that an asset destination is not bootstrap-shaped.
+*
+* `redirectFileAsset` rewrites a destination only when it matches a known
+* bootstrap shape, so anything else survives verbatim and cdkd uploads there
+* with the caller's credentials. A CUSTOM BOOTSTRAP IS LEGITIMATE — which is
+* why this warns and never refuses — but the name is worth printing, because
+* it is the one field a reader can recognise as not theirs.
+*
+* **Shape only, and an adversary can imitate a shape.**
+* `isDefaultBootstrapBucketName` accepts any qualifier, so
+* `cdk-<anything>-assets-<victim-account>-<region>` reads as recognized even
+* when the bucket lives in the attacker's account (S3 names are global and a
+* bucket policy can admit the victim's principal). This warning narrows what
+* a careless manifest gets away with; it is not an ownership check, and
+* nothing here should be read as one.
+*
+* `recognized` is whether the name is default-bootstrap-shaped for this
+* (account, region) or is cdkd's own asset storage. Judged on the FLATTENED
+* name and on shape, not on whether the redirect table rewrote it: in legacy
+* mode nothing is rewritten and every ordinary deploy would otherwise warn,
+* which is the cry-wolf failure this layer already learned once.
+*/
+function warnUnrecognizedAssetDestination(opts) {
+	if (opts.recognized) return;
+	const seen = warnedDestinations[opts.kind];
+	if (seen.has(opts.name)) return;
+	seen.add(opts.name);
+	getLogger().child("assets").warn(`Asset destination ${opts.kind} '${displaySafe(opts.name)}' is not a CDK-bootstrap or cdkd-managed name, so cdkd uploads there exactly as this asset manifest wrote it, with your credentials. That is what a custom bootstrap looks like and is expected for one; if you did not configure it, the manifest chose where your assets go.`);
+}
+
 //#endregion
 //#region src/assets/docker-build.ts
 /**
@@ -8785,6 +9057,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	if (source.executable && source.executable.length > 0) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
+		warnManifestExecutable(source.executable);
 		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
 		const shownExecutable = redactDockerArgvValues(source.executable).join(" ");
 		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
@@ -8811,6 +9084,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
 	const contextDir = contextDirectory(source.directory, "send that directory to BuildKit as the build context and bake it into the image pushed to the repository this manifest names");
 	buildArgs.push(".");
+	warnEscapingBuildKitPaths(source, contextDir, options.assetOutdir ?? cdkOutDir);
 	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displaySafe(contextDir)})`);
 	try {
 		await runDockerStreaming(buildArgs, {
@@ -8849,11 +9123,6 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 	if (source.cacheDisabled) args.push("--no-cache");
 	return args;
 }
-function cacheOptionToFlag(option) {
-	let flag = `type=${option.type}`;
-	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
-	return flag;
-}
 
 //#endregion
 //#region src/assets/docker-asset-publisher.ts
@@ -10380,6 +10649,15 @@ var AssetPublisher = class {
 		const nodeIds = [];
 		const fileAssets = Object.entries(manifest.files || {}).filter(([, asset]) => !isCfnTemplateAssetPath(asset.source.path)).map(([hash, asset]) => [hash, redirect ? redirectFileAsset(asset, redirect) : asset]);
 		for (const [hash, asset] of fileAssets) {
+			for (const dest of Object.values(asset.destinations)) {
+				const destRegion = dest.region ?? options.region;
+				const name = flattenAssetPlaceholders(dest.bucketName, options.accountId, destRegion);
+				warnUnrecognizedAssetDestination({
+					kind: "bucket",
+					name,
+					recognized: isDefaultBootstrapBucketName(name, options.accountId, destRegion) || redirect !== void 0 && [...redirect.buckets.values()].includes(name)
+				});
+			}
 			const nodeId = `asset-publish:${prefix}file:${hash}`;
 			graph.addNode({
 				id: nodeId,
@@ -10400,6 +10678,15 @@ var AssetPublisher = class {
 		}
 		for (const [hash, rawAsset] of Object.entries(manifest.dockerImages || {})) {
 			const asset = redirect ? redirectDockerAsset(rawAsset, redirect) : rawAsset;
+			for (const dest of Object.values(asset.destinations)) {
+				const destRegion = dest.region ?? options.region;
+				const name = flattenAssetPlaceholders(dest.repositoryName, options.accountId, destRegion);
+				warnUnrecognizedAssetDestination({
+					kind: "repository",
+					name,
+					recognized: isDefaultBootstrapRepoName(name, options.accountId, destRegion) || redirect !== void 0 && [...redirect.repos.values()].includes(name)
+				});
+			}
 			const localTag = `cdkd-asset-${hash}`;
 			const buildNodeId = `asset-build:${prefix}docker:${hash}`;
 			const publishNodeId = `asset-publish:${prefix}docker:${hash}`;
@@ -34862,7 +35149,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-06Q6iut6.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CZ5keDoC.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -48571,5 +48858,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, AssemblyReader as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, ProvisioningError as Aa, resolveCaptureObservedState as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, withErrorHandling as Ba, MIGRATE_TMP_PREFIX as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, IntrinsicResolutionRefusalError as Ca, getDockerImageBySourceHash as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, MalformedProducerRecordRefusalError as Da, getLegacyStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, LockError as Ea, getDefaultStateBucketName as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, StateError as Fa, stateBucketExistenceConfirmed as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, markNonRetryable as Ga, injectiveKeyPrefix as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isRetryableTransientError as Ha, uploadCfnTemplate as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, SynthesisError as Ia, warnDeprecatedNoPrefixCliFlag as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, describeAwsFailure as Ja, decodeListingKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, markRedactedCause as Ka, producerCoordinateKey as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, formatError as La, ssmResolvedValueType as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, ResourceUpdateNotSupportedError as Ma, resolveStateBucketWithDefault as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, StackHasActiveImportsError as Na, resolveStateBucketWithDefaultAndSource as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, NestedStackChildDirectDestroyError as Oa, resolveApp as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StackTerminationProtectionError as Pa, resolveUseCdkBootstrapAssets as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, derivePartitionAndUrlSuffix as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, isCdkdError as Ra, CFN_TEMPLATE_BODY_LIMIT as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, DynamicReferenceRegionAmbiguousError as Sa, AssetManifestLoader as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LocalStartServiceError as Ta, synthesisStatusMessage as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isThrottlingError as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, isMarkedNonRetryable as Va, findLargeInlineResources as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isTransientServerError as Wa, injectiveKey as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, __exportAll as Xa, PARTITION_TABLE as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, safeStringify$1 as Ya, expectedOwnerParam as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, canonicalizeRegion as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, CdkdError as _a, redactDockerArgvValues as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, nullPrototypeRecord as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, DependencyError as ba, escapeRegExp$1 as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, renderAssemblyPathEscape as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, resolveBucketRegion as da, describeDockerExecFailure as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, failedStageNote as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, AwsClients as fa, describeDockerFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, AssetError as ga, partitionSensitiveEnv as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, setAwsClients as ha, getDockerCmd as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasPlainPrototype$1 as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ResourceTimeoutError as ja, resolveSkipPrefix as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, PartialFailureError as ka, resolveAutoAssetStorage as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, resolveAssemblyPath as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resetAwsClients as ma, formatDockerLoginError as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, defineOwnKey as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, ownValue as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, getAwsClients as pa, dockerSpawnEnvWithSensitive as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, retryClassificationText as qa, producerRecordKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, hasOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, absoluteAssemblyPathEscape as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, clearBucketRegionCache as ua, describeDockerCapturedOutput as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, ConfigError as va, runDockerForeground as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, LocalInvokeBuildError as wa, Synthesizer as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DeployCancelledError as xa, stripControlChars as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, CrossAccountSecretRefusalError as ya, runDockerStreaming as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, normalizeAwsError as za, CFN_TEMPLATE_URL_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-Cs0cRQIM.js.map
+export { yellow as $, derivePartitionAndUrlSuffix as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PartialFailureError as Aa, resolveAutoAssetStorage as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, normalizeAwsError as Ba, CFN_TEMPLATE_URL_LIMIT as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, DynamicReferenceRegionAmbiguousError as Ca, AssetManifestLoader as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, LockError as Da, getDefaultStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, LocalStartServiceError as Ea, synthesisStatusMessage as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, StackTerminationProtectionError as Fa, resolveUseCdkBootstrapAssets as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, isTransientServerError as Ga, injectiveKey as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isMarkedNonRetryable as Ha, findLargeInlineResources as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, StateError as Ia, stateBucketExistenceConfirmed as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, retryClassificationText as Ja, producerRecordKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, markNonRetryable as Ka, injectiveKeyPrefix as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, SynthesisError as La, warnDeprecatedNoPrefixCliFlag as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, ResourceTimeoutError as Ma, resolveSkipPrefix as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, ResourceUpdateNotSupportedError as Na, resolveStateBucketWithDefault as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, MalformedProducerRecordRefusalError as Oa, getLegacyStateBucketName as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StackHasActiveImportsError as Pa, resolveStateBucketWithDefaultAndSource as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, canonicalizeRegion as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, formatError as Ra, ssmResolvedValueType as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, DeployCancelledError as Sa, stripControlChars as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LocalInvokeBuildError as Ta, Synthesizer as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isRetryableTransientError as Ua, uploadCfnTemplate as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, withErrorHandling as Va, MIGRATE_TMP_PREFIX as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isThrottlingError as Wa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, safeStringify$1 as Xa, expectedOwnerParam as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, describeAwsFailure as Ya, decodeListingKey as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, __exportAll as Za, PARTITION_TABLE as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AssetError as _a, partitionSensitiveEnv as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, hasPlainPrototype$1 as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, CrossAccountSecretRefusalError as ba, runDockerStreaming as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, absoluteAssemblyPathEscape as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, clearBucketRegionCache as da, describeDockerCapturedOutput as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, AssemblyReader as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, resolveBucketRegion as fa, describeDockerExecFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, setAwsClients as ga, getDockerCmd as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resetAwsClients as ha, formatDockerLoginError as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasOwnKey as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ProvisioningError as ja, resolveCaptureObservedState as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, NestedStackChildDirectDestroyError as ka, resolveApp as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, renderAssemblyPathEscape as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, getAwsClients as ma, dockerSpawnEnvWithSensitive as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, processStackMessages as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, nullPrototypeRecord as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, AwsClients as pa, describeDockerFailure as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, markRedactedCause as qa, producerCoordinateKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, defineOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, ownValue as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, failedStageNote as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveAssemblyPath as ua, warnManifestExecutable as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CdkdError as va, redactDockerArgvValues as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, IntrinsicResolutionRefusalError as wa, getDockerImageBySourceHash as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DependencyError as xa, escapeRegExp$1 as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, ConfigError as ya, runDockerForeground as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, isCdkdError as za, CFN_TEMPLATE_BODY_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-9CxYEFh_.js.map