@go-to-k/cdkd 0.290.5 → 0.290.7

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BBIkp8ja.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-XcHj8rQZ.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-D30EPjOn.js");
+	const { buildProgram } = await import("./program-Ckl60p0E.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-WFO9o9M0.js → deploy-engine-BMp4b4Vl.js}

@@ -1,6 +1,6 @@
 import { b as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BBIkp8ja.js";
+import { t as getCdkdVersion } from "./version-XcHj8rQZ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7218,6 +7218,94 @@ function describeDockerFailure(error, args) {
 	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify(error), args);
 }
 /**
+* A `cause` that is safe to CHAIN onto a wrapper error, for a caller that
+* wants the retry classifiers to see the failure as an object rather than as
+* an interpolated string (issue go-to-k/cdkd#2075).
+*
+* Attaching the raw `execFile` error reopens the channel go-to-k/cdkd#2440
+* closed. The mandate above applies to every docker failure text this module
+* hands out, "including one whose argv carries no user data today" — and a
+* chained cause IS such a text: `formatError` prints `cause.message`, and the
+* CLI's top-level handler walks the whole chain. The raw message is the
+* command line, so the moment an argv gains a `-e` or a `--build-arg` the
+* secret is in a printed line again, from a call site nobody re-reads.
+*
+* So the returned cause carries the REDACTED description as its message, and
+* chains nothing further. What the classifiers read is copied across — but
+* through an ALLOWLIST ({@link CLASSIFICATION_FIELDS}), never by sweeping the
+* original's own keys.
+*
+* The allowlist is the whole point, and a denylist was the first cut: it
+* skipped `message` / `stack` / `cause` and copied the rest, which carried
+* `err.cmd` — the full command line — onto the new error verbatim. That is
+* the SAME field that defeated four rounds of the go-to-k/cdkd#2440 fence
+* (`.claude/rules/docker-argv-redaction.md`), reintroduced inside the function
+* written to close it. `stderr` / `stdout` are excluded for the same reason:
+* the composer above has already read and REDACTED them into the message, so
+* copying the raw streams would hand back exactly what it removed.
+*
+* Fail-closed is the correct direction here for the reason the cache-param
+* allowlist gives: a field missing from the allowlist costs one degraded retry
+* classification, while a field missing from a denylist costs a printed
+* credential.
+*/
+/**
+* The fields {@link redactedDockerCause} carries from the original error onto
+* the redacted one.
+*
+* WHAT EACH HALF IS FOR, stated precisely because an earlier revision of this
+* comment got it wrong in a way that reads as more than it is. The AWS-shaped
+* entries (`$metadata`, `$fault`, `__type`, `code`, `statusCode`) are what
+* `isThrottlingError` / `isTransientServerError` /
+* `describeRetryClassificationSignals` actually consult, and they are reachable
+* here only when an SDK error is the cause -- the ECR-login path, whose
+* `GetAuthorizationToken` failure can be one.
+*
+* `exitCode` is NOT read by any classifier. It is carried because it is the
+* ONLY field the DOMINANT failure has: these four sites reject through
+* `spawnStreaming`, whose `SpawnError` sets `stderr` / `stdout` / `exitCode`
+* and nothing else, so without it a non-zero docker exit produced a cause with
+* a name and a message and no other content at all. What that buys is the
+* DIAGNOSTIC -- `cli/index.ts` renders the chain's own enumerable props -- not
+* a retry decision. Do not restate it as a classification field.
+*
+* `stderr` / `stdout` stay OFF: the composer has already read and REDACTED
+* them into the message, so copying the raw streams would hand back exactly
+* what it removed.
+*/
+const CLASSIFICATION_FIELDS = [
+	"exitCode",
+	"code",
+	"errno",
+	"signal",
+	"status",
+	"statusCode",
+	"$metadata",
+	"$fault",
+	"__type"
+];
+function redactedDockerCause(error, args) {
+	if (!(error instanceof Error)) return void 0;
+	const cause = new Error(describeDockerFailure(error, args));
+	try {
+		cause.name = error.name;
+	} catch {}
+	const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
+	try {
+		if (error[NON_RETRYABLE_MARKER] === true) Object.defineProperty(cause, NON_RETRYABLE_MARKER, {
+			value: true,
+			enumerable: false,
+			configurable: true
+		});
+	} catch {}
+	const source = error;
+	const target = cause;
+	for (const key of CLASSIFICATION_FIELDS) try {
+		if (key in source) target[key] = source[key];
+	} catch {}
+	return cause;
+}
+/**
 * Composer for a captured-output failure where the diagnostic may be on
 * STDOUT rather than stderr (`runDockerStreaming`'s non-zero-exit path, whose
 * `SpawnError` carries both). `fallback` is used when neither stream said
@@ -7474,7 +7562,12 @@ var DockerAssetPublisher = class {
 			try {
 				await this.tagImage(actualTag, tag);
 			} catch (err) {
-				throw new AssetError(`Docker tag failed re-tagging '${actualTag}' → '${tag}': ${err.message ?? String(err)}`);
+				const e = err;
+				throw new AssetError(`Docker tag failed re-tagging '${actualTag}' → '${tag}': ${e.message ?? String(err)}`, e.cause instanceof Error ? e.cause : redactedDockerCause(err, [
+					"tag",
+					actualTag,
+					tag
+				]));
 			}
 		}
 	}
@@ -7549,7 +7642,7 @@ var DockerAssetPublisher = class {
 			await runDockerStreaming(loginArgs, { input: password });
 			loggedInRegistries.add(registryKey);
 		} catch (err) {
-			throw new AssetError(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`);
+			throw new AssetError(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`, redactedDockerCause(err, loginArgs));
 		}
 	}
 	/**
@@ -7564,7 +7657,7 @@ var DockerAssetPublisher = class {
 		try {
 			await runDockerStreaming(tagArgs);
 		} catch (err) {
-			throw new AssetError(`Docker tag failed: ${describeDockerFailure(err, tagArgs)}`);
+			throw new AssetError(`Docker tag failed: ${describeDockerFailure(err, tagArgs)}`, redactedDockerCause(err, tagArgs));
 		}
 	}
 	/**
@@ -7578,7 +7671,7 @@ var DockerAssetPublisher = class {
 		try {
 			await runDockerStreaming(pushArgs);
 		} catch (err) {
-			throw new AssetError(`Docker push failed: ${describeDockerFailure(err, pushArgs)}`);
+			throw new AssetError(`Docker push failed: ${describeDockerFailure(err, pushArgs)}`, redactedDockerCause(err, pushArgs));
 		}
 	}
 	/**
@@ -9679,7 +9772,7 @@ var S3StateBackend = class {
 			}));
 		} catch (error) {
 			const name = error.name;
-			if (name === "NotFound" || name === "NoSuchBucket") throw new StateError(`State bucket '${this.config.bucket}' does not exist. Run 'cdkd bootstrap' to create it, or specify an existing bucket via --state-bucket, CDKD_STATE_BUCKET, or cdk.json context.cdkd.stateBucket.`);
+			if (name === "NotFound" || name === "NoSuchBucket") throw new StateError(`State bucket '${this.config.bucket}' does not exist. Run 'cdkd bootstrap' to create it, or specify an existing bucket via --state-bucket, CDKD_STATE_BUCKET, or cdk.json context.cdkd.stateBucket.`, error instanceof Error ? error : void 0);
 			const normalized = normalizeAwsError(error, {
 				bucket: this.config.bucket,
 				operation: "HeadBucket"
@@ -9811,7 +9904,7 @@ var S3StateBackend = class {
 			}
 			return response.ETag;
 		} catch (error) {
-			if (error.name === "PreconditionFailed") throw new StateError(`State has been modified by another process. Expected ETag: ${expectedEtag}, but state has changed.`);
+			if (error.name === "PreconditionFailed") throw new StateError(`State has been modified by another process. Expected ETag: ${expectedEtag}, but state has changed.`, error instanceof Error ? error : void 0);
 			const normalized = normalizeAwsError(error, {
 				bucket: this.config.bucket,
 				operation: "PutObject"
@@ -18099,6 +18192,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["MultiRegionConsistency", "not yet implemented by cdkd"],
 			["ReadOnDemandThroughputSettings", "not yet implemented by cdkd"],
 			["ReadProvisionedThroughputSettings", "not yet implemented by cdkd"],
+			["VectorIndexes", "not yet implemented by cdkd"],
 			["WarmThroughput", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
@@ -18125,7 +18219,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TimeToLiveSpecification",
 			"WarmThroughput"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]]),
+		silentDrop: /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"], ["VectorIndexes", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["ImportSourceSpecification"])
 	}],
 	["AWS::EC2::EIP", {
@@ -23363,15 +23457,19 @@ function withoutProducerRegions(context) {
 }
 /**
 * Masked log twins registered this pass, per pass bag (issue #3100;
-* `rememberLogTwin` / `logTwinOfProduct`). Log-only: nothing that resolves or
-* persists a value reads it.
+* `rememberLogTwin` / `logTwinOfProduct`). Nothing that RESOLVES a value reads
+* it. One persistence decision does: `resolveBase64` registers its encoding
+* mask-only when the input's position mask fires (issue #3119), which a nested
+* child also reaches through the inherited-bag lookup (issue #3114).
 *
 * MODULE scope, not instance scope: a region-pinned sibling resolver
 * (`resolverForProducerRegion`) resolves on behalf of the consumer with the
 * consumer's bag, so an instance-local registry left the sibling's twin where
 * the consumer's `Fn::Join` / `Fn::Sub` never looked. The key is still the
-* pass's own bag object, so scope does not widen: another pass holds another
-* bag and cannot reach these entries, and they die with the bag.
+* pass's own bag object, so scope does not widen to unrelated passes: a pass
+* reaches only the entries under its own bag and under the bag it was handed
+* as `inheritedSecrets` (a nested-stack child reading its parent's, issue
+* #3114), and the entries die with the bag.
 */
 const LOG_TWINS_BY_PASS = /* @__PURE__ */ new WeakMap();
 /**
@@ -24723,6 +24821,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveParameters(template, userParameters, options) {
 		const inheritedSecrets = options?.inheritedSecrets;
 		const maskInherited = (text) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(text, inheritedSecrets) : text;
+		const inheritedLogContext = {
+			template,
+			resources: {},
+			...inheritedSecrets && { inheritedSecrets }
+		};
 		const parameters = Object.create(null);
 		const templateParameters = template.Parameters;
 		if (!templateParameters || typeof templateParameters !== "object") return parameters;
@@ -24735,7 +24838,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (userValue !== void 0) {
 					this.refuseCoercedInheritedSecret(name, paramDef, userValue, inheritedSecrets);
 					parameters[name] = this.coerceParameterValue(userValue, paramDef.Type);
-					this.logger.debug(`Parameter ${name}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, userValue))}`);
+					this.logger.debug(`Parameter ${name}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, this.maskValueLeaves(userValue, inheritedLogContext)))}`);
 					continue;
 				}
 			}
@@ -25064,7 +25167,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const value = context.parameters[logicalId];
 			const declared = context.template.Parameters;
 			const paramDef = declared != null && Object.hasOwn(declared, logicalId) ? declared[logicalId] : void 0;
-			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.maskSecretsForLog(stringifyParameterForLog(paramDef, value), context)}`);
+			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.maskSecretsForLog(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context)}`);
 			this.recordInheritedParameterSecrets(logicalId, value, context);
 			return value;
 		}
@@ -25237,10 +25340,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
-					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, nameServers), context)}`);
+					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, flatValue), context)}`);
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
 				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
@@ -25253,7 +25356,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, cursor), context)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
@@ -25263,7 +25366,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(attributeName.slice(8), context)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, value), context)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
 		return value;
 	}
 	/**
@@ -25955,7 +26058,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const literalList = Array.isArray(rawValues);
 		const parts = (await allSettledKeepingFirstRejection(values.map(async (v) => {
 			if (typeof v === "string") return {
-				...v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, v, context) : {
+				...v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, this.logTwinOfProduct({
+					result: v,
+					twin: v
+				}, context).twin, context) : {
 					result: v,
 					twin: v
 				},
@@ -27277,8 +27383,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* pass is masked too: the over-masking direction `logTwinOfProduct` accepts.
 	*/
 	splitLogTwins(value, delimiter, pieces, context) {
-		const bag = this.logTwinBag(context);
-		const sourceTwin = this.isRecordedSecretForLog(value, context) ? "***" : bag ? LOG_TWINS_BY_PASS.get(bag)?.get(value) : void 0;
+		const sourceTwin = this.isRecordedSecretForLog(value, context) ? "***" : this.registeredLogTwin(value, context);
 		if (sourceTwin === void 0) return pieces;
 		const twinPieces = sourceTwin.split(delimiter);
 		const aligned = twinPieces.length === pieces.length && !"***".includes(delimiter);
@@ -27332,6 +27437,48 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return context?.recordedSecretValues ?? context?.inheritedSecrets;
 	}
 	/**
+	* The masked twin registered for `value`, looked up under the pass's OWN bag
+	* and under the INHERITED one (issue
+	* [#3114](https://github.com/go-to-k/cdkd/issues/3114)). A nested-stack
+	* child receives, as `inheritedSecrets`, the very object its parent resolved
+	* the `AWS::CloudFormation::Stack` resource with: the deploy engine binds the
+	* resource context's `recordedSecretValues` as the resource's secrets, and
+	* `NestedStackProvider` hands that binding to the child. So a parameter value
+	* the parent built around a short secret (`port:q7` -> `port:***`) is
+	* registered under the child's inherited bag, while the child registers its
+	* own writes under its own bag. Two DIFFERENT registered twins mask the
+	* whole string, the rule `rememberLogTwin` applies within one bag. Lookups
+	* only: `rememberLogTwin` still registers under `logTwinBag`, the context's
+	* own `recordedSecretValues` whenever it carries one (every context
+	* `buildResolverContext` returns does; the log-only context
+	* `resolveParameters` builds carries none, and nothing on that path
+	* registers), so such a child never writes into its parent's registry. A
+	* context with ONLY an inherited bag registers into that bag, as it did
+	* before this lookup existed.
+	*
+	* ONE LEVEL ONLY. The bag a child hands its own nested stack is the child's
+	* OWN resource bag, so no twin registered ABOVE the child is reachable from a
+	* grandchild. Where the middle stack passes the value THROUGH
+	* (`{ Ref: Param }` straight into the grandchild's `Parameters`) nothing ever
+	* registers a twin in that bag, so the grandchild prints the value whether or
+	* not the bag holds pairs. Where the middle RE-WRAPS it (an `Fn::Join` around
+	* the `Ref`) the middle registers its own twin, and the hand-off still drops
+	* a bag holding no pairs (it passes `inheritedSecrets` only when `size` is
+	* nonzero). Both are issue #3156.
+	*
+	* The registry is keyed by VALUE, and `splitLogTwins`' unaligned arm
+	* registers every piece, public ones included. So a child `Fn::Base64` over a
+	* string exactly equal to such a piece of its parent's persists `***` for a
+	* non-secret property, the over-masking hazard issue #3119 already accepts
+	* within one pass, now reachable across the parent / child boundary.
+	*/
+	registeredLogTwin(value, context) {
+		const own = context?.recordedSecretValues ? LOG_TWINS_BY_PASS.get(context.recordedSecretValues)?.get(value) : void 0;
+		const inherited = context?.inheritedSecrets ? LOG_TWINS_BY_PASS.get(context.inheritedSecrets)?.get(value) : void 0;
+		if (own === void 0) return inherited;
+		return inherited === void 0 || inherited === own ? own : "***";
+	}
+	/**
 	* The log twin of a RESOLUTION PRODUCT — an intrinsic part, variable or
 	* placeholder — for issue #3100. Masked whole when its value is a recorded
 	* secret. Otherwise a part that carries no mask of its own takes the masked
@@ -27359,8 +27506,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			result: part.result,
 			twin: "***"
 		};
-		const bag = this.logTwinBag(context);
-		const registered = bag ? LOG_TWINS_BY_PASS.get(bag)?.get(part.result) : void 0;
+		const registered = this.registeredLogTwin(part.result, context);
 		if (registered === void 0 || registered === part.twin) return part;
 		return {
 			result: part.result,
@@ -27374,7 +27520,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* two DIFFERENT masked twins for one string register `***` for the whole
 	* string, since their spans cannot be merged. Scoped to the pass's bag
 	* through a `WeakMap`, like the cross-stack associations, so it dies with
-	* the bag and another pass's strings cannot be reached.
+	* the bag. An unrelated pass cannot reach these strings; a nested child
+	* whose `inheritedSecrets` is this bag reads them (`registeredLogTwin`).
 	*/
 	rememberLogTwin(context, result, twin) {
 		if (twin === result) return;
@@ -29149,7 +29296,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DU7mN-cS.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-JRuQeFtl.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -41849,4 +41996,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretSafeKeyDisplay as $, isCrossRegionRedirect as $n, CdkdError as $r, applyRoleArnIfSet as $t, planOrphanAdoption as A, forceQuitRecoveryClause as An, resolveStateBucketWithDefaultAndSource as Ar, isSettledInstanceState as At, formatResourceLine as B, shouldRetainResource as Bn, expectedOwnerParam as Br, readConfigString as Bt, createPreDeleteFinalSnapshot as C, isRetryableTransientError as Ci, redactSecretsForState as Cn, getDefaultStateBucketName as Cr, cfnRefValueFromPhysicalId as Ct, makeCanonicalizePropertiesFn as D, markRedactedCause as Di, rebuildClientForBucketRegion as Dn, resolveCaptureObservedState as Dr, isUnboundTemplateParameter as Dt, unsupportedFinalSnapshotError as E, markNonRetryable as Ei, S3StateBackend as En, resolveAutoAssetStorage as Er, isImpossibleEmptyStoredAttribute as Et, WARM_THROUGHPUT_MEMBERS as F, exportNamesCarriedFrom as Fn, CFN_TEMPLATE_URL_LIMIT as Fr, coerceCfnBoolean as Ft, red as G, createAssetRedirectResolver as Gn, processStackMessages as Gr, classifyReplaySecretRegion as Gt, cyan as H, stringifyValue as Hn, canonicalizeRegion as Hr, requireConfigArray as Ht, coerceWarmThroughput as I, importableOutputKeys as In, MIGRATE_TMP_PREFIX as Ir, coerceCfnInteger as It, collectPublishedOutputNames as J, AssetModeResolver as Jn, AwsClients as Jr, s3BucketArn as Jt, yellow as K, loadPublishableAssetManifest as Kn, clearBucketRegionCache as Kr, producerRegionsFromState as Kt, isWarmThroughputDecrease as L, importableOutputs as Ln, findLargeInlineResources as Lr, configBooleanRefusal as Lt, isStatefulRecreateTargetForReplace as M, shellQuote as Mn, stateBucketExistenceConfirmed as Mr, normalizeAwsTagsToCfn as Mt, isStatefulRecreateTargetSync as N, CUSTOM_RESOURCE_RESPONSE_PREFIX as Nn, warnDeprecatedNoPrefixCliFlag as Nr, resolveExplicitPhysicalId as Nt, extractDeploymentEventError as O, retryClassificationText as Oi, buildForceUnlockCommand as On, resolveSkipPrefix as Or, parameterTypeMayLoseSecretIdentity as Ot, renderStatefulReason as P, DEFAULT_STATE_PREFIX as Pn, CFN_TEMPLATE_BODY_LIMIT as Pr, assertRegionMatch as Pt, secretBearingStateKeyWarning as Q, getBootstrapMarkerKey as Qn, AssetError as Qr, s3BucketWebsiteUrl as Qt, toCfnInteger as R, orphansAfterRollback as Rn, uploadCfnTemplate as Rr, configIntegerRefusal as Rt, ccRoutedFinalSnapshotError as S, isMarkedNonRetryable as Si, recoverMaskedOutput as Sn, synthesisStatusMessage as Sr, carriesDynamicReference as St, refusesFinalSnapshot as T, isTransientServerError as Ti, LockManager as Tn, resolveApp as Tr, getAccountInfo as Tt, gray as U, WorkGraph as Un, derivePartitionAndUrlSuffix as Ur, requireConfigObject as Ut, bold as V, AssetPublisher as Vn, PARTITION_TABLE as Vr, replayWarn as Vt, green as W, buildAssetRedirectMap as Wn, AssemblyReader as Wr, requireConfigString as Wt, isExportAliasCollision as X, assertAssetBucketRegion as Xn, resetAwsClients as Xr, s3BucketDualStackDomainName as Xt, exportAliasCollisionScrubWarning as Y, BOOTSTRAP_MARKER_PREFIX as Yn, getAwsClients as Yr, s3BucketDomainName as Yt, secretBearing as Z, ensureAssetStorage as Zn, setAwsClients as Zr, s3BucketRegionalDomainName as Zt, isSecretBearingReferenceString as _, SynthesisError as _i, isSingleDynamicReferenceToken as _n, escapeRegExp$1 as _r, deleteIndeterminateGuards as _t, DeploymentEventsStore as a, IntrinsicResolutionRefusalError as ai, withRetry as an, describeAwsFailure as ar, wouldReturnToSdkProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, normalizeAwsError as bi, maskSecretsInText as bn, getDockerImageBySourceHash as br, isTerminationProtectionPropagationError as bt, replayFailedOperations as c, LockError as ci, STATE_SOURCED_BASELINE_RULES as cn, describeDockerExecFailure as cr, maskerOrIdentity as ct, updatePartialReason as d, ProvisioningError as di, TEMPLATE_SOURCED_RULES as dn, formatDockerLoginError as dr, interruptWatchListenerCount as dt, ConfigError as ei, DiffCalculator as en, parseBootstrapMarker as er, getCurrentResourceSecrets as et, withResourceDeadline as f, ResourceTimeoutError as fi, carriesSecretMask as fn, getDockerCmd as fr, isInterruptedWaitError as ft, bagHoldsSecretExpression as g, StateError as gi, identityKeyFor as gn, runDockerStreaming as gr, UNSPECIFIED_SKIP_REASON as gt, computeImplicitDeleteEdges as h, StackTerminationProtectionError as hi, errorCauseChain as hn, runDockerForeground as hr, slowCcOperationTimeoutMs as ht, DeploymentEventsReader as i, DynamicReferenceRegionAmbiguousError as ii, describeTypeWithThrottleRetry as in, buildDenyExternalAccessPolicy as ir, ProviderRegistry as it, MULTI_REGION_RECREATE_BLOCKED_TYPES as j, formatLockExpiry as jn, resolveUseCdkBootstrapAssets as jr, WAFv2WebACLProvider as jt, makeSiblingClaimReader as k, __exportAll as ki, buildLockContentionMessage as kn, resolveStateBucketWithDefault as kr, refStateLookupFromResource as kt, replayRollback as l, NestedStackChildDirectDestroyError as li, STATE_SOURCED_CROSS_GENERATION_RULES as ln, describeDockerFailure as lr, beginCommandInterruptScope as lt, IMPLICIT_DELETE_DEPENDENCIES as m, StackHasActiveImportsError as mi, dynamicReferenceTokens as mn, redactDockerArgvValues as mr, CloudControlProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DependencyError as ni, findActionableSilentDrops as nn, validateAssetBucketName as nr, collectInlinePolicyNamesManagedBySiblings as nt, planFailedOps as o, LocalInvokeBuildError as oi, DagBuilder as on, buildDockerImage as or, createMaskedRetryLogger as ot, maskingRetryLogger as p, ResourceUpdateNotSupportedError as pi, createSecretMasker as pn, partitionSensitiveEnv as pr, startInterruptWatch as pt, collectDeclaredOutputNames as q, rewriteTemplateAssetReferences as qn, resolveBucketRegion as qr, withSharedDrainBudget as qt, DeployEngine as r, DeployCancelledError as ri, findSilentDropProperties as rn, validateContainerRepoName as rr, clearOnUpdateRemoval as rt, planRollback as s, LocalStartServiceError as si, TemplateParser as sn, describeDockerCapturedOutput as sr, maskDeep as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CrossAccountSecretRefusalError as ti, INTRINSIC_KEYS as tn, readBootstrapMarkerBody as tr, IAMRoleProvider as tt, updatePartialMessage as u, PartialFailureError as ui, STATE_SOURCED_READBACK_RULES as un, dockerSpawnEnvWithSensitive as ur, endCommandInterruptScope as ut, bindingSkippedOutputs as v, formatError as vi, markSameGenerationBag as vn, stripControlChars as vr, deleteSkipReason as vt, isFinalSnapshotError as w, isThrottlingError as wi, scrubResourceRecord as wn, getLegacyStateBucketName as wr, coerceParameterTypedValue as wt, buildFinalSnapshotIdentifier as x, withErrorHandling as xi, recordMaskOnlyValue as xn, Synthesizer as xr, IntrinsicFunctionResolver as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, isCdkdError as yi, maskSecretsInError as yn, AssetManifestLoader as yr, disableInstanceApiTermination as yt, toFiniteNumber as z, orphansCarriedFrom as zn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as zr, configStringRefusal as zt };
-//# sourceMappingURL=deploy-engine-WFO9o9M0.js.map
+//# sourceMappingURL=deploy-engine-BMp4b4Vl.js.map