@go-to-k/cdkd 0.291.10 → 0.291.11

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-5OUy_OlQ.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CuVd0lOr.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-BfCsjuyU.js");
+	const { buildProgram } = await import("./program-Buh8Yn40.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-BomFOZF4.js → deploy-engine-D4svwrnK.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-5OUy_OlQ.js";
+import { t as getCdkdVersion } from "./version-CuVd0lOr.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -8383,6 +8383,70 @@ function dockerSpawnEnvWithSensitive(sensitiveEnv) {
 	}
 	return env;
 }
+/**
+* The env var that accepts, while it is set, that a container client puts secret
+* VALUES on a process command line ({@link finchSecretArgvRefusal}). Only `1`
+* or `true` (any case) opts in.
+*/
+const ALLOW_SECRETS_ON_ARGV_ENV = "CDKD_ALLOW_SECRETS_ON_ARGV";
+/**
+* Is the container client finch running its Lima VM (macOS / Windows)? There
+* the value-less `-e KEY` that {@link partitionSensitiveEnv} emits does NOT
+* keep the value off argv (#3600): finch's `handleEnv` resolves each bare
+* `KEY` against its own environment and re-emits `-e KEY=<value>` on the argv
+* of the `limactl shell finch sudo -E nerdctl ...` child, and `--env-file` is
+* read on the host and re-emitted the same way (runfinch/finch
+* `cmd/finch/nerdctl_remote.go`, `handleEnv` / `handleEnvFile` and the
+* `envArgs` rebuild). Its `passedEnvs` list also puts `AWS_ACCESS_KEY_ID` /
+* `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` from its environment on that
+* argv for every command. finch on Linux passes the argv to nerdctl unchanged
+* and is NOT matched.
+*
+* Detection is by the BASENAME of the resolved binary (`finch`, `finch.exe`,
+* any case): a wrapper script or a symlink under another name is not
+* recognised, and neither is Lima's own `nerdctl.lima`.
+*/
+function isFinchVmClient(cmd = getDockerCmd(), platform = process.platform) {
+	if (platform !== "darwin" && platform !== "win32") return false;
+	const base = (cmd.split(/[\\/]/).pop() ?? "").toLowerCase();
+	return base === "finch" || base === "finch.exe";
+}
+function secretsOnArgvAllowed() {
+	const v = process.env[ALLOW_SECRETS_ON_ARGV_ENV];
+	return v !== void 0 && ["1", "true"].includes(v.trim().toLowerCase());
+}
+/**
+* The refusal text when template-sourced secrets (ECS `Secrets`, decrypted
+* SecureString parameters) would be forwarded under {@link isFinchVmClient},
+* or `undefined` when they may be forwarded: another client, no such secret,
+* or {@link ALLOW_SECRETS_ON_ARGV_ENV} set. The caller throws it in its own
+* error class BEFORE any `docker run`. The AWS credential set is not refused
+* here (it is warned about by {@link warnFinchArgvExposure}): finch already
+* puts the operator's own credentials on that argv by design, so refusing them
+* would only disable finch without changing the operator's exposure.
+* `subject` is caller-rendered context (e.g. the container name) and is not
+* sanitized here.
+*/
+function finchSecretArgvRefusal(secretNames, subject) {
+	if (secretNames.length === 0 || !isFinchVmClient() || secretsOnArgvAllowed()) return void 0;
+	return `${subject}: refusing to forward secret(s) ${[...new Set(secretNames)].map((k) => displayIdent(k)).join(", ")} under CDK_DOCKER=finch on macOS / Windows. finch turns each value-less '-e KEY' into '-e KEY=<value>' on the command line of the limactl process it starts, where other local processes can read the plaintext. Use a container client that keeps the value off the command line (Docker, podman, nerdctl, or finch on Linux), or set ${ALLOW_SECRETS_ON_ARGV_ENV}=1 to accept that exposure while it stays set.`;
+}
+/** Key sets already warned about by {@link warnFinchArgvExposure} in this process. */
+const finchArgvWarned = /* @__PURE__ */ new Set();
+/**
+* Warn, once per process per distinct key set, that under
+* {@link isFinchVmClient} the values of `keys` (the sensitive env about to be
+* forwarded as value-less `-e KEY`) reach the `limactl` command line. Names
+* only, never a value.
+*/
+function warnFinchArgvExposure(keys) {
+	if (keys.length === 0 || !isFinchVmClient()) return;
+	const names = [...new Set(keys)].sort();
+	const latch = JSON.stringify(names);
+	if (finchArgvWarned.has(latch)) return;
+	finchArgvWarned.add(latch);
+	getLogger().warn(`CDK_DOCKER=finch on macOS / Windows puts the values of ${names.map((k) => displayIdent(k)).join(", ")} on the command line of the limactl process it starts (finch turns a value-less '-e KEY' into '-e KEY=<value>'), where other local processes can read them. Docker, podman, nerdctl, or finch on Linux keep them off the command line.`);
+}
 function mergeEnv(overrides) {
 	const merged = { ...process.env };
 	for (const [k, v] of Object.entries(overrides)) if (v === void 0) delete merged[k];
@@ -36197,7 +36261,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BY-tj21g.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BDhrXE5Y.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -51554,5 +51618,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, markNonRetryable as $a, expectedOwnerParam as $i, repairMalformedResourcePropertiesForReadOnly as $n, AssetModeResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalInvokeBuildError as Aa, getDefaultStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StackTerminationProtectionError as Ba, warnDeprecatedNoPrefixCliFlag as Bi, refuseMalformedOrphansForDestroy as Bn, importableOutputKeys as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CdkdError as Ca, runDockerStreaming as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, UNSPECIFIED_SKIP_REASON as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DeployCancelledError as Da, getDockerImageBySourceHash as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DependencyError as Ea, AssetManifestLoader as Ei, malformedLocalOutputsWarning as En, LockManager as Er, isWaitAbandonedError as Et, extractDeploymentEventError as F, PartialFailureError as Fa, resolveSkipPrefix as Fi, malformedResourcesWarning as Fn, DEFAULT_STATE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, normalizeAwsError as Ga, findLargeInlineResources as Gi, refuseMalformedResourceEntries as Gn, shouldRetainResource as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, SynthesisError as Ha, CFN_TEMPLATE_BODY_LIMIT as Hi, refuseMalformedOutputs as Hn, isReadableBag as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ProvisioningError as Ia, resolveStateBucketWithDefault as Ii, malformedStateRefusalMessage as In, exportNamesCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, shellQuote as Ja, injectiveKey as Ji, refuseMalformedResourcesForDestroy as Jn, WorkGraph as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, withErrorHandling as Ka, uploadCfnTemplate as Ki, refuseMalformedResourceEntriesForOrphan as Kn, AssetPublisher as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceTimeoutError as La, resolveStateBucketWithDefaultAndSource as Li, refuseDivergentRecordRegionForDestroy as Ln, hasReadableExportSet as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, LockError as Ma, resolveApp as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MalformedProducerRecordRefusalError as Na, resolveAutoAssetStorage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, DynamicReferenceRegionAmbiguousError as Oa, Synthesizer as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, NestedStackChildDirectDestroyError as Pa, resolveCaptureObservedState as Pi, malformedResourcePropertiesWarning as Pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Pr, getAccountInfo as Pt, red as Q, isTransientServerError as Qa, decodeListingKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, rewriteTemplateAssetReferences as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, ResourceUpdateNotSupportedError as Ra, resolveUseCdkBootstrapAssets as Ri, refuseMalformedNestedChildOutputs as Rn, hasReasonlessBaselineRefusal as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, AssetError as Sa, runDockerForeground as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, CrossAccountSecretRefusalError as Ta, stripControlChars as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteSkipReason as Tt, coerceWarmThroughput as U, formatError as Ua, CFN_TEMPLATE_URL_LIMIT as Ui, refuseMalformedOutputsForDestroy as Un, orphansAfterRollback as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, StateError as Va, ssmResolvedValueType as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputs as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isCdkdError as Wa, MIGRATE_TMP_PREFIX as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansCarriedFrom as Wr, assertRegionMatch as Wt, gray as X, isRetryableTransientError as Xa, producerCoordinateKey as Xi, repairMalformedOrphansForReadOnly as Xn, createAssetRedirectResolver as Xr, readConfigString as Xt, cyan as Y, isMarkedNonRetryable as Ya, injectiveKeyPrefix as Yi, refuseMalformedState as Yn, buildAssetRedirectMap as Yr, configStringRefusal as Yt, green as Z, isThrottlingError as Za, producerRecordKey as Zi, repairMalformedOutputsForReadOnly as Zn, loadPublishableAssetManifest as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AwsClients as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, globMatches as aa, parseBootstrapMarker as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, runWithStackAwsClients as ba, partitionSensitiveEnv as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasOwnKey as ca, validateContainerRepoName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, ownValue as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, PARTITION_TABLE as ea, BOOTSTRAP_MARKER_PREFIX as ei, requireConfigString as en, markRedactedCause as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, absoluteAssemblyPathEscape as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, resolveBucketRegion as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, clearBucketRegionCache as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, failedStageNote as ia, isCrossRegionRedirect as ii, s3BucketArn as in, __exportAll as io, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LocalStartServiceError as ja, getLegacyStateBucketName as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, IntrinsicResolutionRefusalError as ka, synthesisStatusMessage as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, hasPlainPrototype$1 as la, buildDenyExternalAccessPolicy as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resolveAssemblyPath as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, derivePartitionAndUrlSuffix as na, ensureAssetStorage as ni, producerRegionsFromState as nn, describeAwsFailure as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, processStackMessages as oa, readBootstrapMarkerBody as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, renderAssemblyPathEscape as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, pasteableCommand as qa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as qi, refuseMalformedResourcePropertiesForOrphan as qn, stringifyValue as qr, configBooleanRefusal as qt, DeployEngine as r, AssemblyReader as ra, getBootstrapMarkerKey as ri, withSharedDrainBudget as rn, safeStringify$1 as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, defineOwnKey as sa, validateAssetBucketName as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, canonicalizeRegion as ta, assertAssetBucketRegion as ti, classifyReplaySecretRegion as tn, retryClassificationText as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, nullPrototypeRecord as ua, assertCdkLocalDockerContextContained as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, getAwsClients as va, formatDockerLoginError as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, ConfigError as wa, escapeRegExp$1 as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, deleteIndeterminateGuards as wt, bindingSkippedOutputs as x, setAwsClients as xa, redactDockerArgvValues as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, resetAwsClients as ya, getDockerCmd as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackHasActiveImportsError as za, stateBucketExistenceConfirmed as zi, refuseMalformedOrphans as zn, hasUnverifiableParameterRefusal as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-BomFOZF4.js.map
+export { yellow as $, isMarkedNonRetryable as $a, injectiveKeyPrefix as $i, repairMalformedResourcePropertiesForReadOnly as $n, AssetModeResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, DependencyError as Aa, AssetManifestLoader as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, ProvisioningError as Ba, resolveStateBucketWithDefault as Bi, refuseMalformedOrphansForDestroy as Bn, importableOutputKeys as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, resetAwsClients as Ca, partitionSensitiveEnv as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, UNSPECIFIED_SKIP_REASON as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, CdkdError as Da, warnFinchArgvExposure as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, AssetError as Ea, runDockerStreaming as Ei, malformedLocalOutputsWarning as En, LockManager as Er, isWaitAbandonedError as Et, extractDeploymentEventError as F, LocalStartServiceError as Fa, getLegacyStateBucketName as Fi, malformedResourcesWarning as Fn, DEFAULT_STATE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, StateError as Ga, ssmResolvedValueType as Gi, refuseMalformedResourceEntries as Gn, shouldRetainResource as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, ResourceUpdateNotSupportedError as Ha, resolveUseCdkBootstrapAssets as Hi, refuseMalformedOutputs as Hn, isReadableBag as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, LockError as Ia, resolveApp as Ii, malformedStateRefusalMessage as In, exportNamesCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, isCdkdError as Ja, MIGRATE_TMP_PREFIX as Ji, refuseMalformedResourcesForDestroy as Jn, WorkGraph as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, SynthesisError as Ka, CFN_TEMPLATE_BODY_LIMIT as Ki, refuseMalformedResourceEntriesForOrphan as Kn, AssetPublisher as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, MalformedProducerRecordRefusalError as La, resolveAutoAssetStorage as Li, refuseDivergentRecordRegionForDestroy as Ln, hasReadableExportSet as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, DynamicReferenceRegionAmbiguousError as Ma, Synthesizer as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, IntrinsicResolutionRefusalError as Na, synthesisStatusMessage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, ConfigError as Oa, escapeRegExp$1 as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, LocalInvokeBuildError as Pa, getDefaultStateBucketName as Pi, malformedResourcePropertiesWarning as Pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Pr, getAccountInfo as Pt, red as Q, shellQuote as Qa, injectiveKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, rewriteTemplateAssetReferences as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, NestedStackChildDirectDestroyError as Ra, resolveCaptureObservedState as Ri, refuseMalformedNestedChildOutputs as Rn, hasReasonlessBaselineRefusal as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, getAwsClients as Sa, isMalformedEnvKey as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, setAwsClients as Ta, runDockerForeground as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteSkipReason as Tt, coerceWarmThroughput as U, StackHasActiveImportsError as Ua, stateBucketExistenceConfirmed as Ui, refuseMalformedOutputsForDestroy as Un, orphansAfterRollback as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, ResourceTimeoutError as Va, resolveStateBucketWithDefaultAndSource as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputs as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, StackTerminationProtectionError as Wa, warnDeprecatedNoPrefixCliFlag as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansCarriedFrom as Wr, assertRegionMatch as Wt, gray as X, withErrorHandling as Xa, uploadCfnTemplate as Xi, repairMalformedOrphansForReadOnly as Xn, createAssetRedirectResolver as Xr, readConfigString as Xt, cyan as Y, normalizeAwsError as Ya, findLargeInlineResources as Yi, refuseMalformedState as Yn, buildAssetRedirectMap as Yr, configStringRefusal as Yt, green as Z, pasteableCommand as Za, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Zi, repairMalformedOutputsForReadOnly as Zn, loadPublishableAssetManifest as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, renderAssemblyPathEscape as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, canonicalizeRegion as aa, parseBootstrapMarker as ai, s3BucketDomainName as an, retryClassificationText as ao, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, resolveBucketRegion as ba, getDockerCmd as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, failedStageNote as ca, validateContainerRepoName as ci, s3BucketWebsiteUrl as cn, __exportAll as co, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, defineOwnKey as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, producerCoordinateKey as ea, BOOTSTRAP_MARKER_PREFIX as ei, requireConfigString as en, isRetryableTransientError as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, hasOwnKey as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, absoluteAssemblyPathEscape as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, ownValue as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, PARTITION_TABLE as ia, isCrossRegionRedirect as ii, s3BucketArn as in, markRedactedCause as io, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, DeployCancelledError as ja, getDockerImageBySourceHash as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, CrossAccountSecretRefusalError as ka, stripControlChars as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, globMatches as la, buildDenyExternalAccessPolicy as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, nullPrototypeRecord as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, decodeListingKey as na, ensureAssetStorage as ni, producerRegionsFromState as nn, isTransientServerError as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, derivePartitionAndUrlSuffix as oa, readBootstrapMarkerBody as oi, s3BucketDualStackDomainName as on, describeAwsFailure as oo, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, hasPlainPrototype$1 as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, formatError as qa, CFN_TEMPLATE_URL_LIMIT as qi, refuseMalformedResourcePropertiesForOrphan as qn, stringifyValue as qr, configBooleanRefusal as qt, DeployEngine as r, expectedOwnerParam as ra, getBootstrapMarkerKey as ri, withSharedDrainBudget as rn, markNonRetryable as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, AssemblyReader as sa, validateAssetBucketName as si, s3BucketRegionalDomainName as sn, safeStringify$1 as so, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, producerRecordKey as ta, assertAssetBucketRegion as ti, classifyReplaySecretRegion as tn, isThrottlingError as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, processStackMessages as ua, assertCdkLocalDockerContextContained as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, resolveAssemblyPath as va, finchSecretArgvRefusal as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, runWithStackAwsClients as wa, redactDockerArgvValues as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, deleteIndeterminateGuards as wt, bindingSkippedOutputs as x, AwsClients as xa, isDockerClientEnvKey as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, clearBucketRegionCache as ya, formatDockerLoginError as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, PartialFailureError as za, resolveSkipPrefix as zi, refuseMalformedOrphans as zn, hasUnverifiableParameterRefusal as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-D4svwrnK.js.map