@go-to-k/cdkd 0.291.13 → 0.291.14

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CqL2wd8C.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DHj4zq1f.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-azHUt9mf.js");
+	const { buildProgram } = await import("./program-D7aismcf.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-D8OVUEBp.js → deploy-engine-WVUZ-Jm8.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-CqL2wd8C.js";
+import { t as getCdkdVersion } from "./version-DHj4zq1f.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3583,7 +3583,7 @@ function collectStackMessages(assemblyDir, artifact) {
 	const merged = { ...artifact.metadata ?? {} };
 	if (artifact.additionalMetadataFile) {
 		const resolved = resolveAssemblyPath(assemblyDir, artifact.additionalMetadataFile);
-		if (!resolved.contained) throw new SynthesisError(`Stack metadata file '${displaySafe(artifact.additionalMetadataFile)}' ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+		if (!resolved.contained) throw new SynthesisError(`Stack metadata file ${displayAssemblyPath(artifact.additionalMetadataFile)} ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
 		const metadataPath = resolved.path;
 		let sideFile;
 		try {
@@ -3594,7 +3594,7 @@ function collectStackMessages(assemblyDir, artifact) {
 				merged[path] = [...merged[path] ?? [], ...entries];
 			}
 		} catch (error) {
-			throw new SynthesisError(`Failed to read stack metadata file ${displaySafe(metadataPath)}: ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
+			throw new SynthesisError(`Failed to read stack metadata file ${displayAssemblyPath(metadataPath)}: ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
 	}
 	const messages = [];
@@ -3964,7 +3964,7 @@ var AssemblyReader = class {
 			const props = artifact.properties;
 			if (props?.file) {
 				const resolved = resolveAssemblyPath(assemblyDir, props.file);
-				if (!resolved.contained) throw new SynthesisError(`Asset manifest artifact '${displaySafe(artifactId)}' has file='${displaySafe(props.file)}' which ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
+				if (!resolved.contained) throw new SynthesisError(`Asset manifest artifact '${displaySafe(artifactId)}' has file=${displayAssemblyPath(props.file)} which ${renderAssemblyPathEscape(resolved, assemblyDir)}`);
 				map.set(artifactId, resolved.path);
 			}
 		}
@@ -3979,7 +3979,7 @@ var AssemblyReader = class {
 		const templateFile = props?.templateFile;
 		if (!templateFile) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has no templateFile property`);
 		const resolvedTemplate = resolveAssemblyPath(assemblyDir, templateFile);
-		if (!resolvedTemplate.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has templateFile='${displaySafe(templateFile)}' which ${renderAssemblyPathEscape(resolvedTemplate, assemblyDir)}`);
+		if (!resolvedTemplate.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has templateFile=${displayAssemblyPath(templateFile)} which ${renderAssemblyPathEscape(resolvedTemplate, assemblyDir)}`);
 		const templatePath = resolvedTemplate.path;
 		let template;
 		try {
@@ -4013,9 +4013,9 @@ var AssemblyReader = class {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 			const assetPath = resource.Metadata?.["aws:asset:path"];
 			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 			const resolvedNested = resolveAssemblyPath(assemblyDir, assetPath);
-			if (!resolvedNested.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
+			if (!resolvedNested.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
 			nestedTemplates[logicalId] = resolvedNested.path;
 		}
 		return {
@@ -7452,7 +7452,7 @@ function setsEqual(a, b) {
 * synth` emits `source.path: "."`, so this costs a legitimate run nothing.
 */
 function warnWholeAssemblyAsSource(w) {
-	getLogger().child("assets").warn(`${w.subject} has ${w.field} naming the output directory ITSELF: '${displaySafe(w.outdir)}'. cdkd will ${w.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`);
+	getLogger().child("assets").warn(`${w.subject} has ${w.field} naming the output directory ITSELF: ${displayAssemblyPath(w.outdir)}. cdkd will ${w.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`);
 }
 /**
 * Emit it. Deliberately `warn`, never `throw`: the one producer of this shape
@@ -7460,7 +7460,7 @@ function warnWholeAssemblyAsSource(w) {
 * documented CDK CLI flag.
 */
 function warnAbsoluteAssetPath(w) {
-	getLogger().child("assets").warn(`${w.subject} has an absolute ${w.field} pointing outside the assembly: '${displaySafe(w.absolute)}'` + (w.escape.escape === "symlink" ? ` (through a symbolic link to '${displaySafe(w.escape.realPath)}')` : "") + `. cdkd will ${w.sink}. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted: an absolute source path is honoured as written, so nothing but this line stands between it and that step.`);
+	getLogger().child("assets").warn(`${w.subject} has an absolute ${w.field} pointing outside the assembly: ${displayAssemblyPath(w.absolute)}` + (w.escape.escape === "symlink" ? ` (through a symbolic link to ${displayAssemblyPath(w.escape.realPath)})` : "") + `. cdkd will ${w.sink}. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted: an absolute source path is honoured as written, so nothing but this line stands between it and that step.`);
 }
 
 //#endregion
@@ -7560,7 +7560,7 @@ function resolveFileAssetSourcePath(manifestDir, asset, opts) {
 		});
 		return resolved.path;
 	}
-	if (!resolved.contained) throw new Error(`File asset '${displaySafe(asset.displayName)}' has source.path='${displaySafe(asset.source.path)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
+	if (!resolved.contained) throw new Error(`File asset '${displaySafe(asset.displayName)}' has source.path=${displayAssemblyPath(asset.source.path)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "publish it")}`);
 	return resolved.path;
 }
 /**
@@ -9554,7 +9554,7 @@ function resolveDockerContextDirectory(opts) {
 		});
 		return resolved.path;
 	}
-	if (!resolved.contained) throw wrapError(`asset source.directory='${displaySafe(directory)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "build it")}`);
+	if (!resolved.contained) throw wrapError(`asset source.directory=${displayAssemblyPath(directory)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "build it")}`);
 	return resolved.path;
 }
 /** One spelling of the warning subject, so the two arms cannot drift. */
@@ -9598,7 +9598,7 @@ function assertCdkLocalDockerContextContained(opts) {
 	const bound = tryRealpathNative(assetOutdir) ?? resolve$1(assetOutdir);
 	const rel = relative(bound, physical);
 	if (rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute$1(rel)) return;
-	throw wrapError(`asset source.directory='${displaySafe(directory)}' which ` + renderAssemblyPathEscape({
+	throw wrapError(`asset source.directory=${displayAssemblyPath(directory)} which ` + renderAssemblyPathEscape({
 		contained: false,
 		escape: "symlink",
 		path: engineSpelled,
@@ -9680,7 +9680,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	});
 	buildArgs.push(".");
 	warnEscapingBuildKitPaths(source, contextDir, options.assetOutdir ?? cdkOutDir);
-	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displaySafe(contextDir)})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displayAssemblyPath(contextDir)})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
@@ -36326,7 +36326,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DsMCnbwS.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-EkJQ0mD9.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -42810,7 +42810,8 @@ const MIN_SECRET_NEEDLE = 4;
 * secret verbatim, and the remaining two printed it minus one character.
 *
 * So the fix is not another arm on the check — it is removing the second and
-* third string. Everything below happens in `canonicalForSecretScan` space.
+* third string. Everything below happens in {@link secretScanHaystacks} space:
+* one stripped string, and its trim for printing.
 *
 * THE CLASS IS DERIVED FROM UNICODE CATEGORIES, NOT ENUMERATED. A hand list
 * was written first -- both sanitisers' classes plus the four residuals
@@ -42872,15 +42873,49 @@ const MIN_SECRET_NEEDLE = 4;
 */
 const SECRET_SCAN_INVISIBLES = /[\p{Cc}\p{Cf}\p{Me}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/gu;
 /**
-* The one string space in which this module tests for, masks, and prints a
-* possibly-secret-bearing name.
+* A possibly-secret-bearing name as PRINTED: {@link secretScanHaystacks}'
+* untrimmed string, trimmed.
 *
 * `.trim()` mirrors `displaySafe`, whose trim this replaces on these paths. It
-* is applied to the TEXT only -- see {@link canonicalNeedle}, where trimming
-* would silently shorten a recorded secret.
+* shapes the printed text only; a containment test reads both haystacks, since
+* the trim can remove whitespace that belongs to a recorded secret.
 */
 function canonicalForSecretScan(text) {
-	return text.replace(SECRET_SCAN_INVISIBLES, "").trim();
+	return secretScanHaystacks(text)[0];
+}
+/**
+* The two haystacks every containment test on this path reads: `[trimmed,
+* untrimmed]`, both with the invisible class deleted (issue
+* [#2890](https://github.com/go-to-k/cdkd/issues/2890)).
+*
+* UNTRIMMED, because a recorded secret's own EDGE whitespace (`\p{Zs}`, which
+* the invisible class keeps) is part of the secret and can sit at the edge of
+* the key, where the trim removes it: a recorded `' a<ZWSP>bcd'` in the key
+* `' abcd-x'` matched no arm and printed `abcd-x`. TRIMMED, because the
+* whole-value arm has to see a key whose edge whitespace is NOT part of the
+* secret: `' ab '` is the sub-floor secret `ab`, and the untrimmed string does
+* not equal it. For the embedded arm the trimmed string adds nothing (it is a
+* substring of the untrimmed one); it is read anyway so the two arms walk one
+* list.
+*
+* WHY THIS PAIR CANNOT SPLIT THE VERDICT FROM THE PRINTED TEXT, the class
+* issue [#2874](https://github.com/go-to-k/cdkd/issues/2874) found. That bug
+* was three strings that could each hold a secret the others did not. These
+* two are one string and a trim of it: the trimmed one is a SUBSTRING of the
+* untrimmed one, and {@link secretSafeKeyDisplay} masks the UNTRIMMED string
+* and prints the trim of the result. Every verdict arm implies the canonical
+* needle occurs in that untrimmed string -- the raw arm too, since deleting
+* characters from a text containing the plaintext leaves the plaintext's own
+* deletion contiguous in it. So every occurrence a verdict can see is masked
+* before the trim, and the trim can only drop mask-free
+* whitespace from the ends -- it cannot join two characters, so it cannot
+* create an occurrence either. The post-mask re-test then reads the masked
+* untrimmed string, whose trimmed haystack IS the printed text, character for
+* character.
+*/
+function secretScanHaystacks(text) {
+	const untrimmed = text.replace(SECRET_SCAN_INVISIBLES, "");
+	return [untrimmed.trim(), untrimmed];
 }
 /**
 * A recorded secret as a NEEDLE in canonical space.
@@ -42944,12 +42979,12 @@ function canonicalNeedles(secrets) {
 */
 function secretsPresentIn(text, secrets) {
 	if (!secrets || secrets.size === 0) return void 0;
-	const haystack = canonicalForSecretScan(text);
+	const haystacks = secretScanHaystacks(text);
 	const exposure = /* @__PURE__ */ new Map();
 	for (const [plaintext, expression] of secrets) {
 		const needle = canonicalNeedle(plaintext);
-		const canonicalHit = haystack === needle || needle.length >= MIN_SECRET_NEEDLE && haystack.includes(needle);
-		const rawHit = text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext);
+		const canonicalHit = haystacks.some((haystack) => haystack === needle || needle.length >= MIN_SECRET_NEEDLE && haystack.includes(needle));
+		const rawHit = plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext);
 		if (canonicalHit || rawHit) exposure.set(plaintext, expression);
 	}
 	return exposure.size > 0 ? exposure : void 0;
@@ -43046,7 +43081,11 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets
 	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
 	const shown = name.kind === "masked" ? `(masked: "${name.text}") ` : "";
 	const ownerForceMask = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of exposure) if (plaintext === outputKey || canonicalNeedle(plaintext) === canonicalForSecretScan(outputKey) || plaintext.length >= MIN_SECRET_NEEDLE) ownerForceMask.set(plaintext, expression);
+	const ownerHaystacks = secretScanHaystacks(outputKey);
+	for (const [plaintext, expression] of exposure) {
+		const needle = canonicalNeedle(plaintext);
+		if (ownerHaystacks.some((haystack) => haystack === needle) || plaintext.length >= MIN_SECRET_NEEDLE) ownerForceMask.set(plaintext, expression);
+	}
 	return `Output ${displayTextOrWithheld(secretSafeKeyDisplay(outputKey, corpus, ownerForceMask))} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
 }
 /**
@@ -43069,7 +43108,7 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets
 * the class that replaced it and why it is derived rather than enumerated.
 */
 function secretSafeKeyDisplay(key, secrets, forceMask) {
-	const shown = canonicalForSecretScan(key);
+	const [shown, untrimmed] = secretScanHaystacks(key);
 	const exposure = stateKeySecretExposure(key, secrets);
 	const mask = canonicalNeedles(forceMask);
 	for (const [plaintext, expression] of exposure ?? []) {
@@ -43080,15 +43119,15 @@ function secretSafeKeyDisplay(key, secrets, forceMask) {
 		kind: "safe",
 		text: shown
 	};
-	const masked = maskEveryOccurrence(shown, mask);
-	if (masked === shown) return exposure ? { kind: "withheld" } : {
+	const masked = maskEveryOccurrence(untrimmed, mask);
+	if (masked === untrimmed) return exposure ? { kind: "withheld" } : {
 		kind: "safe",
 		text: shown
 	};
 	if (stateKeySecretExposure(masked, secrets)) return { kind: "withheld" };
 	return {
 		kind: "masked",
-		text: masked
+		text: canonicalForSecretScan(masked)
 	};
 }
 /**
@@ -51683,5 +51722,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, withErrorHandling as $a, uploadCfnTemplate as $i, repairMalformedResourcePropertiesForReadOnly as $n, createAssetRedirectResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, CdkdError as Aa, warnFinchArgvExposure as Ai, malformedOutputsRefusalMessage as An, S3StateBackend as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, MalformedProducerRecordRefusalError as Ba, resolveAutoAssetStorage as Bi, refuseMalformedOrphansForDestroy as Bn, hasReadableExportSet as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, resolveBucketRegion as Ca, getDockerCmd as Ci, isReadableResourceEntry as Cn, pathCrossesDottedKey as Cr, UNSPECIFIED_SKIP_REASON as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, runWithStackAwsClients as Da, redactDockerArgvValues as Di, malformedOrphanRecordsWarning as Dn, redactSecretsForState as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, resetAwsClients as Ea, partitionSensitiveEnv as Ei, malformedLocalOutputsWarning as En, recoverMaskedOutput as Er, isWaitAbandonedError as Et, extractDeploymentEventError as F, DynamicReferenceRegionAmbiguousError as Fa, Synthesizer as Fi, malformedResourcesWarning as Fn, forceQuitRecoveryClause as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, ResourceUpdateNotSupportedError as Ga, resolveUseCdkBootstrapAssets as Gi, refuseMalformedResourceEntries as Gn, isReadableBag as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, PartialFailureError as Ha, resolveSkipPrefix as Hi, refuseMalformedOutputs as Hn, hasUnverifiableParameterRefusal as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, IntrinsicResolutionRefusalError as Ia, synthesisStatusMessage as Ii, malformedStateRefusalMessage as In, formatLockExpiry as Ir, isNamelessDynamicReferenceError as It, bold as J, StateError as Ja, ssmResolvedValueType as Ji, refuseMalformedResourcesForDestroy as Jn, shouldRetainResource as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, StackHasActiveImportsError as Ka, stateBucketExistenceConfirmed as Ki, refuseMalformedResourceEntriesForOrphan as Kn, orphansAfterRollback as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, LocalInvokeBuildError as La, getDefaultStateBucketName as Li, refuseDivergentRecordRegionForDestroy as Ln, CUSTOM_RESOURCE_RESPONSE_PREFIX as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, CrossAccountSecretRefusalError as Ma, stripControlChars as Mi, malformedRenderedContainersWarning as Mn, UNREPRODUCIBLE_LOCK_CLAUSE as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, DependencyError as Na, AssetManifestLoader as Ni, malformedResourceEntriesWarning as Nn, buildForceUnlockCommand as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, setAwsClients as Oa, runDockerForeground as Oi, malformedOrphansRefusalMessage as On, scrubResourceRecord as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, DeployCancelledError as Pa, getDockerImageBySourceHash as Pi, malformedResourcePropertiesWarning as Pn, buildLockContentionMessage as Pr, getAccountInfo as Pt, red as Q, normalizeAwsError as Qa, findLargeInlineResources as Qi, repairMalformedResourceEntriesForReadOnly as Qn, buildAssetRedirectMap as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, LocalStartServiceError as Ra, getLegacyStateBucketName as Ri, refuseMalformedNestedChildOutputs as Rn, DEFAULT_STATE_PREFIX as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, clearBucketRegionCache as Sa, formatDockerLoginError as Si, hasReadableResources as Sn, maskSecretsInText as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, getAwsClients as Ta, isMalformedEnvKey as Ti, malformedExportSourceWarning as Tn, recordMaskOnlyValuesIn as Tr, deleteSkipReason as Tt, coerceWarmThroughput as U, ProvisioningError as Ua, resolveStateBucketWithDefault as Ui, refuseMalformedOutputsForDestroy as Un, importableOutputKeys as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, NestedStackChildDirectDestroyError as Va, resolveCaptureObservedState as Vi, refuseMalformedOrphansForOrphan as Vn, hasReasonlessBaselineRefusal as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, ResourceTimeoutError as Wa, resolveStateBucketWithDefaultAndSource as Wi, refuseMalformedResourceAttributesForOrphan as Wn, importableOutputs as Wr, assertRegionMatch as Wt, gray as X, formatError as Xa, CFN_TEMPLATE_URL_LIMIT as Xi, repairMalformedOrphansForReadOnly as Xn, stringifyValue as Xr, readConfigString as Xt, cyan as Y, SynthesisError as Ya, CFN_TEMPLATE_BODY_LIMIT as Yi, refuseMalformedState as Yn, AssetPublisher as Yr, configStringRefusal as Yt, green as Z, isCdkdError as Za, MIGRATE_TMP_PREFIX as Zi, repairMalformedOutputsForReadOnly as Zn, WorkGraph as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, nullPrototypeRecord as _a, describeDockerCapturedOutput as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, decodeListingKey as aa, ensureAssetStorage as ai, s3BucketDomainName as an, isTransientServerError as ao, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, renderAssemblyPathEscape as ba, dockerSpawnEnvWithSensitive as bi, hasReadableOrphans as bn, markSameGenerationBag as br, startInterruptWatch as bt, replayFailedOperations as c, canonicalizeRegion as ca, parseBootstrapMarker as ci, s3BucketWebsiteUrl as cn, retryClassificationText as co, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, failedStageNote as da, validateContainerRepoName as di, applyCallerIdentityCredentials as dn, __exportAll as do, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ea, loadPublishableAssetManifest as ei, requireConfigString as en, pasteableCommand as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, globMatches as fa, buildDenyExternalAccessPolicy as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, hasPlainPrototype$1 as ga, warnManifestExecutable as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, hasOwnKey as ha, resolveDockerContextDirectory as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, producerRecordKey as ia, assertAssetBucketRegion as ii, s3BucketArn as in, isThrottlingError as io, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, ConfigError as ja, escapeRegExp$1 as ji, malformedOutputsWarning as jn, rebuildClientForBucketRegion as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, AssetError as ka, runDockerStreaming as ki, malformedOrphansWarning as kn, LockManager as kr, IntrinsicFunctionResolver as kt, replayRollback as l, derivePartitionAndUrlSuffix as la, readBootstrapMarkerBody as li, applyRoleArnIfSet as ln, describeAwsFailure as lo, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, defineOwnKey as ma, buildDockerImage as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, injectiveKeyPrefix as na, AssetModeResolver as ni, producerRegionsFromState as nn, isMarkedNonRetryable as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, expectedOwnerParam as oa, getBootstrapMarkerKey as oi, s3BucketDualStackDomainName as on, markNonRetryable as oo, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, processStackMessages as pa, assertCdkLocalDockerContextContained as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, StackTerminationProtectionError as qa, warnDeprecatedNoPrefixCliFlag as qi, refuseMalformedResourcePropertiesForOrphan as qn, orphansCarriedFrom as qr, configBooleanRefusal as qt, DeployEngine as r, producerCoordinateKey as ra, BOOTSTRAP_MARKER_PREFIX as ri, withSharedDrainBudget as rn, isRetryableTransientError as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, PARTITION_TABLE as sa, isCrossRegionRedirect as si, s3BucketRegionalDomainName as sn, markRedactedCause as so, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, injectiveKey as ta, rewriteTemplateAssetReferences as ti, classifyReplaySecretRegion as tn, shellQuote as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, AssemblyReader as ua, validateAssetBucketName as ui, AWS_CREDENTIAL_ENV_KEYS as un, safeStringify$1 as uo, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, ownValue as va, describeDockerExecFailure as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, AwsClients as wa, isDockerClientEnvKey as wi, malformedExportNamesWarning as wn, recordMaskOnlyValue as wr, deleteIndeterminateGuards as wt, bindingSkippedOutputs as x, resolveAssemblyPath as xa, finchSecretArgvRefusal as xi, hasReadableOutputs as xn, maskSecretsInError as xr, CloudControlProvider as xt, keptWholeReasonText as y, absoluteAssemblyPathEscape as ya, describeDockerFailure as yi, displayLogicalId as yn, isUncertifiedBaselineMaskPosition as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, LockError as za, resolveApp as zi, refuseMalformedOrphans as zn, exportNamesCarriedFrom as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-D8OVUEBp.js.map
+export { yellow as $, normalizeAwsError as $a, uploadCfnTemplate as $i, repairMalformedResourcePropertiesForReadOnly as $n, createAssetRedirectResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, AssetError as Aa, warnFinchArgvExposure as Ai, malformedOutputsRefusalMessage as An, S3StateBackend as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, LockError as Ba, resolveAutoAssetStorage as Bi, refuseMalformedOrphansForDestroy as Bn, hasReadableExportSet as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, clearBucketRegionCache as Ca, getDockerCmd as Ci, isReadableResourceEntry as Cn, pathCrossesDottedKey as Cr, UNSPECIFIED_SKIP_REASON as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, resetAwsClients as Da, redactDockerArgvValues as Di, malformedOrphanRecordsWarning as Dn, redactSecretsForState as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, getAwsClients as Ea, partitionSensitiveEnv as Ei, malformedLocalOutputsWarning as En, recoverMaskedOutput as Er, isWaitAbandonedError as Et, extractDeploymentEventError as F, DeployCancelledError as Fa, Synthesizer as Fi, malformedResourcesWarning as Fn, forceQuitRecoveryClause as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, ResourceTimeoutError as Ga, resolveUseCdkBootstrapAssets as Gi, refuseMalformedResourceEntries as Gn, isReadableBag as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, NestedStackChildDirectDestroyError as Ha, resolveSkipPrefix as Hi, refuseMalformedOutputs as Hn, hasUnverifiableParameterRefusal as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, DynamicReferenceRegionAmbiguousError as Ia, synthesisStatusMessage as Ii, malformedStateRefusalMessage as In, formatLockExpiry as Ir, isNamelessDynamicReferenceError as It, bold as J, StackTerminationProtectionError as Ja, ssmResolvedValueType as Ji, refuseMalformedResourcesForDestroy as Jn, shouldRetainResource as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, ResourceUpdateNotSupportedError as Ka, stateBucketExistenceConfirmed as Ki, refuseMalformedResourceEntriesForOrphan as Kn, orphansAfterRollback as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, IntrinsicResolutionRefusalError as La, getDefaultStateBucketName as Li, refuseDivergentRecordRegionForDestroy as Ln, CUSTOM_RESOURCE_RESPONSE_PREFIX as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, ConfigError as Ma, stripControlChars as Mi, malformedRenderedContainersWarning as Mn, UNREPRODUCIBLE_LOCK_CLAUSE as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, CrossAccountSecretRefusalError as Na, AssetManifestLoader as Ni, malformedResourceEntriesWarning as Nn, buildForceUnlockCommand as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, runWithStackAwsClients as Oa, runDockerForeground as Oi, malformedOrphansRefusalMessage as On, scrubResourceRecord as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, DependencyError as Pa, getDockerImageBySourceHash as Pi, malformedResourcePropertiesWarning as Pn, buildLockContentionMessage as Pr, getAccountInfo as Pt, red as Q, isCdkdError as Qa, findLargeInlineResources as Qi, repairMalformedResourceEntriesForReadOnly as Qn, buildAssetRedirectMap as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, LocalInvokeBuildError as Ra, getLegacyStateBucketName as Ri, refuseMalformedNestedChildOutputs as Rn, DEFAULT_STATE_PREFIX as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, resolveAssemblyPath as Sa, formatDockerLoginError as Si, hasReadableResources as Sn, maskSecretsInText as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, AwsClients as Ta, isMalformedEnvKey as Ti, malformedExportSourceWarning as Tn, recordMaskOnlyValuesIn as Tr, deleteSkipReason as Tt, coerceWarmThroughput as U, PartialFailureError as Ua, resolveStateBucketWithDefault as Ui, refuseMalformedOutputsForDestroy as Un, importableOutputKeys as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, MalformedProducerRecordRefusalError as Va, resolveCaptureObservedState as Vi, refuseMalformedOrphansForOrphan as Vn, hasReasonlessBaselineRefusal as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, ProvisioningError as Wa, resolveStateBucketWithDefaultAndSource as Wi, refuseMalformedResourceAttributesForOrphan as Wn, importableOutputs as Wr, assertRegionMatch as Wt, gray as X, SynthesisError as Xa, CFN_TEMPLATE_URL_LIMIT as Xi, repairMalformedOrphansForReadOnly as Xn, stringifyValue as Xr, readConfigString as Xt, cyan as Y, StateError as Ya, CFN_TEMPLATE_BODY_LIMIT as Yi, refuseMalformedState as Yn, AssetPublisher as Yr, configStringRefusal as Yt, green as Z, formatError as Za, MIGRATE_TMP_PREFIX as Zi, repairMalformedOutputsForReadOnly as Zn, WorkGraph as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, nullPrototypeRecord as _a, describeDockerCapturedOutput as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, decodeListingKey as aa, ensureAssetStorage as ai, s3BucketDomainName as an, isThrottlingError as ao, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, displayAssemblyPath as ba, dockerSpawnEnvWithSensitive as bi, hasReadableOrphans as bn, markSameGenerationBag as br, startInterruptWatch as bt, replayFailedOperations as c, canonicalizeRegion as ca, parseBootstrapMarker as ci, s3BucketWebsiteUrl as cn, markRedactedCause as co, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, failedStageNote as da, validateContainerRepoName as di, applyCallerIdentityCredentials as dn, safeStringify$1 as do, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ea, loadPublishableAssetManifest as ei, requireConfigString as en, withErrorHandling as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, globMatches as fa, buildDenyExternalAccessPolicy as fi, callerEnvCredentials as fn, __exportAll as fo, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, hasPlainPrototype$1 as ga, warnManifestExecutable as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, hasOwnKey as ha, resolveDockerContextDirectory as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, producerRecordKey as ia, assertAssetBucketRegion as ii, s3BucketArn as in, isRetryableTransientError as io, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, CdkdError as ja, escapeRegExp$1 as ji, malformedOutputsWarning as jn, rebuildClientForBucketRegion as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, setAwsClients as ka, runDockerStreaming as ki, malformedOrphansWarning as kn, LockManager as kr, IntrinsicFunctionResolver as kt, replayRollback as l, derivePartitionAndUrlSuffix as la, readBootstrapMarkerBody as li, applyRoleArnIfSet as ln, retryClassificationText as lo, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, defineOwnKey as ma, buildDockerImage as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, injectiveKeyPrefix as na, AssetModeResolver as ni, producerRegionsFromState as nn, shellQuote as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, expectedOwnerParam as oa, getBootstrapMarkerKey as oi, s3BucketDualStackDomainName as on, isTransientServerError as oo, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, processStackMessages as pa, assertCdkLocalDockerContextContained as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, StackHasActiveImportsError as qa, warnDeprecatedNoPrefixCliFlag as qi, refuseMalformedResourcePropertiesForOrphan as qn, orphansCarriedFrom as qr, configBooleanRefusal as qt, DeployEngine as r, producerCoordinateKey as ra, BOOTSTRAP_MARKER_PREFIX as ri, withSharedDrainBudget as rn, isMarkedNonRetryable as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, PARTITION_TABLE as sa, isCrossRegionRedirect as si, s3BucketRegionalDomainName as sn, markNonRetryable as so, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, injectiveKey as ta, rewriteTemplateAssetReferences as ti, classifyReplaySecretRegion as tn, pasteableCommand as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, AssemblyReader as ua, validateAssetBucketName as ui, AWS_CREDENTIAL_ENV_KEYS as un, describeAwsFailure as uo, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, ownValue as va, describeDockerExecFailure as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, resolveBucketRegion as wa, isDockerClientEnvKey as wi, malformedExportNamesWarning as wn, recordMaskOnlyValue as wr, deleteIndeterminateGuards as wt, bindingSkippedOutputs as x, renderAssemblyPathEscape as xa, finchSecretArgvRefusal as xi, hasReadableOutputs as xn, maskSecretsInError as xr, CloudControlProvider as xt, keptWholeReasonText as y, absoluteAssemblyPathEscape as ya, describeDockerFailure as yi, displayLogicalId as yn, isUncertifiedBaselineMaskPosition as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, LocalStartServiceError as za, resolveApp as zi, refuseMalformedOrphans as zn, exportNamesCarriedFrom as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-WVUZ-Jm8.js.map