@go-to-k/cdkd 0.291.15 → 0.291.16

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-2myEXI65.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-Qigb_6I0.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-CGsbW6A4.js");
+	const { buildProgram } = await import("./program-DjkAPWi0.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-Bt0ttXRi.js → deploy-engine-yukC8N_f.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-2myEXI65.js";
+import { t as getCdkdVersion } from "./version-Qigb_6I0.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -31639,8 +31639,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		}
 		if (resourceType === "AWS::SNS::Topic") switch (attributeName) {
-			case "TopicArn": return `arn:${partition}:sns:${region}:${accountId}:${physicalId}`;
-			case "TopicName": return physicalId;
+			case "TopicArn": return physicalId.startsWith("arn:") ? physicalId : `arn:${partition}:sns:${region}:${accountId}:${physicalId}`;
+			case "TopicName": return physicalId.startsWith("arn:") ? physicalId.split(":").pop() : physicalId;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
@@ -36326,7 +36326,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CEGHMZnN.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DAvRcbyS.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -41450,7 +41450,7 @@ var ProviderRegistry = class {
 	/**
 	* Escape hatch for the `--allow-unsupported-properties` CLI flag. Each entry
 	* is a `<ResourceType>:<PropertyName>` token (e.g.
-	* `AWS::Lambda::Function:RuntimeManagementConfig`). As of issue
+	* `AWS::ApiGatewayV2::Api:Body`). As of issue
 	* [#614](https://github.com/go-to-k/cdkd/issues/614), the flag now means
 	* "force the SDK Provider path and accept the silent drop" — the default
 	* for an un-flagged silent-drop property is to auto-route the resource
@@ -41888,7 +41888,7 @@ var ProviderRegistry = class {
 	* `--allow-unsupported-properties` allow set — i.e. every resource that
 	* {@link getProviderFor} would auto-route via Cloud Control. Returned
 	* entries carry the silent-drop property names so plan / diff renderers
-	* can show `[via CC API: RuntimeManagementConfig]`.
+	* can show `[via CC API: Body]`.
 	*
 	* Does NOT log or throw. Use {@link reportSilentDropDecisions} for the
 	* side-effecting info / warn surface.
@@ -41916,6 +41916,88 @@ function isCustomResource(resourceType) {
 	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
 }
 
+//#endregion
+//#region src/provisioning/attribute-map.ts
+/**
+* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
+* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
+* shape `docs/provider-development.md` forbids under "Never store an
+* empty-string placeholder"):
+*
+*   an attribute cdkd could not read back is ABSENT from the map — never
+*   recorded as the empty string, and never as a present-but-`undefined` key.
+*
+* The consumers of `ResourceState.attributes` all key off exactly that
+* distinction, and a sentinel puts every one of them on the wrong branch:
+*
+*  - the deploy engine persists the map as-is, so `''` becomes the recorded
+*    value of a field AWS never assigned;
+*  - the intrinsic resolver serves a stored attribute whenever it is not
+*    `undefined`, so `''` shadows `constructAttribute` forever — the
+*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
+*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
+*    only on a MISS;
+*  - the Outputs export pass publishes whatever the resolver returned, so a
+*    stored `''` is exported to every `Fn::ImportValue` consumer.
+*
+* It exists as a MODULE rather than a per-provider idiom because the rule was
+* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
+* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
+* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
+* that DROPS the key is the one form a provider cannot spell wrong by habit.
+*
+* Two values are treated as "not read back":
+*
+*  - `undefined`: the SDK's spelling of an unassigned optional member.
+*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
+*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
+*    like `''` does.
+*
+* Every other value is kept verbatim — INCLUDING an empty string AWS itself
+* reported (`false`, `0`, an empty array and an object likewise). The helper
+* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
+* off the wire is a known value with a meaning the provider owns. The EC2
+* Instance provider is where that distinction is load-bearing: a `running`
+* instance with no public address is described with `PublicDnsName: ''` and
+* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
+* empty, recorded as such so a reference does not degrade to the instance id
+* on every resolution — while the same `''` on a `pending` instance means
+* "not yet", which that provider maps to `undefined` BEFORE calling this
+* helper (its `describedInstanceAttributes`). A caller that knows a `''`
+* means "unknown" is the one that must say so; this helper cannot tell.
+*
+* Deliberately NOT a general "compact this record" utility: it is scoped to
+* attribute maps. A property bag keeps its `undefined`-valued keys out by other
+* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
+* than setting it to `undefined`").
+*
+* A LEAF module (imports nothing) so every provider can take it without adding
+* an edge to the provider import ring.
+*/
+/**
+* Build an attribute map from read-back values, omitting every key whose value
+* is `undefined` or `null`.
+*/
+function definedAttributes(entries) {
+	const out = {};
+	for (const [key, value] of Object.entries(entries)) {
+		if (value === void 0 || value === null) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* `String(value)` for a numeric read-back whose CloudFormation attribute is a
+* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
+* `definedAttributes` drops the key instead of recording the literal
+* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
+* `?? ''` is merely deleted.
+*/
+function stringifyIfAssigned(value) {
+	if (value === void 0 || value === null) return void 0;
+	return String(value);
+}
+
 //#endregion
 //#region src/provisioning/update-removal.ts
 /**
@@ -42489,10 +42571,13 @@ var IAMRoleProvider = class {
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "RoleName");
 		if (explicit) try {
-			await this.iamClient.send(new GetRoleCommand({ RoleName: explicit }));
+			const resp = await this.iamClient.send(new GetRoleCommand({ RoleName: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					Arn: resp.Role?.Arn,
+					RoleId: resp.Role?.RoleId
+				})
 			};
 		} catch (err) {
 			if (err instanceof NoSuchEntityException) return null;
@@ -51722,5 +51807,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, normalizeAwsError as $a, uploadCfnTemplate as $i, repairMalformedResourcePropertiesForReadOnly as $n, createAssetRedirectResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, AssetError as Aa, warnFinchArgvExposure as Ai, malformedOutputsRefusalMessage as An, S3StateBackend as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, LockError as Ba, resolveAutoAssetStorage as Bi, refuseMalformedOrphansForDestroy as Bn, hasReadableExportSet as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, clearBucketRegionCache as Ca, getDockerCmd as Ci, isReadableResourceEntry as Cn, pathCrossesDottedKey as Cr, UNSPECIFIED_SKIP_REASON as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, resetAwsClients as Da, redactDockerArgvValues as Di, malformedOrphanRecordsWarning as Dn, redactSecretsForState as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, getAwsClients as Ea, partitionSensitiveEnv as Ei, malformedLocalOutputsWarning as En, recoverMaskedOutput as Er, isWaitAbandonedError as Et, extractDeploymentEventError as F, DeployCancelledError as Fa, Synthesizer as Fi, malformedResourcesWarning as Fn, forceQuitRecoveryClause as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, ResourceTimeoutError as Ga, resolveUseCdkBootstrapAssets as Gi, refuseMalformedResourceEntries as Gn, isReadableBag as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, NestedStackChildDirectDestroyError as Ha, resolveSkipPrefix as Hi, refuseMalformedOutputs as Hn, hasUnverifiableParameterRefusal as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, DynamicReferenceRegionAmbiguousError as Ia, synthesisStatusMessage as Ii, malformedStateRefusalMessage as In, formatLockExpiry as Ir, isNamelessDynamicReferenceError as It, bold as J, StackTerminationProtectionError as Ja, ssmResolvedValueType as Ji, refuseMalformedResourcesForDestroy as Jn, shouldRetainResource as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, ResourceUpdateNotSupportedError as Ka, stateBucketExistenceConfirmed as Ki, refuseMalformedResourceEntriesForOrphan as Kn, orphansAfterRollback as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, IntrinsicResolutionRefusalError as La, getDefaultStateBucketName as Li, refuseDivergentRecordRegionForDestroy as Ln, CUSTOM_RESOURCE_RESPONSE_PREFIX as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, ConfigError as Ma, stripControlChars as Mi, malformedRenderedContainersWarning as Mn, UNREPRODUCIBLE_LOCK_CLAUSE as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, CrossAccountSecretRefusalError as Na, AssetManifestLoader as Ni, malformedResourceEntriesWarning as Nn, buildForceUnlockCommand as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, runWithStackAwsClients as Oa, runDockerForeground as Oi, malformedOrphansRefusalMessage as On, scrubResourceRecord as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, DependencyError as Pa, getDockerImageBySourceHash as Pi, malformedResourcePropertiesWarning as Pn, buildLockContentionMessage as Pr, getAccountInfo as Pt, red as Q, isCdkdError as Qa, findLargeInlineResources as Qi, repairMalformedResourceEntriesForReadOnly as Qn, buildAssetRedirectMap as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, LocalInvokeBuildError as Ra, getLegacyStateBucketName as Ri, refuseMalformedNestedChildOutputs as Rn, DEFAULT_STATE_PREFIX as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, resolveAssemblyPath as Sa, formatDockerLoginError as Si, hasReadableResources as Sn, maskSecretsInText as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, AwsClients as Ta, isMalformedEnvKey as Ti, malformedExportSourceWarning as Tn, recordMaskOnlyValuesIn as Tr, deleteSkipReason as Tt, coerceWarmThroughput as U, PartialFailureError as Ua, resolveStateBucketWithDefault as Ui, refuseMalformedOutputsForDestroy as Un, importableOutputKeys as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, MalformedProducerRecordRefusalError as Va, resolveCaptureObservedState as Vi, refuseMalformedOrphansForOrphan as Vn, hasReasonlessBaselineRefusal as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, ProvisioningError as Wa, resolveStateBucketWithDefaultAndSource as Wi, refuseMalformedResourceAttributesForOrphan as Wn, importableOutputs as Wr, assertRegionMatch as Wt, gray as X, SynthesisError as Xa, CFN_TEMPLATE_URL_LIMIT as Xi, repairMalformedOrphansForReadOnly as Xn, stringifyValue as Xr, readConfigString as Xt, cyan as Y, StateError as Ya, CFN_TEMPLATE_BODY_LIMIT as Yi, refuseMalformedState as Yn, AssetPublisher as Yr, configStringRefusal as Yt, green as Z, formatError as Za, MIGRATE_TMP_PREFIX as Zi, repairMalformedOutputsForReadOnly as Zn, WorkGraph as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, nullPrototypeRecord as _a, describeDockerCapturedOutput as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, decodeListingKey as aa, ensureAssetStorage as ai, s3BucketDomainName as an, isThrottlingError as ao, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, displayAssemblyPath as ba, dockerSpawnEnvWithSensitive as bi, hasReadableOrphans as bn, markSameGenerationBag as br, startInterruptWatch as bt, replayFailedOperations as c, canonicalizeRegion as ca, parseBootstrapMarker as ci, s3BucketWebsiteUrl as cn, markRedactedCause as co, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, failedStageNote as da, validateContainerRepoName as di, applyCallerIdentityCredentials as dn, safeStringify$1 as do, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ea, loadPublishableAssetManifest as ei, requireConfigString as en, withErrorHandling as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, globMatches as fa, buildDenyExternalAccessPolicy as fi, callerEnvCredentials as fn, __exportAll as fo, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, hasPlainPrototype$1 as ga, warnManifestExecutable as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, hasOwnKey as ha, resolveDockerContextDirectory as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, producerRecordKey as ia, assertAssetBucketRegion as ii, s3BucketArn as in, isRetryableTransientError as io, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, CdkdError as ja, escapeRegExp$1 as ji, malformedOutputsWarning as jn, rebuildClientForBucketRegion as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, setAwsClients as ka, runDockerStreaming as ki, malformedOrphansWarning as kn, LockManager as kr, IntrinsicFunctionResolver as kt, replayRollback as l, derivePartitionAndUrlSuffix as la, readBootstrapMarkerBody as li, applyRoleArnIfSet as ln, retryClassificationText as lo, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, defineOwnKey as ma, buildDockerImage as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, injectiveKeyPrefix as na, AssetModeResolver as ni, producerRegionsFromState as nn, shellQuote as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, expectedOwnerParam as oa, getBootstrapMarkerKey as oi, s3BucketDualStackDomainName as on, isTransientServerError as oo, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, processStackMessages as pa, assertCdkLocalDockerContextContained as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, StackHasActiveImportsError as qa, warnDeprecatedNoPrefixCliFlag as qi, refuseMalformedResourcePropertiesForOrphan as qn, orphansCarriedFrom as qr, configBooleanRefusal as qt, DeployEngine as r, producerCoordinateKey as ra, BOOTSTRAP_MARKER_PREFIX as ri, withSharedDrainBudget as rn, isMarkedNonRetryable as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, PARTITION_TABLE as sa, isCrossRegionRedirect as si, s3BucketRegionalDomainName as sn, markNonRetryable as so, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, injectiveKey as ta, rewriteTemplateAssetReferences as ti, classifyReplaySecretRegion as tn, pasteableCommand as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, AssemblyReader as ua, validateAssetBucketName as ui, AWS_CREDENTIAL_ENV_KEYS as un, describeAwsFailure as uo, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, ownValue as va, describeDockerExecFailure as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, resolveBucketRegion as wa, isDockerClientEnvKey as wi, malformedExportNamesWarning as wn, recordMaskOnlyValue as wr, deleteIndeterminateGuards as wt, bindingSkippedOutputs as x, renderAssemblyPathEscape as xa, finchSecretArgvRefusal as xi, hasReadableOutputs as xn, maskSecretsInError as xr, CloudControlProvider as xt, keptWholeReasonText as y, absoluteAssemblyPathEscape as ya, describeDockerFailure as yi, displayLogicalId as yn, isUncertifiedBaselineMaskPosition as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, LocalStartServiceError as za, resolveApp as zi, refuseMalformedOrphans as zn, exportNamesCarriedFrom as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-Bt0ttXRi.js.map
+export { yellow as $, formatError as $a, MIGRATE_TMP_PREFIX as $i, repairMalformedOutputsForReadOnly as $n, WorkGraph as $r, replayWarn as $t, createPreDeleteFinalSnapshot as A, runWithStackAwsClients as Aa, runDockerForeground as Ai, malformedOrphansRefusalMessage as An, scrubResourceRecord as Ar, isTerminationProtectionPropagationError as At, isStatefulRecreateTargetSync as B, LocalInvokeBuildError as Ba, getLegacyStateBucketName as Bi, refuseMalformedNestedChildOutputs as Bn, DEFAULT_STATE_PREFIX as Br, parameterTypeMayLoseSecretIdentity as Bt, namesAnyDeclaredParameter as C, renderAssemblyPathEscape as Ca, finchSecretArgvRefusal as Ci, hasReadableOutputs as Cn, maskSecretsInError as Cr, CloudControlProvider as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, AwsClients as Da, isMalformedEnvKey as Di, malformedExportSourceWarning as Dn, recordMaskOnlyValuesIn as Dr, deleteSkipReason as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, resolveBucketRegion as Ea, isDockerClientEnvKey as Ei, malformedExportNamesWarning as En, recordMaskOnlyValue as Er, deleteIndeterminateGuards as Et, extractDeploymentEventError as F, CrossAccountSecretRefusalError as Fa, AssetManifestLoader as Fi, malformedResourceEntriesWarning as Fn, buildForceUnlockCommand as Fr, coerceParameterTypedValue as Ft, toCfnInteger as G, PartialFailureError as Ga, resolveStateBucketWithDefault as Gi, refuseMalformedOutputsForDestroy as Gn, importableOutputKeys as Gr, resolveExplicitPhysicalId as Gt, WARM_THROUGHPUT_MEMBERS as H, LockError as Ha, resolveAutoAssetStorage as Hi, refuseMalformedOrphansForDestroy as Hn, hasReadableExportSet as Hr, isSettledInstanceState as Ht, makeSiblingClaimReader as I, DependencyError as Ia, getDockerImageBySourceHash as Ii, malformedResourcePropertiesWarning as In, buildLockContentionMessage as Ir, getAccountInfo as It, bold as J, ResourceUpdateNotSupportedError as Ja, stateBucketExistenceConfirmed as Ji, refuseMalformedResourceEntriesForOrphan as Jn, orphansAfterRollback as Jr, coerceCfnInteger as Jt, toFiniteNumber as K, ProvisioningError as Ka, resolveStateBucketWithDefaultAndSource as Ki, refuseMalformedResourceAttributesForOrphan as Kn, importableOutputs as Kr, assertRegionMatch as Kt, planOrphanAdoption as L, DeployCancelledError as La, Synthesizer as Li, malformedResourcesWarning as Ln, forceQuitRecoveryClause as Lr, isImpossibleEmptyStoredAttribute as Lt, refusesFinalSnapshot as M, AssetError as Ma, warnFinchArgvExposure as Mi, malformedOutputsRefusalMessage as Mn, S3StateBackend as Mr, carriesDynamicReference as Mt, unsupportedFinalSnapshotError as N, CdkdError as Na, escapeRegExp$1 as Ni, malformedOutputsWarning as Nn, rebuildClientForBucketRegion as Nr, carriesFetchableDynamicReference as Nt, buildFinalSnapshotIdentifier as O, getAwsClients as Oa, partitionSensitiveEnv as Oi, malformedLocalOutputsWarning as On, recoverMaskedOutput as Or, isWaitAbandonedError as Ot, makeCanonicalizePropertiesFn as P, ConfigError as Pa, stripControlChars as Pi, malformedRenderedContainersWarning as Pn, UNREPRODUCIBLE_LOCK_CLAUSE as Pr, cfnRefValueFromPhysicalId as Pt, red as Q, SynthesisError as Qa, CFN_TEMPLATE_URL_LIMIT as Qi, repairMalformedOrphansForReadOnly as Qn, stringifyValue as Qr, readConfigString as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, DynamicReferenceRegionAmbiguousError as Ra, synthesisStatusMessage as Ri, malformedStateRefusalMessage as Rn, formatLockExpiry as Rr, isNamelessDynamicReferenceError as Rt, computeParameterTaint as S, displayAssemblyPath as Sa, dockerSpawnEnvWithSensitive as Si, hasReadableOrphans as Sn, markSameGenerationBag as Sr, startInterruptWatch as St, resourcesNamingDeclaredParameter as T, clearBucketRegionCache as Ta, getDockerCmd as Ti, isReadableResourceEntry as Tn, pathCrossesDottedKey as Tr, UNSPECIFIED_SKIP_REASON as Tt, coerceWarmThroughput as U, MalformedProducerRecordRefusalError as Ua, resolveCaptureObservedState as Ui, refuseMalformedOrphansForOrphan as Un, hasReasonlessBaselineRefusal as Ur, WAFv2WebACLProvider as Ut, renderStatefulReason as V, LocalStartServiceError as Va, resolveApp as Vi, refuseMalformedOrphans as Vn, exportNamesCarriedFrom as Vr, refStateLookupFromResource as Vt, isWarmThroughputDecrease as W, NestedStackChildDirectDestroyError as Wa, resolveSkipPrefix as Wi, refuseMalformedOutputs as Wn, hasUnverifiableParameterRefusal as Wr, normalizeAwsTagsToCfn as Wt, gray as X, StackTerminationProtectionError as Xa, ssmResolvedValueType as Xi, refuseMalformedResourcesForDestroy as Xn, shouldRetainResource as Xr, configIntegerRefusal as Xt, cyan as Y, StackHasActiveImportsError as Ya, warnDeprecatedNoPrefixCliFlag as Yi, refuseMalformedResourcePropertiesForOrphan as Yn, orphansCarriedFrom as Yr, configBooleanRefusal as Yt, green as Z, StateError as Za, CFN_TEMPLATE_BODY_LIMIT as Zi, refuseMalformedState as Zn, AssetPublisher as Zr, configStringRefusal as Zt, bagHoldsSecretExpression as _, hasOwnKey as _a, resolveDockerContextDirectory as _i, INTRINSIC_KEYS as _n, dynamicReferenceTokens as _r, maskerOrIdentity as _t, DeploymentEventsStore as a, producerCoordinateKey as aa, BOOTSTRAP_MARKER_PREFIX as ai, withSharedDrainBudget as an, isMarkedNonRetryable as ao, findActionableSilentDrops as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, ownValue as ba, describeDockerExecFailure as bi, UNREADABLE_RESOURCES_MAP_ROW as bn, isSingleDynamicReferenceToken as br, interruptWatchListenerCount as bt, replayFailedOperations as c, expectedOwnerParam as ca, getBootstrapMarkerKey as ci, s3BucketDualStackDomainName as cn, isTransientServerError as co, withRetry as cr, IAMRoleProvider as ct, updatePartialMessage as d, derivePartitionAndUrlSuffix as da, readBootstrapMarkerBody as di, applyRoleArnIfSet as dn, retryClassificationText as do, STATE_SOURCED_BASELINE_RULES as dr, definedAttributes as dt, findLargeInlineResources as ea, buildAssetRedirectMap as ei, requireConfigArray as en, isCdkdError as eo, repairMalformedResourceEntriesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, AssemblyReader as fa, validateAssetBucketName as fi, AWS_CREDENTIAL_ENV_KEYS as fn, describeAwsFailure as fo, STATE_SOURCED_CROSS_GENERATION_RULES as fr, stringifyIfAssigned as ft, computeImplicitDeleteEdges as g, defineOwnKey as ga, buildDockerImage as gi, DiffCalculator as gn, createSecretMasker as gr, maskDeep as gt, IMPLICIT_DELETE_DEPENDENCIES as h, processStackMessages as ha, assertCdkLocalDockerContextContained as hi, envCredentialsAreAssumedRole as hn, carriesSecretMask as hr, createMaskedRetryLogger as ht, DeploymentEventsReader as i, injectiveKeyPrefix as ia, AssetModeResolver as ii, producerRegionsFromState as in, shellQuote as io, safeStackName as ir, secretBearing as it, isFinalSnapshotError as j, setAwsClients as ja, runDockerStreaming as ji, malformedOrphansWarning as jn, LockManager as jr, IntrinsicFunctionResolver as jt, ccRoutedFinalSnapshotError as k, resetAwsClients as ka, redactDockerArgvValues as ki, malformedOrphanRecordsWarning as kn, redactSecretsForState as kr, disableInstanceApiTermination as kt, replayRollback as l, PARTITION_TABLE as la, isCrossRegionRedirect as li, s3BucketRegionalDomainName as ln, markNonRetryable as lo, DagBuilder as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, globMatches as ma, buildDenyExternalAccessPolicy as mi, callerEnvCredentials as mn, __exportAll as mo, TEMPLATE_SOURCED_RULES as mr, wouldReturnToSdkProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as na, loadPublishableAssetManifest as ni, requireConfigString as nn, withErrorHandling as no, repairMalformedResourcesForReadOnly as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, producerRecordKey as oa, assertAssetBucketRegion as oi, s3BucketArn as on, isRetryableTransientError as oo, findSilentDropProperties as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, failedStageNote as pa, validateContainerRepoName as pi, applyCallerIdentityCredentials as pn, safeStringify$1 as po, STATE_SOURCED_READBACK_RULES as pr, ProviderRegistry as pt, formatResourceLine as q, ResourceTimeoutError as qa, resolveUseCdkBootstrapAssets as qi, refuseMalformedResourceEntries as qn, isReadableBag as qr, coerceCfnBoolean as qt, DeployEngine as r, injectiveKey as ra, rewriteTemplateAssetReferences as ri, classifyReplaySecretRegion as rn, pasteableCommand as ro, safeRegion as rr, isExportAliasCollision as rt, planRollback as s, decodeListingKey as sa, ensureAssetStorage as si, s3BucketDomainName as sn, isThrottlingError as so, describeTypeWithThrottleRetry as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, uploadCfnTemplate as ta, createAssetRedirectResolver as ti, requireConfigObject as tn, normalizeAwsError as to, repairMalformedResourcePropertiesForReadOnly as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, canonicalizeRegion as ua, parseBootstrapMarker as ui, s3BucketWebsiteUrl as un, markRedactedCause as uo, TemplateParser as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, hasPlainPrototype$1 as va, warnManifestExecutable as vi, STATE_RESOURCES_MALFORMED as vn, errorCauseChain as vr, beginCommandInterruptScope as vt, reachableDivergentParameters as w, resolveAssemblyPath as wa, formatDockerLoginError as wi, hasReadableResources as wn, maskSecretsInText as wr, slowCcOperationTimeoutMs as wt, bindingSkippedOutputs as x, absoluteAssemblyPathEscape as xa, describeDockerFailure as xi, displayLogicalId as xn, isUncertifiedBaselineMaskPosition as xr, isInterruptedWaitError as xt, keptWholeReasonText as y, nullPrototypeRecord as ya, describeDockerCapturedOutput as yi, UNREADABLE_ORPHANS_CONTAINER_ROW as yn, identityKeyFor as yr, endCommandInterruptScope as yt, isStatefulRecreateTargetForReplace as z, IntrinsicResolutionRefusalError as za, getDefaultStateBucketName as zi, refuseDivergentRecordRegionForDestroy as zn, CUSTOM_RESOURCE_RESPONSE_PREFIX as zr, isUnboundTemplateParameter as zt };
+//# sourceMappingURL=deploy-engine-yukC8N_f.js.map