@go-to-k/cdkd 0.291.4 → 0.291.6

package/dist/{deploy-engine-CpMT9Bmm.js → deploy-engine-BrGb93QQ.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
-import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-ChuDKy_E.js";
+import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
+import { t as getCdkdVersion } from "./version-DQAkja2a.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1436,14 +1436,20 @@ function formatDuration$1(ms) {
 *    the attribute and the live read finds nothing or fails), plus the
 *    read-less `AWS::RDS::DBProxy` / `DBProxyEndpoint` `VpcId` refusal beside
 *    them — each replacing a physical id the attribute's value type can never
-*    accept.
+*    accept; and `lookupResourceRecord`'s refusal of a state record whose
+*    `physicalId` is not a string
+*    ([#3576](https://github.com/go-to-k/cdkd/issues/3576)), which both `Ref`
+*    and `Fn::GetAtt` reach, and so both `${...}` forms.
 * 2. NOT reachable from it, and thrown as this class only so that "deliberate
 *    refusal" is a property of the THROW rather than of the one catch that
 *    inspects it: `resolveSplit`'s two refusals of a non-string value (#1874),
+*    `resolveSelect`'s refusal of an index that does not resolve to a
+*    non-negative integer ([#3574](https://github.com/go-to-k/cdkd/issues/3574)),
 *    and `refuseCoercedInheritedSecret`, which refuses an already-resolved
 *    value whose type cannot be coerced. Their non-reachability has two
-*    DIFFERENT reasons, so do not collapse them: `Fn::Sub` cannot syntactically
-*    contain an `Fn::Split`, while `refuseCoercedInheritedSecret` runs in the
+*    DIFFERENT reasons, so do not collapse them: a `${...}` placeholder cannot
+*    syntactically contain an `Fn::Split` or `Fn::Select`, while
+*    `refuseCoercedInheritedSecret` runs in the
 *    nested-stack PARAMETER pre-pass, before any `Fn::Sub` is resolved. Neither
 *    changes behavior by being this class.
 * 3. PERMANENT — the one site where no user action and no re-run can make the
@@ -1453,7 +1459,8 @@ function formatDuration$1(ms) {
 *    {@link CrossAccountSecretRefusalError} rather than this class, because
 *    every site in groups 1 and 2 is USER-FIXABLE (correct the stale
 *    placeholder ARN, deploy the producer so STS resolves, enrich the
-*    `Fn::GetAtt`, drop `--strict-getatt`, fix the malformed `Fn::Split`,
+*    `Fn::GetAtt`, drop `--strict-getatt`, fix the malformed `Fn::Split` or
+*    `Fn::Select` index, repair the record's `physicalId`,
 *    correct the nested stack's output name, declare the nested-stack parameter
 *    `Type: String`) and a
 *    consumer that treats "permanent" as a property of the CLASS silently
@@ -1983,6 +1990,7 @@ var aws_clients_exports = /* @__PURE__ */ __exportAll({
 	AwsClients: () => AwsClients,
 	getAwsClients: () => getAwsClients,
 	resetAwsClients: () => resetAwsClients,
+	runWithStackAwsClients: () => runWithStackAwsClients,
 	setAwsClients: () => setAwsClients
 });
 /**
@@ -2063,18 +2071,21 @@ var AwsClients = class AwsClients {
 	* incomplete, it is UNSTABLE in the one direction that is dangerous: the SDK
 	* memoizes a region-less client's region at its first resolution
 	* (`@smithy/node-config-provider`'s `loadConfig` wraps the provider chain in
-	* `memoize`), while `deploy.ts`'s `switchRegion` keeps mutating
-	* `process.env.AWS_REGION` per stack and restores it in each stack's
-	* `finally`. So an env-derived answer can report region X for a client that
-	* long ago pinned itself to region P — letting a caller conclude "these
+	* `memoize`), while a per-stack region switch (`destroy-runner.ts` today;
+	* `deploy.ts` until issue #1981 moved it into a stack scope) mutates
+	* `process.env.AWS_REGION` and restores it in each stack's `finally`. So
+	* an env-derived answer can report region X for a client that long ago
+	* pinned itself to region P — letting a caller conclude "these
 	* clients already point at my region" and use the WRONG ones, which is worse
 	* than not knowing.
 	*
 	* When this returns `undefined` the region is not merely unknown to us, it is
-	* NOT YET DECIDED — and that is the important part. {@link clientOptions}
-	* omits `region` entirely in that case, so each service client resolves and
+	* NOT YET DECIDED — and that is the important part. Outside a stack scope
+	* (`runWithStackAwsClients`, which makes `awsClientDefaults()` supply the
+	* scope's region), {@link clientOptions} omits `region` entirely in that
+	* case, so each service client resolves and
 	* MEMOIZES its own region independently, at its own first construction, from
-	* an environment `deploy.ts`'s `switchRegion` is actively mutating. The
+	* an environment a per-stack region switch may be actively mutating. The
 	* members of one region-less bag can therefore disagree with each other:
 	* `ssm` can pin `us-west-2` and `secretsManager` pin `us-east-1` a moment
 	* later, because the getters are lazy and each samples a different instant.
@@ -2491,14 +2502,44 @@ var AwsClients = class AwsClients {
 */
 let globalClients = null;
 /**
-* Get or create global AWS clients
+* The AWS clients for the code running now: the active per-stack scope's
+* clients when one is entered ({@link runWithStackAwsClients}), else the
+* process-global instance, created on first use.
+*
+* The scope comes FIRST so that a stack deploying concurrently with a stack in
+* another region can never read the other stack's clients (issue
+* go-to-k/cdkd#1981). `config` only matters when the global is created.
 */
 function getAwsClients(config) {
+	const scoped = currentStackAwsScope();
+	if (scoped) return scoped.clients;
 	if (!globalClients) globalClients = new AwsClients(config);
 	return globalClients;
 }
 /**
-* Set global AWS clients instance
+* Run `fn` with `clients` as the AWS clients, and their configured region as
+* the ambient region, of everything it calls — across `await`s, and without
+* touching the process-global instance or `process.env.AWS_REGION`, which
+* concurrently running stacks would otherwise overwrite for each other
+* (issue go-to-k/cdkd#1981). See `stack-aws-scope.ts`.
+*
+* `clients` must be configured with a region: the scope's whole job is to name
+* one, and a region-less bag resolves its region from the very environment
+* this replaces.
+*/
+function runWithStackAwsClients(clients, fn) {
+	const region = clients.configuredRegion;
+	if (region === void 0) throw new Error("runWithStackAwsClients requires AwsClients configured with a region");
+	return runInStackAwsScope({
+		region,
+		clients
+	}, fn);
+}
+/**
+* Set global AWS clients instance.
+*
+* Inside a {@link runWithStackAwsClients} scope, `getAwsClients()` keeps
+* returning the scope's clients: the global this sets is only seen outside it.
 */
 function setAwsClients(clients) {
 	globalClients = clients;
@@ -27521,7 +27562,7 @@ function parseWebACLArn(arn) {
 */
 var WAFv2WebACLProvider = class {
 	wafv2Client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("WAFv2WebACLProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::WAFv2::WebACL", /* @__PURE__ */ new Set([
 		"Name",
@@ -28451,6 +28492,19 @@ function nestedStackChildRegionFromLocalArn(physicalId) {
 	return NESTED_STACK_LOCAL_ARN.exec(physicalId)?.[1];
 }
 /**
+* The array position a RESOLVED `Fn::Select` index names, or `undefined` when
+* it names none (issue #3574): a non-negative safe integer, or its canonical
+* decimal string (CloudFormation accepts `"1"`, and a `Ref` to a parameter the
+* resolver did not coerce is still a string). No `Number()` on anything else:
+* it trims whitespace and maps `""` / `null` / `[]` to `0`. No leading zero
+* either, so `String(position)` IS the resolved text and masks like it — the
+* same shape `import.ts`'s `isStaticSelectIndex` vouches for.
+*/
+function selectIndexPosition(value) {
+	const n = typeof value === "number" ? value : typeof value === "string" && /^(0|[1-9][0-9]*)$/.test(value) ? Number(value) : void 0;
+	return n !== void 0 && Number.isSafeInteger(n) && n >= 0 ? n : void 0;
+}
+/**
 * The prefix every dynamic-reference diagnostic this resolver spells carries.
 *
 * Exported because `cdkd scrub` applies the SAME partition on its side and must
@@ -30210,6 +30264,33 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${loggedName}' is declared 'Type: ${loggedType}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${loggedType}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${loggedName}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
 	}
 	/**
+	* The ONE read of a state record by logical id, shared by `Ref` and
+	* `Fn::GetAtt` (the only two arms that take a record out of
+	* `context.resources`; every other method receives it from them).
+	*
+	* - `Object.hasOwn`, never a bare read (issue #2767): the logical id is
+	*   template text, and a plain-object read walks the prototype chain.
+	* - A record whose `physicalId` is not a string, or that is not an object at
+	*   all, is REFUSED here, above every reader (issue #3576). Nothing in
+	*   `src/state/` checks the type, so a hand edit or a foreign writer can
+	*   leave a number, and the arms below call `.startsWith` / `.replace` on
+	*   it (a bare `TypeError`) or build an ARN from it. cdkd never writes such
+	*   a record, so no answer derived from it is honest. `markNonRetryable`:
+	*   the verdict is a function of the persisted record, and the message
+	*   carries a template-controlled id. A NULL record keeps missing as before.
+	*/
+	lookupResourceRecord(logicalId, via, context) {
+		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+		if (!resource) return void 0;
+		const isObject = typeof resource === "object" && !Array.isArray(resource);
+		const physicalId = isObject ? resource.physicalId : void 0;
+		if (typeof physicalId !== "string") {
+			const loggedId = this.displayMasked(logicalId, context);
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`${via} ${loggedId}: ${isObject ? `the state record's physical id is ${physicalId === null ? "null" : typeof physicalId}, not a string` : `the state record is ${Array.isArray(resource) ? "an array" : typeof resource}, not an object`}. cdkd always records an object with a string id, so this record was edited by hand or written by another tool. ${isObject ? `Set the resource's "physicalId" in the stack's state.json back to the id AWS knows the resource by.` : `Restore the resource's record in the stack's state.json, or remove it and re-import the resource.`}`, void 0, "STATE_PHYSICAL_ID_NOT_STRING"));
+		}
+		return resource;
+	}
+	/**
 	* Resolve Ref intrinsic function
 	*
 	* Ref can reference:
@@ -30218,7 +30299,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* 3. Pseudo parameters (AWS::Region, AWS::AccountId, etc.)
 	*/
 	async resolveRef(logicalId, context) {
-		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+		const resource = this.lookupResourceRecord(logicalId, "Ref", context);
 		if (resource) {
 			const refValue = this.resolveRefValue(logicalId, resource, context);
 			this.logger.debug(`Resolved Ref to resource: ${this.displayMasked(logicalId, context)} -> ${this.displayMasked(String(refValue), context)}`);
@@ -30412,7 +30493,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			logicalId = split.logicalId;
 			attributeName = split.attributeName;
 		}
-		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+		const resource = this.lookupResourceRecord(logicalId, "Fn::GetAtt", context);
 		if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${this.displayMasked(logicalId, context)} not found for Fn::GetAtt`));
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
@@ -30768,7 +30849,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			case "Ipv6CidrBlocks": try {
 				const ec2 = this.clientsForRegion(this.explicitRegion).ec2;
 				const maxAttempts = 15;
-				const loggedId = this.displayMasked(String(physicalId), context);
+				const loggedId = this.displayMasked(physicalId, context);
 				for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 					const associations = (await ec2.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0]?.Ipv6CidrBlockAssociationSet || [];
 					const blocks = associations.filter((a) => a.Ipv6CidrBlockState?.State === "associated").map((a) => a.Ipv6CidrBlock);
@@ -30786,7 +30867,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.logger.warn(`VPC ${loggedId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`);
 				return [];
 			} catch (error) {
-				this.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${this.displayMasked(String(physicalId), context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
+				this.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${this.displayMasked(physicalId, context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
 				return [];
 			}
 			case "DefaultSecurityGroup": {
@@ -30911,7 +30992,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const { GetNamespaceCommand } = await import("@aws-sdk/client-servicediscovery");
 				return (await (await this.serviceDiscoveryClient()).send(new GetNamespaceCommand({ Id: physicalId }))).Namespace?.Properties?.DnsProperties?.HostedZoneId;
 			} catch (error) {
-				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${this.displayMasked(String(physicalId), context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
+				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${this.displayMasked(physicalId, context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
 				return;
 			}
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
@@ -31112,7 +31193,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 					if (value !== void 0 && value !== null) return String(value);
 				} catch (err) {
-					this.logger.warn(`DescribeLaunchTemplates(${this.displayMasked(String(physicalId), context)}) failed for ${this.displayMasked(attributeName, context)}: ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
+					this.logger.warn(`DescribeLaunchTemplates(${this.displayMasked(physicalId, context)}) failed for ${this.displayMasked(attributeName, context)}: ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
@@ -31606,18 +31687,29 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Resolve Fn::Select intrinsic function
 	*
 	* Fn::Select: [index, [value1, value2, ...]]
-	* Returns the value at the specified index in the list
+	* Returns the value at the specified index in the list. The index may be an
+	* intrinsic; it is resolved, then must name a position (issue #3574).
 	*/
 	async resolveSelect(selectArgs, context) {
+		if (!Array.isArray(selectArgs) || selectArgs.length !== 2) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Select takes a two-element list [index, list], got ${this.describeOperandShape(selectArgs, context)}`));
 		const [index, list] = selectArgs;
+		const resolvedIndex = await this.resolveValue(index, context);
+		const position = selectIndexPosition(resolvedIndex);
+		if (position === void 0) {
+			const source = this.describeSplitValueSource(index);
+			const sourceClause = source ? ` (from ${this.displayMasked(source.label, context)})` : "";
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Select: the index${sourceClause} must resolve to a non-negative integer (a number, or its decimal string with no leading zero), got ${this.describeOperandShape(resolvedIndex, context)}. Use a literal, a Ref to a parameter or an Fn::FindInMap that yields one.`));
+		}
 		const resolvedList = await this.resolveValue(list, context);
 		if (!Array.isArray(resolvedList)) throw new Error(`Fn::Select: list must be an array, got ${typeof resolvedList}`);
-		if (index < 0 || index >= resolvedList.length) {
-			this.logger.warn(`Fn::Select: index ${this.displayMasked(String(index), context)} out of bounds (array length: ${resolvedList.length})`);
-			return `{{Fn::Select:${index}:OutOfBounds}}`;
-		}
-		const result = resolvedList[index];
-		this.logger.debug(`Resolved Fn::Select: index ${this.displayMasked(String(index), context)} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
+		const loggedPosition = this.displayMasked(String(position), context);
+		if (position >= resolvedList.length) {
+			if (loggedPosition !== String(position)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Select: the index ${loggedPosition} is out of bounds (array length: ${resolvedList.length}), and it resolves from a secret value, so cdkd will not write it into the OutOfBounds placeholder.`));
+			this.logger.warn(`Fn::Select: index ${position} out of bounds (array length: ${resolvedList.length})`);
+			return `{{Fn::Select:${position}:OutOfBounds}}`;
+		}
+		const result = resolvedList[position];
+		this.logger.debug(`Resolved Fn::Select: index ${loggedPosition} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -31636,6 +31728,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return "<intrinsic>";
 	}
 	/**
+	* Name a malformed operand's type, and its value when that is a scalar, for
+	* a refusal message. The value is template text or a resolution product, so
+	* it goes through the builder (issue #3479).
+	*/
+	describeOperandShape(value, context) {
+		if (value === null) return "null";
+		if (Array.isArray(value)) return `an array of ${value.length}`;
+		if (typeof value === "string") return `string "${this.displayMasked(value, context)}"`;
+		if (typeof value === "number" || typeof value === "boolean") return `${typeof value} ${this.displayMasked(String(value), context)}`;
+		return typeof value;
+	}
+	/**
 	* Name the UNRESOLVED value argument of an `Fn::Split` for its refusal
 	* message (issue [#1874](https://github.com/go-to-k/cdkd/issues/1874)).
 	*
@@ -31653,7 +31757,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*   naming the parameter.
 	*
 	* Anything else degrades to its bare intrinsic key, or to `undefined` for a
-	* literal (which the message then simply omits).
+	* literal (which the message then simply omits). `resolveSelect` borrows the
+	* label for its index refusal (issue #3574); only `kind` is Split-specific.
 	*
 	* `kind` is not decoration: the caller uses it to pick the remedy, since the
 	* `Fn::GetAtt` remedy (drop the `Fn::Split`, and the #1868 note for the
@@ -35482,7 +35587,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-_vdcb9QG.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B1pinTYm.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -50732,5 +50837,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, describeAwsFailure as $a, expectedOwnerParam as $i, repairMalformedResourcePropertiesForReadOnly as $n, rewriteTemplateAssetReferences as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalStartServiceError as Aa, getDefaultStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StateError as Ba, warnDeprecatedNoPrefixCliFlag as Bi, refuseMalformedOrphansForDestroy as Bn, hasUnverifiableParameterRefusal as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, ConfigError as Ca, runDockerStreaming as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DynamicReferenceRegionAmbiguousError as Da, getDockerImageBySourceHash as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DeployCancelledError as Ea, AssetManifestLoader as Ei, malformedLocalOutputsWarning as En, LockManager as Er, deleteSkipReason as Et, extractDeploymentEventError as F, ProvisioningError as Fa, resolveSkipPrefix as Fi, malformedResourcesWarning as Fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, withErrorHandling as Ga, findLargeInlineResources as Gi, refuseMalformedResourceEntries as Gn, orphansCarriedFrom as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, formatError as Ha, CFN_TEMPLATE_BODY_LIMIT as Hi, refuseMalformedOutputs as Hn, importableOutputs as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ResourceTimeoutError as Ia, resolveStateBucketWithDefault as Ii, malformedStateRefusalMessage as In, DEFAULT_STATE_PREFIX as Ir, isNamelessDynamicReferenceError as It, bold as J, isThrottlingError as Ja, injectiveKey as Ji, refuseMalformedResourcesForDestroy as Jn, stringifyValue as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, isMarkedNonRetryable as Ka, uploadCfnTemplate as Ki, refuseMalformedResourceEntriesForOrphan as Kn, shouldRetainResource as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceUpdateNotSupportedError as La, resolveStateBucketWithDefaultAndSource as Li, refuseDivergentRecordRegionForDestroy as Ln, exportNamesCarriedFrom as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, MalformedProducerRecordRefusalError as Ma, resolveApp as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, NestedStackChildDirectDestroyError as Na, resolveAutoAssetStorage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, IntrinsicResolutionRefusalError as Oa, Synthesizer as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, PartialFailureError as Pa, resolveCaptureObservedState as Pi, malformedResourcePropertiesWarning as Pn, shellQuote as Pr, getAccountInfo as Pt, red as Q, retryClassificationText as Qa, decodeListingKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, loadPublishableAssetManifest as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, StackHasActiveImportsError as Ra, resolveUseCdkBootstrapAssets as Ri, refuseMalformedNestedChildOutputs as Rn, hasReadableExportSet as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CdkdError as Sa, runDockerForeground as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, DependencyError as Ta, stripControlChars as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isCdkdError as Ua, CFN_TEMPLATE_URL_LIMIT as Ui, refuseMalformedOutputsForDestroy as Un, isReadableBag as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, SynthesisError as Va, ssmResolvedValueType as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputKeys as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, normalizeAwsError as Wa, MIGRATE_TMP_PREFIX as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansAfterRollback as Wr, assertRegionMatch as Wt, gray as X, markNonRetryable as Xa, producerCoordinateKey as Xi, repairMalformedOrphansForReadOnly as Xn, buildAssetRedirectMap as Xr, readConfigString as Xt, cyan as Y, isTransientServerError as Ya, injectiveKeyPrefix as Yi, refuseMalformedState as Yn, WorkGraph as Yr, configStringRefusal as Yt, green as Z, markRedactedCause as Za, producerRecordKey as Zi, repairMalformedOutputsForReadOnly as Zn, createAssetRedirectResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AwsClients as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, globMatches as aa, isCrossRegionRedirect as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, setAwsClients as ba, partitionSensitiveEnv as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasOwnKey as ca, validateAssetBucketName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, ownValue as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, PARTITION_TABLE as ea, AssetModeResolver as ei, requireConfigString as en, safeStringify$1 as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, absoluteAssemblyPathEscape as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, resolveBucketRegion as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, clearBucketRegionCache as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, failedStageNote as ia, getBootstrapMarkerKey as ii, s3BucketArn as in, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LockError as ja, getLegacyStateBucketName as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, LocalInvokeBuildError as ka, synthesisStatusMessage as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, hasPlainPrototype$1 as la, validateContainerRepoName as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resolveAssemblyPath as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, derivePartitionAndUrlSuffix as na, assertAssetBucketRegion as ni, producerRegionsFromState as nn, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, processStackMessages as oa, parseBootstrapMarker as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, renderAssemblyPathEscape as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, isRetryableTransientError as qa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as qi, refuseMalformedResourcePropertiesForOrphan as qn, AssetPublisher as qr, configBooleanRefusal as qt, DeployEngine as r, AssemblyReader as ra, ensureAssetStorage as ri, withSharedDrainBudget as rn, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, defineOwnKey as sa, readBootstrapMarkerBody as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, canonicalizeRegion as ta, BOOTSTRAP_MARKER_PREFIX as ti, classifyReplaySecretRegion as tn, __exportAll as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, nullPrototypeRecord as ua, buildDenyExternalAccessPolicy as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, getAwsClients as va, formatDockerLoginError as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, CrossAccountSecretRefusalError as wa, escapeRegExp$1 as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, AssetError as xa, redactDockerArgvValues as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, resetAwsClients as ya, getDockerCmd as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackTerminationProtectionError as za, stateBucketExistenceConfirmed as zi, refuseMalformedOrphans as zn, hasReasonlessBaselineRefusal as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-CpMT9Bmm.js.map
+export { yellow as $, retryClassificationText as $a, expectedOwnerParam as $i, repairMalformedResourcePropertiesForReadOnly as $n, rewriteTemplateAssetReferences as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalInvokeBuildError as Aa, getDefaultStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StackTerminationProtectionError as Ba, warnDeprecatedNoPrefixCliFlag as Bi, refuseMalformedOrphansForDestroy as Bn, hasUnverifiableParameterRefusal as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CdkdError as Ca, runDockerStreaming as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DeployCancelledError as Da, getDockerImageBySourceHash as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DependencyError as Ea, AssetManifestLoader as Ei, malformedLocalOutputsWarning as En, LockManager as Er, deleteSkipReason as Et, extractDeploymentEventError as F, PartialFailureError as Fa, resolveSkipPrefix as Fi, malformedResourcesWarning as Fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, normalizeAwsError as Ga, findLargeInlineResources as Gi, refuseMalformedResourceEntries as Gn, orphansCarriedFrom as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, SynthesisError as Ha, CFN_TEMPLATE_BODY_LIMIT as Hi, refuseMalformedOutputs as Hn, importableOutputs as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ProvisioningError as Ia, resolveStateBucketWithDefault as Ii, malformedStateRefusalMessage as In, DEFAULT_STATE_PREFIX as Ir, isNamelessDynamicReferenceError as It, bold as J, isRetryableTransientError as Ja, injectiveKey as Ji, refuseMalformedResourcesForDestroy as Jn, stringifyValue as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, withErrorHandling as Ka, uploadCfnTemplate as Ki, refuseMalformedResourceEntriesForOrphan as Kn, shouldRetainResource as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceTimeoutError as La, resolveStateBucketWithDefaultAndSource as Li, refuseDivergentRecordRegionForDestroy as Ln, exportNamesCarriedFrom as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, LockError as Ma, resolveApp as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MalformedProducerRecordRefusalError as Na, resolveAutoAssetStorage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, DynamicReferenceRegionAmbiguousError as Oa, Synthesizer as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, NestedStackChildDirectDestroyError as Pa, resolveCaptureObservedState as Pi, malformedResourcePropertiesWarning as Pn, shellQuote as Pr, getAccountInfo as Pt, red as Q, markRedactedCause as Qa, decodeListingKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, loadPublishableAssetManifest as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, ResourceUpdateNotSupportedError as Ra, resolveUseCdkBootstrapAssets as Ri, refuseMalformedNestedChildOutputs as Rn, hasReadableExportSet as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, AssetError as Sa, runDockerForeground as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, CrossAccountSecretRefusalError as Ta, stripControlChars as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, formatError as Ua, CFN_TEMPLATE_URL_LIMIT as Ui, refuseMalformedOutputsForDestroy as Un, isReadableBag as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, StateError as Va, ssmResolvedValueType as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputKeys as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isCdkdError as Wa, MIGRATE_TMP_PREFIX as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansAfterRollback as Wr, assertRegionMatch as Wt, gray as X, isTransientServerError as Xa, producerCoordinateKey as Xi, repairMalformedOrphansForReadOnly as Xn, buildAssetRedirectMap as Xr, readConfigString as Xt, cyan as Y, isThrottlingError as Ya, injectiveKeyPrefix as Yi, refuseMalformedState as Yn, WorkGraph as Yr, configStringRefusal as Yt, green as Z, markNonRetryable as Za, producerRecordKey as Zi, repairMalformedOutputsForReadOnly as Zn, createAssetRedirectResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AwsClients as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, globMatches as aa, isCrossRegionRedirect as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, runWithStackAwsClients as ba, partitionSensitiveEnv as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasOwnKey as ca, validateAssetBucketName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, ownValue as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, PARTITION_TABLE as ea, AssetModeResolver as ei, requireConfigString as en, describeAwsFailure as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, absoluteAssemblyPathEscape as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, resolveBucketRegion as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, clearBucketRegionCache as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, failedStageNote as ia, getBootstrapMarkerKey as ii, s3BucketArn as in, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LocalStartServiceError as ja, getLegacyStateBucketName as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, IntrinsicResolutionRefusalError as ka, synthesisStatusMessage as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, hasPlainPrototype$1 as la, validateContainerRepoName as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resolveAssemblyPath as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, derivePartitionAndUrlSuffix as na, assertAssetBucketRegion as ni, producerRegionsFromState as nn, __exportAll as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, processStackMessages as oa, parseBootstrapMarker as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, renderAssemblyPathEscape as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, isMarkedNonRetryable as qa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as qi, refuseMalformedResourcePropertiesForOrphan as qn, AssetPublisher as qr, configBooleanRefusal as qt, DeployEngine as r, AssemblyReader as ra, ensureAssetStorage as ri, withSharedDrainBudget as rn, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, defineOwnKey as sa, readBootstrapMarkerBody as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, canonicalizeRegion as ta, BOOTSTRAP_MARKER_PREFIX as ti, classifyReplaySecretRegion as tn, safeStringify$1 as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, nullPrototypeRecord as ua, buildDenyExternalAccessPolicy as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, getAwsClients as va, formatDockerLoginError as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, ConfigError as wa, escapeRegExp$1 as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, setAwsClients as xa, redactDockerArgvValues as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, resetAwsClients as ya, getDockerCmd as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackHasActiveImportsError as za, stateBucketExistenceConfirmed as zi, refuseMalformedOrphans as zn, hasReasonlessBaselineRefusal as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-BrGb93QQ.js.map