@go-to-k/cdkd 0.291.9 → 0.291.11

package/dist/{deploy-engine-TkL9nyq8.js → deploy-engine-D4svwrnK.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-RzKz4JAW.js";
+import { t as getCdkdVersion } from "./version-CuVd0lOr.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10,7 +10,7 @@ import { SQSClient } from "@aws-sdk/client-sqs";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { CreateSnapshotCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
+import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
 import { DescribeTableCommand, DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStacksCommand, DescribeTypeCommand, GetTemplateCommand, ListExportsCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, GetRestApiCommand } from "@aws-sdk/client-api-gateway";
@@ -35,9 +35,10 @@ import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } fro
 import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBalancingV2Client } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
-import { isAbsolute as isAbsolute$1, resolve as resolve$1 } from "path";
+import { isAbsolute as isAbsolute$1, relative, resolve as resolve$1, sep } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
 import { inspect } from "node:util";
+import { realpathSync as realpathSync$1 } from "fs";
 import { hostname } from "os";
 import graphlib from "graphlib";
 import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from "@aws-sdk/client-rds";
@@ -8135,6 +8136,39 @@ const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"GLIBC_TUNABLES",
 	"GCONV_PATH",
 	"BASH_ENV",
+	"SHELLOPTS",
+	"PS4",
+	"PYTHONPATH",
+	"PYTHONHOME",
+	"PYTHONUSERBASE",
+	"PYTHONPYCACHEPREFIX",
+	"PYTHONPLATLIBDIR",
+	"PYTHONWARNINGS",
+	"BROWSER",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"HTTPLIB2_CA_CERTS",
+	"SSLKEYLOGFILE",
+	"GCE_METADATA_HOST",
+	"GCE_METADATA_ROOT",
+	"GCE_METADATA_IP",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"NODE_COMPILE_CACHE",
+	"NODE_EXTRA_CA_CERTS",
+	"NODE_TLS_REJECT_UNAUTHORIZED",
+	"RUBYOPT",
+	"RUBYLIB",
+	"GEM_PATH",
+	"GEM_HOME",
+	"RUBYGEMS_GEMDEPS",
+	"PERL5OPT",
+	"PERL5LIB",
+	"PERLLIB",
+	"PERL5DB",
+	"OPENSSL_CONF",
+	"OPENSSL_MODULES",
+	"OPENSSL_ENGINES",
 	"SSH_AUTH_SOCK",
 	"SSH_ASKPASS",
 	"SSH_ASKPASS_REQUIRE",
@@ -8203,10 +8237,16 @@ const DOCKER_CLIENT_ENV_KEYS_UPPER = new Set([...DOCKER_CLIENT_ENV_KEYS].map((k)
 * family aws-sdk-go-v2 (and so `docker-credential-ecr-login`) honours — a
 * secret named `AWS_ENDPOINT_URL_ECR` walks around the exact
 * `AWS_ENDPOINT_URL` entry and redirects a request signed with the operator's
-* real credentials (#2186 round 4). No plausible secret name collides with
-* any of the three. Matched by prefix rather than enumerated (issue #2183
-* review). `SSH_` was a prefix here and was demoted to an EXACT enumeration
-* in {@link DOCKER_CLIENT_ENV_KEYS} (#2186 review round 3): the family is not
+* real credentials (#2186 round 4). `CLOUDSDK_` is gcloud's (#3599): every
+* gcloud property is settable as `CLOUDSDK_<SECTION>_<NAME>`, which covers
+* its token host, API endpoint overrides, proxy, CA bundle and account, and
+* the `docker-credential-gcloud` wrapper execs `$CLOUDSDK_PYTHON
+* $CLOUDSDK_PYTHON_ARGS`. `BASH_FUNC_` is bash's exported-function family.
+* No plausible secret name collides with these, apart from the one listed in
+* {@link DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS}. Matched by prefix rather than
+* enumerated (issue #2183 review). `SSH_` was a prefix here and was demoted to
+* an EXACT enumeration in {@link DOCKER_CLIENT_ENV_KEYS} (#2186 review round
+* 3): the family is not
 * uniformly dangerous and is not growing, while the prefix broke realistic,
 * currently-working secrets (`SSH_PRIVATE_KEY`, GitLab CI's canonical
 * deploy-key spelling). Exported so the test fence can assert the EXACT
@@ -8216,19 +8256,37 @@ const DOCKER_CLIENT_ENV_KEYS_UPPER = new Set([...DOCKER_CLIENT_ENV_KEYS].map((k)
 const DOCKER_CLIENT_ENV_PREFIXES = [
 	"LD_",
 	"DYLD_",
-	"AWS_ENDPOINT_URL_"
+	"AWS_ENDPOINT_URL_",
+	"CLOUDSDK_",
+	"BASH_FUNC_"
 ];
 /**
+* Exact names inside a {@link DOCKER_CLIENT_ENV_PREFIXES} family that are still
+* delivered. An entry must be a realistic secret name AND harmless to the
+* helper that reads it. `CLOUDSDK_AUTH_ACCESS_TOKEN` is gcloud's own variable
+* for a caller-supplied access token (#3599). Given to `docker-credential-gcloud`,
+* it only changes which token gcloud hands docker, with no network call of its
+* own. gcloud's `auth docker-helper` answers only for a registry in its own
+* supported list unless `artifacts/allow_unrecognized_registry` is set, and
+* that property, the token host, the universe domain and every other variable
+* that could redirect or weaken the exchange stay refused by the `CLOUDSDK_`
+* prefix. Stored upper-case and matched case-insensitively. Never exempt an
+* exact {@link DOCKER_CLIENT_ENV_KEYS} member: the exact list wins.
+*/
+const DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS = /* @__PURE__ */ new Set(["CLOUDSDK_AUTH_ACCESS_TOKEN"]);
+/**
 * Is `key` the name of a var the docker client reads? Case-INSENSITIVE, because
 * Windows environment lookups are, so a lowercase `docker_host` must be caught
 * too (issue #2183). Matches the exact denylist OR a prefixed family — the
 * prefix families are fail-closed on the whole prefix, so an unlisted `LD_*` /
-* `DYLD_*` / `AWS_ENDPOINT_URL_*` secret is dropped (with a rename warning)
-* rather than reaching the client.
+* `DYLD_*` / `AWS_ENDPOINT_URL_*` / `CLOUDSDK_*` / `BASH_FUNC_*` secret is
+* dropped (with a rename warning) rather than reaching the client, except for
+* a name in {@link DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS}.
 */
 function isDockerClientEnvKey(key) {
 	const upper = key.toUpperCase();
 	if (DOCKER_CLIENT_ENV_KEYS_UPPER.has(upper)) return true;
+	if (DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS.has(upper)) return false;
 	return DOCKER_CLIENT_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
 }
 /**
@@ -8325,6 +8383,70 @@ function dockerSpawnEnvWithSensitive(sensitiveEnv) {
 	}
 	return env;
 }
+/**
+* The env var that accepts, while it is set, that a container client puts secret
+* VALUES on a process command line ({@link finchSecretArgvRefusal}). Only `1`
+* or `true` (any case) opts in.
+*/
+const ALLOW_SECRETS_ON_ARGV_ENV = "CDKD_ALLOW_SECRETS_ON_ARGV";
+/**
+* Is the container client finch running its Lima VM (macOS / Windows)? There
+* the value-less `-e KEY` that {@link partitionSensitiveEnv} emits does NOT
+* keep the value off argv (#3600): finch's `handleEnv` resolves each bare
+* `KEY` against its own environment and re-emits `-e KEY=<value>` on the argv
+* of the `limactl shell finch sudo -E nerdctl ...` child, and `--env-file` is
+* read on the host and re-emitted the same way (runfinch/finch
+* `cmd/finch/nerdctl_remote.go`, `handleEnv` / `handleEnvFile` and the
+* `envArgs` rebuild). Its `passedEnvs` list also puts `AWS_ACCESS_KEY_ID` /
+* `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` from its environment on that
+* argv for every command. finch on Linux passes the argv to nerdctl unchanged
+* and is NOT matched.
+*
+* Detection is by the BASENAME of the resolved binary (`finch`, `finch.exe`,
+* any case): a wrapper script or a symlink under another name is not
+* recognised, and neither is Lima's own `nerdctl.lima`.
+*/
+function isFinchVmClient(cmd = getDockerCmd(), platform = process.platform) {
+	if (platform !== "darwin" && platform !== "win32") return false;
+	const base = (cmd.split(/[\\/]/).pop() ?? "").toLowerCase();
+	return base === "finch" || base === "finch.exe";
+}
+function secretsOnArgvAllowed() {
+	const v = process.env[ALLOW_SECRETS_ON_ARGV_ENV];
+	return v !== void 0 && ["1", "true"].includes(v.trim().toLowerCase());
+}
+/**
+* The refusal text when template-sourced secrets (ECS `Secrets`, decrypted
+* SecureString parameters) would be forwarded under {@link isFinchVmClient},
+* or `undefined` when they may be forwarded: another client, no such secret,
+* or {@link ALLOW_SECRETS_ON_ARGV_ENV} set. The caller throws it in its own
+* error class BEFORE any `docker run`. The AWS credential set is not refused
+* here (it is warned about by {@link warnFinchArgvExposure}): finch already
+* puts the operator's own credentials on that argv by design, so refusing them
+* would only disable finch without changing the operator's exposure.
+* `subject` is caller-rendered context (e.g. the container name) and is not
+* sanitized here.
+*/
+function finchSecretArgvRefusal(secretNames, subject) {
+	if (secretNames.length === 0 || !isFinchVmClient() || secretsOnArgvAllowed()) return void 0;
+	return `${subject}: refusing to forward secret(s) ${[...new Set(secretNames)].map((k) => displayIdent(k)).join(", ")} under CDK_DOCKER=finch on macOS / Windows. finch turns each value-less '-e KEY' into '-e KEY=<value>' on the command line of the limactl process it starts, where other local processes can read the plaintext. Use a container client that keeps the value off the command line (Docker, podman, nerdctl, or finch on Linux), or set ${ALLOW_SECRETS_ON_ARGV_ENV}=1 to accept that exposure while it stays set.`;
+}
+/** Key sets already warned about by {@link warnFinchArgvExposure} in this process. */
+const finchArgvWarned = /* @__PURE__ */ new Set();
+/**
+* Warn, once per process per distinct key set, that under
+* {@link isFinchVmClient} the values of `keys` (the sensitive env about to be
+* forwarded as value-less `-e KEY`) reach the `limactl` command line. Names
+* only, never a value.
+*/
+function warnFinchArgvExposure(keys) {
+	if (keys.length === 0 || !isFinchVmClient()) return;
+	const names = [...new Set(keys)].sort();
+	const latch = JSON.stringify(names);
+	if (finchArgvWarned.has(latch)) return;
+	finchArgvWarned.add(latch);
+	getLogger().warn(`CDK_DOCKER=finch on macOS / Windows puts the values of ${names.map((k) => displayIdent(k)).join(", ")} on the command line of the limactl process it starts (finch turns a value-less '-e KEY' into '-e KEY=<value>'), where other local processes can read them. Docker, podman, nerdctl, or finch on Linux keep them off the command line.`);
+}
 function mergeEnv(overrides) {
 	const merged = { ...process.env };
 	for (const [k, v] of Object.entries(overrides)) if (v === void 0) delete merged[k];
@@ -9436,6 +9558,62 @@ function dockerSubject(assetId) {
 	return assetId === void 0 ? "A Docker asset" : `Docker asset '${displaySafe(assetId)}'`;
 }
 /**
+* Refuse a Docker asset whose build context the bundled `cdk-local` engine
+* would take from outside the assembly (issue
+* [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
+*
+* `cdk-local`'s own `buildDockerImage` spells the context (and the
+* `executable` arm's cwd) as `${cdkOutDir}/${source.directory}` with no
+* containment, and cdkd cannot hand it a pre-resolved path without changing
+* the image tag it derives from `source`. So this judges the path the engine
+* WILL open, before the engine runs, through the same
+* {@link resolveDockerContextDirectory} cdkd's own build uses.
+*
+* An ABSOLUTE value is judged by the engine's spelling, not honoured: the
+* concatenation folds it UNDER the manifest directory, so its leading
+* separators are stripped and the remainder takes the relative arm. That
+* keeps a symlink inside the assembly from becoming an escape through an
+* absolute spelling, and keeps the honour-and-warn arm, which describes a
+* build this engine never performs, out of these paths.
+*/
+function assertCdkLocalDockerContextContained(opts) {
+	const { manifestDir, source, assetOutdir, wrapError } = opts;
+	const directory = source.directory;
+	if (!directory) return;
+	const asEngineJoinsIt = isAbsolute$1(directory) ? directory.replace(/^[/\\]+/, "") : directory;
+	resolveDockerContextDirectory({
+		manifestDir,
+		directory: asEngineJoinsIt,
+		wrapError,
+		assetOutdir,
+		sink: source.executable && source.executable.length > 0 ? "run this asset's source.executable with that directory as its working directory" : "send that directory to docker build as the context of an image cdkd then runs locally"
+	});
+	const engineSpelled = `${manifestDir}/${asEngineJoinsIt}`;
+	const physical = tryRealpathNative(engineSpelled);
+	if (physical === void 0) return;
+	const bound = tryRealpathNative(assetOutdir) ?? resolve$1(assetOutdir);
+	const rel = relative(bound, physical);
+	if (rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute$1(rel)) return;
+	throw wrapError(`asset source.directory='${displaySafe(directory)}' which ` + renderAssemblyPathEscape({
+		contained: false,
+		escape: "symlink",
+		path: engineSpelled,
+		realPath: physical
+	}, assetOutdir, "build it"));
+}
+/**
+* `realpath(3)`, or `undefined` when the path does not resolve. `.native` is
+* load-bearing: the JavaScript `realpathSync` folds `..` lexically first,
+* which is the very reading the check above exists to avoid.
+*/
+function tryRealpathNative(p) {
+	try {
+		return realpathSync$1.native(p);
+	} catch {
+		return;
+	}
+}
+/**
 * Build a Docker image from a CDK asset source. Returns the local image
 * tag the caller should use for `docker tag` / `docker push` (publisher)
 * or `docker run` (local-invoke).
@@ -34318,6 +34496,221 @@ function isTerminationProtectionPropagationError(message) {
 	return /may not be terminated|disableApiTermination/i.test(message);
 }
 
+//#endregion
+//#region src/provisioning/wait-abandoned.ts
+/**
+* The "cdkd stopped watching an operation that may still be running" marker
+* (issue [#3236](https://github.com/go-to-k/cdkd/issues/3236), widened by
+* [#3253](https://github.com/go-to-k/cdkd/issues/3253)).
+*
+* `CloudControlWaitAbandonedError` is raised in `cloud-control-provider.ts`,
+* and `ec2-volume-delete.ts` marks its own abandoned volume-delete wait (issue
+* [#3455](https://github.com/go-to-k/cdkd/issues/3455)) with the same marker,
+* but FIVE call sites have to refuse it, and three of them live in other
+* files. Four are GOVERNED by
+* `tests/unit/provisioning/wait-abandoned-guard-population.test.ts`:
+*
+*  - `cloud-control-provider.ts`'s own `delete()` catch,
+*  - `deploy-engine.ts`'s replacement delete-then-CREATE arm,
+*  - `deploy-engine.ts`'s template-removal delete arm,
+*  - `destroy-runner.ts`'s per-resource delete loop.
+*
+* The FIFTH is `cleanupFailedCreateRemnant`, and it is outside that population
+* by construction rather than by oversight: its partner classifier is the
+* REGEX helper `isNotFoundMessage`, which carries no literal needles, so no
+* needle-driven scan can find it. It has a behavioural case instead, and it
+* needs the guard for a sharper reason than the other four — that regex is
+* case-INSENSITIVE, so `getaddrinfo ENOTFOUND ...` matches `/not\s*found/i`.
+*
+* Each decides "the resource is already gone" by SUBSTRING-matching the error
+* message, and each then DROPS the state row. An abandoned wait says the
+* opposite — the delete may still be running — and its message interpolates
+* the LOGICAL ID and the last-seen IDENTIFIER, both user- or template-chosen,
+* so a resource named `PageNotFound` satisfies those needles. Round 1 of
+* go-to-k/cdkd#3249 guarded the first site with a local `instanceof` and left
+* the other three, which is what this module exists to fix: ONE predicate the
+* three foreign sites can import without importing the provider.
+*
+* **A marker rather than an exported class + `instanceof`**, for the reason
+* `markNonRetryable` is one: `deploy-engine.ts` reaches the provider only
+* through `ProviderRegistry`, so importing the class there would add an edge
+* into an already dense ring, and a marker survives a wrapper that copies a
+* message without preserving a prototype.
+*
+* **NOT `markNonRetryable`**, though the mechanism is identical: a DELETE or
+* UPDATE abandonment is deliberately left RETRYABLE so the destroy runner can
+* re-issue an idempotent delete, and only CREATE is marked. Reusing that
+* marker would either make the guards miss DELETE — the case that drops a
+* state row — or make a DELETE non-retryable and lose the recovery.
+*
+* A LEAF: no imports, ever. All four consumers sit on the deploy engine ->
+* rollback executor -> registry -> provider ring, and a new edge into it from
+* any of them would close a cycle.
+*/
+const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
+/**
+* The `.cause` walk depth, the same bound `retryable-errors.ts` uses. cdkd
+* wraps errors, so the marked error is routinely one or two hops down.
+*/
+const MAX_CAUSE_CHAIN_DEPTH = 5;
+/**
+* Stamp an error as an abandoned wait.
+*
+* `E extends Error`, not `object`: the reader below is a PROTOTYPE-CHAIN
+* lookup, so marking a class or a shared prototype would silently mark every
+* instance of it. A non-extensible (frozen / sealed) error is returned
+* UNMARKED rather than allowed to throw — callers use this inline, so a
+* `TypeError` raised here would REPLACE the error the caller meant to raise.
+* Both rules are `markNonRetryable`'s, for its reasons.
+*/
+function markWaitAbandoned(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, WAIT_ABANDONED_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+/**
+* True when the error, or anything in its bounded `.cause` chain, was marked
+* by {@link markWaitAbandoned}.
+*
+* Every already-deleted classifier must test this BEFORE its substring match,
+* and must treat a true answer as "not already deleted" — i.e. re-throw. The
+* ordering is the whole point: a message-first guard has already decided by
+* the time it would consult the marker.
+*/
+function isWaitAbandonedError(error) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		if (current[WAIT_ABANDONED_MARKER] === true) return true;
+		current = current.cause;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/provisioning/ec2-volume-delete.ts
+/**
+* Delete a Cloud-Control-routed `AWS::EC2::Volume` with EC2 `DeleteVolume`
+* instead of Cloud Control `DeleteResource` (issue
+* [#3455](https://github.com/go-to-k/cdkd/issues/3455)).
+*
+* WHY THE CLOUD CONTROL DELETE IS BYPASSED. The registry delete handler for
+* this type holds `ec2:CreateSnapshot` (it implements CloudFormation's
+* `DeletionPolicy: Snapshot` itself), and it has been observed taking that
+* snapshot on a plain Cloud Control delete, which carries no deletion policy
+* at all: CloudTrail shows a `CreateSnapshot` from `cloudformation.amazonaws.com`
+* in the same second as cdkd's `DeleteResource`, then the handler's
+* `DeleteVolume` while that snapshot was still pending. Both times it
+* happened, the volume then sat in `deleting` for well over the 15-minute
+* wait, the delete failed, and the handler's snapshot was left behind
+* untracked. What makes the handler do it is not known, so the only fix that
+* does not depend on the trigger is not to invoke the handler. The EC2 call is
+* the same one the handler makes; cdkd's own final snapshot (when the policy
+* asks for one) is taken and waited to `completed` before this runs.
+*
+* CONTRACT, matching the Cloud Control delete it replaces:
+*  - Resolves only once the volume is GONE (`InvalidVolume.NotFound`, or state
+*    `deleted`) — returning means "deleted" to every caller.
+*  - `DeleteVolume`'s own errors propagate UNCHANGED, so the caller's
+*    existing already-deleted arm (region-checked) sees `InvalidVolume.NotFound`
+*    exactly as it saw Cloud Control's `NotFound`, and every other failure
+*    takes the caller's ordinary wrap.
+*  - `IncorrectState` from `DeleteVolume` on a volume that is already
+*    `deleting`, `deleted` or gone (a re-run after an interrupted destroy, or
+*    a race with one) is waited on rather than failed. If the describe that
+*    classifies it fails, the ORIGINAL `IncorrectState` is rethrown, carrying
+*    the describe failure as its `cause`.
+*  - A TRANSIENT describe failure during the wait (a throttle, a 5xx, a
+*    socket error — `isTransientFailure`, the Cloud Control poll's own
+*    classifier) is re-polled for up to `transientGraceMs` of unbroken
+*    failures, the same grace the Cloud Control wait gives its status poll.
+*  - Every way the wait can end without seeing the volume gone — the
+*    `maxWaitMs` deadline, the grace running out, a non-transient describe
+*    failure — throws an error marked as an abandoned wait
+*    (`wait-abandoned.ts`). Every already-deleted classifier refuses that
+*    marker structurally, and they must: they match SUBSTRINGS of a message
+*    that interpolates the user's logical id (`PageNotFound` would match). So
+*    the state record is KEPT, and the error stays retryable, like a Cloud
+*    Control DELETE abandonment, because a re-issued `DeleteVolume` is
+*    idempotent.
+*/
+async function deleteEc2VolumeDirect(client, volumeId, logicalId, opts) {
+	const now = opts.now ?? Date.now;
+	try {
+		await client.send(new DeleteVolumeCommand({ VolumeId: volumeId }));
+		opts.logger.debug(`DeleteVolume accepted for ${logicalId} (${volumeId})`);
+	} catch (error) {
+		if (errorName(error) !== "IncorrectState") throw error;
+		let state;
+		try {
+			state = await readVolumeState(client, volumeId);
+		} catch (describeError) {
+			throw withCause(error, describeError);
+		}
+		if (!(state === void 0 || state === "deleted" || state === "deleting")) throw error;
+		opts.logger.debug(`${logicalId} (${volumeId}) is already ${state ?? "gone"}; waiting for it to go`);
+	}
+	const abandoned = (reason, cause) => markWaitAbandoned(new ProvisioningError(`DELETE of ${logicalId} (${volumeId}) was accepted by EC2, but ${reason}. The state record is kept; re-run the command once the volume is gone.`, "AWS::EC2::Volume", logicalId, volumeId, cause instanceof Error ? cause : void 0));
+	const deadline = now() + opts.maxWaitMs;
+	let interval = 2e3;
+	let outageStartedAt;
+	for (;;) {
+		let state;
+		let polled = false;
+		try {
+			state = await readVolumeState(client, volumeId);
+			polled = true;
+			outageStartedAt = void 0;
+		} catch (pollError) {
+			if (!opts.isTransientFailure(pollError)) throw abandoned(`cdkd could not read the volume's state: ${describeAwsFailure(pollError).summary}`, pollError);
+			outageStartedAt ??= now();
+			const outageMs = now() - outageStartedAt;
+			if (outageMs >= opts.transientGraceMs) throw abandoned(`cdkd could not read the volume's state for ${Math.round(outageMs / 1e3)}s: ` + describeAwsFailure(pollError).summary, pollError);
+			opts.logger.debug(`Could not read ${logicalId} (${volumeId}) while waiting for its delete; re-polling: ${describeAwsFailure(pollError).detail}`);
+		}
+		if (polled && (state === void 0 || state === "deleted")) return;
+		if (now() >= deadline) throw abandoned(polled ? `the volume was still '${state}' after ${Math.round(opts.maxWaitMs / 1e3)}s` : `cdkd could not read the volume's state before the ${Math.round(opts.maxWaitMs / 1e3)}s wait ran out`);
+		if (polled) opts.logger.debug(`Waiting for ${logicalId} (${volumeId}) to be deleted (state: ${state})`);
+		await opts.sleep(interval);
+		interval = Math.min(Math.ceil(interval * 1.5), 1e4);
+	}
+}
+/**
+* Rethrow `original` carrying `cause`, without replacing it: the caller's
+* classification (the idempotent arm, the retry classifier) must see the
+* `DeleteVolume` failure, not the describe that tried to explain it. A
+* non-extensible error, or one that already has a cause, is returned as-is.
+*/
+function withCause(original, cause) {
+	if (typeof original === "object" && original !== null && Object.isExtensible(original) && original.cause === void 0) Object.defineProperty(original, "cause", {
+		value: cause,
+		configurable: true,
+		writable: true,
+		enumerable: false
+	});
+	return original;
+}
+/** The volume's state, or `undefined` when EC2 reports it does not exist. */
+async function readVolumeState(client, volumeId) {
+	try {
+		const volume = (await client.send(new DescribeVolumesCommand({ VolumeIds: [volumeId] }))).Volumes?.[0];
+		return volume === void 0 ? void 0 : volume.State ?? "unknown";
+	} catch (error) {
+		if (errorName(error) === "InvalidVolume.NotFound") return void 0;
+		throw error;
+	}
+}
+/** The error's `name`, or `''` — never throws, whatever was rejected. */
+function errorName(error) {
+	if (typeof error !== "object" || error === null) return "";
+	const name = error.name;
+	return typeof name === "string" ? name : "";
+}
+
 //#endregion
 //#region src/deployment/delete-outcome.ts
 /**
@@ -35188,99 +35581,6 @@ function slowCcOperationTimeoutMs(resourceType, operation) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/wait-abandoned.ts
-/**
-* The "cdkd stopped watching an operation that may still be running" marker
-* (issue [#3236](https://github.com/go-to-k/cdkd/issues/3236), widened by
-* [#3253](https://github.com/go-to-k/cdkd/issues/3253)).
-*
-* `CloudControlWaitAbandonedError` is raised in `cloud-control-provider.ts`,
-* but FIVE call sites have to refuse it, and three of them live in other
-* files. Four are GOVERNED by
-* `tests/unit/provisioning/wait-abandoned-guard-population.test.ts`:
-*
-*  - `cloud-control-provider.ts`'s own `delete()` catch,
-*  - `deploy-engine.ts`'s replacement delete-then-CREATE arm,
-*  - `deploy-engine.ts`'s template-removal delete arm,
-*  - `destroy-runner.ts`'s per-resource delete loop.
-*
-* The FIFTH is `cleanupFailedCreateRemnant`, and it is outside that population
-* by construction rather than by oversight: its partner classifier is the
-* REGEX helper `isNotFoundMessage`, which carries no literal needles, so no
-* needle-driven scan can find it. It has a behavioural case instead, and it
-* needs the guard for a sharper reason than the other four — that regex is
-* case-INSENSITIVE, so `getaddrinfo ENOTFOUND ...` matches `/not\s*found/i`.
-*
-* Each decides "the resource is already gone" by SUBSTRING-matching the error
-* message, and each then DROPS the state row. An abandoned wait says the
-* opposite — the delete may still be running — and its message interpolates
-* the LOGICAL ID and the last-seen IDENTIFIER, both user- or template-chosen,
-* so a resource named `PageNotFound` satisfies those needles. Round 1 of
-* go-to-k/cdkd#3249 guarded the first site with a local `instanceof` and left
-* the other three, which is what this module exists to fix: ONE predicate the
-* three foreign sites can import without importing the provider.
-*
-* **A marker rather than an exported class + `instanceof`**, for the reason
-* `markNonRetryable` is one: `deploy-engine.ts` reaches the provider only
-* through `ProviderRegistry`, so importing the class there would add an edge
-* into an already dense ring, and a marker survives a wrapper that copies a
-* message without preserving a prototype.
-*
-* **NOT `markNonRetryable`**, though the mechanism is identical: a DELETE or
-* UPDATE abandonment is deliberately left RETRYABLE so the destroy runner can
-* re-issue an idempotent delete, and only CREATE is marked. Reusing that
-* marker would either make the guards miss DELETE — the case that drops a
-* state row — or make a DELETE non-retryable and lose the recovery.
-*
-* A LEAF: no imports, ever. All four consumers sit on the deploy engine ->
-* rollback executor -> registry -> provider ring, and a new edge into it from
-* any of them would close a cycle.
-*/
-const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
-/**
-* The `.cause` walk depth, the same bound `retryable-errors.ts` uses. cdkd
-* wraps errors, so the marked error is routinely one or two hops down.
-*/
-const MAX_CAUSE_CHAIN_DEPTH = 5;
-/**
-* Stamp an error as an abandoned wait.
-*
-* `E extends Error`, not `object`: the reader below is a PROTOTYPE-CHAIN
-* lookup, so marking a class or a shared prototype would silently mark every
-* instance of it. A non-extensible (frozen / sealed) error is returned
-* UNMARKED rather than allowed to throw — callers use this inline, so a
-* `TypeError` raised here would REPLACE the error the caller meant to raise.
-* Both rules are `markNonRetryable`'s, for its reasons.
-*/
-function markWaitAbandoned(error) {
-	if (!Object.isExtensible(error)) return error;
-	Object.defineProperty(error, WAIT_ABANDONED_MARKER, {
-		value: true,
-		enumerable: false,
-		configurable: true,
-		writable: false
-	});
-	return error;
-}
-/**
-* True when the error, or anything in its bounded `.cause` chain, was marked
-* by {@link markWaitAbandoned}.
-*
-* Every already-deleted classifier must test this BEFORE its substring match,
-* and must treat a true answer as "not already deleted" — i.e. re-throw. The
-* ordering is the whole point: a message-first guard has already decided by
-* the time it would consult the marker.
-*/
-function isWaitAbandonedError(error) {
-	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
-		if (current[WAIT_ABANDONED_MARKER] === true) return true;
-		current = current.cause;
-	}
-	return false;
-}
-
 //#endregion
 //#region src/provisioning/cloud-control-provider.ts
 /**
@@ -35961,7 +36261,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D9EJApN9.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BDhrXE5Y.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -35971,8 +36271,20 @@ var CloudControlProvider = class {
 			const protectionEntry = ccProtectionProperty(resourceType);
 			if (protectionEntry) await this.disableCcProtection(logicalId, physicalId, resourceType, protectionEntry);
 		}
+		const volumeEc2Client = resourceType === "AWS::EC2::Volume" ? await this.ec2ClientInCcRegion(resourceType, logicalId, physicalId) : void 0;
 		const maxAttempts = isProtectedEc2Instance ? 5 : 1;
 		for (let attempt = 1;; attempt++) try {
+			if (volumeEc2Client !== void 0) {
+				await deleteEc2VolumeDirect(volumeEc2Client, physicalId, logicalId, {
+					logger: this.logger,
+					sleep: (ms) => this.sleep(ms),
+					maxWaitMs: Math.max(this.MAX_WAIT_TIME_MS, slowCcOperationTimeoutMs(resourceType, "DELETE")),
+					transientGraceMs: this.POLL_TRANSIENT_GRACE_MS,
+					isTransientFailure: isTransientPollFailure
+				});
+				this.logger.debug(`Deleted resource ${logicalId}`);
+				return withIndeterminateGuard(void 0, indeterminateGuard);
+			}
 			const deleteResponse = await this.cloudControlClient.send(new DeleteResourceCommand({
 				TypeName: resourceType,
 				Identifier: physicalId
@@ -36000,6 +36312,32 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
+	* The EC2 client for a delete this provider issues through EC2 instead of
+	* Cloud Control (issue #3455), refused unless it targets the SAME region as
+	* the Cloud Control client the region pre-flight vetted.
+	*
+	* `getAwsClients()` is read at call time while `cloudControlClient` was
+	* captured at construction, so the two are not the same object and could
+	* name different regions. The comparison is load-bearing rather than
+	* defensive: a volume id is region-scoped, so a wrong-region `DeleteVolume`
+	* answers `InvalidVolume.NotFound`, which the caller's already-deleted arm
+	* would take as success and drop the record of a live volume.
+	*/
+	async ec2ClientInCcRegion(resourceType, logicalId, physicalId) {
+		const ec2 = getAwsClients().ec2;
+		const resolve = async (client) => {
+			try {
+				return canonicalizeRegion((await client.config.region())?.trim());
+			} catch {
+				return;
+			}
+		};
+		const ccRegion = await resolve(this.cloudControlClient);
+		const ec2Region = await resolve(ec2);
+		if (ccRegion === void 0 || ccRegion === "" || ccRegion !== ec2Region) throw markNonRetryable(new ProvisioningError(`Refusing to delete ${logicalId} (${resourceType}, ${physicalId}): the EC2 client targets region '${ec2Region ?? "unknown"}' but the Cloud Control client targets '${ccRegion ?? "unknown"}', so cdkd cannot show the delete would reach this volume. Re-run with --region set to the stack's region.`, resourceType, logicalId, physicalId));
+		return ec2;
+	}
+	/**
 	* Refuse a Cloud Control call whose target region cannot be shown to be the
 	* one the state record was written in (issue #2301).
 	*
@@ -51280,5 +51618,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, markRedactedCause as $a, PARTITION_TABLE as $i, repairMalformedResourcePropertiesForReadOnly as $n, AssetModeResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalStartServiceError as Aa, getLegacyStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StateError as Ba, ssmResolvedValueType as Bi, refuseMalformedOrphansForDestroy as Bn, importableOutputKeys as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, ConfigError as Ca, escapeRegExp$1 as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DynamicReferenceRegionAmbiguousError as Da, Synthesizer as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DeployCancelledError as Ea, getDockerImageBySourceHash as Ei, malformedLocalOutputsWarning as En, LockManager as Er, deleteSkipReason as Et, extractDeploymentEventError as F, ProvisioningError as Fa, resolveStateBucketWithDefault as Fi, malformedResourcesWarning as Fn, DEFAULT_STATE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, withErrorHandling as Ga, uploadCfnTemplate as Gi, refuseMalformedResourceEntries as Gn, shouldRetainResource as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, formatError as Ha, CFN_TEMPLATE_URL_LIMIT as Hi, refuseMalformedOutputs as Hn, isReadableBag as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ResourceTimeoutError as Ia, resolveStateBucketWithDefaultAndSource as Ii, malformedStateRefusalMessage as In, exportNamesCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, isMarkedNonRetryable as Ja, injectiveKeyPrefix as Ji, refuseMalformedResourcesForDestroy as Jn, WorkGraph as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, pasteableCommand as Ka, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ki, refuseMalformedResourceEntriesForOrphan as Kn, AssetPublisher as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceUpdateNotSupportedError as La, resolveUseCdkBootstrapAssets as Li, refuseDivergentRecordRegionForDestroy as Ln, hasReadableExportSet as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, MalformedProducerRecordRefusalError as Ma, resolveAutoAssetStorage as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, NestedStackChildDirectDestroyError as Na, resolveCaptureObservedState as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, IntrinsicResolutionRefusalError as Oa, synthesisStatusMessage as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, PartialFailureError as Pa, resolveSkipPrefix as Pi, malformedResourcePropertiesWarning as Pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Pr, getAccountInfo as Pt, red as Q, markNonRetryable as Qa, expectedOwnerParam as Qi, repairMalformedResourceEntriesForReadOnly as Qn, rewriteTemplateAssetReferences as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, StackHasActiveImportsError as Ra, stateBucketExistenceConfirmed as Ri, refuseMalformedNestedChildOutputs as Rn, hasReasonlessBaselineRefusal as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CdkdError as Sa, runDockerStreaming as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, DependencyError as Ta, AssetManifestLoader as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isCdkdError as Ua, MIGRATE_TMP_PREFIX as Ui, refuseMalformedOutputsForDestroy as Un, orphansAfterRollback as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, SynthesisError as Va, CFN_TEMPLATE_BODY_LIMIT as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputs as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, normalizeAwsError as Wa, findLargeInlineResources as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansCarriedFrom as Wr, assertRegionMatch as Wt, gray as X, isThrottlingError as Xa, producerRecordKey as Xi, repairMalformedOrphansForReadOnly as Xn, createAssetRedirectResolver as Xr, readConfigString as Xt, cyan as Y, isRetryableTransientError as Ya, producerCoordinateKey as Yi, refuseMalformedState as Yn, buildAssetRedirectMap as Yr, configStringRefusal as Yt, green as Z, isTransientServerError as Za, decodeListingKey as Zi, repairMalformedOutputsForReadOnly as Zn, loadPublishableAssetManifest as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, getAwsClients as _a, formatDockerLoginError as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, processStackMessages as aa, parseBootstrapMarker as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, setAwsClients as ba, redactDockerArgvValues as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasPlainPrototype$1 as ca, validateContainerRepoName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, absoluteAssemblyPathEscape as da, resolveDockerContextDirectory as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, canonicalizeRegion as ea, BOOTSTRAP_MARKER_PREFIX as ei, requireConfigString as en, retryClassificationText as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, renderAssemblyPathEscape as fa, warnManifestExecutable as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, AwsClients as ga, dockerSpawnEnvWithSensitive as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveBucketRegion as ha, describeDockerFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, globMatches as ia, isCrossRegionRedirect as ii, s3BucketArn as in, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LockError as ja, resolveApp as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, LocalInvokeBuildError as ka, getDefaultStateBucketName as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, nullPrototypeRecord as la, buildDenyExternalAccessPolicy as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, clearBucketRegionCache as ma, describeDockerExecFailure as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssemblyReader as na, ensureAssetStorage as ni, producerRegionsFromState as nn, safeStringify$1 as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, defineOwnKey as oa, readBootstrapMarkerBody as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, resolveAssemblyPath as pa, describeDockerCapturedOutput as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, shellQuote as qa, injectiveKey as qi, refuseMalformedResourcePropertiesForOrphan as qn, stringifyValue as qr, configBooleanRefusal as qt, DeployEngine as r, failedStageNote as ra, getBootstrapMarkerKey as ri, withSharedDrainBudget as rn, __exportAll as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, hasOwnKey as sa, validateAssetBucketName as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, derivePartitionAndUrlSuffix as ta, assertAssetBucketRegion as ti, classifyReplaySecretRegion as tn, describeAwsFailure as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, ownValue as ua, buildDockerImage as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, resetAwsClients as va, getDockerCmd as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, CrossAccountSecretRefusalError as wa, stripControlChars as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, AssetError as xa, runDockerForeground as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, runWithStackAwsClients as ya, partitionSensitiveEnv as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackTerminationProtectionError as za, warnDeprecatedNoPrefixCliFlag as zi, refuseMalformedOrphans as zn, hasUnverifiableParameterRefusal as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-TkL9nyq8.js.map
+export { yellow as $, isMarkedNonRetryable as $a, injectiveKeyPrefix as $i, repairMalformedResourcePropertiesForReadOnly as $n, AssetModeResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, DependencyError as Aa, AssetManifestLoader as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, ProvisioningError as Ba, resolveStateBucketWithDefault as Bi, refuseMalformedOrphansForDestroy as Bn, importableOutputKeys as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, resetAwsClients as Ca, partitionSensitiveEnv as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, UNSPECIFIED_SKIP_REASON as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, CdkdError as Da, warnFinchArgvExposure as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, AssetError as Ea, runDockerStreaming as Ei, malformedLocalOutputsWarning as En, LockManager as Er, isWaitAbandonedError as Et, extractDeploymentEventError as F, LocalStartServiceError as Fa, getLegacyStateBucketName as Fi, malformedResourcesWarning as Fn, DEFAULT_STATE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, StateError as Ga, ssmResolvedValueType as Gi, refuseMalformedResourceEntries as Gn, shouldRetainResource as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, ResourceUpdateNotSupportedError as Ha, resolveUseCdkBootstrapAssets as Hi, refuseMalformedOutputs as Hn, isReadableBag as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, LockError as Ia, resolveApp as Ii, malformedStateRefusalMessage as In, exportNamesCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, isCdkdError as Ja, MIGRATE_TMP_PREFIX as Ji, refuseMalformedResourcesForDestroy as Jn, WorkGraph as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, SynthesisError as Ka, CFN_TEMPLATE_BODY_LIMIT as Ki, refuseMalformedResourceEntriesForOrphan as Kn, AssetPublisher as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, MalformedProducerRecordRefusalError as La, resolveAutoAssetStorage as Li, refuseDivergentRecordRegionForDestroy as Ln, hasReadableExportSet as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, DynamicReferenceRegionAmbiguousError as Ma, Synthesizer as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, IntrinsicResolutionRefusalError as Na, synthesisStatusMessage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, ConfigError as Oa, escapeRegExp$1 as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, LocalInvokeBuildError as Pa, getDefaultStateBucketName as Pi, malformedResourcePropertiesWarning as Pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Pr, getAccountInfo as Pt, red as Q, shellQuote as Qa, injectiveKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, rewriteTemplateAssetReferences as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, NestedStackChildDirectDestroyError as Ra, resolveCaptureObservedState as Ri, refuseMalformedNestedChildOutputs as Rn, hasReasonlessBaselineRefusal as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, getAwsClients as Sa, isMalformedEnvKey as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, setAwsClients as Ta, runDockerForeground as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteSkipReason as Tt, coerceWarmThroughput as U, StackHasActiveImportsError as Ua, stateBucketExistenceConfirmed as Ui, refuseMalformedOutputsForDestroy as Un, orphansAfterRollback as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, ResourceTimeoutError as Va, resolveStateBucketWithDefaultAndSource as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputs as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, StackTerminationProtectionError as Wa, warnDeprecatedNoPrefixCliFlag as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansCarriedFrom as Wr, assertRegionMatch as Wt, gray as X, withErrorHandling as Xa, uploadCfnTemplate as Xi, repairMalformedOrphansForReadOnly as Xn, createAssetRedirectResolver as Xr, readConfigString as Xt, cyan as Y, normalizeAwsError as Ya, findLargeInlineResources as Yi, refuseMalformedState as Yn, buildAssetRedirectMap as Yr, configStringRefusal as Yt, green as Z, pasteableCommand as Za, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Zi, repairMalformedOutputsForReadOnly as Zn, loadPublishableAssetManifest as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, renderAssemblyPathEscape as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, canonicalizeRegion as aa, parseBootstrapMarker as ai, s3BucketDomainName as an, retryClassificationText as ao, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, resolveBucketRegion as ba, getDockerCmd as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, failedStageNote as ca, validateContainerRepoName as ci, s3BucketWebsiteUrl as cn, __exportAll as co, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, defineOwnKey as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, producerCoordinateKey as ea, BOOTSTRAP_MARKER_PREFIX as ei, requireConfigString as en, isRetryableTransientError as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, hasOwnKey as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, absoluteAssemblyPathEscape as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, ownValue as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, PARTITION_TABLE as ia, isCrossRegionRedirect as ii, s3BucketArn as in, markRedactedCause as io, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, DeployCancelledError as ja, getDockerImageBySourceHash as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, CrossAccountSecretRefusalError as ka, stripControlChars as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, globMatches as la, buildDenyExternalAccessPolicy as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, nullPrototypeRecord as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, decodeListingKey as na, ensureAssetStorage as ni, producerRegionsFromState as nn, isTransientServerError as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, derivePartitionAndUrlSuffix as oa, readBootstrapMarkerBody as oi, s3BucketDualStackDomainName as on, describeAwsFailure as oo, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, hasPlainPrototype$1 as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, formatError as qa, CFN_TEMPLATE_URL_LIMIT as qi, refuseMalformedResourcePropertiesForOrphan as qn, stringifyValue as qr, configBooleanRefusal as qt, DeployEngine as r, expectedOwnerParam as ra, getBootstrapMarkerKey as ri, withSharedDrainBudget as rn, markNonRetryable as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, AssemblyReader as sa, validateAssetBucketName as si, s3BucketRegionalDomainName as sn, safeStringify$1 as so, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, producerRecordKey as ta, assertAssetBucketRegion as ti, classifyReplaySecretRegion as tn, isThrottlingError as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, processStackMessages as ua, assertCdkLocalDockerContextContained as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, resolveAssemblyPath as va, finchSecretArgvRefusal as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, runWithStackAwsClients as wa, redactDockerArgvValues as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, deleteIndeterminateGuards as wt, bindingSkippedOutputs as x, AwsClients as xa, isDockerClientEnvKey as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, clearBucketRegionCache as ya, formatDockerLoginError as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, PartialFailureError as za, resolveSkipPrefix as zi, refuseMalformedOrphans as zn, hasUnverifiableParameterRefusal as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-D4svwrnK.js.map