@go-to-k/cdkd 0.243.0 → 0.245.0

package/dist/{deploy-engine-DNqZHDA5.js → deploy-engine-Ci_7Y2ol.js}

@@ -9335,10 +9335,8 @@ const NON_PROVISIONABLE_TYPES = new Set([
 	"AWS::ElastiCache::SecurityGroupIngress",
 	"AWS::ElasticLoadBalancingV2::ListenerCertificate",
 	"AWS::Elasticsearch::Domain",
-	"AWS::EMR::Cluster",
 	"AWS::EMR::InstanceFleetConfig",
 	"AWS::EMR::InstanceGroupConfig",
-	"AWS::FSx::FileSystem",
 	"AWS::FSx::Snapshot",
 	"AWS::FSx::StorageVirtualMachine",
 	"AWS::FSx::Volume",
@@ -9428,6 +9426,7 @@ const NON_PROVISIONABLE_TYPES = new Set([
 	"AWS::SageMaker::MonitoringScheduleAlert",
 	"AWS::SageMaker::NotebookInstance",
 	"AWS::SageMaker::NotebookInstanceLifecycleConfig",
+	"AWS::SageMaker::TransformJob",
 	"AWS::SageMaker::Workteam",
 	"AWS::SDB::Domain",
 	"AWS::ServiceDiscovery::Instance",
@@ -11901,6 +11900,38 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			["Targets", "not yet implemented by cdkd"]
 		])
 	}],
+	["AWS::EMR::Cluster", {
+		handled: new Set([
+			"AdditionalInfo",
+			"Applications",
+			"AutoScalingRole",
+			"AutoTerminationPolicy",
+			"BootstrapActions",
+			"Configurations",
+			"CustomAmiId",
+			"EbsRootVolumeIops",
+			"EbsRootVolumeSize",
+			"EbsRootVolumeThroughput",
+			"Instances",
+			"JobFlowRole",
+			"KerberosAttributes",
+			"LogEncryptionKmsKeyId",
+			"LogUri",
+			"ManagedScalingPolicy",
+			"Name",
+			"OSReleaseLabel",
+			"PlacementGroupConfigs",
+			"ReleaseLabel",
+			"ScaleDownBehavior",
+			"SecurityConfiguration",
+			"ServiceRole",
+			"StepConcurrencyLevel",
+			"Steps",
+			"Tags",
+			"VisibleToAllUsers"
+		]),
+		silentDrop: /* @__PURE__ */ new Map()
+	}],
 	["AWS::Events::EventBus", {
 		handled: new Set([
 			"DeadLetterConfig",
@@ -11928,6 +11959,26 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
+	["AWS::FSx::FileSystem", {
+		handled: new Set([
+			"BackupId",
+			"FileSystemType",
+			"FileSystemTypeVersion",
+			"KmsKeyId",
+			"LustreConfiguration",
+			"NetworkType",
+			"SecurityGroupIds",
+			"StorageCapacity",
+			"StorageType",
+			"SubnetIds",
+			"Tags"
+		]),
+		silentDrop: new Map([
+			["OntapConfiguration", "FSx for NetApp ONTAP variant — the file system is only a container for SVMs/volumes (separate AWS::FSx::StorageVirtualMachine / AWS::FSx::Volume types, both still unsupported), so shipping it alone would be misleading; only the Lustre variant is supported in v1. Follow-up to issue #1042."],
+			["OpenZFSConfiguration", "FSx for OpenZFS variant — root-volume semantics (RootVolumeId, child AWS::FSx::Volume trees) are not implemented in v1; only the Lustre variant is supported. Follow-up to issue #1042."],
+			["WindowsConfiguration", "FSx for Windows File Server variant — requires Active Directory wiring and Windows-specific update/delete semantics (final backups, throughput tiers) that v1 does not implement; only the Lustre variant (the CDK L2) is supported. Follow-up to issue #1042."]
+		])
+	}],
 	["AWS::Glue::Connection", {
 		handled: new Set(["CatalogId", "ConnectionInput"]),
 		silentDrop: /* @__PURE__ */ new Map()
@@ -12957,7 +13008,11 @@ function findActionableSilentDrops(resourceType, templateProperties, allowedKeys
 * 3. SDK Provider registered, no silent-drop properties (after the
 *    `--allow-unsupported-properties` override filter) → SDK Provider.
 * 4. SDK Provider registered, silent-drop properties present, NOT all
-*    in the allow set → Cloud Control (auto-route, info-logged).
+*    in the allow set → Cloud Control (auto-route, info-logged). When the
+*    CC route is NOT viable — the type is `NON_PROVISIONABLE` (no CC
+*    handlers, e.g. AWS::FSx::FileSystem) or the provider sets
+*    `disableCcApiFallback` (e.g. NestedStackProvider) — throw the clear
+*    pre-flight error instead of failing opaquely at provisioning time.
 * 5. SDK Provider registered, silent-drop properties present, ALL in
 *    the allow set → SDK Provider (the user explicitly accepted the
 *    silent drop, warn-logged).
@@ -12965,10 +13020,12 @@ function findActionableSilentDrops(resourceType, templateProperties, allowedKeys
 * 7. `--allow-unsupported-types` escape hatch → Cloud Control optimistically.
 * 8. Otherwise → throw (no provider available).
 *
-* Tier 3 (`NON_PROVISIONABLE`) types are rejected earlier by
-* {@link validateResourceTypes}; the silent-drop auto-route only fires for
-* Tier 1 types whose SDK Provider declares `handledProperties` and where
-* Cloud Control is guaranteed to be a viable alternative.
+* SDK-provider-less Tier 3 (`NON_PROVISIONABLE`) types are rejected earlier
+* by {@link validateResourceTypes}. A Tier 1 type that is ALSO
+* NON_PROVISIONABLE (SDK provider registered for a type Cloud Control cannot
+* manage — e.g. AWS::FSx::FileSystem, AWS::DLM::LifecyclePolicy) passes the
+* type check but has no viable CC auto-route; rule 4's viability guard turns
+* that case into a clear pre-flight error.
 */
 /**
 * Types exempt from the sticky `provisionedBy: 'cc-api'` routing rule.
@@ -13103,6 +13160,7 @@ var ProviderRegistry = class {
 					provisionedBy: "sdk"
 				};
 			}
+			if (isNonProvisionable(resourceType) || specificProvider.disableCcApiFallback === true) throw new Error(this.buildUnroutableSilentDropMessage(resourceType, actionableDrops));
 			this.logger.debug(`Auto-routing ${resourceType} via Cloud Control (silent-drop properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
 			return {
 				provider: this.cloudControlProvider,
@@ -13127,6 +13185,21 @@ var ProviderRegistry = class {
 		throw new Error(`No provider available for resource type: ${resourceType}. This resource type is not supported by Cloud Control API and no SDK provider is registered.`);
 	}
 	/**
+	* Error message for a resource whose template uses SDK-provider-unhandled
+	* properties on a type where the Cloud Control auto-route (issue #614) is
+	* NOT viable — `ProvisioningType: NON_PROVISIONABLE` (no CC handlers) or a
+	* provider-level `disableCcApiFallback` opt-out. Includes each property's
+	* `unhandledByDesign` rationale so the user sees WHY it is unhandled, plus
+	* the `--allow-unsupported-properties` escape hatch (which forces the SDK
+	* path and accepts the drop — the provider may still reject the resource
+	* if the property is load-bearing, e.g. a non-Lustre FSx variant config).
+	*/
+	buildUnroutableSilentDropMessage(resourceType, drops) {
+		const details = drops.map((d) => `  - ${d.property}: ${d.rationale}`).join("\n");
+		const overrideHint = drops.map((d) => `${resourceType}:${d.property}`).join(",");
+		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${isNonProvisionable(resourceType) ? "ProvisioningType: NON_PROVISIONABLE — Cloud Control has no handlers for it" : "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)"}):\n${details}\nRemove the properties, or force the SDK provider path and accept the drop via --allow-unsupported-properties ${overrideHint} (the provider may still reject the resource if the property is required).`;
+	}
+	/**
 	* Legacy entry point that returns just the provider. Delegates to
 	* {@link getProviderFor} with no properties / no state-recorded layer —
 	* which means silent-drop auto-routing CANNOT fire (no template to
@@ -13204,14 +13277,17 @@ var ProviderRegistry = class {
 	/**
 	* Walk every resource in the template and identify top-level CFn
 	* properties cdkd's SDK provider would silently drop on write. As of
-	* issue [#614](https://github.com/go-to-k/cdkd/issues/614), this method
-	* **no longer throws** — silent drops now auto-route the resource through
-	* Cloud Control API by default (see {@link getProviderFor}). The method
-	* is retained on the name `validateResourceProperties` so existing deploy
-	* call sites continue to work; it now emits info-level routing decisions
+	* issue [#614](https://github.com/go-to-k/cdkd/issues/614), silent drops
+	* auto-route the resource through Cloud Control API by default (see
+	* {@link getProviderFor}) — the method emits info-level routing decisions
 	* for each silent-drop resource, plus warn-level lines for resources
 	* where the user explicitly opted into the silent drop via
-	* `--allow-unsupported-properties`.
+	* `--allow-unsupported-properties`. The ONE remaining throw path is the
+	* CC-route viability guard: when the auto-route target cannot manage the
+	* type (`NON_PROVISIONABLE` or a provider-level `disableCcApiFallback`
+	* opt-out — e.g. AWS::FSx::FileSystem's Windows/ONTAP/OpenZFS blocks),
+	* this rejects pre-flight with a clear per-property error instead of
+	* letting provisioning fail opaquely.
 	*
 	* Must be called AFTER {@link validateResourceTypes} — type-level errors
 	* are still hard rejects. For a type allowed via `--allow-unsupported-types`,
@@ -13228,11 +13304,13 @@ var ProviderRegistry = class {
 	* Info-log every silent-drop routing decision (auto-route via CC API) and
 	* warn-log every silent drop the user explicitly opted into via
 	* `--allow-unsupported-properties` (forced SDK path, the property will
-	* be dropped). Pure side-effect — does not mutate state and never throws.
+	* be dropped). Does not mutate state; throws ONLY for the CC-route
+	* viability guard (un-allowed silent drops on a type Cloud Control cannot
+	* manage — see {@link buildUnroutableSilentDropMessage}).
 	*
 	* Issue [#614](https://github.com/go-to-k/cdkd/issues/614). Replaces the
 	* pre-v0.16x throw path: silent drops are now a routing signal, not an
-	* error.
+	* error (except the viability guard above).
 	*
 	* When the optional `provisionedBy` (from existing state) is `'cc-api'`,
 	* the auto-route info line is demoted to `debug` — the resource has been
@@ -13255,6 +13333,8 @@ var ProviderRegistry = class {
 				else autoRouted.push(property);
 			}
 			if (autoRouted.length > 0) {
+				const provider = this.providers.get(resourceType);
+				if (isNonProvisionable(resourceType) || provider?.disableCcApiFallback === true) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)))}`);
 				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${autoRouted.join(", ")} — CC API will forward the full property map. Override via --allow-unsupported-properties ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")}.)`;
 				if (provisionedBy === "cc-api") this.logger.debug(message);
 				else this.logger.info(message);
@@ -14012,6 +14092,7 @@ const STATEFUL_TYPES = new Set([
 	"AWS::DynamoDB::Table",
 	"AWS::DynamoDB::GlobalTable",
 	"AWS::EFS::FileSystem",
+	"AWS::FSx::FileSystem",
 	"AWS::S3::Bucket",
 	"AWS::ECR::Repository",
 	"AWS::Kinesis::Stream",
@@ -14395,6 +14476,7 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"KMS key is invalid for CreateGrant",
 	"Policy contains a statement with one or more invalid principals",
 	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
 	"Could not deliver test message",
 	"wait 60 seconds",
 	"concurrent update operation",
@@ -15826,11 +15908,12 @@ var DeployEngine = class {
 						} else throw updateError;
 					}
 					if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+					const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
 					stateResources[logicalId] = {
 						physicalId: result.physicalId,
 						resourceType,
 						properties: resolvedProps,
-						...result.attributes && { attributes: result.attributes },
+						...carriedAttributes && { attributes: carriedAttributes },
 						...dependencies && dependencies.length > 0 && { dependencies },
 						...this.extractTemplateAttributes(template, logicalId),
 						provisionedBy: resultProvisionedBy
@@ -16092,4 +16175,4 @@ var DeployEngine = class {
 
 //#endregion
 export { getDockerCmd as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, resolveBucketRegion as Ct, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, parseBootstrapMarker as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, formatDockerLoginError as Q, stringifyValue as R, ProviderRegistry as S, clearBucketRegionCache as St, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, validateContainerRepoName as X, validateAssetBucketName as Y, buildDockerImage as Z, green as _, CFN_TEMPLATE_URL_LIMIT as _t, withRetry as a, synthesisStatusMessage as at, IAMRoleProvider as b, uploadCfnTemplate as bt, computeImplicitDeleteEdges as c, resolveApp as ct, isStatefulRecreateTargetSync as d, resolveSkipPrefix as dt, runDockerForeground as et, renderStatefulReason as f, resolveStateBucketWithDefault as ft, gray as g, CFN_TEMPLATE_BODY_LIMIT as gt, cyan as h, warnDeprecatedNoPrefixCliFlag as ht, withResourceDeadline as i, Synthesizer as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveAutoAssetStorage as lt, bold as m, resolveUseCdkBootstrapAssets as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetManifestLoader as nt, isRetryableTransientError as o, getDefaultStateBucketName as ot, formatResourceLine as p, resolveStateBucketWithDefaultAndSource as pt, getBootstrapMarkerKey as q, DeployEngine as r, getDockerImageBySourceHash as rt, IMPLICIT_DELETE_DEPENDENCIES as s, getLegacyStateBucketName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, runDockerStreaming as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveCaptureObservedState as ut, red as v, MIGRATE_TMP_PREFIX as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, AssemblyReader as xt, yellow as y, findLargeInlineResources as yt, WorkGraph as z };
-//# sourceMappingURL=deploy-engine-DNqZHDA5.js.map
+//# sourceMappingURL=deploy-engine-Ci_7Y2ol.js.map