@go-to-k/cdkd 0.271.0 → 0.272.0

package/dist/{deploy-engine-DlTH1ou6.js → deploy-engine-DbrhfQ9b.js}

@@ -11425,6 +11425,35 @@ function unescapeJsonPointerSegment(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
+//#endregion
+//#region src/provisioning/cc-protection-properties.ts
+/**
+* Deletion-protection properties for Cloud-Control-routed resource types.
+*
+* Cloud Control's DeleteResource has no notion of deletion protection: a
+* protected resource simply fails to delete. For types WITH an SDK provider,
+* `--remove-protection` is implemented inside each provider's `delete()`
+* (RDS / DynamoDB / Cognito / etc.), and two special cases are hardcoded in
+* `CloudControlProvider.delete` (ASG delegation, EC2 `DisableApiTermination`).
+* This registry covers the remaining case: a CC-routed type whose protection
+* is an ordinary top-level boolean template property that can be flipped off
+* in-place via a CC UpdateResource patch right before DeleteResource.
+*
+* Only add entries verified against real AWS (the property name must match
+* the type's CFn schema exactly, and the type's UPDATE handler must support
+* flipping it in-place). Candidates such as `AWS::QLDB::Ledger`
+* (`DeletionProtection`) or `AWS::RDS::GlobalCluster` (`DeletionProtection`)
+* can join once live-verified — see issue #1312.
+*/
+const CC_PROTECTION_PROPERTIES = { "AWS::DSQL::Cluster": "DeletionProtectionEnabled" };
+/**
+* Returns the top-level protection property name for a CC-routed resource
+* type, or undefined when the type has no registered protection property.
+*/
+function ccProtectionProperty(resourceType) {
+	return CC_PROTECTION_PROPERTIES[resourceType];
+}
+
 //#endregion
 //#region src/provisioning/unsupported-types.generated.ts
 /**
@@ -11958,12 +11987,16 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CpHXw10b.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-qtJX36If.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
 		if (isProtectedEc2Instance) await disableInstanceApiTermination(getAwsClients().ec2, physicalId, this.logger);
+		if (context?.removeProtection === true) {
+			const protectionProperty = ccProtectionProperty(resourceType);
+			if (protectionProperty) await this.disableCcProtection(logicalId, physicalId, resourceType, protectionProperty);
+		}
 		const maxAttempts = isProtectedEc2Instance ? 5 : 1;
 		for (let attempt = 1;; attempt++) try {
 			const deleteResponse = await this.cloudControlClient.send(new DeleteResourceCommand({
@@ -11992,6 +12025,38 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
+	* Flip a registry-declared deletion-protection property off in-place via a
+	* CC UpdateResource patch (issue #1312). Best-effort: failures are logged
+	* at warn and swallowed — the subsequent DeleteResource surfaces the real
+	* error if the protection is still on. The `add` patch op is used (RFC
+	* 6902: replaces when the path exists, adds when absent), so the flip is
+	* idempotent regardless of whether the live model carries the property.
+	*/
+	async disableCcProtection(logicalId, physicalId, resourceType, protectionProperty) {
+		this.logger.debug(`Disabling ${protectionProperty} on ${logicalId} (${resourceType}) before delete (--remove-protection)`);
+		try {
+			const patch = [{
+				op: "add",
+				path: `/${protectionProperty}`,
+				value: false
+			}];
+			const response = await this.cloudControlClient.send(new UpdateResourceCommand({
+				TypeName: resourceType,
+				Identifier: physicalId,
+				PatchDocument: JSON.stringify(patch)
+			}));
+			if (!response.ProgressEvent?.RequestToken) {
+				this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId}: no request token received; proceeding with delete`);
+				return;
+			}
+			await this.waitForOperation(response.ProgressEvent.RequestToken, logicalId, "UPDATE", resourceType);
+			this.logger.debug(`Disabled ${protectionProperty} on ${logicalId}`);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId} (${resourceType}): ${message}; proceeding with delete`);
+		}
+	}
+	/**
 	* Get current state of a resource
 	*/
 	async getResourceState(resourceType, physicalId) {
@@ -17689,7 +17754,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.271.0";
+	return "0.272.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -19735,4 +19800,4 @@ var DeployEngine = class {
 
 //#endregion
 export { WorkGraph as $, LockError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LocalStartServiceError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalInvokeBuildError as Xt, rebuildClientForBucketRegion as Y, DeployCancelledError as Yt, AssetPublisher as Z, LocalMigrateError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, ResourceUpdateNotSupportedError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, StateError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, isCdkdError as dn, buildDockerImage as dt, MissingCdkCliError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, normalizeAwsError as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceTimeoutError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, SynthesisError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, __exportAll as mn, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, PartialFailureError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackHasActiveImportsError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, withErrorHandling as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ProvisioningError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StackTerminationProtectionError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, NestedStackChildDirectDestroyError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, formatError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
-//# sourceMappingURL=deploy-engine-DlTH1ou6.js.map
+//# sourceMappingURL=deploy-engine-DbrhfQ9b.js.map