@go-to-k/cdkd 0.271.0 → 0.273.0

package/dist/{deploy-engine-DlTH1ou6.js → deploy-engine-DrZSOAoG.js}

@@ -11425,6 +11425,34 @@ function unescapeJsonPointerSegment(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
+//#endregion
+//#region src/provisioning/cc-protection-properties.ts
+const CC_PROTECTION_PROPERTIES = {
+	"AWS::DSQL::Cluster": {
+		property: "DeletionProtectionEnabled",
+		offValue: false
+	},
+	"AWS::NeptuneGraph::Graph": {
+		property: "DeletionProtection",
+		offValue: false
+	},
+	"AWS::SMSVOICE::ProtectConfiguration": {
+		property: "DeletionProtectionEnabled",
+		offValue: false
+	},
+	"AWS::VerifiedPermissions::PolicyStore": {
+		property: "DeletionProtection",
+		offValue: { Mode: "DISABLED" }
+	}
+};
+/**
+* Returns the protection entry for a CC-routed resource type, or undefined
+* when the type has no registered protection property.
+*/
+function ccProtectionProperty(resourceType) {
+	return CC_PROTECTION_PROPERTIES[resourceType];
+}
+
 //#endregion
 //#region src/provisioning/unsupported-types.generated.ts
 /**
@@ -11958,12 +11986,16 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CpHXw10b.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-kIy8tYTG.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
 		if (isProtectedEc2Instance) await disableInstanceApiTermination(getAwsClients().ec2, physicalId, this.logger);
+		if (context?.removeProtection === true) {
+			const protectionEntry = ccProtectionProperty(resourceType);
+			if (protectionEntry) await this.disableCcProtection(logicalId, physicalId, resourceType, protectionEntry);
+		}
 		const maxAttempts = isProtectedEc2Instance ? 5 : 1;
 		for (let attempt = 1;; attempt++) try {
 			const deleteResponse = await this.cloudControlClient.send(new DeleteResourceCommand({
@@ -11992,6 +12024,40 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
+	* Set a registry-declared deletion-protection property to its "off" value
+	* in-place via a CC UpdateResource patch (issues #1312 / #1314).
+	* Best-effort: failures are logged at warn and swallowed — the subsequent
+	* DeleteResource surfaces the real error if the protection is still on.
+	* The `add` patch op is used (RFC 6902: replaces when the path exists,
+	* adds when absent), so the flip is idempotent regardless of whether the
+	* live model carries the property.
+	*/
+	async disableCcProtection(logicalId, physicalId, resourceType, entry) {
+		const protectionProperty = entry.property;
+		this.logger.debug(`Disabling ${protectionProperty} on ${logicalId} (${resourceType}) before delete (--remove-protection)`);
+		try {
+			const patch = [{
+				op: "add",
+				path: `/${protectionProperty}`,
+				value: entry.offValue
+			}];
+			const response = await this.cloudControlClient.send(new UpdateResourceCommand({
+				TypeName: resourceType,
+				Identifier: physicalId,
+				PatchDocument: JSON.stringify(patch)
+			}));
+			if (!response.ProgressEvent?.RequestToken) {
+				this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId}: no request token received; proceeding with delete`);
+				return;
+			}
+			await this.waitForOperation(response.ProgressEvent.RequestToken, logicalId, "UPDATE", resourceType);
+			this.logger.debug(`Disabled ${protectionProperty} on ${logicalId}`);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId} (${resourceType}): ${message}; proceeding with delete`);
+		}
+	}
+	/**
 	* Get current state of a resource
 	*/
 	async getResourceState(resourceType, physicalId) {
@@ -17689,7 +17755,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.271.0";
+	return "0.273.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -19735,4 +19801,4 @@ var DeployEngine = class {
 
 //#endregion
 export { WorkGraph as $, LockError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LocalStartServiceError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalInvokeBuildError as Xt, rebuildClientForBucketRegion as Y, DeployCancelledError as Yt, AssetPublisher as Z, LocalMigrateError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, ResourceUpdateNotSupportedError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, StateError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, isCdkdError as dn, buildDockerImage as dt, MissingCdkCliError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, normalizeAwsError as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceTimeoutError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, SynthesisError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, __exportAll as mn, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, PartialFailureError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackHasActiveImportsError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, withErrorHandling as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ProvisioningError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StackTerminationProtectionError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, NestedStackChildDirectDestroyError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, formatError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
-//# sourceMappingURL=deploy-engine-DlTH1ou6.js.map
+//# sourceMappingURL=deploy-engine-DrZSOAoG.js.map