@go-to-k/cdkd 0.278.25 → 0.278.27

package/dist/{deploy-engine-B65VTlrZ.js → deploy-engine-0SZS30V4.js}

@@ -12430,7 +12430,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BRlawK4H.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C2V8DwC0.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -18128,6 +18128,32 @@ async function withResourceDeadline(operation, opts) {
 /** The `--skip-final-snapshot` flag name cited by every refusal below. */
 const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 /**
+* The {@link CreateContext} every reverse-replacement re-create passes
+* (issue #1463). Both arms of that path — the create-first attempt and the
+* delete-new-first retry — revive the OLD resource from
+* `previousState.properties`, i.e. from a cdkd STATE record rather than the
+* template, so a provider pre-flight refusal has no template-side remedy and
+* must downgrade to a warning. Declared once so the two arms cannot drift.
+*
+* These are the only create call sites that can DECLARE a replay. The deploy
+* engine's five sites (CREATE, the property-driven replacement, the
+* `--recreate-via-*` destroy-then-create, the `--replace` delete-first
+* fallback, and the update-failure replacement) are all driven by freshly
+* resolved TEMPLATE properties, so they deliberately pass no context and the
+* refusal stands where the user can edit the input.
+*
+* The remaining call sites are the providers that re-create inside their own
+* `update()` (`this.create(...)` in ACM certificate / IAM managed policy / IAM
+* role / Lambda permission / SNS subscription). Those are NOT template-driven
+* — this executor's `revert` arm calls `provider.update(...)` with
+* `previousState.properties`, so they forward a STATE record on a replay — but
+* they CANNOT receive a context, because `update()` has no context parameter.
+* The constraint that follows is on providers, not on this constant: a
+* provider with a create-side pre-flight refusal must not re-create inside
+* `update()`. See `CreateContext` in `src/types/resource.ts`.
+*/
+const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
+/**
 * Which provisioning layer a delete must be judged against: the CURRENT
 * state record wins (it is what state says AWS holds right now), with the
 * journaled op's routing as the legacy-state fallback. Shared by both
@@ -18542,7 +18568,7 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				let deletedNewFirst = false;
 				let createResult;
 				try {
-					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }), op.logicalId, {
+					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
 						...RECREATE_RETRY_SCHEDULE,
 						logger,
 						...isInterrupted && {
@@ -18565,7 +18591,7 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					delete stateResources[op.logicalId];
 					await afterOp?.(op.logicalId);
 					try {
-						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }), op.logicalId, {
+						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
 							...RECREATE_RETRY_SCHEDULE,
 							logger,
 							...isInterrupted && {
@@ -18898,7 +18924,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.278.25";
+	return "0.278.27";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21010,4 +21036,4 @@ var DeployEngine = class {
 
 //#endregion
 export { isThrottlingError as $, setAwsClients as $t, red as A, getLegacyStateBucketName as At, isTerminationProtectionPropagationError as B, CFN_TEMPLATE_BODY_LIMIT as Bt, isStatefulRecreateTargetSync as C, __exportAll as Cn, runDockerForeground as Ct, cyan as D, Synthesizer as Dt, bold as E, getDockerImageBySourceHash as Et, ProviderRegistry as F, resolveStateBucketWithDefault as Ft, normalizeAwsTagsToCfn as G, expectedOwnerParam as Gt, cfnRefValueFromPhysicalId as H, MIGRATE_TMP_PREFIX as Ht, findActionableSilentDrops as I, resolveStateBucketWithDefaultAndSource as It, applyRoleArnIfSet as J, clearBucketRegionCache as Jt, resolveExplicitPhysicalId as K, AssemblyReader as Kt, CloudControlProvider as L, resolveUseCdkBootstrapAssets as Lt, IAMRoleProvider as M, resolveAutoAssetStorage as Mt, collectInlinePolicyNamesManagedBySiblings as N, resolveCaptureObservedState as Nt, gray as O, synthesisStatusMessage as Ot, clearOnUpdateRemoval as P, resolveSkipPrefix as Pt, isRetryableTransientError as Q, resetAwsClients as Qt, slowCcOperationTimeoutMs as R, stateBucketExistenceConfirmed as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, withErrorHandling as Sn, getDockerCmd as St, formatResourceLine as T, AssetManifestLoader as Tt, refStateLookupFromResource as U, findLargeInlineResources as Ut, IntrinsicFunctionResolver as V, CFN_TEMPLATE_URL_LIMIT as Vt, WAFv2WebACLProvider as W, uploadCfnTemplate as Wt, describeTypeWithThrottleRetry as X, AwsClients as Xt, DiffCalculator as Y, resolveBucketRegion as Yt, withRetry as Z, getAwsClients as Zt, createPreDeleteFinalSnapshot as _, StateError as _n, parseBootstrapMarker as _t, DeploymentEventsStore as a, LocalInvokeBuildError as an, shouldRetainResource as at, unsupportedFinalSnapshotError as b, isCdkdError as bn, buildDockerImage as bt, replayFailedOperations as c, LockError as cn, WorkGraph as ct, IMPLICIT_DELETE_DEPENDENCIES as d, PartialFailureError as dn, loadPublishableAssetManifest as dt, AssetError as en, DagBuilder as et, computeImplicitDeleteEdges as f, ProvisioningError as fn, rewriteTemplateAssetReferences as ft, ccRoutedFinalSnapshotError as g, StackTerminationProtectionError as gn, getBootstrapMarkerKey as gt, buildFinalSnapshotIdentifier as h, StackHasActiveImportsError as hn, ensureAssetStorage as ht, DeploymentEventsReader as i, DeployCancelledError as in, rebuildClientForBucketRegion as it, yellow as j, resolveApp as jt, green as k, getDefaultStateBucketName as kt, replayRollback as l, MissingCdkCliError as ln, buildAssetRedirectMap as lt, PRE_DELETE_SNAPSHOT_TYPES as m, ResourceUpdateNotSupportedError as mn, BOOTSTRAP_MARKER_PREFIX as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ConfigError as nn, LockManager as nt, planFailedOps as o, LocalMigrateError as on, AssetPublisher as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, ResourceTimeoutError as pn, AssetModeResolver as pt, assertRegionMatch as q, processStackMessages as qt, DeployEngine as r, DependencyError as rn, S3StateBackend as rt, planRollback as s, LocalStartServiceError as sn, stringifyValue as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CdkdError as tn, TemplateParser as tt, withResourceDeadline as u, NestedStackChildDirectDestroyError as un, createAssetRedirectResolver as ut, isFinalSnapshotError as v, SynthesisError as vn, validateAssetBucketName as vt, renderStatefulReason as w, runDockerStreaming as wt, extractDeploymentEventError as x, normalizeAwsError as xn, formatDockerLoginError as xt, refusesFinalSnapshot as y, formatError as yn, validateContainerRepoName as yt, disableInstanceApiTermination as z, warnDeprecatedNoPrefixCliFlag as zt };
-//# sourceMappingURL=deploy-engine-B65VTlrZ.js.map
+//# sourceMappingURL=deploy-engine-0SZS30V4.js.map