@go-to-k/cdkd 0.278.26 → 0.278.28

package/dist/{deploy-engine-BsHkBRtK.js → deploy-engine-Dcg1nH3d.js}

@@ -9094,6 +9094,133 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/config-shape.ts
+/**
+* Shape guards for nested CloudFormation config blocks read by SDK providers.
+*
+* The bug class this exists for (issue #1471): a provider reads a string out
+* of a nested block with
+*
+* ```ts
+* const status = (versioningConfig['Status'] as string) || 'Suspended';
+* ```
+*
+* When `versioningConfig` is a STRING / array / number rather than the object
+* the template was supposed to carry, the index yields `undefined` and the
+* `||` substitutes the default — which is frequently the OPPOSITE of what the
+* template declared. `VersioningConfiguration: 'Enabled'` (a hand-written L1
+* template, or an intrinsic the resolver could not resolve) therefore turned
+* versioning OFF on a live bucket with no error anywhere. The same shape was
+* measured at 16 sites across 5 providers.
+*
+* `readConfigString` is that read, done safely, in ONE place — so the class is
+* fixed by construction rather than by 16 hand-written `throw`s that can each
+* be subtly different.
+*
+* Four rules, each of which the versioning case forced (see #1471):
+*
+* 1. **An absent container is not an error.** `undefined` / `null` means the
+*    template omitted the block, and the caller's default is the right answer.
+* 2. **A present-but-non-object container is refused.** This is the headline
+*    bug: a string container silently produced the default.
+* 3. **An absent KEY is not an error** — `{}` legitimately means "defaulted",
+*    e.g. `VersioningConfiguration: {}` really does mean Suspended.
+* 4. **A present-but-unusable key is refused.** `{ Status: null }` and
+*    `{ Status: '' }` both pass a `typeof container === 'object'` check and
+*    still fall through to the default, so validating the CONTAINER alone is
+*    not enough — the FIELD has to be validated too.
+*
+* **Callers must pass the DESIRED side only.** The previous side comes from
+* cdkd state, not from the user's template: a stack deployed by an older cdkd
+* that already recorded a malformed value would otherwise throw on every
+* subsequent `cdkd deploy`, with no way out except hand-editing the S3 state
+* file (editing the template does not help, because the previous side stays
+* malformed until a deploy succeeds). An earlier attempt at this fix guarded
+* both sides and turned a silent misbehavior into an unrecoverable one; that
+* is why `KinesisProvider`'s read of `previousProperties.StreamModeDetails`
+* is deliberately left unguarded.
+*
+* This is a provider-layer guard rather than a pre-flight template check
+* because **rule 4** is only decidable AFTER intrinsic resolution: at pre-flight
+* time a legitimate `Fn::If`-valued block is an object whose `Status` key does
+* not exist yet, so a pre-flight field check would reject valid templates.
+* (Rule 3 is permissive and so cannot false-positive at any layer — it simply
+* could never be STRENGTHENED at pre-flight, since an absent key there is
+* indistinguishable from one an intrinsic will supply. Rule 2 alone genuinely
+* IS pre-flight-able; splitting one guard across two layers for it was judged
+* not worth the divergence.)
+*
+* The trade-off that choice accepts, recorded rather than left implicit: the
+* issue's pre-flight proposal would have failed BEFORE any AWS mutation,
+* whereas a provider-layer guard can throw after `CreateBucket` has already
+* succeeded. `create()` self-heals by deleting the partially-created bucket,
+* but a downstream refusal can still leave earlier sub-config PUTs applied —
+* the same exposure the pre-existing `applyOwnershipControls` throw has, and
+* still strictly better than a silent wrong-direction PUT.
+*/
+/**
+* Read an optional string field out of a nested CFn config block, refusing a
+* container or a value whose shape would otherwise be silently defaulted away.
+*
+* @param container The block the field lives in. Pass the provider's own
+*   `properties` bag directly when the field is top-level.
+* @param key The CFn field name.
+* @param fallback The value to use when the container or the key is absent.
+* @param containerPath CFn path of the CONTAINER, used to build both error
+*   messages, e.g. `AWS::S3::Bucket VersioningConfiguration` (the field is
+*   reported as `<containerPath>.<key>`).
+* @throws Error when the container is present but not a plain object, or the
+*   key is present but not a non-blank string.
+*/
+function readConfigString(container, key, fallback, containerPath) {
+	if (container === void 0 || container === null) return fallback;
+	if (!isPlainObject$1(container)) throw new Error(`${containerPath} must be an object (got ${describe(container)}) — check for an unresolved intrinsic or a mis-nested template value`);
+	return requireConfigString(container[key], fallback, `${containerPath}.${key}`);
+}
+/**
+* The value-level half of {@link readConfigString}, for a value the caller has
+* ALREADY read out of a container it knows is a plain object — in practice a
+* TOP-LEVEL property read straight off the provider's `properties` bag, where
+* only rules 3 and 4 can apply.
+*
+* Keep this form at top-level call sites rather than passing `properties` to
+* {@link readConfigString}: the `handled-property-wiring` critic
+* (`scripts/gen-handled-property-wiring.ts`) recognises a property as WIRED
+* from the `properties['X']` element-read at the call site, and deliberately
+* does not treat a whole-bag forward into a helper as evidence. Hiding the
+* read inside the helper made `S3DirectoryBucketProvider` and
+* `WAFv2WebACLProvider` report un-wired — a false handled claim, which is the
+* exact thing that critic exists to prevent.
+*
+* @param value The already-read field value.
+* @param fallback The value to use when the field is absent.
+* @param path CFn path used in the error message, e.g. `AWS::WAFv2::WebACL Scope`.
+* @throws Error when the value is present but not a non-blank string.
+*/
+function requireConfigString(value, fallback, path) {
+	if (value === void 0) return fallback;
+	if (fallback === "" && typeof value === "string") return value;
+	if (typeof value !== "string" || value.trim() === "") throw new Error(`${path} must be a non-empty string (got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value. Omit the field entirely to use the default` + (fallback === "" ? "" : ` (${fallback})`));
+	return value;
+}
+/**
+* A plain object, i.e. something a CFn config block can legitimately be.
+* Arrays are excluded on purpose: an array where an object belongs is one of
+* the malformed shapes this module exists to catch, and `typeof [] === 'object'`
+* would otherwise wave it through.
+*/
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Human-readable type for an error message, without dumping user data. */
+function describe(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
+	return typeof value === "object" ? "an object" : `a ${typeof value}`;
+}
+
 //#endregion
 //#region src/provisioning/region-check.ts
 /**
@@ -9601,7 +9728,7 @@ var WAFv2WebACLProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
 		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
-		const scope = properties["Scope"] || "REGIONAL";
+		const scope = requireConfigString(properties["Scope"], "REGIONAL", "AWS::WAFv2::WebACL Scope");
 		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
 			const tags = [];
@@ -12430,7 +12557,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DLScqiT2.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BJnh483x.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -18128,6 +18255,32 @@ async function withResourceDeadline(operation, opts) {
 /** The `--skip-final-snapshot` flag name cited by every refusal below. */
 const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 /**
+* The {@link CreateContext} every reverse-replacement re-create passes
+* (issue #1463). Both arms of that path — the create-first attempt and the
+* delete-new-first retry — revive the OLD resource from
+* `previousState.properties`, i.e. from a cdkd STATE record rather than the
+* template, so a provider pre-flight refusal has no template-side remedy and
+* must downgrade to a warning. Declared once so the two arms cannot drift.
+*
+* These are the only create call sites that can DECLARE a replay. The deploy
+* engine's five sites (CREATE, the property-driven replacement, the
+* `--recreate-via-*` destroy-then-create, the `--replace` delete-first
+* fallback, and the update-failure replacement) are all driven by freshly
+* resolved TEMPLATE properties, so they deliberately pass no context and the
+* refusal stands where the user can edit the input.
+*
+* The remaining call sites are the providers that re-create inside their own
+* `update()` (`this.create(...)` in ACM certificate / IAM managed policy / IAM
+* role / Lambda permission / SNS subscription). Those are NOT template-driven
+* — this executor's `revert` arm calls `provider.update(...)` with
+* `previousState.properties`, so they forward a STATE record on a replay — but
+* they CANNOT receive a context, because `update()` has no context parameter.
+* The constraint that follows is on providers, not on this constant: a
+* provider with a create-side pre-flight refusal must not re-create inside
+* `update()`. See `CreateContext` in `src/types/resource.ts`.
+*/
+const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
+/**
 * Which provisioning layer a delete must be judged against: the CURRENT
 * state record wins (it is what state says AWS holds right now), with the
 * journaled op's routing as the legacy-state fallback. Shared by both
@@ -18542,7 +18695,7 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				let deletedNewFirst = false;
 				let createResult;
 				try {
-					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }), op.logicalId, {
+					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
 						...RECREATE_RETRY_SCHEDULE,
 						logger,
 						...isInterrupted && {
@@ -18565,7 +18718,7 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					delete stateResources[op.logicalId];
 					await afterOp?.(op.logicalId);
 					try {
-						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }), op.logicalId, {
+						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
 							...RECREATE_RETRY_SCHEDULE,
 							logger,
 							...isInterrupted && {
@@ -18898,7 +19051,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.278.26";
+	return "0.278.28";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21009,5 +21162,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { isThrottlingError as $, setAwsClients as $t, red as A, getLegacyStateBucketName as At, isTerminationProtectionPropagationError as B, CFN_TEMPLATE_BODY_LIMIT as Bt, isStatefulRecreateTargetSync as C, __exportAll as Cn, runDockerForeground as Ct, cyan as D, Synthesizer as Dt, bold as E, getDockerImageBySourceHash as Et, ProviderRegistry as F, resolveStateBucketWithDefault as Ft, normalizeAwsTagsToCfn as G, expectedOwnerParam as Gt, cfnRefValueFromPhysicalId as H, MIGRATE_TMP_PREFIX as Ht, findActionableSilentDrops as I, resolveStateBucketWithDefaultAndSource as It, applyRoleArnIfSet as J, clearBucketRegionCache as Jt, resolveExplicitPhysicalId as K, AssemblyReader as Kt, CloudControlProvider as L, resolveUseCdkBootstrapAssets as Lt, IAMRoleProvider as M, resolveAutoAssetStorage as Mt, collectInlinePolicyNamesManagedBySiblings as N, resolveCaptureObservedState as Nt, gray as O, synthesisStatusMessage as Ot, clearOnUpdateRemoval as P, resolveSkipPrefix as Pt, isRetryableTransientError as Q, resetAwsClients as Qt, slowCcOperationTimeoutMs as R, stateBucketExistenceConfirmed as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, withErrorHandling as Sn, getDockerCmd as St, formatResourceLine as T, AssetManifestLoader as Tt, refStateLookupFromResource as U, findLargeInlineResources as Ut, IntrinsicFunctionResolver as V, CFN_TEMPLATE_URL_LIMIT as Vt, WAFv2WebACLProvider as W, uploadCfnTemplate as Wt, describeTypeWithThrottleRetry as X, AwsClients as Xt, DiffCalculator as Y, resolveBucketRegion as Yt, withRetry as Z, getAwsClients as Zt, createPreDeleteFinalSnapshot as _, StateError as _n, parseBootstrapMarker as _t, DeploymentEventsStore as a, LocalInvokeBuildError as an, shouldRetainResource as at, unsupportedFinalSnapshotError as b, isCdkdError as bn, buildDockerImage as bt, replayFailedOperations as c, LockError as cn, WorkGraph as ct, IMPLICIT_DELETE_DEPENDENCIES as d, PartialFailureError as dn, loadPublishableAssetManifest as dt, AssetError as en, DagBuilder as et, computeImplicitDeleteEdges as f, ProvisioningError as fn, rewriteTemplateAssetReferences as ft, ccRoutedFinalSnapshotError as g, StackTerminationProtectionError as gn, getBootstrapMarkerKey as gt, buildFinalSnapshotIdentifier as h, StackHasActiveImportsError as hn, ensureAssetStorage as ht, DeploymentEventsReader as i, DeployCancelledError as in, rebuildClientForBucketRegion as it, yellow as j, resolveApp as jt, green as k, getDefaultStateBucketName as kt, replayRollback as l, MissingCdkCliError as ln, buildAssetRedirectMap as lt, PRE_DELETE_SNAPSHOT_TYPES as m, ResourceUpdateNotSupportedError as mn, BOOTSTRAP_MARKER_PREFIX as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ConfigError as nn, LockManager as nt, planFailedOps as o, LocalMigrateError as on, AssetPublisher as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, ResourceTimeoutError as pn, AssetModeResolver as pt, assertRegionMatch as q, processStackMessages as qt, DeployEngine as r, DependencyError as rn, S3StateBackend as rt, planRollback as s, LocalStartServiceError as sn, stringifyValue as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CdkdError as tn, TemplateParser as tt, withResourceDeadline as u, NestedStackChildDirectDestroyError as un, createAssetRedirectResolver as ut, isFinalSnapshotError as v, SynthesisError as vn, validateAssetBucketName as vt, renderStatefulReason as w, runDockerStreaming as wt, extractDeploymentEventError as x, normalizeAwsError as xn, formatDockerLoginError as xt, refusesFinalSnapshot as y, formatError as yn, validateContainerRepoName as yt, disableInstanceApiTermination as z, warnDeprecatedNoPrefixCliFlag as zt };
-//# sourceMappingURL=deploy-engine-BsHkBRtK.js.map
+export { withRetry as $, getAwsClients as $t, red as A, synthesisStatusMessage as At, isTerminationProtectionPropagationError as B, stateBucketExistenceConfirmed as Bt, isStatefulRecreateTargetSync as C, normalizeAwsError as Cn, formatDockerLoginError as Ct, cyan as D, AssetManifestLoader as Dt, bold as E, runDockerStreaming as Et, ProviderRegistry as F, resolveCaptureObservedState as Ft, normalizeAwsTagsToCfn as G, findLargeInlineResources as Gt, cfnRefValueFromPhysicalId as H, CFN_TEMPLATE_BODY_LIMIT as Ht, findActionableSilentDrops as I, resolveSkipPrefix as It, readConfigString as J, AssemblyReader as Jt, resolveExplicitPhysicalId as K, uploadCfnTemplate as Kt, CloudControlProvider as L, resolveStateBucketWithDefault as Lt, IAMRoleProvider as M, getLegacyStateBucketName as Mt, collectInlinePolicyNamesManagedBySiblings as N, resolveApp as Nt, gray as O, getDockerImageBySourceHash as Ot, clearOnUpdateRemoval as P, resolveAutoAssetStorage as Pt, describeTypeWithThrottleRetry as Q, AwsClients as Qt, slowCcOperationTimeoutMs as R, resolveStateBucketWithDefaultAndSource as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, isCdkdError as Sn, buildDockerImage as St, formatResourceLine as T, __exportAll as Tn, runDockerForeground as Tt, refStateLookupFromResource as U, CFN_TEMPLATE_URL_LIMIT as Ut, IntrinsicFunctionResolver as V, warnDeprecatedNoPrefixCliFlag as Vt, WAFv2WebACLProvider as W, MIGRATE_TMP_PREFIX as Wt, applyRoleArnIfSet as X, clearBucketRegionCache as Xt, requireConfigString as Y, processStackMessages as Yt, DiffCalculator as Z, resolveBucketRegion as Zt, createPreDeleteFinalSnapshot as _, StackHasActiveImportsError as _n, ensureAssetStorage as _t, DeploymentEventsStore as a, DependencyError as an, S3StateBackend as at, unsupportedFinalSnapshotError as b, SynthesisError as bn, validateAssetBucketName as bt, replayFailedOperations as c, LocalMigrateError as cn, AssetPublisher as ct, IMPLICIT_DELETE_DEPENDENCIES as d, MissingCdkCliError as dn, buildAssetRedirectMap as dt, resetAwsClients as en, isRetryableTransientError as et, computeImplicitDeleteEdges as f, NestedStackChildDirectDestroyError as fn, createAssetRedirectResolver as ft, ccRoutedFinalSnapshotError as g, ResourceUpdateNotSupportedError as gn, BOOTSTRAP_MARKER_PREFIX as gt, buildFinalSnapshotIdentifier as h, ResourceTimeoutError as hn, AssetModeResolver as ht, DeploymentEventsReader as i, ConfigError as in, LockManager as it, yellow as j, getDefaultStateBucketName as jt, green as k, Synthesizer as kt, replayRollback as l, LocalStartServiceError as ln, stringifyValue as lt, PRE_DELETE_SNAPSHOT_TYPES as m, ProvisioningError as mn, rewriteTemplateAssetReferences as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as nn, DagBuilder as nt, planFailedOps as o, DeployCancelledError as on, rebuildClientForBucketRegion as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, PartialFailureError as pn, loadPublishableAssetManifest as pt, assertRegionMatch as q, expectedOwnerParam as qt, DeployEngine as r, CdkdError as rn, TemplateParser as rt, planRollback as s, LocalInvokeBuildError as sn, shouldRetainResource as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as tn, isThrottlingError as tt, withResourceDeadline as u, LockError as un, WorkGraph as ut, isFinalSnapshotError as v, StackTerminationProtectionError as vn, getBootstrapMarkerKey as vt, renderStatefulReason as w, withErrorHandling as wn, getDockerCmd as wt, extractDeploymentEventError as x, formatError as xn, validateContainerRepoName as xt, refusesFinalSnapshot as y, StateError as yn, parseBootstrapMarker as yt, disableInstanceApiTermination as z, resolveUseCdkBootstrapAssets as zt };
+//# sourceMappingURL=deploy-engine-Dcg1nH3d.js.map