@go-to-k/cdkd 0.278.34 → 0.278.35

package/dist/{deploy-engine-Dp2u4Ktr.js → deploy-engine-CWZlo2Il.js}

@@ -9141,6 +9141,54 @@ async function applyRoleArnIfSet(opts) {
 * is why `KinesisProvider`'s read of `previousProperties.StreamModeDetails`
 * is deliberately left unguarded.
 *
+* **The `??` spelling has the same failure mode (issue #1493), and it defaults
+* on MORE than `||` did.** The #1471 sweep measured the `||` form;
+* `(cfg['K'] as string) ?? 'default'` substitutes on the same `undefined` a
+* malformed container indexes to, and ALSO on an explicit `null` — so a
+* `{ Comment: null }` that used to default now refuses, per rule 4.
+*
+* Measuring it is the part worth copying, because the obvious grep is wrong.
+* `\] \?\? '` finds NONE of the real sites (the cast sits inside the parens) and
+* the cast-word form `as [A-Za-z]+\) \?\? '` misses every `as string | undefined`
+* / quoted-union / line-wrapped site — including four this change rolls. The
+* class-covering pattern is `as [A-Za-z<>,| ]+\) \?\? '` (20 sites in
+* `providers/` on the pre-fix tree), plus a hand pass for the wrapped ones.
+*
+* ROLLED here: the 9 sites that INDEX A NESTED CONTAINER — CodeBuild
+* `Source` / `SecondarySources[]` / `Artifacts` / `SecondaryArtifacts[]` and
+* `Environment.{Type,ComputeType}`, DynamoDB GlobalTable
+* `StreamSpecification`, Route 53 `HostedZoneConfig` (create + update),
+* CloudFront OAI config (create + update), ECS `DeploymentController` — plus
+* the two `AWS::Lambda::Url` `AuthType` sites the #1471 sweep's
+* cast-specific grep missed (`as FunctionUrlAuthType`, not `as string`),
+* where the default is a PUBLIC function URL.
+*
+* Deliberately NOT rolled, so the decision is challengeable rather than
+* invisible:
+*
+* - **TOP-LEVEL `properties['X'] ?? 'default'` reads** (EC2 `InstanceType` /
+*   `Domain`, API Gateway `AuthorizationType`, IAM access-key `Status`, Lambda
+*   event-invoke `Qualifier`, RDS DB-proxy `TargetGroupName`, GlobalTable
+*   `BillingMode` on create and on the desired side of update). The container
+*   is the provider's own property bag, so rule 2 cannot fire; only rules 3/4
+*   would apply, and refusing a present-but-non-string value there is a
+*   stricter-value decision with its own regression surface (an unquoted YAML
+*   `IpProtocol: -1` is a NUMBER today and deploys fine). Tracked as issue #1513.
+* - **Nested reads whose value is an identity key or a label, never sent to
+*   AWS**: EC2's `rule['IpProtocol'] ?? '-1'` (composes a physical id and is
+*   read from BOTH the previous and next rule), `agentcore-evaluator`'s
+*   `(tag as Record<string, unknown>)['Value'] ?? ''`, and S3's three
+*   `rule['Id'] ?? '<unnamed>'` warning labels. These ARE nested containers —
+*   rule 2 could fire — but a refusal would buy nothing.
+* - **`EC2Provider`'s two `VpcId ?? ''` reads** — they populate the returned
+*   ATTRIBUTE cache only, and `CreateSecurityGroup` already forwards the same
+*   value, so AWS rejects a malformed one first. On the create site a guard
+*   would additionally throw AFTER a successful create and orphan the security
+*   group.
+* - **Reads off the PREVIOUS / state side** (GlobalTable `previousProperties`
+*   `BillingMode`, RDS DB-proxy `delete()` / `readCurrentState`) — the
+*   desired-side-only rule above.
+*
 * This is a provider-layer guard rather than a pre-flight template check
 * because **rule 4** is only decidable AFTER intrinsic resolution: at pre-flight
 * time a legitimate `Fn::If`-valued block is an object whose `Status` key does
@@ -9205,6 +9253,26 @@ function requireConfigString(value, fallback, path) {
 	return value;
 }
 /**
+* Refuse a present-but-non-ARRAY value where a CFn LIST block belongs.
+*
+* The list-shaped sibling of {@link readConfigString}, for the container one
+* level up from a per-item mapper. Without it a truthy non-array
+* (`SecondarySources: 'GITHUB'`) reaches `.map` and dies with a raw
+* `TypeError: … .map is not a function`, and a FALSY one (`''`) is silently
+* dropped by the truthiness gate that usually guards these — the same class
+* `readConfigString` exists for, one level up (issue #1493 review).
+*
+* Callers keep the ABSENT case themselves (`== null ? undefined : …`), because
+* an absent list block legitimately means "no entries" and the caller's own
+* `undefined` is what the SDK expects.
+*
+* @throws Error when the value is not an array.
+*/
+function requireConfigArray(value, path) {
+	if (!Array.isArray(value)) throw new Error(`${path} must be an array (got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`);
+	return value;
+}
+/**
 * A plain object, i.e. something a CFn config block can legitimately be.
 * Arrays are excluded on purpose: an array where an object belongs is one of
 * the malformed shapes this module exists to catch, and `typeof [] === 'object'`
@@ -12584,7 +12652,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Cta08VYI.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-8XxBHtzK.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -19081,7 +19149,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.278.34";
+	return "0.278.35";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21192,5 +21260,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { withRetry as $, getAwsClients as $t, red as A, synthesisStatusMessage as At, isTerminationProtectionPropagationError as B, stateBucketExistenceConfirmed as Bt, isStatefulRecreateTargetSync as C, normalizeAwsError as Cn, formatDockerLoginError as Ct, cyan as D, AssetManifestLoader as Dt, bold as E, runDockerStreaming as Et, ProviderRegistry as F, resolveCaptureObservedState as Ft, normalizeAwsTagsToCfn as G, findLargeInlineResources as Gt, cfnRefValueFromPhysicalId as H, CFN_TEMPLATE_BODY_LIMIT as Ht, findActionableSilentDrops as I, resolveSkipPrefix as It, readConfigString as J, AssemblyReader as Jt, resolveExplicitPhysicalId as K, uploadCfnTemplate as Kt, CloudControlProvider as L, resolveStateBucketWithDefault as Lt, IAMRoleProvider as M, getLegacyStateBucketName as Mt, collectInlinePolicyNamesManagedBySiblings as N, resolveApp as Nt, gray as O, getDockerImageBySourceHash as Ot, clearOnUpdateRemoval as P, resolveAutoAssetStorage as Pt, describeTypeWithThrottleRetry as Q, AwsClients as Qt, slowCcOperationTimeoutMs as R, resolveStateBucketWithDefaultAndSource as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, isCdkdError as Sn, buildDockerImage as St, formatResourceLine as T, __exportAll as Tn, runDockerForeground as Tt, refStateLookupFromResource as U, CFN_TEMPLATE_URL_LIMIT as Ut, IntrinsicFunctionResolver as V, warnDeprecatedNoPrefixCliFlag as Vt, WAFv2WebACLProvider as W, MIGRATE_TMP_PREFIX as Wt, applyRoleArnIfSet as X, clearBucketRegionCache as Xt, requireConfigString as Y, processStackMessages as Yt, DiffCalculator as Z, resolveBucketRegion as Zt, createPreDeleteFinalSnapshot as _, StackHasActiveImportsError as _n, ensureAssetStorage as _t, DeploymentEventsStore as a, DependencyError as an, S3StateBackend as at, unsupportedFinalSnapshotError as b, SynthesisError as bn, validateAssetBucketName as bt, replayFailedOperations as c, LocalMigrateError as cn, AssetPublisher as ct, IMPLICIT_DELETE_DEPENDENCIES as d, MissingCdkCliError as dn, buildAssetRedirectMap as dt, resetAwsClients as en, isRetryableTransientError as et, computeImplicitDeleteEdges as f, NestedStackChildDirectDestroyError as fn, createAssetRedirectResolver as ft, ccRoutedFinalSnapshotError as g, ResourceUpdateNotSupportedError as gn, BOOTSTRAP_MARKER_PREFIX as gt, buildFinalSnapshotIdentifier as h, ResourceTimeoutError as hn, AssetModeResolver as ht, DeploymentEventsReader as i, ConfigError as in, LockManager as it, yellow as j, getDefaultStateBucketName as jt, green as k, Synthesizer as kt, replayRollback as l, LocalStartServiceError as ln, stringifyValue as lt, PRE_DELETE_SNAPSHOT_TYPES as m, ProvisioningError as mn, rewriteTemplateAssetReferences as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as nn, DagBuilder as nt, planFailedOps as o, DeployCancelledError as on, rebuildClientForBucketRegion as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, PartialFailureError as pn, loadPublishableAssetManifest as pt, assertRegionMatch as q, expectedOwnerParam as qt, DeployEngine as r, CdkdError as rn, TemplateParser as rt, planRollback as s, LocalInvokeBuildError as sn, shouldRetainResource as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as tn, isThrottlingError as tt, withResourceDeadline as u, LockError as un, WorkGraph as ut, isFinalSnapshotError as v, StackTerminationProtectionError as vn, getBootstrapMarkerKey as vt, renderStatefulReason as w, withErrorHandling as wn, getDockerCmd as wt, extractDeploymentEventError as x, formatError as xn, validateContainerRepoName as xt, refusesFinalSnapshot as y, StateError as yn, parseBootstrapMarker as yt, disableInstanceApiTermination as z, resolveUseCdkBootstrapAssets as zt };
-//# sourceMappingURL=deploy-engine-Dp2u4Ktr.js.map
+export { describeTypeWithThrottleRetry as $, AwsClients as $t, red as A, Synthesizer as At, isTerminationProtectionPropagationError as B, resolveUseCdkBootstrapAssets as Bt, isStatefulRecreateTargetSync as C, isCdkdError as Cn, buildDockerImage as Ct, cyan as D, runDockerStreaming as Dt, bold as E, __exportAll as En, runDockerForeground as Et, ProviderRegistry as F, resolveAutoAssetStorage as Ft, normalizeAwsTagsToCfn as G, MIGRATE_TMP_PREFIX as Gt, cfnRefValueFromPhysicalId as H, warnDeprecatedNoPrefixCliFlag as Ht, findActionableSilentDrops as I, resolveCaptureObservedState as It, readConfigString as J, expectedOwnerParam as Jt, resolveExplicitPhysicalId as K, findLargeInlineResources as Kt, CloudControlProvider as L, resolveSkipPrefix as Lt, IAMRoleProvider as M, getDefaultStateBucketName as Mt, collectInlinePolicyNamesManagedBySiblings as N, getLegacyStateBucketName as Nt, gray as O, AssetManifestLoader as Ot, clearOnUpdateRemoval as P, resolveApp as Pt, DiffCalculator as Q, resolveBucketRegion as Qt, slowCcOperationTimeoutMs as R, resolveStateBucketWithDefault as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, formatError as Sn, validateContainerRepoName as St, formatResourceLine as T, withErrorHandling as Tn, getDockerCmd as Tt, refStateLookupFromResource as U, CFN_TEMPLATE_BODY_LIMIT as Ut, IntrinsicFunctionResolver as V, stateBucketExistenceConfirmed as Vt, WAFv2WebACLProvider as W, CFN_TEMPLATE_URL_LIMIT as Wt, requireConfigString as X, processStackMessages as Xt, requireConfigArray as Y, AssemblyReader as Yt, applyRoleArnIfSet as Z, clearBucketRegionCache as Zt, createPreDeleteFinalSnapshot as _, ResourceUpdateNotSupportedError as _n, BOOTSTRAP_MARKER_PREFIX as _t, DeploymentEventsStore as a, ConfigError as an, LockManager as at, unsupportedFinalSnapshotError as b, StateError as bn, parseBootstrapMarker as bt, replayFailedOperations as c, LocalInvokeBuildError as cn, shouldRetainResource as ct, IMPLICIT_DELETE_DEPENDENCIES as d, LockError as dn, WorkGraph as dt, getAwsClients as en, withRetry as et, computeImplicitDeleteEdges as f, MissingCdkCliError as fn, buildAssetRedirectMap as ft, ccRoutedFinalSnapshotError as g, ResourceTimeoutError as gn, AssetModeResolver as gt, buildFinalSnapshotIdentifier as h, ProvisioningError as hn, rewriteTemplateAssetReferences as ht, DeploymentEventsReader as i, CdkdError as in, TemplateParser as it, yellow as j, synthesisStatusMessage as jt, green as k, getDockerImageBySourceHash as kt, replayRollback as l, LocalMigrateError as ln, AssetPublisher as lt, PRE_DELETE_SNAPSHOT_TYPES as m, PartialFailureError as mn, loadPublishableAssetManifest as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, setAwsClients as nn, isThrottlingError as nt, planFailedOps as o, DependencyError as on, S3StateBackend as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, NestedStackChildDirectDestroyError as pn, createAssetRedirectResolver as pt, assertRegionMatch as q, uploadCfnTemplate as qt, DeployEngine as r, AssetError as rn, DagBuilder as rt, planRollback as s, DeployCancelledError as sn, rebuildClientForBucketRegion as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resetAwsClients as tn, isRetryableTransientError as tt, withResourceDeadline as u, LocalStartServiceError as un, stringifyValue as ut, isFinalSnapshotError as v, StackHasActiveImportsError as vn, ensureAssetStorage as vt, renderStatefulReason as w, normalizeAwsError as wn, formatDockerLoginError as wt, extractDeploymentEventError as x, SynthesisError as xn, validateAssetBucketName as xt, refusesFinalSnapshot as y, StackTerminationProtectionError as yn, getBootstrapMarkerKey as yt, disableInstanceApiTermination as z, resolveStateBucketWithDefaultAndSource as zt };
+//# sourceMappingURL=deploy-engine-CWZlo2Il.js.map