@go-to-k/cdkd 0.278.41 → 0.278.43

package/dist/{deploy-engine-CiMIsVFt.js → deploy-engine-1qwryuQH.js}

@@ -9167,14 +9167,6 @@ async function applyRoleArnIfSet(opts) {
 * Deliberately NOT rolled, so the decision is challengeable rather than
 * invisible:
 *
-* - **TOP-LEVEL `properties['X'] ?? 'default'` reads** (EC2 `InstanceType` /
-*   `Domain`, API Gateway `AuthorizationType`, IAM access-key `Status`, Lambda
-*   event-invoke `Qualifier`, RDS DB-proxy `TargetGroupName`, GlobalTable
-*   `BillingMode` on create and on the desired side of update). The container
-*   is the provider's own property bag, so rule 2 cannot fire; only rules 3/4
-*   would apply, and refusing a present-but-non-string value there is a
-*   stricter-value decision with its own regression surface (an unquoted YAML
-*   `IpProtocol: -1` is a NUMBER today and deploys fine). Tracked as issue #1513.
 * - **Nested reads whose value is an identity key or a label, never sent to
 *   AWS**: EC2's `rule['IpProtocol'] ?? '-1'` (composes a physical id and is
 *   read from BOTH the previous and next rule), `agentcore-evaluator`'s
@@ -9190,6 +9182,40 @@ async function applyRoleArnIfSet(opts) {
 *   `BillingMode`, RDS DB-proxy `delete()` / `readCurrentState`) — the
 *   desired-side-only rule above.
 *
+* **The TOP-LEVEL `properties['X'] ?? 'default'` reads followed in issue
+* #1513**, per site rather than as a sweep: the container there is the
+* provider's own property bag, so rule 2 cannot fire and only rules 3/4 apply —
+* and those turn a present-but-non-string value into a hard refusal, which is a
+* stricter-value decision with its own regression surface. Three axes came out
+* of it, each an option or an omission rather than a blanket:
+*
+* - **Coerce where the value is legitimately numeric-looking.** An unquoted
+*   YAML `IpProtocol: -1` / `Qualifier: 1` is a NUMBER today and deploys fine,
+*   so those sites pass `coerceNumber` (CFn coerces scalars; cdkd does not).
+*   The enum-valued sites — EC2 `InstanceType` / `Domain`, API Gateway
+*   `AuthorizationType`, IAM access-key `Status`, RDS DB-proxy
+*   `TargetGroupName` — do not: a number there is a template bug.
+* - **Throw on CREATE, warn on any STATE-REPLAY path** (`onUnusable`). A rollback
+*   replays via `provider.update(..., previousState.properties, ...)`, so an
+*   update-path refusal can strand a historical state record with no
+*   template-side remedy. "Create is always template-borne" is FALSE and was
+*   corrected in review: the reverse-replacement arm also calls
+*   `provider.create(..., previousState.properties, REPLAYING_STATE_CREATE_CONTEXT)`,
+*   so a create guard downgrades too — see {@link replayWarn}. A create reached
+*   as the re-create half of a delete-then-create UPDATE
+*   (`EC2Provider.updateSecurityGroupIngress`) is the third such path, and the
+*   worst: the revoke has already committed, so a refusal leaves the rule
+*   deleted from AWS.
+* - **Left unguarded: `EC2Provider.buildIpPermission`'s `IpProtocol` read.**
+*   Textually a top-level read, but the helper is also reached from
+*   `deleteSecurityGroupIngress` and from the REVOKE half of the inline-rule
+*   update diff, both carrying STATE-borne rules — a refusal there would break
+*   destroy and rollback. The create path is guarded at its own call site
+*   instead, which refuses before the helper is ever reached.
+*
+* The one site #1513 leaves open is GlobalTable `BillingMode`, whose file was
+* owned by a parallel lane at the time.
+*
 * This is a provider-layer guard rather than a pre-flight template check
 * because **rule 4** is only decidable AFTER intrinsic resolution: at pre-flight
 * time a legitimate `Fn::If`-valued block is an object whose `Status` key does
@@ -9245,15 +9271,47 @@ function readConfigString(container, key, fallback, containerPath) {
 * @param value The already-read field value.
 * @param fallback The value to use when the field is absent.
 * @param path CFn path used in the error message, e.g. `AWS::WAFv2::WebACL Scope`.
-* @throws Error when the value is present but not a non-blank string.
+* @param options Per-site relaxations — see {@link ConfigStringOptions}.
+* @throws Error when the value is present but not a non-blank string (and not a
+*   finite number under `coerceNumber`), unless `onUnusable` is supplied.
 */
-function requireConfigString(value, fallback, path) {
+function requireConfigString(value, fallback, path, options) {
 	if (value === void 0) return fallback;
 	if (fallback === "" && typeof value === "string") return value;
-	if (typeof value !== "string" || value.trim() === "") throw new Error(`${path} must be a non-empty string (got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value. Omit the field entirely to use the default` + (fallback === "" ? "" : ` (${fallback})`));
+	if (options?.coerceNumber === true && typeof value === "number" && Number.isFinite(value)) return String(value);
+	if (typeof value !== "string" || value.trim() === "") {
+		const detail = `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
+		const named = fallback === "" ? "" : ` (${fallback})`;
+		if (options?.onUnusable) {
+			options.onUnusable(`${path} must be a non-empty string ${detail}. Ignoring it and using the default${named} here; the same value is REFUSED on a template-path create`);
+			return fallback;
+		}
+		throw new Error(`${path} must be a non-empty string ${detail}. Omit the field entirely to use the default` + named);
+	}
 	return value;
 }
 /**
+* The CREATE-path counterpart of {@link ConfigStringOptions.onUnusable}.
+*
+* `create()` is NOT always template-borne, which is the correction that made
+* this helper necessary: `rollback-executor.ts`'s reverse-replacement arm
+* revives the OLD resource by calling `provider.create(..., previousState.properties,
+* REPLAYING_STATE_CREATE_CONTEXT)`. A resource written by an older binary with a
+* value this guard now refuses would otherwise become un-rollbackable, with only
+* a hand-edit of `state.json` as a remedy — the same failure the update-path
+* warn exists to prevent, and what `.claude/rules/providers.md` requires a
+* create-side pre-flight refusal to downgrade for.
+*
+* Spread into the options bag so a site can combine it with `coerceNumber`:
+* `{ coerceNumber: true, ...replayWarn(this.logger, context) }`.
+*
+* @returns `{ onUnusable }` when the caller declared a state replay, else `{}`
+*   (an ordinary template-path create, where the refusal stands).
+*/
+function replayWarn(logger, context) {
+	return context?.replayingState === true ? { onUnusable: (message) => logger.warn(message) } : {};
+}
+/**
 * Refuse a present-but-non-ARRAY value where a CFn LIST block belongs.
 *
 * The list-shaped sibling of {@link readConfigString}, for the container one
@@ -12653,7 +12711,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CoBHZKJt.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DIkqTnMR.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -19150,7 +19208,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.278.41";
+	return "0.278.43";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21261,5 +21319,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { describeTypeWithThrottleRetry as $, AwsClients as $t, red as A, Synthesizer as At, isTerminationProtectionPropagationError as B, resolveUseCdkBootstrapAssets as Bt, isStatefulRecreateTargetSync as C, isCdkdError as Cn, buildDockerImage as Ct, cyan as D, runDockerStreaming as Dt, bold as E, __exportAll as En, runDockerForeground as Et, ProviderRegistry as F, resolveAutoAssetStorage as Ft, normalizeAwsTagsToCfn as G, MIGRATE_TMP_PREFIX as Gt, cfnRefValueFromPhysicalId as H, warnDeprecatedNoPrefixCliFlag as Ht, findActionableSilentDrops as I, resolveCaptureObservedState as It, readConfigString as J, expectedOwnerParam as Jt, resolveExplicitPhysicalId as K, findLargeInlineResources as Kt, CloudControlProvider as L, resolveSkipPrefix as Lt, IAMRoleProvider as M, getDefaultStateBucketName as Mt, collectInlinePolicyNamesManagedBySiblings as N, getLegacyStateBucketName as Nt, gray as O, AssetManifestLoader as Ot, clearOnUpdateRemoval as P, resolveApp as Pt, DiffCalculator as Q, resolveBucketRegion as Qt, slowCcOperationTimeoutMs as R, resolveStateBucketWithDefault as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, formatError as Sn, validateContainerRepoName as St, formatResourceLine as T, withErrorHandling as Tn, getDockerCmd as Tt, refStateLookupFromResource as U, CFN_TEMPLATE_BODY_LIMIT as Ut, IntrinsicFunctionResolver as V, stateBucketExistenceConfirmed as Vt, WAFv2WebACLProvider as W, CFN_TEMPLATE_URL_LIMIT as Wt, requireConfigString as X, processStackMessages as Xt, requireConfigArray as Y, AssemblyReader as Yt, applyRoleArnIfSet as Z, clearBucketRegionCache as Zt, createPreDeleteFinalSnapshot as _, ResourceUpdateNotSupportedError as _n, BOOTSTRAP_MARKER_PREFIX as _t, DeploymentEventsStore as a, ConfigError as an, LockManager as at, unsupportedFinalSnapshotError as b, StateError as bn, parseBootstrapMarker as bt, replayFailedOperations as c, LocalInvokeBuildError as cn, shouldRetainResource as ct, IMPLICIT_DELETE_DEPENDENCIES as d, LockError as dn, WorkGraph as dt, getAwsClients as en, withRetry as et, computeImplicitDeleteEdges as f, MissingCdkCliError as fn, buildAssetRedirectMap as ft, ccRoutedFinalSnapshotError as g, ResourceTimeoutError as gn, AssetModeResolver as gt, buildFinalSnapshotIdentifier as h, ProvisioningError as hn, rewriteTemplateAssetReferences as ht, DeploymentEventsReader as i, CdkdError as in, TemplateParser as it, yellow as j, synthesisStatusMessage as jt, green as k, getDockerImageBySourceHash as kt, replayRollback as l, LocalMigrateError as ln, AssetPublisher as lt, PRE_DELETE_SNAPSHOT_TYPES as m, PartialFailureError as mn, loadPublishableAssetManifest as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, setAwsClients as nn, isThrottlingError as nt, planFailedOps as o, DependencyError as on, S3StateBackend as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, NestedStackChildDirectDestroyError as pn, createAssetRedirectResolver as pt, assertRegionMatch as q, uploadCfnTemplate as qt, DeployEngine as r, AssetError as rn, DagBuilder as rt, planRollback as s, DeployCancelledError as sn, rebuildClientForBucketRegion as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resetAwsClients as tn, isRetryableTransientError as tt, withResourceDeadline as u, LocalStartServiceError as un, stringifyValue as ut, isFinalSnapshotError as v, StackHasActiveImportsError as vn, ensureAssetStorage as vt, renderStatefulReason as w, normalizeAwsError as wn, formatDockerLoginError as wt, extractDeploymentEventError as x, SynthesisError as xn, validateAssetBucketName as xt, refusesFinalSnapshot as y, StackTerminationProtectionError as yn, getBootstrapMarkerKey as yt, disableInstanceApiTermination as z, resolveStateBucketWithDefaultAndSource as zt };
-//# sourceMappingURL=deploy-engine-CiMIsVFt.js.map
+export { DiffCalculator as $, resolveBucketRegion as $t, red as A, getDockerImageBySourceHash as At, isTerminationProtectionPropagationError as B, resolveStateBucketWithDefaultAndSource as Bt, isStatefulRecreateTargetSync as C, formatError as Cn, validateContainerRepoName as Ct, cyan as D, __exportAll as Dn, runDockerForeground as Dt, bold as E, withErrorHandling as En, getDockerCmd as Et, ProviderRegistry as F, resolveApp as Ft, normalizeAwsTagsToCfn as G, CFN_TEMPLATE_URL_LIMIT as Gt, cfnRefValueFromPhysicalId as H, stateBucketExistenceConfirmed as Ht, findActionableSilentDrops as I, resolveAutoAssetStorage as It, readConfigString as J, uploadCfnTemplate as Jt, resolveExplicitPhysicalId as K, MIGRATE_TMP_PREFIX as Kt, CloudControlProvider as L, resolveCaptureObservedState as Lt, IAMRoleProvider as M, synthesisStatusMessage as Mt, collectInlinePolicyNamesManagedBySiblings as N, getDefaultStateBucketName as Nt, gray as O, runDockerStreaming as Ot, clearOnUpdateRemoval as P, getLegacyStateBucketName as Pt, applyRoleArnIfSet as Q, clearBucketRegionCache as Qt, slowCcOperationTimeoutMs as R, resolveSkipPrefix as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, SynthesisError as Sn, validateAssetBucketName as St, formatResourceLine as T, normalizeAwsError as Tn, formatDockerLoginError as Tt, refStateLookupFromResource as U, warnDeprecatedNoPrefixCliFlag as Ut, IntrinsicFunctionResolver as V, resolveUseCdkBootstrapAssets as Vt, WAFv2WebACLProvider as W, CFN_TEMPLATE_BODY_LIMIT as Wt, requireConfigArray as X, AssemblyReader as Xt, replayWarn as Y, expectedOwnerParam as Yt, requireConfigString as Z, processStackMessages as Zt, createPreDeleteFinalSnapshot as _, ResourceTimeoutError as _n, AssetModeResolver as _t, DeploymentEventsStore as a, CdkdError as an, TemplateParser as at, unsupportedFinalSnapshotError as b, StackTerminationProtectionError as bn, getBootstrapMarkerKey as bt, replayFailedOperations as c, DeployCancelledError as cn, rebuildClientForBucketRegion as ct, IMPLICIT_DELETE_DEPENDENCIES as d, LocalStartServiceError as dn, stringifyValue as dt, AwsClients as en, describeTypeWithThrottleRetry as et, computeImplicitDeleteEdges as f, LockError as fn, WorkGraph as ft, ccRoutedFinalSnapshotError as g, ProvisioningError as gn, rewriteTemplateAssetReferences as gt, buildFinalSnapshotIdentifier as h, PartialFailureError as hn, loadPublishableAssetManifest as ht, DeploymentEventsReader as i, AssetError as in, DagBuilder as it, yellow as j, Synthesizer as jt, green as k, AssetManifestLoader as kt, replayRollback as l, LocalInvokeBuildError as ln, shouldRetainResource as lt, PRE_DELETE_SNAPSHOT_TYPES as m, NestedStackChildDirectDestroyError as mn, createAssetRedirectResolver as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resetAwsClients as nn, isRetryableTransientError as nt, planFailedOps as o, ConfigError as on, LockManager as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, MissingCdkCliError as pn, buildAssetRedirectMap as pt, assertRegionMatch as q, findLargeInlineResources as qt, DeployEngine as r, setAwsClients as rn, isThrottlingError as rt, planRollback as s, DependencyError as sn, S3StateBackend as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, getAwsClients as tn, withRetry as tt, withResourceDeadline as u, LocalMigrateError as un, AssetPublisher as ut, isFinalSnapshotError as v, ResourceUpdateNotSupportedError as vn, BOOTSTRAP_MARKER_PREFIX as vt, renderStatefulReason as w, isCdkdError as wn, buildDockerImage as wt, extractDeploymentEventError as x, StateError as xn, parseBootstrapMarker as xt, refusesFinalSnapshot as y, StackHasActiveImportsError as yn, ensureAssetStorage as yt, disableInstanceApiTermination as z, resolveStateBucketWithDefault as zt };
+//# sourceMappingURL=deploy-engine-1qwryuQH.js.map