@go-to-k/cdkd 0.278.6 → 0.278.7

package/dist/{deploy-engine-BKRlw9Hx.js → deploy-engine-DQxqNiZR.js}

@@ -9222,6 +9222,182 @@ function sanitizeDescription(value) {
 	if (typeof value === "string" && value.length === 0) return void 0;
 	return value;
 }
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* CFn `Rules` members that have NO counterpart in the installed
+* `@aws-sdk/client-wafv2` model (verified: zero hits in
+* `dist-types/models/models_0.d.ts`).
+*
+* The AWS SDK v3 serializer drops unknown members, so these silently do
+* not reach AWS no matter what cdkd forwards. There is no mapping cdkd
+* can invent — the fix is an SDK bump, after which the spellings already
+* match and no code here has to change. Until then the drop is made LOUD
+* (`warnOnSdkUnsupportedRuleKeys`) instead of silent.
+*
+* They cannot be declared in `unhandledByDesign` either: that map is
+* TOP-LEVEL CFn property granularity, and all three are nested inside
+* `Rules`, which the provider genuinely handles.
+*/
+const SDK_UNSUPPORTED_RULE_KEYS = [
+	"PreParseTextTransformations",
+	"Monetize",
+	"PriceMultiplier"
+];
+/**
+* Convert a CFn `ByteMatchStatement` into the SDK shape.
+*
+* `SearchStringBase64` exists ONLY in CloudFormation — the SDK models
+* carry a single `SearchString: Uint8Array | undefined` blob member
+* (`@aws-sdk/client-wafv2/dist-types/models/models_0.d.ts:1034`).
+* Forwarding the CFn blob raw made the serializer drop the unknown key
+* and `CreateWebACL` then failed validation on the missing required
+* `SearchString` (issue #1389).
+*
+* The decoded bytes are passed as a `Uint8Array`, matching the declared
+* member type: the JSON serializer base64-encodes a blob member on the
+* wire, so decoding here reproduces byte-for-byte what CloudFormation
+* sends. Plain `SearchString` values are deliberately left untouched —
+* the same serializer accepts a string at a blob member and UTF-8 +
+* base64 encodes it, which is exactly the existing (working) behavior.
+*
+* Precedence when a template carries BOTH keys: `SearchStringBase64`
+* wins. CloudFormation treats them as mutually exclusive and rejects
+* such a template, so any choice is arbitrary; the explicit-encoding
+* form is preferred because it is the only one that can express
+* non-UTF-8 bytes, so honoring it never loses information.
+*/
+function toSdkByteMatchStatement(byteMatchStatement) {
+	const encoded = byteMatchStatement["SearchStringBase64"];
+	if (typeof encoded !== "string") return byteMatchStatement;
+	const converted = { ...byteMatchStatement };
+	delete converted["SearchStringBase64"];
+	converted["SearchString"] = Uint8Array.from(Buffer.from(encoded, "base64"));
+	return converted;
+}
+/**
+* CFn `Statement` members that carry a reference ARN.
+*
+* CloudFormation spells the member `Arn`; every one of these SDK types
+* declares it `ARN` (and marks it REQUIRED) — verified against
+* `@aws-sdk/client-wafv2` `models_0.d.ts` (`IPSetReferenceStatement` /
+* `RegexPatternSetReferenceStatement` / `RuleGroupReferenceStatement`),
+* whose schema serde carries a single `_ARN = "ARN"` alias and no `Arn`.
+* The serializer drops the CFn spelling, so `CreateWebACL` fails
+* validation on the missing required `ARN` — the same silent-drop class
+* as `SearchStringBase64`, and the only other one in the whole `Rules`
+* tree (all 154 CFn keys were diffed against the SDK member set).
+*/
+const ARN_REFERENCE_STATEMENT_KEYS = [
+	"IPSetReferenceStatement",
+	"RegexPatternSetReferenceStatement",
+	"RuleGroupReferenceStatement"
+];
+/**
+* Recursively convert a CFn `Statement` tree into the SDK shape.
+*
+* Two conversions ride this walk: the `ByteMatchStatement`
+* `SearchStringBase64` decode and the reference-statement `Arn` -> `ARN`
+* rename (see {@link ARN_REFERENCE_STATEMENT_KEYS}). Both leaves are
+* nestable, so the walk has to cover every recursion point the SDK
+* `Statement` union declares:
+*   - `NotStatement.Statement`            (single nested Statement)
+*   - `AndStatement.Statements[]`         (Statement array)
+*   - `OrStatement.Statements[]`          (Statement array)
+*   - `RateBasedStatement.ScopeDownStatement`
+*   - `ManagedRuleGroupStatement.ScopeDownStatement`
+*
+* That list mirrors the SDK model exactly — those are the only members
+* typed `Statement` / `Statement[]`. `RuleGroupReferenceStatement` is
+* NOT a recursion point (it declares no nested statement member, only
+* `ARN` / `ExcludedRules` / `RuleActionOverrides`); it appears in the
+* ARN list above for the rename alone. Extend either list if AWS adds a
+* member.
+*
+* The caller's object is never mutated — every level is rebuilt.
+*/
+function toSdkStatement(statement) {
+	const converted = { ...statement };
+	const byteMatchStatement = converted["ByteMatchStatement"];
+	if (isPlainObject(byteMatchStatement)) converted["ByteMatchStatement"] = toSdkByteMatchStatement(byteMatchStatement);
+	for (const key of ARN_REFERENCE_STATEMENT_KEYS) {
+		const reference = converted[key];
+		if (!isPlainObject(reference) || !("Arn" in reference)) continue;
+		const { Arn: arn, ...rest } = reference;
+		converted[key] = {
+			...rest,
+			ARN: arn
+		};
+	}
+	const notStatement = converted["NotStatement"];
+	if (isPlainObject(notStatement)) {
+		const nested = notStatement["Statement"];
+		if (isPlainObject(nested)) converted["NotStatement"] = {
+			...notStatement,
+			Statement: toSdkStatement(nested)
+		};
+	}
+	for (const key of ["AndStatement", "OrStatement"]) {
+		const combined = converted[key];
+		if (!isPlainObject(combined)) continue;
+		const nested = combined["Statements"];
+		if (!Array.isArray(nested)) continue;
+		converted[key] = {
+			...combined,
+			Statements: nested.map((item) => isPlainObject(item) ? toSdkStatement(item) : item)
+		};
+	}
+	for (const key of ["RateBasedStatement", "ManagedRuleGroupStatement"]) {
+		const scoping = converted[key];
+		if (!isPlainObject(scoping)) continue;
+		const nested = scoping["ScopeDownStatement"];
+		if (!isPlainObject(nested)) continue;
+		converted[key] = {
+			...scoping,
+			ScopeDownStatement: toSdkStatement(nested)
+		};
+	}
+	return converted;
+}
+/**
+* Convert the CFn `Rules` blob into the SDK `Rule[]` shape.
+*
+* Falsy input degrades to `[]`, matching the previous
+* `(properties['Rules'] as Rule[]) || []` behavior exactly. A truthy NON-array
+* (an unresolved intrinsic) is deliberately passed through instead:
+* defaulting it to `[]` would make `update()` a silent `UpdateWebACL`
+* that wipes every rule and still reports success, where the old code
+* handed the value to the SDK and failed loudly.
+*/
+function toSdkRules(rules) {
+	if (!rules) return [];
+	if (!Array.isArray(rules)) return rules;
+	return rules.map((rule) => {
+		if (!isPlainObject(rule)) return rule;
+		const statement = rule["Statement"];
+		if (!isPlainObject(statement)) return rule;
+		return {
+			...rule,
+			Statement: toSdkStatement(statement)
+		};
+	});
+}
+/**
+* Collect every {@link SDK_UNSUPPORTED_RULE_KEYS} member present anywhere
+* in the CFn `Rules` blob, so the caller can report the silent drop.
+*/
+function collectSdkUnsupportedRuleKeys(value, found) {
+	if (Array.isArray(value)) {
+		for (const item of value) collectSdkUnsupportedRuleKeys(item, found);
+		return;
+	}
+	if (!isPlainObject(value)) return;
+	for (const [key, nested] of Object.entries(value)) {
+		if (SDK_UNSUPPORTED_RULE_KEYS.includes(key)) found.add(key);
+		collectSdkUnsupportedRuleKeys(nested, found);
+	}
+}
 /**
 * Parse WAFv2 WebACL ARN to extract Id, Name, and Scope.
 *
@@ -9280,6 +9456,7 @@ var WAFv2WebACLProvider = class {
 		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
 		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
 		const scope = properties["Scope"] || "REGIONAL";
+		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
 			const tags = [];
 			if (properties["Tags"]) {
@@ -9294,7 +9471,7 @@ var WAFv2WebACLProvider = class {
 				Scope: scope,
 				DefaultAction: properties["DefaultAction"],
 				Description: sanitizeDescription(properties["Description"]),
-				Rules: properties["Rules"] || [],
+				Rules: toSdkRules(properties["Rules"]),
 				VisibilityConfig: properties["VisibilityConfig"],
 				...tags.length > 0 && { Tags: tags },
 				CustomResponseBodies: properties["CustomResponseBodies"],
@@ -9327,6 +9504,7 @@ var WAFv2WebACLProvider = class {
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
+		this.warnOnSdkUnsupportedRuleKeys(logicalId, properties["Rules"]);
 		try {
 			const { id, name, scope } = parseWebACLArn(physicalId);
 			const getResponse = await this.getClient().send(new GetWebACLCommand({
@@ -9343,7 +9521,7 @@ var WAFv2WebACLProvider = class {
 				LockToken: lockToken,
 				DefaultAction: properties["DefaultAction"],
 				Description: sanitizeDescription(properties["Description"]),
-				Rules: properties["Rules"] || [],
+				Rules: toSdkRules(properties["Rules"]),
 				VisibilityConfig: properties["VisibilityConfig"],
 				CustomResponseBodies: properties["CustomResponseBodies"],
 				CaptchaConfig: properties["CaptchaConfig"],
@@ -9402,6 +9580,22 @@ var WAFv2WebACLProvider = class {
 		}
 	}
 	/**
+	* Report every CFn `Rules` member the installed `@aws-sdk/client-wafv2`
+	* model has no counterpart for, so the drop is visible instead of
+	* silent. See {@link SDK_UNSUPPORTED_RULE_KEYS} for why cdkd cannot map
+	* them and what makes them work (an SDK bump).
+	*/
+	warnOnSdkUnsupportedRuleKeys(logicalId, rules) {
+		const found = /* @__PURE__ */ new Set();
+		collectSdkUnsupportedRuleKeys(rules, found);
+		if (found.size === 0) return;
+		const sorted = [...found].sort();
+		const names = sorted.join(", ");
+		const subject = sorted.length === 1 ? "property" : "properties";
+		const verb = sorted.length === 1 ? "has" : "have";
+		this.logger.warn(`WAFv2 WebACL ${logicalId}: rule ${subject} ${names} ${verb} no member in the installed AWS SDK WAFv2 model and will NOT be sent to AWS. Upgrade cdkd once its @aws-sdk/client-wafv2 dependency carries the ${subject}.`);
+	}
+	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via WAFv2's
 	* `TagResource` / `UntagResource` APIs (keyed by `ResourceARN`).
 	*/
@@ -12090,7 +12284,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CTMEDbqF.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Cqw9Gzck.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -18513,7 +18707,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.278.6";
+	return "0.278.7";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -20625,4 +20819,4 @@ var DeployEngine = class {
 
 //#endregion
 export { DagBuilder as $, AssetError as $t, red as A, resolveApp as At, isTerminationProtectionPropagationError as B, CFN_TEMPLATE_URL_LIMIT as Bt, isStatefulRecreateTargetSync as C, runDockerStreaming as Ct, cyan as D, synthesisStatusMessage as Dt, bold as E, Synthesizer as Et, ProviderRegistry as F, resolveStateBucketWithDefaultAndSource as Ft, normalizeAwsTagsToCfn as G, AssemblyReader as Gt, cfnRefValueFromPhysicalId as H, findLargeInlineResources as Ht, findActionableSilentDrops as I, resolveUseCdkBootstrapAssets as It, applyRoleArnIfSet as J, resolveBucketRegion as Jt, resolveExplicitPhysicalId as K, processStackMessages as Kt, CloudControlProvider as L, stateBucketExistenceConfirmed as Lt, IAMRoleProvider as M, resolveCaptureObservedState as Mt, collectInlinePolicyNamesManagedBySiblings as N, resolveSkipPrefix as Nt, gray as O, getDefaultStateBucketName as Ot, clearOnUpdateRemoval as P, resolveStateBucketWithDefault as Pt, isRetryableTransientError as Q, setAwsClients as Qt, slowCcOperationTimeoutMs as R, warnDeprecatedNoPrefixCliFlag as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, __exportAll as Sn, runDockerForeground as St, formatResourceLine as T, getDockerImageBySourceHash as Tt, refStateLookupFromResource as U, uploadCfnTemplate as Ut, IntrinsicFunctionResolver as V, MIGRATE_TMP_PREFIX as Vt, WAFv2WebACLProvider as W, expectedOwnerParam as Wt, describeTypeWithThrottleRetry as X, getAwsClients as Xt, DiffCalculator as Y, AwsClients as Yt, withRetry as Z, resetAwsClients as Zt, createPreDeleteFinalSnapshot as _, SynthesisError as _n, validateAssetBucketName as _t, DeploymentEventsStore as a, LocalMigrateError as an, AssetPublisher as at, unsupportedFinalSnapshotError as b, normalizeAwsError as bn, formatDockerLoginError as bt, replayFailedOperations as c, MissingCdkCliError as cn, buildAssetRedirectMap as ct, IMPLICIT_DELETE_DEPENDENCIES as d, ProvisioningError as dn, rewriteTemplateAssetReferences as dt, CdkdError as en, TemplateParser as et, computeImplicitDeleteEdges as f, ResourceTimeoutError as fn, AssetModeResolver as ft, ccRoutedFinalSnapshotError as g, StateError as gn, parseBootstrapMarker as gt, buildFinalSnapshotIdentifier as h, StackTerminationProtectionError as hn, getBootstrapMarkerKey as ht, DeploymentEventsReader as i, LocalInvokeBuildError as in, shouldRetainResource as it, yellow as j, resolveAutoAssetStorage as jt, green as k, getLegacyStateBucketName as kt, replayRollback as l, NestedStackChildDirectDestroyError as ln, createAssetRedirectResolver as lt, PRE_DELETE_SNAPSHOT_TYPES as m, StackHasActiveImportsError as mn, ensureAssetStorage as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DependencyError as nn, S3StateBackend as nt, planFailedOps as o, LocalStartServiceError as on, stringifyValue as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, ResourceUpdateNotSupportedError as pn, BOOTSTRAP_MARKER_PREFIX as pt, assertRegionMatch as q, clearBucketRegionCache as qt, DeployEngine as r, DeployCancelledError as rn, rebuildClientForBucketRegion as rt, planRollback as s, LockError as sn, WorkGraph as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ConfigError as tn, LockManager as tt, withResourceDeadline as u, PartialFailureError as un, loadPublishableAssetManifest as ut, isFinalSnapshotError as v, formatError as vn, validateContainerRepoName as vt, renderStatefulReason as w, AssetManifestLoader as wt, extractDeploymentEventError as x, withErrorHandling as xn, getDockerCmd as xt, refusesFinalSnapshot as y, isCdkdError as yn, buildDockerImage as yt, disableInstanceApiTermination as z, CFN_TEMPLATE_BODY_LIMIT as zt };
-//# sourceMappingURL=deploy-engine-BKRlw9Hx.js.map
+//# sourceMappingURL=deploy-engine-DQxqNiZR.js.map