@go-to-k/cdkd 0.278.7 → 0.278.9

package/dist/{deploy-engine-DQxqNiZR.js → deploy-engine-D304rUnl.js}

@@ -7774,6 +7774,8 @@ const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"cannot be assumed",
 	"Firehose is unable to assume role",
 	"is unable to assume provided role",
+	"is unable to assume the role",
+	"security token included in the request is invalid. (Service:",
 	"role defined for the function",
 	"not authorized to perform",
 	"execution role",
@@ -9384,6 +9386,149 @@ function toSdkRules(rules) {
 	});
 }
 /**
+* Inverse of {@link toSdkByteMatchStatement}.
+*
+* `GetWebACL` returns `SearchString` as the SDK blob type (a `Uint8Array`),
+* but the template — and therefore cdkd state — carries EITHER a plain
+* `SearchString` string OR a `SearchStringBase64` string. The bytes are
+* identical for both spellings, so the AWS value alone cannot say which
+* one to emit: only the BASELINE can. That is why every function on this
+* side takes the corresponding state node alongside the AWS node.
+*
+* Whenever the baseline string RE-ENCODES to exactly the AWS bytes, it is
+* emitted VERBATIM rather than re-derived. That is what keeps two otherwise
+* permanent false positives from appearing:
+*
+*   - a non-canonical `SearchStringBase64` (whitespace / newlines, missing
+*     padding, base64url) would never equal a canonically re-encoded string,
+*     so the WebACL would drift forever;
+*   - `Buffer.toString('utf8')` is LOSSY for non-UTF-8 bytes (U+FFFD), so a
+*     binary needle under a plain-`SearchString` baseline would both drift
+*     and — via `drift --accept`, which writes the AWS value into
+*     `observedProperties`, then `--revert` — push a mangled needle to AWS.
+*
+* When the bytes genuinely differ from the baseline (REAL drift) or no usable
+* baseline exists, the value is derived: base64 if the baseline used base64,
+* otherwise plain UTF-8 but ONLY when that round-trips losslessly, falling
+* back to base64 so binary content is never corrupted.
+*/
+function toCfnByteMatchStatement(byteMatchStatement, baseline) {
+	const raw = byteMatchStatement["SearchString"];
+	if (raw === void 0) return byteMatchStatement;
+	const bytes = raw instanceof Uint8Array ? Buffer.from(raw) : typeof raw === "string" ? Buffer.from(raw, "utf8") : void 0;
+	if (!bytes) return byteMatchStatement;
+	const base = isPlainObject(baseline) ? baseline : void 0;
+	const baseEncoded = base?.["SearchStringBase64"];
+	const basePlain = base?.["SearchString"];
+	const converted = { ...byteMatchStatement };
+	delete converted["SearchString"];
+	delete converted["SearchStringBase64"];
+	if (typeof baseEncoded === "string" && Buffer.from(baseEncoded, "base64").equals(bytes)) {
+		converted["SearchStringBase64"] = baseEncoded;
+		return converted;
+	}
+	if (typeof basePlain === "string" && Buffer.from(basePlain, "utf8").equals(bytes)) {
+		converted["SearchString"] = basePlain;
+		return converted;
+	}
+	if (typeof baseEncoded === "string") {
+		converted["SearchStringBase64"] = bytes.toString("base64");
+		return converted;
+	}
+	const utf8 = bytes.toString("utf8");
+	if (Buffer.from(utf8, "utf8").equals(bytes)) converted["SearchString"] = utf8;
+	else converted["SearchStringBase64"] = bytes.toString("base64");
+	return converted;
+}
+/**
+* Inverse of {@link toSdkStatement}: re-shape an AWS-returned `Statement`
+* tree back into the CFn spelling, walking the state baseline in lockstep
+* so the per-`ByteMatchStatement` spelling choice is baseline-driven.
+*
+* Recursion points are IDENTICAL to the forward walk by construction — if
+* one gains a member, so must the other, or drift silently reappears at
+* the new nesting depth. When the baseline diverges structurally (a real
+* drift, or a rule added console-side) the walk simply passes `undefined`
+* down and the defaults apply; the resulting difference is exactly the
+* drift the user should see.
+*/
+function toCfnStatement(statement, baseline) {
+	const converted = { ...statement };
+	const base = isPlainObject(baseline) ? baseline : void 0;
+	const byteMatchStatement = converted["ByteMatchStatement"];
+	if (isPlainObject(byteMatchStatement)) converted["ByteMatchStatement"] = toCfnByteMatchStatement(byteMatchStatement, base?.["ByteMatchStatement"]);
+	for (const key of ARN_REFERENCE_STATEMENT_KEYS) {
+		const reference = converted[key];
+		if (!isPlainObject(reference) || !("ARN" in reference)) continue;
+		const { ARN: arn, ...rest } = reference;
+		converted[key] = {
+			...rest,
+			Arn: arn
+		};
+	}
+	const notStatement = converted["NotStatement"];
+	if (isPlainObject(notStatement)) {
+		const nested = notStatement["Statement"];
+		if (isPlainObject(nested)) {
+			const baseNot = base?.["NotStatement"];
+			converted["NotStatement"] = {
+				...notStatement,
+				Statement: toCfnStatement(nested, isPlainObject(baseNot) ? baseNot["Statement"] : void 0)
+			};
+		}
+	}
+	for (const key of ["AndStatement", "OrStatement"]) {
+		const combined = converted[key];
+		if (!isPlainObject(combined)) continue;
+		const nested = combined["Statements"];
+		if (!Array.isArray(nested)) continue;
+		const baseCombined = base?.[key];
+		const baseList = isPlainObject(baseCombined) && Array.isArray(baseCombined["Statements"]) ? baseCombined["Statements"] : void 0;
+		converted[key] = {
+			...combined,
+			Statements: nested.map((item, i) => isPlainObject(item) ? toCfnStatement(item, baseList?.[i]) : item)
+		};
+	}
+	for (const key of ["RateBasedStatement", "ManagedRuleGroupStatement"]) {
+		const scoping = converted[key];
+		if (!isPlainObject(scoping)) continue;
+		const nested = scoping["ScopeDownStatement"];
+		if (!isPlainObject(nested)) continue;
+		const baseScoping = base?.[key];
+		converted[key] = {
+			...scoping,
+			ScopeDownStatement: toCfnStatement(nested, isPlainObject(baseScoping) ? baseScoping["ScopeDownStatement"] : void 0)
+		};
+	}
+	return converted;
+}
+/**
+* Inverse of {@link toSdkRules}: re-shape the AWS `Rules` array back into
+* the CFn spelling so `cdkd drift` compares like with like.
+*
+* Without this every WebACL carrying a `ByteMatchStatement` or a reference
+* statement reported permanent phantom drift, because `drift-calculator`
+* compares `Rules` wholesale via `deepEqual` (issue #1403).
+*
+* Rules are matched to the baseline POSITIONALLY, which is what the
+* comparator itself does — a reordered or console-added rule therefore
+* still surfaces as drift, correctly.
+*/
+function toCfnRules(rules, baselineRules) {
+	if (!Array.isArray(rules)) return [];
+	const baseList = Array.isArray(baselineRules) ? baselineRules : void 0;
+	return rules.map((rule, i) => {
+		if (!isPlainObject(rule)) return rule;
+		const statement = rule["Statement"];
+		if (!isPlainObject(statement)) return rule;
+		const baseRule = baseList?.[i];
+		return {
+			...rule,
+			Statement: toCfnStatement(statement, isPlainObject(baseRule) ? baseRule["Statement"] : void 0)
+		};
+	});
+}
+/**
 * Collect every {@link SDK_UNSUPPORTED_RULE_KEYS} member present anywhere
 * in the CFn `Rules` blob, so the caller can report the silent drop.
 */
@@ -9645,7 +9790,7 @@ var WAFv2WebACLProvider = class {
 	* when the ARN can't be parsed or the WebACL is gone
 	* (`WAFNonexistentItemException`).
 	*/
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		const { id, name, scope } = parseWebACLArn(physicalId);
 		if (!id || !name) return void 0;
 		let webACL;
@@ -9665,7 +9810,7 @@ var WAFv2WebACLProvider = class {
 		result["Scope"] = scope;
 		result["Description"] = webACL.Description ?? "";
 		if (webACL.DefaultAction) result["DefaultAction"] = webACL.DefaultAction;
-		result["Rules"] = (webACL.Rules ?? []).map((r) => r);
+		result["Rules"] = toCfnRules(webACL.Rules ?? [], properties?.["Rules"]);
 		if (webACL.VisibilityConfig) result["VisibilityConfig"] = webACL.VisibilityConfig;
 		result["CustomResponseBodies"] = webACL.CustomResponseBodies ?? {};
 		if (webACL.CaptchaConfig) result["CaptchaConfig"] = webACL.CaptchaConfig;
@@ -12284,7 +12429,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Cqw9Gzck.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D9iaehAe.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -18707,7 +18852,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.278.7";
+	return "0.278.9";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -20819,4 +20964,4 @@ var DeployEngine = class {
 
 //#endregion
 export { DagBuilder as $, AssetError as $t, red as A, resolveApp as At, isTerminationProtectionPropagationError as B, CFN_TEMPLATE_URL_LIMIT as Bt, isStatefulRecreateTargetSync as C, runDockerStreaming as Ct, cyan as D, synthesisStatusMessage as Dt, bold as E, Synthesizer as Et, ProviderRegistry as F, resolveStateBucketWithDefaultAndSource as Ft, normalizeAwsTagsToCfn as G, AssemblyReader as Gt, cfnRefValueFromPhysicalId as H, findLargeInlineResources as Ht, findActionableSilentDrops as I, resolveUseCdkBootstrapAssets as It, applyRoleArnIfSet as J, resolveBucketRegion as Jt, resolveExplicitPhysicalId as K, processStackMessages as Kt, CloudControlProvider as L, stateBucketExistenceConfirmed as Lt, IAMRoleProvider as M, resolveCaptureObservedState as Mt, collectInlinePolicyNamesManagedBySiblings as N, resolveSkipPrefix as Nt, gray as O, getDefaultStateBucketName as Ot, clearOnUpdateRemoval as P, resolveStateBucketWithDefault as Pt, isRetryableTransientError as Q, setAwsClients as Qt, slowCcOperationTimeoutMs as R, warnDeprecatedNoPrefixCliFlag as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, __exportAll as Sn, runDockerForeground as St, formatResourceLine as T, getDockerImageBySourceHash as Tt, refStateLookupFromResource as U, uploadCfnTemplate as Ut, IntrinsicFunctionResolver as V, MIGRATE_TMP_PREFIX as Vt, WAFv2WebACLProvider as W, expectedOwnerParam as Wt, describeTypeWithThrottleRetry as X, getAwsClients as Xt, DiffCalculator as Y, AwsClients as Yt, withRetry as Z, resetAwsClients as Zt, createPreDeleteFinalSnapshot as _, SynthesisError as _n, validateAssetBucketName as _t, DeploymentEventsStore as a, LocalMigrateError as an, AssetPublisher as at, unsupportedFinalSnapshotError as b, normalizeAwsError as bn, formatDockerLoginError as bt, replayFailedOperations as c, MissingCdkCliError as cn, buildAssetRedirectMap as ct, IMPLICIT_DELETE_DEPENDENCIES as d, ProvisioningError as dn, rewriteTemplateAssetReferences as dt, CdkdError as en, TemplateParser as et, computeImplicitDeleteEdges as f, ResourceTimeoutError as fn, AssetModeResolver as ft, ccRoutedFinalSnapshotError as g, StateError as gn, parseBootstrapMarker as gt, buildFinalSnapshotIdentifier as h, StackTerminationProtectionError as hn, getBootstrapMarkerKey as ht, DeploymentEventsReader as i, LocalInvokeBuildError as in, shouldRetainResource as it, yellow as j, resolveAutoAssetStorage as jt, green as k, getLegacyStateBucketName as kt, replayRollback as l, NestedStackChildDirectDestroyError as ln, createAssetRedirectResolver as lt, PRE_DELETE_SNAPSHOT_TYPES as m, StackHasActiveImportsError as mn, ensureAssetStorage as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DependencyError as nn, S3StateBackend as nt, planFailedOps as o, LocalStartServiceError as on, stringifyValue as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, ResourceUpdateNotSupportedError as pn, BOOTSTRAP_MARKER_PREFIX as pt, assertRegionMatch as q, clearBucketRegionCache as qt, DeployEngine as r, DeployCancelledError as rn, rebuildClientForBucketRegion as rt, planRollback as s, LockError as sn, WorkGraph as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ConfigError as tn, LockManager as tt, withResourceDeadline as u, PartialFailureError as un, loadPublishableAssetManifest as ut, isFinalSnapshotError as v, formatError as vn, validateContainerRepoName as vt, renderStatefulReason as w, AssetManifestLoader as wt, extractDeploymentEventError as x, withErrorHandling as xn, getDockerCmd as xt, refusesFinalSnapshot as y, isCdkdError as yn, buildDockerImage as yt, disableInstanceApiTermination as z, CFN_TEMPLATE_BODY_LIMIT as zt };
-//# sourceMappingURL=deploy-engine-DQxqNiZR.js.map
+//# sourceMappingURL=deploy-engine-D304rUnl.js.map