@go-to-k/cdkd 0.280.39 → 0.280.41

package/dist/{deploy-engine-BXVYshtP.js → deploy-engine-D3j4WK7_.js}

@@ -10278,15 +10278,28 @@ var WAFv2WebACLProvider = class {
 const AWS_NO_VALUE = Symbol("AWS::NoValue");
 /**
 * Resource types whose CloudFormation `Ref` returns the segment AFTER the LAST
-* pipe in cdkd's compound Cloud Control physical id (rather than the whole
-* physical id). These are types provisioned via Cloud Control — either because
-* they have no SDK provider, or because the #614 silent-drop routing sent an
-* SDK-backed type through CC (e.g. an ApiGateway Stage carrying
-* `MethodSettings`, which the SDK provider does not wire — issue #963). Their
-* CC primaryIdentifier is compound (`<parentId>|<ref>`, or `<a>|<b>|<ref>` for
-* triple-segment AppConfig children) while CFn's `Ref` returns only the
-* trailing `<ref>` component. For SDK-provisioned instances of the same types
-* the stored physical id has no pipe, so the extraction is a no-op:
+* pipe in cdkd's compound physical id (rather than the whole physical id).
+*
+* Membership is decided by the ID SHAPE, not by the routing layer, and the Set
+* carries BOTH kinds:
+*
+*  - **Cloud-Control-provisioned** (the original and still the majority) —
+*    either the type has no SDK provider, or the #614 silent-drop routing sent
+*    an SDK-backed type through CC (e.g. an ApiGateway Stage carrying
+*    `MethodSettings`, which the SDK provider does not wire — issue #963). CC's
+*    primaryIdentifier is compound (`<parentId>|<ref>`, or `<a>|<b>|<ref>` for
+*    triple-segment AppConfig children) while CFn's `Ref` returns only the
+*    trailing `<ref>`. For SDK-provisioned instances of these types the stored
+*    id has no pipe, so the extraction is a no-op.
+*  - **SDK-provisioned, provider-built compound** — the SDK provider ITSELF
+*    packs the segments because its CRUD calls need all of them while
+*    `ResourceProvider`'s read-side methods receive a single string. Here the
+*    extraction is load-bearing on the ORDINARY deploy path and there is no
+*    pipe-free variant to fall through. `AWS::S3Tables::Namespace` /
+*    `::Table` (whose per-routing split is spelled out at their entry) and
+*    `AWS::Glue::Table` (issue #1667) are these.
+*
+* The per-type map:
 *   - AWS::ApiGateway::Model            `<restApiId>|<modelName>`     -> model name
 *   - AWS::ApiGateway::RequestValidator `<restApiId>|<validatorId>`   -> validator id
 *   - AWS::ApiGateway::Stage            `<restApiId>|<stageName>`     -> stage name
@@ -10309,6 +10322,7 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 *   - AWS::AppConfig::ConfigurationProfile   `<appId>|<profileId>`           -> profile id
 *   - AWS::AppConfig::HostedConfigurationVersion `<appId>|<profileId>|<ver>` -> version number
 *   - AWS::AppConfig::Deployment             `<appId>|<envId>|<deployNum>`   -> deployment number
+*   - AWS::Glue::Table                       `<databaseName>|<tableName>`    -> table name
 *
 * The extraction takes the segment after the LAST pipe (see
 * {@link IntrinsicFunctionResolver.resolveRefValue}) so it is correct for both
@@ -10348,6 +10362,31 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 *      {@link REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE} instead of this Set: the
 *      after-last-pipe extraction would return the PARENT id for them.
 *   5. Pin each addition with a unit test in intrinsic-functions.test.ts.
+*
+* AUDIT RECORD (2026-08-12, issue #1667) — every type in the composite-id table
+* of `docs/state-management.md` was re-checked against its docs-verified `Ref`,
+* plus the two types that table lists as ACCEPTING a composite without
+* producing one. `AWS::Glue::Table` was the one this Set could fix and is added
+* below. The types deliberately NOT in either Set, with the reason:
+*   - correct to exclude, `Ref` is a synthetic / AWS-generated id no segment
+*     reconstructs: ApiGateway::Method, EC2::NetworkAclEntry ("the ID of the
+*     network ACL entry"), EC2::Route, EC2::VPCGatewayAttachment,
+*     Lambda::EventInvokeConfig;
+*   - correct to exclude, the docs page documents NO `Ref` return value at all:
+*     EC2::SecurityGroupIngress (and its Egress sibling, same id shape), and
+*     Lambda::Permission — cdkd stores the bare statement id, but state written
+*     by the older Cloud Control path can hold `<functionArn>|<statementId>`,
+*     and with no documented contract the raw id is the least-surprising value
+*     (the same call the maintenance note above already records for it);
+*   - already correct, no change needed: EC2::EIP (before-first-pipe),
+*     S3Tables::Namespace / ::Table (added by the 2026-07-03 close-out audit),
+*     ECS::Service (before-first-pipe; stores the bare ARN on the SDK path);
+*   - KNOWN WRONG and NOT fixable by a Set entry, tracked in issue #1681:
+*     AppSync::ApiKey / ::DataSource / ::Resolver (`Ref` returns the resource
+*     ARN, so the value must be RECONSTRUCTED like the WAFv2::WebACL case
+*     below, not extracted) and Route53::RecordSet (`Ref` returns "the name of
+*     the record" — the MIDDLE segment of `<hostedZoneId>|<name>|<type>`, which
+*     neither after-LAST-pipe nor before-FIRST-pipe yields).
 */
 const REF_RETURNS_SEGMENT_AFTER_PIPE = /* @__PURE__ */ new Set([
 	"AWS::ApiGateway::Model",
@@ -10373,7 +10412,8 @@ const REF_RETURNS_SEGMENT_AFTER_PIPE = /* @__PURE__ */ new Set([
 	"AWS::AppConfig::HostedConfigurationVersion",
 	"AWS::AppConfig::Deployment",
 	"AWS::S3Tables::Namespace",
-	"AWS::S3Tables::Table"
+	"AWS::S3Tables::Table",
+	"AWS::Glue::Table"
 ]);
 /**
 * Sibling of {@link REF_RETURNS_SEGMENT_AFTER_PIPE} for compound-id types
@@ -10869,11 +10909,14 @@ var IntrinsicFunctionResolver = class {
 	* stores. But for a few types CFn's `Ref` returns a sub-component of the
 	* physical id, and returning the raw physical id breaks downstream consumers.
 	*
-	* The {@link REF_RETURNS_SEGMENT_AFTER_PIPE} types are provisioned via Cloud
-	* Control (either they have no SDK provider, or the #614 silent-drop routing
-	* sent an SDK-backed type through CC), whose primary identifier — and thus
-	* cdkd's physical id — is the compound `<parentId>|<ref>`, while CFn's `Ref`
-	* returns only the trailing `<ref>` segment:
+	* The {@link REF_RETURNS_SEGMENT_AFTER_PIPE} types store a COMPOUND physical
+	* id `<parentId>|<ref>` while CFn's `Ref` returns only the trailing `<ref>`
+	* segment. Most are compound because Cloud Control provisions them (either
+	* they have no SDK provider, or the #614 silent-drop routing sent an
+	* SDK-backed type through CC) and its primaryIdentifier is compound; the rest
+	* — `AWS::S3Tables::Namespace` / `::Table` and `AWS::Glue::Table` — are
+	* compound because their own SDK provider packs the segments. The Set's
+	* header records the split per type; examples:
 	*   - `AWS::ApiGateway::Model` → Ref is the model NAME; physical id is
 	*     `<restApiId>|<modelName>`. A method wiring
 	*     `RequestModels: { "application/json": { "Ref": <Model> } }` would
@@ -12872,7 +12915,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DPYPr-Op.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Bdmv1zQr.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -19689,7 +19732,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.280.39";
+	return "0.280.41";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21855,4 +21898,4 @@ var DeployEngine = class {
 
 //#endregion
 export { requireConfigObject as $, AssemblyReader as $t, green as A, __exportAll as An, runDockerForeground as At, disableInstanceApiTermination as B, resolveCaptureObservedState as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, StackTerminationProtectionError as Cn, getBootstrapMarkerKey as Ct, bold as D, isCdkdError as Dn, buildDockerImage as Dt, formatResourceLine as E, formatError as En, validateContainerRepoName as Et, clearOnUpdateRemoval as F, synthesisStatusMessage as Ft, WAFv2WebACLProvider as G, stateBucketExistenceConfirmed as Gt, IntrinsicFunctionResolver as H, resolveStateBucketWithDefault as Ht, ProviderRegistry as I, getDefaultStateBucketName as It, assertRegionMatch as J, CFN_TEMPLATE_URL_LIMIT as Jt, normalizeAwsTagsToCfn as K, warnDeprecatedNoPrefixCliFlag as Kt, findActionableSilentDrops as L, getLegacyStateBucketName as Lt, yellow as M, AssetManifestLoader as Mt, IAMRoleProvider as N, getDockerImageBySourceHash as Nt, cyan as O, normalizeAwsError as On, formatDockerLoginError as Ot, collectInlinePolicyNamesManagedBySiblings as P, Synthesizer as Pt, requireConfigArray as Q, expectedOwnerParam as Qt, CloudControlProvider as R, resolveApp as Rt, extractDeploymentEventError as S, StackHasActiveImportsError as Sn, ensureAssetStorage as St, renderStatefulReason as T, SynthesisError as Tn, validateAssetBucketName as Tt, cfnRefValueFromPhysicalId as U, resolveStateBucketWithDefaultAndSource as Ut, isTerminationProtectionPropagationError as V, resolveSkipPrefix as Vt, refStateLookupFromResource as W, resolveUseCdkBootstrapAssets as Wt, readConfigString as X, findLargeInlineResources as Xt, configStringRefusal as Y, MIGRATE_TMP_PREFIX as Yt, replayWarn as Z, uploadCfnTemplate as Zt, createPreDeleteFinalSnapshot as _, NestedStackChildDirectDestroyError as _n, createAssetRedirectResolver as _t, DeploymentEventsStore as a, resetAwsClients as an, isRetryableTransientError as at, unsupportedFinalSnapshotError as b, ResourceTimeoutError as bn, AssetModeResolver as bt, replayFailedOperations as c, CdkdError as cn, TemplateParser as ct, IMPLICIT_DELETE_DEPENDENCIES as d, DeployCancelledError as dn, rebuildClientForBucketRegion as dt, processStackMessages as en, requireConfigString as et, computeImplicitDeleteEdges as f, LocalInvokeBuildError as fn, shouldRetainResource as ft, ccRoutedFinalSnapshotError as g, MissingCdkCliError as gn, buildAssetRedirectMap as gt, buildFinalSnapshotIdentifier as h, LockError as hn, WorkGraph as ht, DeploymentEventsReader as i, getAwsClients as in, withRetry as it, red as j, runDockerStreaming as jt, gray as k, withErrorHandling as kn, getDockerCmd as kt, replayRollback as l, ConfigError as ln, LockManager as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalStartServiceError as mn, stringifyValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveBucketRegion as nn, DiffCalculator as nt, planFailedOps as o, setAwsClients as on, isThrottlingError as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalMigrateError as pn, AssetPublisher as pt, resolveExplicitPhysicalId as q, CFN_TEMPLATE_BODY_LIMIT as qt, DeployEngine as r, AwsClients as rn, describeTypeWithThrottleRetry as rt, planRollback as s, AssetError as sn, DagBuilder as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, clearBucketRegionCache as tn, applyRoleArnIfSet as tt, withResourceDeadline as u, DependencyError as un, S3StateBackend as ut, isFinalSnapshotError as v, PartialFailureError as vn, loadPublishableAssetManifest as vt, isStatefulRecreateTargetSync as w, StateError as wn, parseBootstrapMarker as wt, makeCanonicalizePropertiesFn as x, ResourceUpdateNotSupportedError as xn, BOOTSTRAP_MARKER_PREFIX as xt, refusesFinalSnapshot as y, ProvisioningError as yn, rewriteTemplateAssetReferences as yt, slowCcOperationTimeoutMs as z, resolveAutoAssetStorage as zt };
-//# sourceMappingURL=deploy-engine-BXVYshtP.js.map
+//# sourceMappingURL=deploy-engine-D3j4WK7_.js.map