@go-to-k/cdkd 0.284.78 → 0.284.79

package/dist/{deploy-engine-Cvkqa30x.js → deploy-engine-C411KMRS.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-GEIr41xq.js";
+import { t as getCdkdVersion } from "./version-Hlzx3l_O.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -16125,21 +16125,71 @@ function collectReferencedParameterNames(template) {
 *    all -- it has already failed.
 *  - {@link IntrinsicFunctionResolver.subPlaceholderNamesADeclaredTemplateEntity}
 *    answers for the callers that CATCH that error and resolve anyway.
-*    `cdkd import --migrate-from-cloudformation` is the live one: it logs the
-*    parameter-resolution failure and continues with an EMPTY bag, on a context
-*    that is NOT `bestEffort`, so `${Stage}` used to be written verbatim into
-*    the imported resource's persisted properties -- and from there into the
+*    `cdkd import` is the live one -- EVERY mode of it, not only
+*    `--migrate-from-cloudformation`: `resolveImportedProperties` sits on
+*    `importCommand`'s unconditional flow, so auto / selective / hybrid all
+*    reach it. It logs the parameter-resolution failure, RETRIES over the
+*    template's `Default`-carrying parameters alone (issue
+*    [#2321](https://github.com/go-to-k/cdkd/issues/2321)), and resolves
+*    against that partial bag on a context that is NOT `bestEffort`. The
+*    retry binds every parameter it can, and a parameter with no `Default` is
+*    exactly what it cannot bind -- so this population still arrives here,
+*    and a `${Tier}` over such a parameter used to be written verbatim into
+*    the imported resource's persisted properties, and from there into the
 *    next deploy's desired bag, which is how the literal reaches AWS.
+*    (The fixtures spell that parameter `Stage`; this doc says `Tier` because
+*    `import.ts`'s own #2321 comments use `Stage` for the opposite role -- the
+*    parameter that DOES carry a `Default` -- and one name for both roles in
+*    one change is how a reader mis-reads which population is which.)
+*    Before #2321 that caller continued with an EMPTY bag instead; the note
+*    below turns on the difference, and on what survives it.
 *
 * A key PRESENT with an `undefined` value is not a binding: `resolveParameters`
 * falls through such a key to the `Default` check, so the predicate must too.
 * That single edge is the reason this is shared code and not a paraphrase.
 *
 * A `Default`-carrying parameter the caller never merged is DELIBERATELY not
-* in this population. `resolveParameters` merges every `Default` it sees, so
-* the only way to reach the resolver with one unbound is to have discarded the
-* whole bag -- and refusing there would newly hard-fail input cdkd accepts
-* today, for a parameter whose value the template itself declares.
+* in this population, and issue
+* [#2321](https://github.com/go-to-k/cdkd/issues/2321) NARROWED the population
+* that reaches here without emptying it. Both halves matter, and an earlier
+* revision of this paragraph shipped only the first, claiming the exclusion
+* "describes a population that no live path produces". That was FALSE, and the
+* counter-example is in the very change that prompted the rewrite.
+*
+* What #2321 fixed is `import`'s retry SUCCESS path. `resolveParameters`
+* merges every `Default` it sees on the path that succeeds; `import` is the
+* one caller that catches its throw on a non-`bestEffort` context, and it now
+* retries over exactly the `Default`-carrying parameters instead of continuing
+* with an empty bag, so a `Default`-carrying parameter reaching the refusing
+* site from THAT path arrives BOUND. (`diff-recursive` and `scrub` also catch,
+* but both set `bestEffort: true` and `rethrowStructuralSubFailure` returns on
+* that flag BEFORE consulting this predicate, so neither reaches the refusing
+* site at all; `deploy-engine` does not catch.)
+*
+* What SURVIVES is `import`'s retry FAILURE path, and it is a live producer,
+* not a hypothetical one. When the `Default`-only retry itself throws -- an
+* SSM-typed default whose `GetParameter` is rejected is the reachable case --
+* `resolveImportedProperties` falls back to an empty bag rather than aborting
+* an import that already succeeded against AWS, and `import.ts` omits the
+* `parameters` key entirely when the bag is empty, so the context arrives with
+* `parameters: undefined`. A `Default`-carrying parameter is then unbound at
+* the refusing site, and this exclusion is the ONLY thing standing between it
+* and a refusal.
+*
+* So the clause below is PRESENT-TENSE LOAD-BEARING, not a courtesy kept for
+* some future caller: that fallback path exists right now, and the clause is
+* what keeps a `Default`-carrying parameter off the refusing site on it.
+* What removing the clause would DO downstream is deliberately not asserted
+* here -- it was not probed, and the residual note below is what carries the
+* observable consequence. It is also what
+* {@link IntrinsicFunctionResolver.subPlaceholderNamesADeclaredTemplateEntity}
+* cross-references.
+*
+* The cost of that fallback is that the #2321 defect persists on it -- the
+* placeholder is kept and written verbatim -- which is a KNOWN residual rather
+* than an oversight; `import.ts` records it at the fallback, and
+* `tests/unit/cli/import.test.ts` pins it so the residual cannot widen
+* silently.
 */
 function isUnboundTemplateParameter(name, template, boundParameters) {
 	const declaredParameters = template?.Parameters;
@@ -17616,12 +17666,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `Parameter <name> is required ...` for exactly the same population up
 	* front -- so on a plain `cdkd deploy` this arm is unreachable by
 	* construction, and what it actually covers is the caller that CATCHES that
-	* error and resolves anyway (`cdkd import --migrate-from-cloudformation`,
-	* on a context that is not `bestEffort`).
+	* error and resolves anyway (`cdkd import`, in every mode, on a context that
+	* is not `bestEffort`).
 	*
 	* A parameter carrying a `Default` the caller never merged stays OUT, for
-	* the reason recorded on the shared predicate: refusing it would newly
-	* hard-fail input cdkd accepts today.
+	* the reason recorded on the shared predicate.
 	*
 	* An earlier revision excluded parameters WHOLESALE and justified that by
 	* "the routine `cdkd scrub` case (it takes no `--parameters`)". That reason
@@ -20009,7 +20058,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-R60Irey3.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CujMYGki.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -31903,4 +31952,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, CFN_TEMPLATE_URL_LIMIT as $n, redactSecretsForState as $t, renderStatefulReason as A, buildDockerImage as An, ResourceTimeoutError as Ar, classifyReplaySecretRegion as At, exportAliasCollisionScrubWarning as B, synthesisStatusMessage as Bn, isMarkedNonRetryable as Br, describeTypeWithThrottleRetry as Bt, isFinalSnapshotError as C, isCrossRegionRedirect as Cn, LocalMigrateError as Cr, configBooleanRefusal as Ct, extractDeploymentEventError as D, validateContainerRepoName as Dn, NestedStackChildDirectDestroyError as Dr, requireConfigArray as Dt, makeCanonicalizePropertiesFn as E, validateAssetBucketName as En, MissingCdkCliError as Er, replayWarn as Et, green as F, runDockerForeground as Fn, SynthesisError as Fr, s3BucketRegionalDomainName as Ft, IAMRoleProvider as G, resolveCaptureObservedState as Gn, retryClassificationText as Gr, STATE_SOURCED_READBACK_RULES as Gt, secretBearingStateKeyWarning as H, getLegacyStateBucketName as Hn, isThrottlingError as Hr, DagBuilder as Ht, red as I, runDockerStreaming as In, formatError as Ir, s3BucketWebsiteUrl as It, ProviderRegistry as J, resolveStateBucketWithDefaultAndSource as Jn, dynamicReferenceTokens as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveSkipPrefix as Kn, __exportAll as Kr, TEMPLATE_SOURCED_RULES as Kt, yellow as L, AssetManifestLoader as Ln, isCdkdError as Lr, applyRoleArnIfSet as Lt, bold as M, formatDockerLoginError as Mn, StackHasActiveImportsError as Mr, s3BucketArn as Mt, cyan as N, getDockerCmd as Nn, StackTerminationProtectionError as Nr, s3BucketDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDenyExternalAccessPolicy as On, PartialFailureError as Or, requireConfigObject as Ot, gray as P, partitionSensitiveEnv as Pn, StateError as Pr, s3BucketDualStackDomainName as Pt, maskDeep as Q, CFN_TEMPLATE_BODY_LIMIT as Qn, maskSecretsInText as Qt, collectDeclaredOutputNames as R, getDockerImageBySourceHash as Rn, normalizeAwsError as Rr, DiffCalculator as Rt, createPreDeleteFinalSnapshot as S, getBootstrapMarkerKey as Sn, LocalInvokeBuildError as Sr, coerceCfnBoolean as St, unsupportedFinalSnapshotError as T, readBootstrapMarkerBody as Tn, LockError as Tr, readConfigString as Tt, stateKeySecretExposure as U, resolveApp as Un, markNonRetryable as Ur, TemplateParser as Ut, isExportAliasCollision as V, getDefaultStateBucketName as Vn, isRetryableTransientError as Vr, withRetry as Vt, getCurrentResourceSecrets as W, resolveAutoAssetStorage as Wn, markRedactedCause as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, findSilentDropProperties as X, stateBucketExistenceConfirmed as Xn, isSingleDynamicReferenceToken as Xt, findActionableSilentDrops as Y, resolveUseCdkBootstrapAssets as Yn, errorCauseChain as Yt, createMaskedRetryLogger as Z, warnDeprecatedNoPrefixCliFlag as Zn, maskSecretsInError as Zt, computeImplicitDeleteEdges as _, stripControlChars as _n, ConfigError as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, exportNamesCarriedFrom as an, canonicalizeRegion as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, assertAssetBucketRegion as bn, DeployCancelledError as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, shouldRetainResource as cn, processStackMessages as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, WorkGraph as dn, AwsClients as dr, IntrinsicFunctionResolver as dt, scrubResourceRecord as en, MIGRATE_TMP_PREFIX as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, buildAssetRedirectMap as fn, getAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, escapeRegExp$1 as gn, CdkdError as gr, parameterTypeMayLoseSecretIdentity as gt, maskingRetryLogger as h, rewriteTemplateAssetReferences as hn, AssetError as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, rebuildClientForBucketRegion as in, PARTITION_TABLE as ir, interruptWatchListenerCount as it, formatResourceLine as j, dockerSpawnEnvWithSensitive as jn, ResourceUpdateNotSupportedError as jr, producerRegionsFromState as jt, isStatefulRecreateTargetSync as k, describeAwsFailure as kn, ProvisioningError as kr, requireConfigString as kt, replayRollback as l, AssetPublisher as ln, clearBucketRegionCache as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, loadPublishableAssetManifest as mn, setAwsClients as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, displaySafe as nn, uploadCfnTemplate as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputKeys as on, derivePartitionAndUrlSuffix as or, startInterruptWatch as ot, deleteSkipReason as p, createAssetRedirectResolver as pn, resetAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveStateBucketWithDefault as qn, createSecretMasker as qt, DeployEngine as r, S3StateBackend as rn, expectedOwnerParam as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputs as sn, AssemblyReader as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockManager as tn, findLargeInlineResources as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, stringifyValue as un, resolveBucketRegion as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, AssetModeResolver as vn, CrossAccountSecretRefusalError as vr, WAFv2WebACLProvider as vt, refusesFinalSnapshot as w, parseBootstrapMarker as wn, LocalStartServiceError as wr, configStringRefusal as wt, ccRoutedFinalSnapshotError as x, ensureAssetStorage as xn, DynamicReferenceRegionAmbiguousError as xr, assertRegionMatch as xt, PRE_DELETE_SNAPSHOT_TYPES as y, BOOTSTRAP_MARKER_PREFIX as yn, DependencyError as yr, normalizeAwsTagsToCfn as yt, collectPublishedOutputNames as z, Synthesizer as zn, withErrorHandling as zr, INTRINSIC_KEYS as zt };
-//# sourceMappingURL=deploy-engine-Cvkqa30x.js.map
+//# sourceMappingURL=deploy-engine-C411KMRS.js.map