@go-to-k/cdkd 0.284.81 → 0.284.82

package/dist/{deploy-engine-DAY3Q6s4.js → deploy-engine-Dh4Jid_H.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-D91AoEe5.js";
+import { t as getCdkdVersion } from "./version-D_b3uJus.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4008,6 +4008,83 @@ function findLargeInlineResources(template, threshold = LARGE_INLINE_RESOURCE_TH
 	return result;
 }
 
+//#endregion
+//#region src/utils/parameter-types.ts
+/**
+* ONE definition of "is this CloudFormation Parameter `Type` LIST-shaped?".
+*
+* cdkd used to hold TWO independent answers to this question (issue
+* [#2347](https://github.com/go-to-k/cdkd/issues/2347)):
+*
+* - `coerceParameterTypedValue` in `src/deployment/intrinsic-function-resolver.ts`
+*   named exactly two list types (`List<Number>`, `CommaDelimitedList`) in a
+*   `switch`, so every other `List<...>` spelling fell to `default` and a
+*   `Ref` to it resolved to the raw comma-joined STRING;
+* - `stringifyParamDefault` in `src/synthesis/macro-expander.ts` tested
+*   `inner.startsWith('List<') || inner === 'CommaDelimitedList'` when choosing
+*   the placeholder shape for an `AWS::SSM::Parameter::Value<...>` parameter,
+*   i.e. the WIDER, correct view.
+*
+* The two disagreeing is what let a `List<AWS::EC2::Subnet::Id>` child
+* parameter be handed to a nested stack as a string. They now share this
+* predicate, so a third spelling cannot appear without deleting this file.
+*
+* This lives in `src/utils/` rather than beside either consumer because it has
+* TWO, in different layers -- `src/deployment/intrinsic-function-resolver.ts`
+* and `src/synthesis/macro-expander.ts`. Hosting it in `src/deployment/` gave
+* the tree its FIRST `src/synthesis/**` -> `src/deployment/**` import, which
+* inverts the documented layer order (synthesis runs before deployment); every
+* other synthesis import goes to `../types`, `../utils` or `../cli`.
+* `src/utils/ip-protocol.ts` is the precedent, hosted here for the same reason
+* and stating it in the same place. `src/types/` was the other candidate and is
+* wrong for this: it carries type declarations plus the constants and helpers
+* that read them, not a standalone runtime predicate with no type of its own.
+*
+* ## What CloudFormation actually defines
+*
+* Measured 2026-08-28 against the AWS-published enumerations, NOT against a
+* library:
+*
+* - `parameters-section-structure.html` lists the base types as `String`,
+*   `Number`, `List<Number>`, `CommaDelimitedList`, plus "AWS-specific
+*   parameter types" and "Systems Manager parameter types". **A bare
+*   `List<String>` is NOT in that enumeration.**
+* - `cloudformation-supplied-parameter-types.html` enumerates ten AWS-specific
+*   SCALAR types and nine `List<AWS::...>` types (`List<AWS::EC2::Subnet::Id>`,
+*   `List<AWS::EC2::SecurityGroup::Id>`, ...). `List<String>` appears only as
+*   the INNER shape of the Systems Manager form
+*   `AWS::SSM::Parameter::Value<List<String>>`.
+*
+* `List<String>` is nevertheless accepted here, because `aws-cdk-lib`'s own
+* `CfnParameter` accepts it (`isListType` in
+* `node_modules/aws-cdk-lib/core/lib/cfn-parameter.js` is a substring test) and
+* `valueAsList()` on such a parameter synthesizes a template cdkd will deploy
+* WITHOUT CloudFormation ever seeing it. Treating it as a list is the reading
+* that agrees with the app that produced it; the alternative silently hands a
+* string to something the CDK typed as a string list.
+*
+* ## Why this is `startsWith`, not `aws-cdk-lib`'s `indexOf`
+*
+* `indexOf('List<') >= 0` also matches `MyList<String>` and, load-bearing here,
+* the Systems Manager OUTER form `AWS::SSM::Parameter::Value<List<String>>`.
+* That outer form must NOT be list-shaped for the coercion: the VALUE supplied
+* for an SSM-typed parameter is a Parameter Store KEY, not the resolved list,
+* so splitting it on `,` would shred a key rather than build a list. The
+* macro-expander asks this question of the INNER shape it has already peeled
+* out of `Value<...>`, so the same predicate serves both sites unchanged.
+*
+* A closing `>` is required, so `List<`, `List<>` and `List<String` are NOT
+* list-shaped. That is the whole of the claim: this predicate is a test of the
+* SPELLING, not a validator. Measured, `List< >`, `List<a>`, `List<<>>` and
+* `List<X>>` all return `true` -- nothing here rejects a nonsense inner type,
+* and cdkd deploys without CloudFormation ever seeing the template, so no
+* service-side validation stands behind it either.
+*/
+function isListParameterType(type) {
+	if (type === "CommaDelimitedList") return true;
+	return type.length > 6 && type.startsWith("List<") && type.endsWith(">");
+}
+
 //#endregion
 //#region src/synthesis/macro-expander.ts
 /** 600 seconds = 10 minutes. SDK waiter's `maxWaitTime` is in seconds. */
@@ -4281,8 +4358,7 @@ function stringifyParamDefault(value, type, paramKey, logger) {
 		const known = PARAMETER_TYPE_PLACEHOLDERS[type];
 		if (known !== void 0) return known;
 		if (type.startsWith("AWS::SSM::Parameter::Value<")) {
-			const inner = type.slice(27, -1);
-			if (inner.startsWith("List<") || inner === "CommaDelimitedList") return "placeholder,placeholder";
+			if (isListParameterType(type.slice(27, -1))) return "placeholder,placeholder";
 			return "placeholder";
 		}
 		logger.warn(`Parameter '${paramKey}' has unrecognized CFn Type '${type}'; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
@@ -16559,14 +16635,26 @@ function parameterTypeMayLoseSecretIdentity(type) {
 * ONE definition of parameter-type coercion, at module scope so
 * {@link parameterTypeMayLoseSecretIdentity} probes the same code the resolver
 * runs rather than a copy of it.
+*
+* WHICH TYPES ARE LISTS is asked of the SHARED {@link isListParameterType}
+* rather than enumerated in the `switch` (issue #2347). The `switch` named only
+* `List<Number>` and `CommaDelimitedList`, so the nine `List<AWS::...>` types
+* CloudFormation defines -- `List<AWS::EC2::Subnet::Id>` and its siblings --
+* fell to `default` and a `Ref` to such a parameter resolved to the raw
+* comma-joined STRING, while `src/synthesis/macro-expander.ts` held the wider,
+* correct view of the very same question. Both sites now read one predicate.
+*
+* `List<Number>` keeps its own arm because it is the only list type whose
+* ELEMENTS are not strings; every other list type produces trimmed strings,
+* which is what CloudFormation says a `Ref` to one returns.
 */
 function coerceParameterTypedValue(value, type) {
 	switch (type) {
 		case "Number": return Number(value);
 		case "List<Number>": return value.split(",").map((v) => Number(v.trim()));
-		case "CommaDelimitedList": return value.split(",").map((v) => v.trim());
-		default: return value;
 	}
+	if (isListParameterType(type)) return value.split(",").map((v) => v.trim());
+	return value;
 }
 /**
 * The inherited `plaintext -> expression` pairs that `value` CARRIES.
@@ -16587,8 +16675,8 @@ function coerceParameterTypedValue(value, type) {
 *   for the same reason the redactor excludes them: a 3-character secret
 *   matches half the alphabet's worth of ordinary identifiers.
 *
-* A `CommaDelimitedList` parameter arrives as an array, so the scan walks
-* string elements too.
+* A LIST-TYPED parameter — any `List<...>` type or `CommaDelimitedList` — arrives as an
+* array, so the scan walks string elements too.
 */
 function inheritedSecretsCarriedBy(value, inherited) {
 	const candidates = [];
@@ -17919,7 +18007,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const [delimiter, rawValues] = joinArgs;
 		let values = rawValues;
 		if (!Array.isArray(values)) values = await this.resolveValue(values, context);
-		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a CommaDelimitedList parameter), but resolved to ${typeof values}`);
+		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
 		let result = (await Promise.all(values.map(async (v) => {
 			const resolved = await this.resolveValue(v, context);
 			return String(resolved);
@@ -18176,9 +18264,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* - a list-valued `Fn::GetAtt` renders as `Fn::GetAtt [Zone, NameServers]`,
 	*   naming both the resource and the attribute;
-	* - a `Ref` to a `CommaDelimitedList` / `List<Number>` parameter — the
-	*   SECOND genuinely reachable array source, via `coerceParameterValue` —
-	*   renders as `Ref MyListParam`, naming the parameter.
+	* - a `Ref` to a LIST-TYPED parameter — any `List<...>` type or `CommaDelimitedList`, per the
+	*   shared `isListParameterType` — the SECOND genuinely reachable array
+	*   source, via `coerceParameterValue` — renders as `Ref MyListParam`,
+	*   naming the parameter.
 	*
 	* Anything else degrades to its bare intrinsic key, or to `undefined` for a
 	* literal (which the message then simply omits).
@@ -18283,7 +18372,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const source = this.describeSplitValueSource(value);
 			const sourceClause = source ? ` (from ${source.label})` : "";
 			if (Array.isArray(resolvedValue)) {
-				const remedy = source?.kind === "ref" ? `A CommaDelimitedList / List<Number> parameter is already a list.` : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a CommaDelimitedList / List<Number> parameter, Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
+				const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
 				throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} is ALREADY a list (an array of ${resolvedValue.length} item${resolvedValue.length === 1 ? "" : "s"}), not a string. CloudFormation rejects Fn::Split over a list too, so this template is not valid CloudFormation either. Remove the Fn::Split and use the value directly. ${remedy}`));
 			}
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
@@ -20387,7 +20476,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DW0VKnyp.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BoJz-x3Q.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -32302,4 +32391,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, ProvisioningError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, withErrorHandling as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, LocalInvokeBuildError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, MissingCdkCliError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LockError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StateError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, markRedactedCause as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isRetryableTransientError as Hr, withRetry as Ht, red as I, runDockerForeground as In, SynthesisError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, retryClassificationText as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, formatError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceUpdateNotSupportedError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, StackHasActiveImportsError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, NestedStackChildDirectDestroyError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackTerminationProtectionError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, isCdkdError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DynamicReferenceRegionAmbiguousError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalStartServiceError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isThrottlingError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, isMarkedNonRetryable as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, markNonRetryable as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, CdkdError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, PARTITION_TABLE as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, DependencyError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, AssemblyReader as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, resolveBucketRegion as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, AwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, AssetError as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, setAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, expectedOwnerParam as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ResourceTimeoutError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, PartialFailureError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, processStackMessages as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, resetAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, canonicalizeRegion as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, getAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, __exportAll as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, derivePartitionAndUrlSuffix as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, clearBucketRegionCache as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, ConfigError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalMigrateError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DeployCancelledError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, CrossAccountSecretRefusalError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, normalizeAwsError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-DAY3Q6s4.js.map
+//# sourceMappingURL=deploy-engine-Dh4Jid_H.js.map