@go-to-k/cdkd 0.284.84 → 0.284.85

package/dist/{deploy-engine-Du2CDZop.js → deploy-engine-BoDdOfCO.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-BJFNb-b3.js";
+import { t as getCdkdVersion } from "./version-cNxTfzBH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4257,6 +4257,85 @@ function isListParameterType(type) {
 	if (type === "CommaDelimitedList") return true;
 	return type.length > 6 && type.startsWith("List<") && type.endsWith(">");
 }
+/**
+* The literal prefix of the Systems Manager parameter form. Declared ABOVE the
+* docblock below so that docblock attaches to {@link ssmResolvedValueType}
+* rather than to this constant.
+*/
+const SSM_PARAMETER_VALUE_PREFIX = "AWS::SSM::Parameter::Value<";
+/**
+* ONE definition of "peel the inner shape out of
+* `AWS::SSM::Parameter::Value<...>`", returning `undefined` when `type` is not
+* that form.
+*
+* It lives beside {@link isListParameterType} for the reason that predicate
+* exists at all: this file was created by issue
+* [#2347](https://github.com/go-to-k/cdkd/issues/2347) after cdkd was found
+* holding TWO answers to one type question in these same two modules, and
+* issue [#2367](https://github.com/go-to-k/cdkd/issues/2367) then wrote a
+* SECOND peel in `src/deployment/intrinsic-function-resolver.ts` next to the
+* one already in `src/synthesis/macro-expander.ts` -- reproducing the exact
+* shape #2347 had just deleted, one question with two spellings in one file
+* pair. Both now call this.
+*
+* ## The two callers, and the one deliberate difference between them
+*
+* The peel is shared; the handling of a MALFORMED spelling is not, and that is
+* a call-site policy rather than a second answer:
+*
+*  - `resolveParameters` (deployment) treats `undefined` as "do not coerce" and
+*    keeps the resolved string verbatim -- the safe direction on a path that
+*    writes state.
+*  - `stringifyParamDefault` (synthesis) keeps its own pre-existing behaviour
+*    of emitting the SCALAR placeholder for anything carrying the prefix,
+*    including a malformed one, rather than falling through to its generic
+*    warn + `PARAMETER_PLACEHOLDER`. Routing a malformed spelling to that
+*    fallback would change the emitted placeholder text (`placeholder` ->
+*    `cdkd-macro-expand-placeholder`) and add a warn line, which is a
+*    behaviour change unrelated to #2367.
+*
+* The STRICTNESS here is the stricter of the two originals: a closing `>` is
+* required and the inner shape must be non-empty, so `Value<` and `Value<>`
+* peel to `undefined`. The synthesis site never required either, but it also
+* never distinguished the cases -- `''` is not list-shaped, so it took the
+* scalar arm, which is what its `undefined` branch now does explicitly.
+*
+* ## WHAT THE SUPPLIED VALUE IS -- AN OPEN DISAGREEMENT INSIDE THIS REPO
+*
+* This function answers only "what shape does `Value<...>` WRAP". It
+* deliberately does NOT settle what the value SUPPLIED for such a parameter
+* means, because cdkd currently holds two incompatible readings and this
+* function's callers do not need the answer:
+*
+*  - **Read from the AWS documentation** (`cloudformation-supplied-parameter-types.html`,
+*    2026-08-29): the supplied value is ONE Parameter Store key, phrased in the
+*    singular throughout ("you must specify a Parameter Store key", "you must
+*    provide the parameter name"), with `Value<List<String>>` /
+*    `Value<CommaDelimitedList>` described as "a Systems Manager parameter
+*    whose value is a list of strings". `aws-cdk-lib`'s own
+*    `StringListParameter.fromListParameterAttributes` agrees: it emits
+*    `{type: 'AWS::SSM::Parameter::Value<List<String>>', default:
+*    attrs.parameterName}` -- a single name.
+*  - **A LIVE CloudFormation OBSERVATION** recorded at
+*    `src/synthesis/macro-expander.ts` (the CR-MJ3 fix): a single-string
+*    placeholder against a `Value<List<*>>` type "would reject the changeset
+*    with `Parameter ... must be a list`", which is why that site emits a
+*    2-element comma-joined placeholder. Someone watched CloudFormation do
+*    that, and a live observation outranks a documentation read.
+*
+* THESE MAY BOTH BE TRUE OF DIFFERENT THINGS -- CloudFormation's pre-macro
+* changeset VALIDATOR may demand a list-shaped literal while the runtime
+* resolves one key -- and that reconciliation is plausible but UNMEASURED. It
+* is recorded as unresolved rather than decided, and neither caller depends on
+* it: the synthesis site is choosing a placeholder for a validator, and the
+* deployment site is coercing a value `GetParameter` ALREADY returned, which is
+* downstream of whatever the supplied key meant.
+*/
+function ssmResolvedValueType(type) {
+	if (!type.startsWith("AWS::SSM::Parameter::Value<") || !type.endsWith(">")) return void 0;
+	const inner = type.slice(27, -1);
+	return inner.length > 0 ? inner : void 0;
+}
 
 //#endregion
 //#region src/synthesis/macro-expander.ts
@@ -4531,7 +4610,8 @@ function stringifyParamDefault(value, type, paramKey, logger) {
 		const known = PARAMETER_TYPE_PLACEHOLDERS[type];
 		if (known !== void 0) return known;
 		if (type.startsWith("AWS::SSM::Parameter::Value<")) {
-			if (isListParameterType(type.slice(27, -1))) return "placeholder,placeholder";
+			const inner = ssmResolvedValueType(type);
+			if (inner !== void 0 && isListParameterType(inner)) return "placeholder,placeholder";
 			return "placeholder";
 		}
 		logger.warn(`Parameter '${paramKey}' has unrecognized CFn Type '${type}'; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
@@ -16749,6 +16829,62 @@ function coerceParameterTypedValue(value, type) {
 	return value;
 }
 /**
+* Bind a template-declared `Default` the way the USER-SUPPLIED path binds a
+* value (issue
+* [#2367](https://github.com/go-to-k/cdkd/issues/2367)).
+*
+* `resolveParameters` writes `parameters[name]` at three sites and only the
+* user-supplied one asked the coercion anything, so a parameter declared
+* `Type: CommaDelimitedList` with `Default: "a,b,c"` and no CLI override
+* reached every consumer as the raw string -- `Fn::Select` over it threw
+* `Fn::Select: list must be an array, got string`, and a bare `Ref` handed the
+* provider a comma-joined scalar where the resource schema declares a list.
+* The defect predates the #2347 widening: it hits `CommaDelimitedList` and
+* `List<Number>`, the two list types the `switch` has recognised all along.
+*
+* CloudFormation's own documentation is written in exactly these terms --
+* `parameters-section-structure.html`'s worked example declares
+* `VpcAzs: {Type: CommaDelimitedList, Default: "us-west-2a, us-west-2b,
+* us-west-2c"}` and then reads it with `Fn::Select`, which is the case that
+* threw.
+*
+* ONLY A STRING IS COERCED, and that is the whole of the rule. `Default` is
+* typed `unknown` because it is whatever the template parser produced, and the
+* shapes are not hypothetical -- measured 2026-08-29 on both parsers cdkd
+* feeds this from:
+*
+*  - `aws-cdk-lib`'s `CfnParameter._toCloudFormation` emits `Default:
+*    this.default` with no conversion, so `{type: 'Number', default: 42}`
+*    synthesizes the JSON NUMBER `42`, and `{type: 'CommaDelimitedList',
+*    default: ['a','b','c']}` synthesizes a JSON ARRAY;
+*  - `parseCfnTemplate` (`src/cli/yaml-cfn.ts`), on the `cdkd import
+*    --migrate-from-cloudformation` / `cdkd export` path, resolves `Default:
+*    42` to a number, `Default: "42"` to a string, a YAML sequence to an array
+*    and `Default: true` to a boolean.
+*
+* FOR THE SHAPES MEASURED ABOVE, a non-string default is already what the
+* declared type calls for -- `42` for a `Number`, `['a','b']` for a
+* `CommaDelimitedList` -- so coercing it could only damage it.
+* `String(['a,b','c'])` is `'a,b,c'`, which the split would then shred into
+* THREE elements, and `String(true)` would turn a boolean a consumer sees today
+* into text. Stringifying first is therefore not a harmless normalization, and
+* `coerceParameterTypedValue` takes a `string` precisely because parsing the
+* wire text is its whole job.
+*
+* THE CLAIM IS SCOPED TO THOSE SHAPES ON PURPOSE, because a mismatched pairing
+* is reachable and is NOT in it: YAML admits `Type: CommaDelimitedList` with
+* `Default: 42` or `Default: true`, and such a default is passed through as the
+* scalar it parsed to rather than becoming a one-element list. That is the
+* PRE-EXISTING behaviour, unchanged here and deliberately so -- a template
+* pairing a list type with a scalar default is malformed CloudFormation, and
+* inventing a coercion for it on a path that writes state is a bigger decision
+* than this fix.
+*/
+function coerceParameterDefault(defaultValue, type) {
+	if (typeof defaultValue !== "string") return defaultValue;
+	return coerceParameterTypedValue(defaultValue, type);
+}
+/**
 * The inherited `plaintext -> expression` pairs that `value` CARRIES.
 *
 * ONE definition, shared by the RECORDING side
@@ -17256,11 +17392,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const ssmPath = String(paramDef.Default);
 					this.logger.debug(`Parameter ${name}: resolving SSM parameter path ${ssmPath}`);
 					const resolved = await this.resolveSSMParameter(ssmPath);
-					parameters[name] = resolved;
+					const resolvedType = ssmResolvedValueType(paramDef.Type);
+					parameters[name] = resolvedType === void 0 ? resolved : this.coerceParameterValue(resolved, resolvedType);
 					this.logger.debug(`Parameter ${name}: resolved SSM value ${maskInherited(stringifyParameterForLog(paramDef, resolved))}`);
 					continue;
 				}
-				parameters[name] = paramDef.Default;
+				parameters[name] = coerceParameterDefault(paramDef.Default, paramDef.Type);
 				this.logger.debug(`Parameter ${name}: using default value ${maskInherited(stringifyParameterForLog(paramDef, paramDef.Default))}`);
 				continue;
 			}
@@ -20570,7 +20707,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BeELAzdu.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CnpxfVci.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -32559,4 +32696,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, PartialFailureError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, normalizeAwsError as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, DynamicReferenceRegionAmbiguousError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, LockError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LocalStartServiceError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StackTerminationProtectionError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, markNonRetryable as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isMarkedNonRetryable as Hr, withRetry as Ht, red as I, runDockerForeground as In, StateError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, __exportAll as Jr, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, markRedactedCause as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, SynthesisError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceTimeoutError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, ResourceUpdateNotSupportedError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, MissingCdkCliError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackHasActiveImportsError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, formatError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DeployCancelledError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalMigrateError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isRetryableTransientError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, withErrorHandling as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, isThrottlingError as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, AssetError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, expectedOwnerParam as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, CrossAccountSecretRefusalError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, derivePartitionAndUrlSuffix as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, clearBucketRegionCache as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, resolveBucketRegion as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, setAwsClients as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, resetAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ProvisioningError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, NestedStackChildDirectDestroyError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, AssemblyReader as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, getAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, PARTITION_TABLE as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, AwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, retryClassificationText as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, canonicalizeRegion as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, processStackMessages as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, CdkdError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalInvokeBuildError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DependencyError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, ConfigError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, isCdkdError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-Du2CDZop.js.map
+//# sourceMappingURL=deploy-engine-BoDdOfCO.js.map