@go-to-k/cdkd 0.285.15 → 0.285.16

package/dist/{deploy-engine-DPh-XamZ.js → deploy-engine-DuFUy9D0.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-Dcdouqd3.js";
+import { t as getCdkdVersion } from "./version-C_ZRHikq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -22378,7 +22378,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CKEf903K.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DoP-32eU.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -29243,6 +29243,25 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 * agreement checkable rather than hand-curated.
 * `AWS::S3Express::DirectoryBucket` was the one type on the wrong side.
 *
+* **Third bound, and the first that reads the population the other two are
+* blind to** (issue [#2553]): both bounds above are derived from
+* `src/provisioning/providers/**` and `register-providers.ts`, so both can
+* only see types cdkd has an SDK PROVIDER for — 134 of them, against the
+* 1371 tier-2 types that have none and whose replacement routes through
+* Cloud Control's DELETE. That is the population issue [#2514] was filed
+* about, and until now it had never been swept.
+* `scripts/audit-stateful-candidates.ts` reads every tier-2 type's
+* CloudFormation registry schema and PROPOSES the ones that declare a
+* createOnly property (so a rename is a replacement a plain `cdkd deploy`
+* reaches with no flag) AND fire a data-bearing signal. Each proposal must
+* end up either on this list or in that script's `NOT_GUARDED` map with a
+* reason; `tests/unit/scripts/stateful-candidates.test.ts` fails on any that
+* is in neither, and on a `NOT_GUARDED` entry the derivation has stopped
+* proposing. Unlike the two bounds above the signals are HEURISTIC — no AWS
+* artifact states "deleting this destroys user data" — so this bound makes
+* the widening CHECKABLE rather than proven, which is the property a hand
+* pass over 1371 types could not have.
+*
 * Neither fence can see a provider whose delete destroys data with NO opt-in
 * at all — an unconditional empty (`S3TablesProvider.deleteTableBucket`,
 * `S3VectorsProvider.deleteVectorBucket`) or a plainly destructive API call
@@ -29286,7 +29305,70 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::Glue::Database",
 	"AWS::Glue::Table",
 	"AWS::Logs::LogGroup",
-	"AWS::CloudFront::Distribution"
+	"AWS::CloudFront::Distribution",
+	"AWS::Cassandra::Table",
+	"AWS::DocDBElastic::Cluster",
+	"AWS::Lightsail::Database",
+	"AWS::Timestream::Database",
+	"AWS::Timestream::Table",
+	"AWS::Timestream::InfluxDBCluster",
+	"AWS::Timestream::InfluxDBInstance",
+	"AWS::ODB::CloudAutonomousVmCluster",
+	"AWS::ODB::CloudVmCluster",
+	"AWS::RedshiftServerless::Namespace",
+	"AWS::RedshiftServerless::Snapshot",
+	"AWS::NeptuneGraph::Graph",
+	"AWS::NeptuneGraph::GraphSnapshot",
+	"AWS::MemoryDB::Cluster",
+	"AWS::MemoryDB::MultiRegionCluster",
+	"AWS::ElastiCache::ServerlessCache",
+	"AWS::MSK::Cluster",
+	"AWS::MSK::ServerlessCluster",
+	"AWS::MSK::Channel",
+	"AWS::AmazonMQ::Broker",
+	"AWS::OSIS::Pipeline",
+	"AWS::KinesisVideo::Stream",
+	"AWS::Events::Archive",
+	"AWS::OpenSearchServerless::Collection",
+	"AWS::OpenSearchServerless::Index",
+	"AWS::OpenSearchServerless::CollectionIndex",
+	"AWS::Kendra::Index",
+	"AWS::QBusiness::Index",
+	"AWS::QBusiness::Application",
+	"AWS::Rekognition::Collection",
+	"AWS::Location::GeofenceCollection",
+	"AWS::S3Vectors::Index",
+	"AWS::Bedrock::KnowledgeBase",
+	"AWS::Bedrock::DataAutomationLibrary",
+	"AWS::Lightsail::Bucket",
+	"AWS::S3Outposts::Bucket",
+	"AWS::HealthImaging::Datastore",
+	"AWS::HealthLake::FHIRDatastore",
+	"AWS::SES::MailManagerArchive",
+	"AWS::WorkspacesInstances::Volume",
+	"AWS::IoTAnalytics::Channel",
+	"AWS::IoTAnalytics::Datastore",
+	"AWS::IoTAnalytics::Dataset",
+	"AWS::CodeArtifact::Domain",
+	"AWS::CodeArtifact::Repository",
+	"AWS::ECR::PublicRepository",
+	"AWS::Backup::BackupVault",
+	"AWS::Backup::LogicallyAirGappedBackupVault",
+	"AWS::EKS::Cluster",
+	"AWS::SageMaker::Cluster",
+	"AWS::SageMaker::Domain",
+	"AWS::Cases::Domain",
+	"AWS::CustomerProfiles::Domain",
+	"AWS::DataZone::Domain",
+	"AWS::CleanRooms::IdMappingTable",
+	"AWS::CleanRooms::IntermediateTable",
+	"AWS::CloudFront::KeyValueStore",
+	"AWS::Connect::DataTable",
+	"AWS::AppConfig::ConfigurationProfile",
+	"AWS::AIOps::InvestigationGroup",
+	"AWS::Rbin::Rule",
+	"AWS::SMSVOICE::PhoneNumber",
+	"AWS::SMSVOICE::SenderId"
 ]);
 /**
 * Multi-region resource types — `--recreate-via-cc-api` refuses these
@@ -34541,4 +34623,4 @@ var DeployEngine = class {
 
 //#endregion
 export { endCommandInterruptScope as $, resolveCaptureObservedState as $n, isThrottlingError as $r, maskSecretsInText as $t, bold as A, getBootstrapMarkerKey as An, DeployCancelledError as Ar, classifyReplaySecretRegion as At, secretBearingStateKeyWarning as B, formatDockerLoginError as Bn, ProvisioningError as Br, describeTypeWithThrottleRetry as Bt, unsupportedFinalSnapshotError as C, rewriteTemplateAssetReferences as Cn, resetAwsClients as Cr, configBooleanRefusal as Ct, isStatefulRecreateTargetSync as D, BOOTSTRAP_MARKER_PREFIX as Dn, ConfigError as Dr, requireConfigArray as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, AssetModeResolver as En, CdkdError as Er, replayWarn as Et, yellow as F, validateContainerRepoName as Fn, LocalStartServiceError as Fr, s3BucketRegionalDomainName as Ft, clearOnUpdateRemoval as G, AssetManifestLoader as Gn, StateError as Gr, STATE_SOURCED_READBACK_RULES as Gt, getCurrentResourceSecrets as H, partitionSensitiveEnv as Hn, ResourceUpdateNotSupportedError as Hr, DagBuilder as Ht, collectDeclaredOutputNames as I, buildDenyExternalAccessPolicy as In, LockError as Ir, s3BucketWebsiteUrl as It, findSilentDropProperties as J, synthesisStatusMessage as Jn, isCdkdError as Jr, createSecretMasker as Jt, ProviderRegistry as K, getDockerImageBySourceHash as Kn, SynthesisError as Kr, TEMPLATE_SOURCED_RULES as Kt, collectPublishedOutputNames as L, describeAwsFailure as Ln, MissingCdkCliError as Lr, applyRoleArnIfSet as Lt, gray as M, parseBootstrapMarker as Mn, IntrinsicResolutionRefusalError as Mr, s3BucketArn as Mt, green as N, readBootstrapMarkerBody as Nn, LocalInvokeBuildError as Nr, s3BucketDomainName as Nt, renderStatefulReason as O, assertAssetBucketRegion as On, CrossAccountSecretRefusalError as Or, requireConfigObject as Ot, red as P, validateAssetBucketName as Pn, LocalMigrateError as Pr, s3BucketDualStackDomainName as Pt, beginCommandInterruptScope as Q, resolveAutoAssetStorage as Qn, isRetryableTransientError as Qr, maskSecretsInError as Qt, exportAliasCollisionScrubWarning as R, buildDockerImage as Rn, NestedStackChildDirectDestroyError as Rr, DiffCalculator as Rt, refusesFinalSnapshot as S, loadPublishableAssetManifest as Sn, getAwsClients as Sr, coerceCfnBoolean as St, extractDeploymentEventError as T, stripControlChars as Tn, AssetError as Tr, readConfigString as Tt, IAMRoleProvider as U, runDockerForeground as Un, StackHasActiveImportsError as Ur, TemplateParser as Ut, stateKeySecretExposure as V, getDockerCmd as Vn, ResourceTimeoutError as Vr, withRetry as Vt, collectInlinePolicyNamesManagedBySiblings as W, runDockerStreaming as Wn, StackTerminationProtectionError as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, maskDeep as X, getLegacyStateBucketName as Xn, withErrorHandling as Xr, errorCauseChain as Xt, createMaskedRetryLogger as Y, getDefaultStateBucketName as Yn, normalizeAwsError as Yr, dynamicReferenceTokens as Yt, maskerOrIdentity as Z, resolveApp as Zn, isMarkedNonRetryable as Zr, isSingleDynamicReferenceToken as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, AssetPublisher as _n, AssemblyReader as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, S3StateBackend as an, warnDeprecatedNoPrefixCliFlag as ar, UNSPECIFIED_SKIP_REASON as at, createPreDeleteFinalSnapshot as b, buildAssetRedirectMap as bn, resolveBucketRegion as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, buildForceUnlockCommand as cn, MIGRATE_TMP_PREFIX as cr, disableInstanceApiTermination as ct, updatePartialReason as d, CUSTOM_RESOURCE_RESPONSE_PREFIX as dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as dr, carriesDynamicReference as dt, isTransientServerError as ei, recordMaskOnlyValue as en, resolveSkipPrefix as er, interruptWatchListenerCount as et, withResourceDeadline as f, DEFAULT_STATE_PREFIX as fn, displaySafe as fr, cfnRefValueFromPhysicalId as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, shouldRetainResource as gn, derivePartitionAndUrlSuffix as gr, parameterTypeMayLoseSecretIdentity as gt, computeImplicitDeleteEdges as h, importableOutputs as hn, canonicalizeRegion as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, __exportAll as ii, LockManager as in, stateBucketExistenceConfirmed as ir, slowCcOperationTimeoutMs as it, cyan as j, isCrossRegionRedirect as jn, DynamicReferenceRegionAmbiguousError as jr, producerRegionsFromState as jt, formatResourceLine as k, ensureAssetStorage as kn, DependencyError as kr, requireConfigString as kt, replayRollback as l, buildLockContentionMessage as ln, findLargeInlineResources as lr, isTerminationProtectionPropagationError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, importableOutputKeys as mn, PARTITION_TABLE as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, markRedactedCause as ni, redactSecretsForState as nn, resolveStateBucketWithDefaultAndSource as nr, startInterruptWatch as nt, planFailedOps as o, rebuildClientForBucketRegion as on, CFN_TEMPLATE_BODY_LIMIT as or, deleteIndeterminateGuards as ot, maskingRetryLogger as p, exportNamesCarriedFrom as pn, expectedOwnerParam as pr, coerceParameterTypedValue as pt, findActionableSilentDrops as q, Synthesizer as qn, formatError as qr, carriesSecretMask as qt, DeployEngine as r, retryClassificationText as ri, scrubResourceRecord as rn, resolveUseCdkBootstrapAssets as rr, CloudControlProvider as rt, planRollback as s, UNRENDERABLE as sn, CFN_TEMPLATE_URL_LIMIT as sr, deleteSkipReason as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, markNonRetryable as ti, recoverMaskedOutput as tn, resolveStateBucketWithDefault as tr, isInterruptedWaitError as tt, updatePartialMessage as u, forceQuitRecoveryClause as un, uploadCfnTemplate as ur, IntrinsicFunctionResolver as ut, buildFinalSnapshotIdentifier as v, stringifyValue as vn, processStackMessages as vr, WAFv2WebACLProvider as vt, makeCanonicalizePropertiesFn as w, escapeRegExp$1 as wn, setAwsClients as wr, configStringRefusal as wt, isFinalSnapshotError as x, createAssetRedirectResolver as xn, AwsClients as xr, assertRegionMatch as xt, ccRoutedFinalSnapshotError as y, WorkGraph as yn, clearBucketRegionCache as yr, normalizeAwsTagsToCfn as yt, isExportAliasCollision as z, dockerSpawnEnvWithSensitive as zn, PartialFailureError as zr, INTRINSIC_KEYS as zt };
-//# sourceMappingURL=deploy-engine-DPh-XamZ.js.map
+//# sourceMappingURL=deploy-engine-DuFUy9D0.js.map