@go-to-k/cdkd 0.289.0 → 0.289.2

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CCKo6fK2.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DUhfbsEF.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-Bg60hZhr.js");
+	const { buildProgram } = await import("./program-Du5rJeYT.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-B6pEfNd9.js → deploy-engine-ClLLdy68.js}

@@ -1,6 +1,6 @@
 import { d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName } from "./logger-D2Md1kTq.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CCKo6fK2.js";
+import { t as getCdkdVersion } from "./version-DUhfbsEF.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -20869,7 +20869,7 @@ function classifyReplaySecretRegion(expression, consumerRegion, importedProducer
 */
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$1(container)) {
+	if (!isPlainObject$1(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -20949,7 +20949,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$1(value)) {
+	if (!isPlainObject$1(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -20980,7 +20980,7 @@ function requireConfigObject(value, path, options) {
 */
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$1(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$1(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 /**
@@ -21034,7 +21034,7 @@ function coerceCfnBoolean(value) {
 */
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$1(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$1(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -21055,6 +21055,7 @@ function configValueRefusal(value, fallback, path, options) {
 * only, which is invisible in review.
 */
 function malformedShapeDetail(value) {
+	if (isPlainObject$1(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
 /**
@@ -21066,11 +21067,121 @@ function malformedShapeDetail(value) {
 function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/**
+* CFn intrinsic names this module is willing to NAME in an error message.
+*
+* Display-only, and the reason is in `describe`: the message reaches
+* substring-matching retry classifiers, and a state record can carry an
+* arbitrary `Fn::*` key (`cdkd import` writes the raw intrinsic shape when it
+* cannot resolve one). An unrecognized key therefore degrades to the generic
+* wording rather than being interpolated. Nothing depends on this list being
+* complete — a missing entry costs diagnostic detail, never safety.
+*/
+const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
+	"Ref",
+	"Fn::Base64",
+	"Fn::Cidr",
+	"Fn::FindInMap",
+	"Fn::GetAZs",
+	"Fn::GetAtt",
+	"Fn::GetStackOutput",
+	"Fn::If",
+	"Fn::ImportValue",
+	"Fn::Join",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::Sub",
+	"Fn::Transform"
+]);
+/**
+* True for a single-key object whose key is `Ref` or `Fn::*` — the shape of an
+* unresolved CloudFormation intrinsic (issue #3032).
+*
+* Every CONTAINER gate in this module needs it, which is the correction a
+* review round forced: an earlier revision of this comment claimed the sibling
+* guards were safe "by type", and that is true only of their FIELD halves. An
+* intrinsic is not a string and not an array, so {@link requireConfigArray} and
+* the value-level reads refuse it — but `readConfigString`,
+* {@link configStringRefusal} and {@link configBooleanRefusal} each open by
+* testing their CONTAINER with a bare `isPlainObject`, which an intrinsic
+* passes. The key probe then indexes to `undefined` and the FALLBACK is
+* substituted: measured on this module's own motivating case, a
+* `VersioningConfiguration` of `{ 'Fn::If': [...] }` returned `'Suspended'`,
+* i.e. versioning turned OFF on a live bucket (the #1471 headline). So all four
+* container gates test this, not just {@link requireConfigObject}.
+*
+* A REVIEW ROUND ASKED FOR THE UPDATE-PATH DOWNGRADE HERE AND IT IS WRONG,
+* which is worth recording because the general rule points the other way.
+* SEVERAL `readConfigString` UPDATE sites pass no `onUnusable` and therefore
+* now throw on an intrinsic — `route53-provider.ts` (`HostedZoneConfig`),
+* `cloudfront-oai-provider.ts` (`CloudFrontOriginAccessIdentityConfig`),
+* `kinesis-provider.ts` (`StreamModeDetails`), `ecs-provider.ts`
+* (`DeploymentController`), `secretsmanager-secret-provider.ts`
+* (`GenerateSecretString`, via `generateSecretString`) and `codebuild-provider.ts`
+* (reached from `update()` through `mapProperties`). Not a count, for the same
+* reason as the near-copy list below: two successive reviews each found
+* another. Re-derive with
+* `grep -rn 'readConfigString(' src/provisioning/providers/`.
+* That reads like the #1544 un-rollbackable hazard —
+* but each is a DELIBERATE refusal from issues #1493 / #1471, pinned by a test
+* that states the reason in its own name ("refuses a string container on
+* update, so the live comment is not blanked", "instead of assuming the ECS
+* controller"). At those sites the FALLBACK is the destructive direction: it
+* blanks a live comment or silently picks a controller. Adding the downgrade
+* reddened the existing test at every one of those sites that had one, which
+* is how the reversal was caught.
+* An intrinsic container simply inherits that recorded decision — this change
+* widens WHICH shapes are refused, never WHETHER a site refuses.
+*
+* Reachability is DOMINATED by the STATE-borne replay paths — the rollback
+* executor's reverse-replacement create, its revert arms, and
+* `cdkd drift --revert` — because a record written by an older binary can carry
+* the raw intrinsic, which is why three S3 suites already list
+* `{ 'Fn::If': [...] }` among "the malformed shapes a state record written by
+* an older binary can carry". A fresh template is MOSTLY excluded rather than
+* entirely: the resolver throws on an unresolvable `Ref` / `Fn::GetAtt` and
+* hard-errors on an unknown `Fn::*` key, so those never arrive — but
+* `Fn::Transform` is listed in its `HANDLED_INTRINSIC_KEYS` with no dispatch
+* arm (deliberately, so a stray already-expanded occurrence does not
+* hard-error), falls through the generic object walk, and reaches a provider
+* bag verbatim. Refusing it here is the right outcome anyway: an unexpanded
+* `Fn::Transform` sitting AS a container value means the macro never expanded,
+* so the block is genuinely broken and the pre-guard behaviour was a silently
+* emptied one.
+*
+* KEPT LOCAL, deliberately, and the rule is `.claude/rules/`'s own. SEVERAL
+* near-copies of this shape exist across the tree — `create-only-properties.ts`,
+* `mutually-exclusive-properties.ts`, `route53-provider.ts` and
+* `dynamodb-globaltable-provider.ts` under `src/provisioning/`, plus more in
+* `cli/commands/drift.ts`, `cli/commands/import.ts` and
+* `deployment/intrinsic-function-resolver.ts`. Deliberately NOT stated as a
+* count: three successive review rounds corrected one, each time finding
+* another. Re-derive it if you need it
+* (`grep -rn "startsWith('Fn::')" src/`) rather than trusting a number here.
+* `mutually-exclusive-properties.ts` records WHY they are not shared — the modules answer different questions about the shape and
+* must not drift into one another's behavior by accident. This module asks its OWN
+* question ("is this container a real config block, or an intrinsic wearing
+* one's shape"), so it takes its own predicate rather than overriding that
+* decision. Note the copies do NOT agree and are not meant to:
+* `dynamodb-globaltable-provider.ts` asks whether a block is ENTIRELY
+* intrinsic (`keys.every`), which is a broader question than this one.
+*
+* No CFn config block declares a property named `Ref` or `Fn::*`, so the
+* single-key test cannot misread a legitimate container.
+*/
+function isUnresolvedIntrinsicContainer(value) {
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
 /** Human-readable type for an error message, without dumping user data. */
 function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
+	if (isPlainObject$1(value) && isUnresolvedIntrinsicContainer(value)) {
+		const key = Object.keys(value)[0];
+		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
+	}
 	return typeof value === "object" ? "an object" : `a ${typeof value}`;
 }
 
@@ -27637,7 +27748,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-1XVtAjhm.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C5FQJwUN.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -38984,7 +39095,10 @@ var DeployEngine = class DeployEngine {
 				recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
-				if (JSON.stringify(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps)) === JSON.stringify(currentPropsAsWritten)) {
+				const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
+				const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
+				const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops) : desiredForSkipCheck;
+				if (JSON.stringify(desiredForSkipCheckAsWritten) === JSON.stringify(currentPropsAsWritten)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 						this.logger.info(`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -39971,4 +40085,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { collectInlinePolicyNamesManagedBySiblings as $, describeDockerCapturedOutput as $n, LocalInvokeBuildError as $r, DagBuilder as $t, isStatefulRecreateTargetForReplace as A, orphansAfterRollback as An, uploadCfnTemplate as Ar, coerceCfnBoolean as At, gray as B, AssetModeResolver as Bn, resolveBucketRegion as Br, withSharedDrainBudget as Bt, refusesFinalSnapshot as C, forceQuitRecoveryClause as Cn, resolveUseCdkBootstrapAssets as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, exportNamesCarriedFrom as Dn, CFN_TEMPLATE_URL_LIMIT as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, DEFAULT_STATE_PREFIX as En, CFN_TEMPLATE_BODY_LIMIT as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, WorkGraph as Fn, canonicalizeRegion as Fr, requireConfigArray as Ft, collectPublishedOutputNames as G, isCrossRegionRedirect as Gn, AssetError as Gr, s3BucketWebsiteUrl as Gt, red as H, assertAssetBucketRegion as Hn, getAwsClients as Hr, s3BucketDomainName as Ht, toFiniteNumber as I, buildAssetRedirectMap as In, derivePartitionAndUrlSuffix as Ir, requireConfigObject as It, secretBearing as J, validateAssetBucketName as Jn, CrossAccountSecretRefusalError as Jr, INTRINSIC_KEYS as Jt, exportAliasCollisionScrubWarning as K, parseBootstrapMarker as Kn, CdkdError as Kr, applyRoleArnIfSet as Kt, formatResourceLine as L, createAssetRedirectResolver as Ln, AssemblyReader as Lr, requireConfigString as Lt, renderStatefulReason as M, shouldRetainResource as Mn, displaySafe as Mr, configStringRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, AssetPublisher as Nn, expectedOwnerParam as Nr, readConfigString as Nt, planOrphanAdoption as O, importableOutputKeys as On, MIGRATE_TMP_PREFIX as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, stringifyValue as Pn, PARTITION_TABLE as Pr, replayWarn as Pt, IAMRoleProvider as Q, buildDockerImage as Qn, IntrinsicResolutionRefusalError as Qr, withRetry as Qt, bold as R, loadPublishableAssetManifest as Rn, processStackMessages as Rr, classifyReplaySecretRegion as Rt, isFinalSnapshotError as S, __exportAll as Si, buildLockContentionMessage as Sn, resolveStateBucketWithDefaultAndSource as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, CUSTOM_RESOURCE_RESPONSE_PREFIX as Tn, warnDeprecatedNoPrefixCliFlag as Tr, refStateLookupFromResource as Tt, yellow as U, ensureAssetStorage as Un, resetAwsClients as Ur, s3BucketDualStackDomainName as Ut, green as V, BOOTSTRAP_MARKER_PREFIX as Vn, AwsClients as Vr, s3BucketArn as Vt, collectDeclaredOutputNames as W, getBootstrapMarkerKey as Wn, setAwsClients as Wr, s3BucketRegionalDomainName as Wt, secretSafeKeyDisplay as X, buildDenyExternalAccessPolicy as Xn, DeployCancelledError as Xr, findSilentDropProperties as Xt, secretBearingStateKeyWarning as Y, validateContainerRepoName as Yn, DependencyError as Yr, findActionableSilentDrops as Yt, getCurrentResourceSecrets as Z, describeAwsFailure as Zn, DynamicReferenceRegionAmbiguousError as Zr, describeTypeWithThrottleRetry as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isThrottlingError as _i, LockManager as _n, resolveApp as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, ResourceTimeoutError as ai, carriesSecretMask as an, partitionSensitiveEnv as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, markRedactedCause as bi, UNRENDERABLE as bn, resolveSkipPrefix as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, StackTerminationProtectionError as ci, errorCauseChain as cn, runDockerStreaming as cr, interruptWatchListenerCount as ct, updatePartialReason as d, formatError as di, maskSecretsInError as dn, AssetManifestLoader as dr, CloudControlProvider as dt, LocalStartServiceError as ei, TemplateParser as en, describeDockerExecFailure as er, clearOnUpdateRemoval as et, withResourceDeadline as f, isCdkdError as fi, maskSecretsInText as fn, getDockerImageBySourceHash as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, isRetryableTransientError as gi, scrubResourceRecord as gn, getLegacyStateBucketName as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, isMarkedNonRetryable as hi, redactSecretsForState as hn, getDefaultStateBucketName as hr, deleteSkipReason as ht, DeploymentEventsReader as i, ProvisioningError as ii, TEMPLATE_SOURCED_RULES as in, getDockerCmd as ir, maskDeep as it, isStatefulRecreateTargetSync as j, orphansCarriedFrom as jn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as jr, configBooleanRefusal as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, importableOutputs as kn, findLargeInlineResources as kr, assertRegionMatch as kt, replayRollback as l, StateError as li, identityKeyFor as ln, escapeRegExp$1 as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, withErrorHandling as mi, recoverMaskedOutput as mn, synthesisStatusMessage as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, NestedStackChildDirectDestroyError as ni, STATE_SOURCED_CROSS_GENERATION_RULES as nn, dockerSpawnEnvWithSensitive as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ResourceUpdateNotSupportedError as oi, createSecretMasker as on, redactDockerArgvValues as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, normalizeAwsError as pi, recordMaskOnlyValue as pn, Synthesizer as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, readBootstrapMarkerBody as qn, ConfigError as qr, DiffCalculator as qt, DeployEngine as r, PartialFailureError as ri, STATE_SOURCED_READBACK_RULES as rn, formatDockerLoginError as rr, createMaskedRetryLogger as rt, planRollback as s, StackHasActiveImportsError as si, dynamicReferenceTokens as sn, runDockerForeground as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockError as ti, STATE_SOURCED_BASELINE_RULES as tn, describeDockerFailure as tr, ProviderRegistry as tt, updatePartialMessage as u, SynthesisError as ui, isSingleDynamicReferenceToken as un, stripControlChars as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isTransientServerError as vi, S3StateBackend as vn, resolveAutoAssetStorage as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, shellQuote as wn, stateBucketExistenceConfirmed as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, retryClassificationText as xi, buildForceUnlockCommand as xn, resolveStateBucketWithDefault as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, markNonRetryable as yi, rebuildClientForBucketRegion as yn, resolveCaptureObservedState as yr, carriesDynamicReference as yt, cyan as z, rewriteTemplateAssetReferences as zn, clearBucketRegionCache as zr, producerRegionsFromState as zt };
-//# sourceMappingURL=deploy-engine-B6pEfNd9.js.map
+//# sourceMappingURL=deploy-engine-ClLLdy68.js.map