@go-to-k/cdkd 0.104.0 → 0.105.0

package/dist/cli.js

@@ -35,6 +35,7 @@ import { Command, Option } from "commander";
 import { writeFileSync as writeFileSync$1 } from "fs";
 import { join as join$1 } from "path";
 import * as zlib from "node:zlib";
+import { ApplicationAutoScalingClient, DescribeScalingPoliciesCommand } from "@aws-sdk/client-application-auto-scaling";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$9, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$9, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$10, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
@@ -7878,13 +7879,26 @@ var DynamoDBTableProvider = class {
 *    calling `update()`, but the guard is defense-in-depth.
 *  - Per-replica drift (`ContributorInsightsSpecification` /
 *    `PointInTimeRecoverySpecification` / `KinesisStreamSpecification`)
-*    is surfaced for the LOCAL replica only; cross-region replicas
-*    require per-region SDK clients which are out of scope for v1.
+*    is surfaced for BOTH the LOCAL replica AND cross-region replicas
+*    via per-region SDK clients (cached in `regionalClientCache` for
+*    the deploy run). Issue #389 lifted the v1 LOCAL-only limitation.
+*  - Cross-region replica Tags propagation (Issue #389): when the
+*    update path detects a Tags-only diff on a non-local replica,
+*    cdkd resolves the replica's table ARN by swapping the region
+*    segment of the local ARN and issues `TagResource` /
+*    `UntagResource` against a per-region client.
 */
 var DynamoDBGlobalTableProvider = class {
 	dynamoDBClient;
 	logger = getLogger().child("DynamoDBGlobalTableProvider");
 	/**
+	* Caches per-region `DynamoDBClient` instances for cross-region drift
+	* reads (`readCurrentState`) and cross-region Tag propagation
+	* (`update()`). Keyed by region string; reuses the default credential
+	* chain. Lifetime is the provider instance — one deploy run.
+	*/
+	regionalClientCache = /* @__PURE__ */ new Map();
+	/**
 	* Caches `getAttribute(physicalId, attribute)` results for the lifetime
 	* of this provider instance (one deploy run). Safe under the current
 	* `update()` contract because `update()` cannot mid-deploy mutate
@@ -7916,6 +7930,50 @@ var DynamoDBGlobalTableProvider = class {
 		this.dynamoDBClient = awsClients.dynamoDB;
 	}
 	/**
+	* Return a `DynamoDBClient` pinned to the given region, caching per
+	* region for the lifetime of this provider instance. Uses the default
+	* credential chain (env / shared config / IAM role) — no explicit
+	* credential plumbing needed.
+	*
+	* Used by `readCurrentState` (cross-region per-replica sub-spec reads)
+	* and `update()` (cross-region replica Tag propagation). Both code
+	* paths fire region-scoped DynamoDB APIs (`DescribeContributorInsights`
+	* / `DescribeContinuousBackups` / `DescribeKinesisStreamingDestination`
+	* / `TagResource` / `UntagResource`) against the replica's region.
+	*
+	* The cache may return `this.dynamoDBClient` when `region` happens to
+	* match the local client's region — in tests the local mock is
+	* intercepted via `vi.mock('../../utils/aws-clients.js')` so reuse
+	* is safe (and explicitly desired so the mock catches the call).
+	*/
+	getRegionalClient(region) {
+		const cached = this.regionalClientCache.get(region);
+		if (cached) return cached;
+		const client = new DynamoDBClient({ region });
+		this.regionalClientCache.set(region, client);
+		return client;
+	}
+	/**
+	* Construct the regional table ARN for a cross-region replica of a
+	* GlobalTable. AWS replicates the same `TableName` across every
+	* replica region, with each replica's ARN differing only in the
+	* `:<region>:` segment. Cheaper than a second `DescribeTable` round-
+	* trip on the regional client.
+	*
+	* Example:
+	*   local ARN:   arn:aws:dynamodb:us-east-1:123:table/Foo
+	*   for eu-west-1 → arn:aws:dynamodb:eu-west-1:123:table/Foo
+	*
+	* Returns `undefined` when the local ARN is malformed (defensive —
+	* downstream callers omit the offending operation rather than throw).
+	*/
+	replicaArnForRegion(localTableArn, targetRegion) {
+		const segments = localTableArn.split(":");
+		if (segments.length < 6) return void 0;
+		segments[3] = targetRegion;
+		return segments.join(":");
+	}
+	/**
 	* Create a DynamoDB Global Table (CDK TableV2).
 	*
 	* GlobalTable is built on the regular DynamoDB Table primitive: cdkd issues
@@ -8167,12 +8225,24 @@ var DynamoDBGlobalTableProvider = class {
 			for (const replica of replicaDiff.modified) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
+				const oldReplicaTags = (previousProperties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["Tags"];
+				const newReplicaTags = replica["Tags"];
+				if (!deepEqual$1(oldReplicaTags, newReplicaTags)) if (tableArn) {
+					const replicaArn = this.replicaArnForRegion(tableArn, region);
+					if (replicaArn) try {
+						const regionalClient = this.getRegionalClient(region);
+						await this.applyTagDiffOnClient(regionalClient, replicaArn, oldReplicaTags, newReplicaTags);
+					} catch (tagErr) {
+						this.logger.warn(`Could not apply Tags diff to cross-region replica ${region} of ${physicalId}: ${tagErr instanceof Error ? tagErr.message : String(tagErr)}. The replica's Tags state will surface as drift until the next successful deploy.`);
+					}
+					else this.logger.warn(`Could not derive replica ARN for region ${region} from ${tableArn} — skipping Tags propagation for ${physicalId}`);
+				} else this.logger.warn(`Local DescribeTable returned no TableArn — cannot propagate Tags to cross-region replica ${region} of ${physicalId}`);
 				const updateAction = { RegionName: region };
 				if (replica["KMSMasterKeyId"] !== void 0) updateAction.KMSMasterKeyId = replica["KMSMasterKeyId"];
 				if (replica["GlobalSecondaryIndexes"]) updateAction.GlobalSecondaryIndexes = replica["GlobalSecondaryIndexes"];
 				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
 				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0)) {
-					this.logger.debug(`Cross-region replica ${region} of ${physicalId}: only Tags-style changes detected; skipping UpdateReplica (AWS rejects empty Update actions). Per-region Tag propagation is deferred.`);
+					this.logger.debug(`Cross-region replica ${region} of ${physicalId}: only Tags-style changes detected; UpdateReplica skipped (AWS rejects empty Update actions). Tags propagation handled above via per-region client.`);
 					continue;
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -8259,10 +8329,22 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via DynamoDB's
-	* `TagResource` / `UntagResource` APIs. Both take the table ARN as
-	* `ResourceArn`.
+	* `TagResource` / `UntagResource` APIs against the local client. Both
+	* take the table ARN as `ResourceArn`.
+	*
+	* Local-replica convenience wrapper around `applyTagDiffOnClient` so
+	* existing call sites stay unchanged.
 	*/
 	async applyTagDiff(tableArn, oldTagsRaw, newTagsRaw) {
+		await this.applyTagDiffOnClient(this.dynamoDBClient, tableArn, oldTagsRaw, newTagsRaw);
+	}
+	/**
+	* Apply a Tags diff against the given `DynamoDBClient` (which may be
+	* the local client or a per-region client returned by
+	* `getRegionalClient`). Used by the local-replica path AND the
+	* cross-region replica Tags propagation path (Issue #389).
+	*/
+	async applyTagDiffOnClient(client, tableArn, oldTagsRaw, newTagsRaw) {
 		const toMap = (tags) => {
 			const m = /* @__PURE__ */ new Map();
 			for (const t of tags ?? []) if (t.Key !== void 0 && t.Value !== void 0) m.set(t.Key, t.Value);
@@ -8278,14 +8360,14 @@ var DynamoDBGlobalTableProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.dynamoDBClient.send(new UntagResourceCommand$2({
+			await client.send(new UntagResourceCommand$2({
 				ResourceArn: tableArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from DynamoDB GlobalTable ${tableArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.dynamoDBClient.send(new TagResourceCommand$2({
+			await client.send(new TagResourceCommand$2({
 				ResourceArn: tableArn,
 				Tags: tagsToAdd
 			}));
@@ -8453,20 +8535,36 @@ var DynamoDBGlobalTableProvider = class {
 			result["Replicas"] = await Promise.all((table.Replicas ?? []).map(async (r) => {
 				const entry = { Region: r.RegionName };
 				if (r.KMSMasterKeyId !== void 0) entry["KMSMasterKeyId"] = r.KMSMasterKeyId;
-				if (r.RegionName && r.RegionName === currentRegion) {
-					const subs = await this.readLocalReplicaSubSpecs(tableNameForSubs);
-					Object.assign(entry, subs);
-					if (table.TableArn) try {
-						entry["Tags"] = normalizeAwsTagsToCfn((await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: table.TableArn }))).Tags);
-					} catch (tagErr) {
-						if (tagErr instanceof ResourceNotFoundException$1) throw tagErr;
-						this.logger.warn(`Could not fetch tags for DynamoDB GlobalTable ${tableNameForSubs}: ${tagErr instanceof Error ? tagErr.message : String(tagErr)}`);
+				if (!r.RegionName) return entry;
+				const isLocal = r.RegionName === currentRegion;
+				const client = isLocal ? this.dynamoDBClient : this.getRegionalClient(r.RegionName);
+				const regionLabel = r.RegionName;
+				const replicaArn = isLocal ? table.TableArn : table.TableArn ? this.replicaArnForRegion(table.TableArn, r.RegionName) : void 0;
+				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel);
+				Object.assign(entry, subs);
+				if (replicaArn) try {
+					entry["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }))).Tags);
+				} catch (tagErr) {
+					if (tagErr instanceof ResourceNotFoundException$1) {
+						if (isLocal) throw tagErr;
+						this.logger.debug(`Cross-region replica ${regionLabel} returned RNF on ListTagsOfResource; omitting Tags`);
+						entry["Tags"] = [];
+					} else {
+						this.logger.warn(`Could not fetch tags for DynamoDB GlobalTable ${tableNameForSubs} in ${regionLabel}: ${tagErr instanceof Error ? tagErr.message : String(tagErr)}`);
 						entry["Tags"] = [];
 					}
-					else entry["Tags"] = [];
 				}
+				else entry["Tags"] = [];
 				return entry;
 			}));
+			if (table.OnDemandThroughput?.MaxWriteRequestUnits !== void 0) result["WriteOnDemandThroughputSettings"] = { MaxWriteRequestUnits: table.OnDemandThroughput.MaxWriteRequestUnits };
+			else result["WriteOnDemandThroughputSettings"] = {};
+			if (billingMode === "PROVISIONED") {
+				const writeCapacity = table.ProvisionedThroughput?.WriteCapacityUnits;
+				if (writeCapacity !== void 0) if (!await this.hasWriteAutoScalingPolicy(tableNameForSubs)) result["WriteProvisionedThroughputSettings"] = { WriteCapacityUnits: writeCapacity };
+				else result["WriteProvisionedThroughputSettings"] = {};
+				else result["WriteProvisionedThroughputSettings"] = {};
+			} else result["WriteProvisionedThroughputSettings"] = {};
 			try {
 				const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: tableNameForSubs }))).TimeToLiveDescription;
 				const ttlStatus = ttlDesc?.TimeToLiveStatus;
@@ -8485,7 +8583,9 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	/**
-	* Read per-replica sub-specifications for the LOCAL replica:
+	* Read per-replica sub-specifications against the given `DynamoDBClient`
+	* (which may be the local client or a per-region client returned by
+	* `getRegionalClient`):
 	*  - `ContributorInsightsSpecification` via `DescribeContributorInsights`
 	*    (table-level; GSI overrides are NOT surfaced in v1 — they would
 	*    require one call per GSI and a different CFn nesting under the
@@ -8498,51 +8598,86 @@ var DynamoDBGlobalTableProvider = class {
 	* Each call is best-effort: errors omit the offending key rather than
 	* fail the whole drift read.
 	*
-	* Cross-region replicas would need per-region SDK clients (the calls
-	* are region-scoped to the replica) — deferred to a follow-up PR.
+	* Issue #389 lifted the LOCAL-only limitation by parameterizing the
+	* client — the same reverse-mapping logic runs against any region's
+	* client.
 	*/
-	async readLocalReplicaSubSpecs(tableName) {
+	async readReplicaSubSpecs(client, tableName, regionLabel) {
 		const out = {};
 		try {
-			const ci = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: tableName }));
+			const ci = await client.send(new DescribeContributorInsightsCommand({ TableName: tableName }));
 			if (ci.ContributorInsightsStatus) out["ContributorInsightsSpecification"] = { Enabled: ci.ContributorInsightsStatus === "ENABLED" };
 		} catch (err) {
-			this.logger.debug(`Could not read ContributorInsights for ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Could not read ContributorInsights for ${tableName} in ${regionLabel}: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		try {
-			const pitrStatus = (await this.dynamoDBClient.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus;
+			const pitrStatus = (await client.send(new DescribeContinuousBackupsCommand({ TableName: tableName }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus;
 			if (pitrStatus) out["PointInTimeRecoverySpecification"] = { PointInTimeRecoveryEnabled: pitrStatus === "ENABLED" };
 		} catch (err) {
-			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Could not read PointInTimeRecovery for ${tableName} in ${regionLabel}: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		try {
-			const active = ((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING");
+			const active = ((await client.send(new DescribeKinesisStreamingDestinationCommand({ TableName: tableName }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING");
 			if (active?.StreamArn) {
 				const ksOut = { StreamArn: active.StreamArn };
 				if (active.ApproximateCreationDateTimePrecision !== void 0) ksOut["ApproximateCreationDateTimePrecision"] = active.ApproximateCreationDateTimePrecision;
 				out["KinesisStreamSpecification"] = ksOut;
 			}
 		} catch (err) {
-			this.logger.debug(`Could not read KinesisStreamingDestination for ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Could not read KinesisStreamingDestination for ${tableName} in ${regionLabel}: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		return out;
 	}
 	/**
+	* Detect whether application-autoscaling has a scaling policy on this
+	* table's WriteCapacityUnits dimension. Used to decide whether the
+	* `WriteProvisionedThroughputSettings.WriteCapacityUnits` flat-value
+	* surface in `readCurrentState` is safe to emit (auto-scaling
+	* dynamically mutates capacity, so a flat snapshot would fire false
+	* drift on every scale event — when an autoscaling policy is in play
+	* we omit the flat surface so a follow-up PR can reverse-map the
+	* full `WriteCapacityAutoScalingSettings` shape).
+	*
+	* Best-effort: errors return `false` (no autoscaling detected) so a
+	* permissions gap on `application-autoscaling:DescribeScalingPolicies`
+	* does not abort drift reads. Logged at debug.
+	*/
+	async hasWriteAutoScalingPolicy(tableName) {
+		try {
+			return ((await new ApplicationAutoScalingClient({ region: await this.dynamoDBClient.config.region() ?? "" }).send(new DescribeScalingPoliciesCommand({
+				ServiceNamespace: "dynamodb",
+				ResourceId: `table/${tableName}`,
+				ScalableDimension: "dynamodb:table:WriteCapacityUnits"
+			}))).ScalingPolicies ?? []).length > 0;
+		} catch (err) {
+			this.logger.debug(`Could not query application-autoscaling for ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
+			return false;
+		}
+	}
+	/**
 	* State property paths cdkd's GlobalTable readCurrentState cannot (yet)
 	* reverse-map. The drift comparator skips these so a templated value
 	* doesn't fire guaranteed false drift on every clean run.
 	*
-	* - `WriteProvisionedThroughputSettings` /
-	*   `WriteOnDemandThroughputSettings`: CFn's shapes wrap
-	*   auto-scaling / on-demand max-RU settings whose reverse-mapping
-	*   from `DescribeTable.ProvisionedThroughput` / `OnDemandThroughput`
-	*   is non-trivial and would fire false drift in v1.
-	*
-	* `TimeToLiveSpecification` is reverse-mapped via `DescribeTimeToLive`
-	* in `readCurrentState` (no longer in this list).
+	* Issue #389 emptied this list:
+	*  - `WriteProvisionedThroughputSettings` (flat-WriteCapacityUnits
+	*    subset) is now reverse-mapped from `Table.ProvisionedThroughput`
+	*    when BillingMode is PROVISIONED AND application-autoscaling has
+	*    no policy on the WriteCapacityUnits dimension. Auto-scaling
+	*    cases emit an empty `{}` placeholder so the comparator does NOT
+	*    fire false drift on the literal `WriteCapacityUnits` subtree.
+	*  - `WriteOnDemandThroughputSettings` is reverse-mapped from
+	*    `Table.OnDemandThroughput.MaxWriteRequestUnits`. Always-emit
+	*    `{}` placeholder when AWS reports no override.
+	*  - `TimeToLiveSpecification` is reverse-mapped via
+	*    `DescribeTimeToLive` in `readCurrentState`.
+	*
+	* Returning an empty list is the canonical "no known-unknown paths"
+	* shape — keeping the method present (rather than removing it) for
+	* future additions and for backward compat on test reflection.
 	*/
 	getDriftUnknownPaths(_resourceType) {
-		return ["WriteProvisionedThroughputSettings", "WriteOnDemandThroughputSettings"];
+		return [];
 	}
 	/**
 	* Adopt an existing DynamoDB GlobalTable into cdkd state.
@@ -44028,7 +44163,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.104.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.105.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());