@go-to-k/cdkd 0.167.2 → 0.168.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { _ as withSkipPrefix, a as runDockerStreaming, c as getLogger, d as getLiveRenderer, f as PATTERN_B_NAME_PROPERTIES, g as generateResourceNameWithFallback, h as generateResourceName, i as runDockerForeground, n as formatDockerLoginError, p as PATTERN_B_RESOURCE_TYPES, r as getDockerCmd, u as runStackBuffered, v as withStackName } from "./docker-cmd-iDMcWcre.js";
-import { A as S3StateBackend, B as resolveCaptureObservedState, C as assertRegionMatch, D as DagBuilder, E as DiffCalculator, F as buildDockerImage, G as CFN_TEMPLATE_BODY_LIMIT, H as resolveStateBucketWithDefault, I as Synthesizer, J as findLargeInlineResources, K as CFN_TEMPLATE_URL_LIMIT, L as getDefaultStateBucketName, M as AssetPublisher, N as stringifyValue, O as TemplateParser, P as WorkGraph, Q as resolveBucketRegion, R as getLegacyStateBucketName, S as CloudControlProvider, T as applyRoleArnIfSet, U as resolveStateBucketWithDefaultAndSource, V as resolveSkipPrefix, W as warnDeprecatedNoPrefixCliFlag, X as AssemblyReader, Y as uploadCfnTemplate, _ as matchesCdkPath, a as withRetry, at as LocalStartServiceError, b as ProviderRegistry, bt as normalizeAwsError, c as bold, ct as NestedStackChildDirectDestroyError, d as green, dt as ResourceTimeoutError, et as CdkdError, f as red, ft as ResourceUpdateNotSupportedError, g as CDK_PATH_TAG, h as collectInlinePolicyNamesManagedBySiblings, ht as StackTerminationProtectionError, i as withResourceDeadline, it as LocalMigrateError, j as shouldRetainResource, k as LockManager, l as cyan, lt as PartialFailureError, m as IAMRoleProvider, mt as StackHasActiveImportsError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as IMPLICIT_DELETE_DEPENDENCIES, p as yellow, pt as RouteDiscoveryError, q as MIGRATE_TMP_PREFIX, r as DeployEngine, rt as LocalInvokeBuildError, s as formatResourceLine, st as MissingCdkCliError, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, ut as ProvisioningError, v as normalizeAwsTagsToCfn, w as IntrinsicFunctionResolver, x as findActionableSilentDrops, xt as withErrorHandling, y as resolveExplicitPhysicalId, z as resolveApp } from "./deploy-engine-BQkk03hJ.js";
+import { A as S3StateBackend, B as resolveCaptureObservedState, C as assertRegionMatch, D as DagBuilder, E as DiffCalculator, F as buildDockerImage, G as CFN_TEMPLATE_BODY_LIMIT, H as resolveStateBucketWithDefault, I as Synthesizer, J as findLargeInlineResources, K as CFN_TEMPLATE_URL_LIMIT, L as getDefaultStateBucketName, M as AssetPublisher, N as stringifyValue, O as TemplateParser, P as WorkGraph, Q as resolveBucketRegion, R as getLegacyStateBucketName, S as CloudControlProvider, T as applyRoleArnIfSet, U as resolveStateBucketWithDefaultAndSource, V as resolveSkipPrefix, W as warnDeprecatedNoPrefixCliFlag, X as AssemblyReader, Y as uploadCfnTemplate, _ as matchesCdkPath, a as withRetry, at as LocalStartServiceError, b as ProviderRegistry, bt as normalizeAwsError, c as bold, ct as NestedStackChildDirectDestroyError, d as green, dt as ResourceTimeoutError, et as CdkdError, f as red, ft as ResourceUpdateNotSupportedError, g as CDK_PATH_TAG, h as collectInlinePolicyNamesManagedBySiblings, ht as StackTerminationProtectionError, i as withResourceDeadline, it as LocalMigrateError, j as shouldRetainResource, k as LockManager, l as cyan, lt as PartialFailureError, m as IAMRoleProvider, mt as StackHasActiveImportsError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as IMPLICIT_DELETE_DEPENDENCIES, p as yellow, pt as RouteDiscoveryError, q as MIGRATE_TMP_PREFIX, r as DeployEngine, rt as LocalInvokeBuildError, s as formatResourceLine, st as MissingCdkCliError, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, ut as ProvisioningError, v as normalizeAwsTagsToCfn, w as IntrinsicFunctionResolver, x as findActionableSilentDrops, xt as withErrorHandling, y as resolveExplicitPhysicalId, z as resolveApp } from "./deploy-engine-Cux0aKqI.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1369,16 +1369,28 @@ async function findDownstreamConsumers(input) {
 		const region = ref.region ?? input.baseRegion;
 		if (ref.stackName === input.producerStack && region === input.producerRegion) return null;
 		try {
-			const imports = (await input.stateBackend.getState(ref.stackName, region))?.state.imports;
-			if (!imports || imports.length === 0) return null;
-			const matches = imports.filter((entry) => entry.sourceStack === input.producerStack && entry.sourceRegion === input.producerRegion);
-			if (matches.length === 0) return null;
-			return matches.map((entry) => ({
-				consumerStack: ref.stackName,
-				consumerRegion: region,
-				exportName: entry.exportName,
-				intrinsic: "ImportValue"
-			}));
+			const got = await input.stateBackend.getState(ref.stackName, region);
+			if (!got) return null;
+			const out = [];
+			const imports = got.state.imports;
+			if (imports && imports.length > 0) {
+				for (const entry of imports) if (entry.sourceStack === input.producerStack && entry.sourceRegion === input.producerRegion) out.push({
+					consumerStack: ref.stackName,
+					consumerRegion: region,
+					exportName: entry.exportName,
+					intrinsic: "ImportValue"
+				});
+			}
+			const outputReads = got.state.outputReads;
+			if (outputReads && outputReads.length > 0) {
+				for (const entry of outputReads) if (entry.sourceStack === input.producerStack && entry.sourceRegion === input.producerRegion) out.push({
+					consumerStack: ref.stackName,
+					consumerRegion: region,
+					exportName: entry.outputName,
+					intrinsic: "GetStackOutput"
+				});
+			}
+			return out.length > 0 ? out : null;
 		} catch (err) {
 			logger.debug(`findDownstreamConsumers: skip ${ref.stackName} (${region}); ${err instanceof Error ? err.message : String(err)}`);
 			return null;
@@ -33933,7 +33945,7 @@ async function deployCommand(stacks, options) {
 						validation: validateRecreateTargets({
 							template: stackInfo.template,
 							state: stateForRecreateCheck?.state ?? {
-								version: 7,
+								version: 8,
 								stackName: stackInfo.stackName,
 								region: stackRegion,
 								resources: {},
@@ -34940,7 +34952,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		region,
 		resources: {},
 		outputs: {},
-		version: 7,
+		version: 8,
 		lastModified: Date.now()
 	};
 }
@@ -41656,7 +41668,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 		};
 	}
 	return {
-		version: 7,
+		version: 8,
 		stackName,
 		region,
 		resources,
@@ -56904,7 +56916,8 @@ async function runEcsTask(task, options, state) {
 			sidecarIp: state.network.sidecarIp,
 			...options.skipHostPortPublish ? { skipHostPortPublish: true } : {},
 			...options.addHostFlags && options.addHostFlags.length > 0 ? { addHostFlags: options.addHostFlags } : {},
-			...(options.networkAliasesByContainer?.get(container.name)?.length ?? 0) > 0 ? { networkAliases: options.networkAliasesByContainer.get(container.name) } : {}
+			...(options.networkAliasesByContainer?.get(container.name)?.length ?? 0) > 0 ? { networkAliases: options.networkAliasesByContainer.get(container.name) } : {},
+			...options.profileCredentialsFile && { profileCredentialsFile: options.profileCredentialsFile }
 		}));
 	}
 	const startedByName = /* @__PURE__ */ new Map();
@@ -57236,6 +57249,7 @@ function buildDockerRunArgs(opts) {
 		const hostPort = pm.hostPort ?? pm.containerPort;
 		args.push("-p", `${containerHost}:${hostPort}:${pm.containerPort}/${pm.protocol}`);
 	}
+	if (opts.profileCredentialsFile) args.push("-v", `${opts.profileCredentialsFile.hostPath}:${opts.profileCredentialsFile.containerPath}:ro`);
 	for (const mp of container.mountPoints) {
 		const v = volumeByName.get(mp.sourceVolume);
 		if (!v) continue;
@@ -57257,6 +57271,10 @@ function buildDockerRunArgs(opts) {
 		...opts.sidecarIp !== void 0 && { sidecarIp: opts.sidecarIp }
 	});
 	Object.assign(finalEnv, metaEnv);
+	if (opts.profileCredentialsFile) {
+		finalEnv["AWS_SHARED_CREDENTIALS_FILE"] = opts.profileCredentialsFile.containerPath;
+		finalEnv["AWS_PROFILE"] = opts.profileCredentialsFile.profileName;
+	}
 	Object.assign(finalEnv, container.environment);
 	for (const s of secrets) finalEnv[s.name] = s.value;
 	const overrides = opts.envOverrides;
@@ -57326,6 +57344,7 @@ async function localRunTaskCommand(target, options) {
 	let sigintHandler;
 	let sigintCount = 0;
 	let stateProvider;
+	let profileCredsFile;
 	let cleanupPromise;
 	const cleanup = async () => {
 		if (!cleanupPromise) cleanupPromise = (async () => {
@@ -57334,6 +57353,11 @@ async function localRunTaskCommand(target, options) {
 			} catch (err) {
 				getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
+			if (profileCredsFile) try {
+				await profileCredsFile.dispose();
+			} catch (err) {
+				getLogger().debug(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+			}
 		})();
 		await cleanupPromise;
 	};
@@ -57395,6 +57419,7 @@ async function localRunTaskCommand(target, options) {
 			assumedCredentials = await assumeTaskRole$1(resolvedRoleArn, options.region);
 		}
 		const sidecarCredentials = await resolveSidecarCredentials(options, assumedCredentials);
+		if (options.profile && sidecarCredentials && !assumedCredentials) profileCredsFile = await writeProfileCredentialsFile(options.profile, sidecarCredentials);
 		const envOverrides = readEnvOverridesFile$2(options.envVars);
 		const runOpts = {
 			cluster: options.cluster,
@@ -57409,6 +57434,11 @@ async function localRunTaskCommand(target, options) {
 		if (options.platform) runOpts.platformOverride = options.platform;
 		if (options.region) runOpts.region = options.region;
 		if (options.ecrRoleArn) runOpts.ecrRoleArn = options.ecrRoleArn;
+		if (profileCredsFile) runOpts.profileCredentialsFile = {
+			hostPath: profileCredsFile.hostPath,
+			containerPath: profileCredsFile.containerPath,
+			profileName: profileCredsFile.profileName
+		};
 		const result = await runEcsTask(task, runOpts, state);
 		if (options.detach) {
 			logger.info("Task containers started in detached mode; cdkd is exiting.");
@@ -58659,6 +58689,7 @@ async function localStartServiceCommand(targets, options) {
 	let sigintHandler;
 	let sigintCount = 0;
 	let sharedNetwork;
+	let profileCredsFile;
 	const cleanup = singleFlight(async () => {
 		await Promise.allSettled(perTarget.map(async (pt) => {
 			if (pt.controller) await pt.controller.shutdown();
@@ -58667,6 +58698,14 @@ async function localStartServiceCommand(targets, options) {
 				await Promise.allSettled(pt.runState.replicas.map((r) => cleanupEcsRun(r.state, { keepRunning: false }).catch(() => void 0)));
 			}
 		}));
+		if (profileCredsFile) {
+			try {
+				await profileCredsFile.dispose();
+			} catch (err) {
+				getLogger().warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			profileCredsFile = void 0;
+		}
 		if (sharedNetwork) {
 			try {
 				await destroyTaskNetwork(sharedNetwork);
@@ -58715,6 +58754,7 @@ async function localStartServiceCommand(targets, options) {
 		} catch (err) {
 			throw new LocalStartServiceError(`Failed to create shared service network: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		if (options.profile && sidecarCredentials) profileCredsFile = await writeProfileCredentialsFile(options.profile, sidecarCredentials);
 		const discovery = {
 			registry,
 			cloudMapIndexByStack,
@@ -58731,7 +58771,7 @@ async function localStartServiceCommand(targets, options) {
 		};
 		process.on("SIGINT", sigintHandler);
 		process.on("SIGTERM", sigintHandler);
-		for (const pt of perTarget) pt.controller = await bootOneTarget(pt.target, pt.runState, stacks, options, discovery, skipPull);
+		for (const pt of perTarget) pt.controller = await bootOneTarget(pt.target, pt.runState, stacks, options, discovery, skipPull, profileCredsFile);
 		const summary = perTarget.map((pt) => `${pt.controller.service.serviceName} (${pt.controller.activeReplicaCount()} replica(s))`).join(", ");
 		logger.info(`Service(s) running: ${summary}. Press ^C to shut down.`);
 		await Promise.all(perTarget.map((pt) => pt.controller.waitForShutdown()));
@@ -58749,16 +58789,16 @@ async function localStartServiceCommand(targets, options) {
 * options) is scoped locally. Returns the started controller for the
 * outer code to wait + tear down.
 */
-async function bootOneTarget(target, runState, stacks, options, discovery, skipPull) {
+async function bootOneTarget(target, runState, stacks, options, discovery, skipPull, profileCredsFile) {
 	const candidate = pickCandidateStack(parseEcsTarget(target).stackPattern, stacks);
 	const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", candidate?.region);
 	try {
-		return await runOneTarget(target, runState, stacks, options, discovery, skipPull, stateProvider);
+		return await runOneTarget(target, runState, stacks, options, discovery, skipPull, stateProvider, profileCredsFile);
 	} finally {
 		if (stateProvider) stateProvider.dispose();
 	}
 }
-async function runOneTarget(target, runState, stacks, options, discovery, skipPull, stateProvider) {
+async function runOneTarget(target, runState, stacks, options, discovery, skipPull, stateProvider, profileCredsFile) {
 	const logger = getLogger();
 	const imageContext = await buildEcsImageResolutionContext(target, stacks, options, stateProvider);
 	const service = resolveEcsServiceTarget(target, stacks, imageContext);
@@ -58804,6 +58844,11 @@ async function runOneTarget(target, runState, stacks, options, discovery, skipPu
 	if (options.platform) taskOpts.platformOverride = options.platform;
 	if (options.region) taskOpts.region = options.region;
 	if (options.ecrRoleArn) taskOpts.ecrRoleArn = options.ecrRoleArn;
+	if (profileCredsFile && !assumedCredentials) taskOpts.profileCredentialsFile = {
+		hostPath: profileCredsFile.hostPath,
+		containerPath: profileCredsFile.containerPath,
+		profileName: profileCredsFile.profileName
+	};
 	return startEcsService(service, {
 		maxTasks: options.maxTasks,
 		restartPolicy: options.restartPolicy,
@@ -60882,7 +60927,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.167.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.168.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());