@go-to-k/cdkd 0.219.6 → 0.219.7

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceNameWithFallback, C as StackHasActiveImportsError, F as getLiveRenderer, H as withStackName, I as PATTERN_B_NAME_PROPERTIES, L as PATTERN_B_RESOURCE_TYPES, M as getLogger, P as runStackBuffered, S as ResourceUpdateNotSupportedError, V as withSkipPrefix, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { A as WorkGraph, B as resolveCaptureObservedState, C as DagBuilder, D as shouldRetainResource, E as S3StateBackend, F as runDockerStreaming, G as CFN_TEMPLATE_BODY_LIMIT, H as resolveStateBucketWithDefault, I as Synthesizer, J as findLargeInlineResources, K as CFN_TEMPLATE_URL_LIMIT, L as getDefaultStateBucketName, M as formatDockerLoginError, N as getDockerCmd, O as AssetPublisher, P as runDockerForeground, Q as resolveBucketRegion, R as getLegacyStateBucketName, S as DiffCalculator, T as LockManager, U as resolveStateBucketWithDefaultAndSource, V as resolveSkipPrefix, W as warnDeprecatedNoPrefixCliFlag, X as AssemblyReader, Y as uploadCfnTemplate, _ as ProviderRegistry, a as withRetry, b as IntrinsicFunctionResolver, c as formatResourceLine, d as gray, f as green, g as collectInlinePolicyNamesManagedBySiblings, h as IAMRoleProvider, i as withResourceDeadline, j as buildDockerImage, k as stringifyValue, l as bold, m as yellow, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as red, q as MIGRATE_TMP_PREFIX, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as cyan, v as findActionableSilentDrops, w as TemplateParser, x as applyRoleArnIfSet, y as CloudControlProvider, z as resolveApp } from "./deploy-engine-CwB8POpC.js";
+import { A as WorkGraph, B as resolveCaptureObservedState, C as DagBuilder, D as shouldRetainResource, E as S3StateBackend, F as runDockerStreaming, G as CFN_TEMPLATE_BODY_LIMIT, H as resolveStateBucketWithDefault, I as Synthesizer, J as findLargeInlineResources, K as CFN_TEMPLATE_URL_LIMIT, L as getDefaultStateBucketName, M as formatDockerLoginError, N as getDockerCmd, O as AssetPublisher, P as runDockerForeground, Q as resolveBucketRegion, R as getLegacyStateBucketName, S as DiffCalculator, T as LockManager, U as resolveStateBucketWithDefaultAndSource, V as resolveSkipPrefix, W as warnDeprecatedNoPrefixCliFlag, X as AssemblyReader, Y as uploadCfnTemplate, _ as ProviderRegistry, a as withRetry, b as IntrinsicFunctionResolver, c as formatResourceLine, d as gray, f as green, g as collectInlinePolicyNamesManagedBySiblings, h as IAMRoleProvider, i as withResourceDeadline, j as buildDockerImage, k as stringifyValue, l as bold, m as yellow, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as red, q as MIGRATE_TMP_PREFIX, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as cyan, v as findActionableSilentDrops, w as TemplateParser, x as applyRoleArnIfSet, y as CloudControlProvider, z as resolveApp } from "./deploy-engine-BWfGeCMs.js";
 import { t as ASGProvider } from "./asg-provider-B_hrCxRx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -52867,7 +52867,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.219.6");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.219.7");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());

package/dist/{deploy-engine-CwB8POpC.js → deploy-engine-BWfGeCMs.js}

@@ -9,7 +9,7 @@ import { GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctio
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client } from "@aws-sdk/client-ec2";
 import { DescribeTableCommand } from "@aws-sdk/client-dynamodb";
-import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, GetTemplateCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
+import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeTypeCommand, GetTemplateCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
 import { GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
@@ -6388,6 +6388,100 @@ var JsonPatchGenerator = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/write-only-properties.ts
+/**
+* Write-only property resolution for Cloud Control API updates (issue #809).
+*
+* Cloud Control API applies UPDATE patch documents with read-modify-write
+* semantics: the type's read handler returns the current model, the patch is
+* applied on top, and the result becomes the desired state handed to the
+* update handler. Read handlers cannot return write-only properties, so any
+* write-only property that is not explicitly present in the patch document
+* vanishes from the desired state on every CC-routed UPDATE (e.g.
+* `AWS::ECS::Service` loses `VolumeConfigurations` and the update hard-fails;
+* for other types the loss is silent).
+*
+* This module resolves each resource type's `writeOnlyProperties` from the
+* CloudFormation registry schema via `cloudformation:DescribeType`, reduced
+* to the TOP-LEVEL containing property names (a nested path like
+* `/properties/Foo/Bar` strips to `Foo` — re-adding the whole containing
+* property is sufficient and matches terraform-provider-awscc's approach of
+* clearing write-only attribute paths in the prior state so the patch
+* generator always emits `add` ops for them).
+*
+* Only SUCCESSFUL lookups are cached per resource type for the process
+* (deploy) lifetime — `cloudformation:DescribeType` is throttled per-account,
+* and the schema cannot change mid-deploy. A FAILED lookup (missing IAM
+* permission, transient throttle / 5xx) is logged as a warning and resolves
+* to an empty set WITHOUT poisoning the cache, so the caller gracefully falls
+* back to the minimal patch for THIS update while a later update of the same
+* type retries `DescribeType`. Caching failures would let a single transient
+* throttle on the first CC-routed UPDATE silently disable write-only
+* re-inclusion for every CC-routed type for the rest of the deploy —
+* reintroducing the exact hard-fail this module fixes. No regression for
+* callers permanently without the `cloudformation:DescribeType` permission:
+* each update simply re-warns and re-falls-back.
+*/
+/**
+* Per-type cache of SUCCESSFUL lookups only. The value is the in-flight (or
+* settled) promise so that concurrent updates of the same resource type share
+* a single DescribeType call. A failed lookup removes its own entry so a
+* later call retries instead of being permanently poisoned by a transient
+* throttle / 5xx.
+*/
+const writeOnlyPropertiesCache = /* @__PURE__ */ new Map();
+/**
+* Resolve the TOP-LEVEL write-only property names for a resource type.
+*
+* Never throws: a DescribeType failure logs a warning and resolves to an
+* empty set (graceful fallback to the minimal patch). Only SUCCESSFUL
+* lookups are cached per resource type for the process lifetime; a failed
+* lookup is NOT cached, so a later call for the same type retries
+* DescribeType (a transient throttle must not poison the deploy).
+*/
+function getTopLevelWriteOnlyProperties(resourceType) {
+	const cached = writeOnlyPropertiesCache.get(resourceType);
+	if (cached) return cached;
+	const entry = fetchTopLevelWriteOnlyProperties(resourceType).catch((error) => {
+		writeOnlyPropertiesCache.delete(resourceType);
+		const message = error instanceof Error ? error.message : String(error);
+		getLogger().child("WriteOnlyProperties").warn(`Failed to resolve write-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to a minimal update patch — write-only properties (if any) may be dropped by the Cloud Control read-modify-write update. Grant cloudformation:DescribeType to enable write-only property re-inclusion.`);
+		return /* @__PURE__ */ new Set();
+	});
+	writeOnlyPropertiesCache.set(resourceType, entry);
+	return entry;
+}
+/**
+* Fetch + parse the type's write-only properties. THROWS on a DescribeType
+* failure — the caller (`getTopLevelWriteOnlyProperties`) catches, warns, and
+* declines to cache so the lookup can be retried later.
+*/
+async function fetchTopLevelWriteOnlyProperties(resourceType) {
+	const logger = getLogger().child("WriteOnlyProperties");
+	const response = await getAwsClients().cloudFormation.send(new DescribeTypeCommand({
+		Type: "RESOURCE",
+		TypeName: resourceType
+	}));
+	const result = /* @__PURE__ */ new Set();
+	if (response.Schema) {
+		const writeOnly = JSON.parse(response.Schema).writeOnlyProperties;
+		if (Array.isArray(writeOnly)) for (const path of writeOnly) {
+			if (typeof path !== "string") continue;
+			const match = /^\/properties\/([^/]+)/.exec(path);
+			if (match?.[1]) result.add(unescapeJsonPointerSegment(match[1]));
+		}
+	}
+	logger.debug(`Resolved ${result.size} top-level write-only properties for ${resourceType}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
+	return result;
+}
+/**
+* Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
+*/
+function unescapeJsonPointerSegment(segment) {
+	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+
 //#endregion
 //#region src/provisioning/unsupported-types.generated.ts
 /**
@@ -6700,7 +6794,7 @@ var CloudControlProvider = class {
 		try {
 			const cleanPreviousProperties = stringifyJsonProperties(resourceType, stripNullValues(previousProperties));
 			const cleanProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
-			const patch = this.patchGenerator.generatePatch(cleanPreviousProperties, cleanProperties);
+			let patch = this.patchGenerator.generatePatch(cleanPreviousProperties, cleanProperties);
 			if (patch.length === 0) {
 				this.logger.debug(`No property changes detected for ${logicalId}, skipping update`);
 				return {
@@ -6708,6 +6802,19 @@ var CloudControlProvider = class {
 					wasReplaced: false
 				};
 			}
+			const writeOnlyProperties = await getTopLevelWriteOnlyProperties(resourceType);
+			if (writeOnlyProperties.size > 0) {
+				const previousWithoutWriteOnly = { ...cleanPreviousProperties };
+				for (const propertyName of writeOnlyProperties) delete previousWithoutWriteOnly[propertyName];
+				patch = this.patchGenerator.generatePatch(previousWithoutWriteOnly, cleanProperties);
+				if (patch.length === 0) {
+					this.logger.debug(`Only removed write-only properties detected for ${logicalId}, skipping update`);
+					return {
+						physicalId,
+						wasReplaced: false
+					};
+				}
+			}
 			this.logger.debug(`Generated ${patch.length} patch operations for ${logicalId}: ${JSON.stringify(patch)}`);
 			const updateResponse = await this.cloudControlClient.send(new UpdateResourceCommand({
 				TypeName: resourceType,
@@ -12272,4 +12379,4 @@ var DeployEngine = class {
 
 //#endregion
 export { WorkGraph as A, resolveCaptureObservedState as B, DagBuilder as C, shouldRetainResource as D, S3StateBackend as E, runDockerStreaming as F, CFN_TEMPLATE_BODY_LIMIT as G, resolveStateBucketWithDefault as H, Synthesizer as I, findLargeInlineResources as J, CFN_TEMPLATE_URL_LIMIT as K, getDefaultStateBucketName as L, formatDockerLoginError as M, getDockerCmd as N, AssetPublisher as O, runDockerForeground as P, resolveBucketRegion as Q, getLegacyStateBucketName as R, DiffCalculator as S, LockManager as T, resolveStateBucketWithDefaultAndSource as U, resolveSkipPrefix as V, warnDeprecatedNoPrefixCliFlag as W, AssemblyReader as X, uploadCfnTemplate as Y, clearBucketRegionCache as Z, ProviderRegistry as _, withRetry as a, IntrinsicFunctionResolver as b, formatResourceLine as c, gray as d, green as f, collectInlinePolicyNamesManagedBySiblings as g, IAMRoleProvider as h, withResourceDeadline as i, buildDockerImage as j, stringifyValue as k, bold as l, yellow as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, red as p, MIGRATE_TMP_PREFIX as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, cyan as u, findActionableSilentDrops as v, TemplateParser as w, applyRoleArnIfSet as x, CloudControlProvider as y, resolveApp as z };
-//# sourceMappingURL=deploy-engine-CwB8POpC.js.map
+//# sourceMappingURL=deploy-engine-BWfGeCMs.js.map