@go-to-k/cdkd 0.220.3 → 0.220.5

package/dist/cli.js

@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.220.3";
+	return "0.220.5";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -1929,6 +1929,18 @@ function recordRunFailed(recorder, stackName, error) {
 *   lock + bounded retry. After exhaustion, the writer logs warn and
 *   continues; the index becomes stale until the next deploy/destroy
 *   updates it.
+*
+* Cross-region state bucket: like `S3StateBackend` and `LockManager`, the
+* store tolerates a state bucket that lives in a different AWS region from
+* the CLI's base region. Before its first S3 operation it resolves the
+* bucket's actual region via `GetBucketLocation` and, if it differs from
+* the supplied client's region, builds a private replacement client for
+* that region (issue #819 — without this, every index write/remove against
+* a cross-region bucket failed with S3's 301 PermanentRedirect, surfacing
+* as `Exports index ... failed (non-retryable): ... must be addressed using
+* the specified endpoint`; the index was silently never maintained
+* cross-region, although the canonical state.json — written through the
+* already-region-corrected `S3StateBackend` — stayed correct).
 */
 /** Schema version for the exports index file. Separate from state.json's version. */
 const EXPORT_INDEX_VERSION = 1;
@@ -1977,6 +1989,9 @@ var ExportIndexStore = class {
 	* where it actually matters. Reads (`lookup`) remain unsynchronized.
 	*/
 	writeChain = Promise.resolve();
+	/** Memoization for the one-time bucket-region resolution (issue #819). */
+	clientResolved = false;
+	resolveInFlight = null;
 	constructor(s3Client, bucket, prefix, region, stateBackend, opts = {}) {
 		this.s3Client = s3Client;
 		this.bucket = bucket;
@@ -1993,6 +2008,72 @@ var ExportIndexStore = class {
 		return `${this.prefix}/_index/${this.region}/exports.json`;
 	}
 	/**
+	* Resolve the state bucket's actual region and, if it differs from the
+	* supplied client's configured region, replace the client reference with
+	* a new S3Client pointed at the bucket's region (issue #819).
+	*
+	* Mirrors `LockManager.ensureClientForBucket()` (issue #803) with the same
+	* two deliberate differences from `S3StateBackend`:
+	*
+	* - The replacement client reuses the original client's resolved
+	*   credentials provider, so `--profile` / static credentials carry over
+	*   without the four `ExportIndexStore` call sites having to thread client
+	*   options.
+	* - The original client is NOT destroyed. It is the shared `AwsClients.s3`
+	*   instance that other components (state backend, lock manager) still hold
+	*   a reference to.
+	*
+	* `resolveBucketRegion` caches per bucket name for the process lifetime, so
+	* when the state backend / lock manager have already resolved the same
+	* bucket this incurs no additional `GetBucketLocation` call.
+	*
+	* Best-effort: if the supplied client does not expose the SDK
+	* `config.region()` shape (e.g. a hand-rolled test double) the resolution
+	* is skipped and the original client is used unchanged.
+	*/
+	async ensureClientForBucket() {
+		if (this.clientResolved) return;
+		if (this.resolveInFlight) return this.resolveInFlight;
+		this.resolveInFlight = (async () => {
+			try {
+				const config = this.s3Client.config;
+				if (!config || typeof config.region !== "function") {
+					this.clientResolved = true;
+					return;
+				}
+				const currentRegion = await config.region();
+				const fallbackRegion = typeof currentRegion === "string" ? currentRegion : void 0;
+				let probeCredentials;
+				try {
+					if (typeof config.credentials === "function") probeCredentials = await config.credentials();
+				} catch {
+					probeCredentials = void 0;
+				}
+				const bucketRegion = await resolveBucketRegion(this.bucket, {
+					...probeCredentials && { credentials: probeCredentials },
+					...fallbackRegion && { fallbackRegion }
+				});
+				if (bucketRegion !== currentRegion) {
+					this.logger.debug(`State bucket '${this.bucket}' is in '${bucketRegion}' (exports-index client was '${String(currentRegion)}'); building a region-corrected S3 client for index operations.`);
+					this.s3Client = new S3Client({
+						region: bucketRegion,
+						credentials: this.s3Client.config.credentials,
+						logger: {
+							debug: () => {},
+							info: () => {},
+							warn: () => {},
+							error: () => {}
+						}
+					});
+				}
+				this.clientResolved = true;
+			} finally {
+				this.resolveInFlight = null;
+			}
+		})();
+		return this.resolveInFlight;
+	}
+	/**
 	* Look up an exported value by name. Returns the cached entry on hit,
 	* or `undefined` on miss. The caller is responsible for falling back
 	* to a state.json scan and (if found) patching the index via
@@ -2113,6 +2194,7 @@ var ExportIndexStore = class {
 		}
 	}
 	async readIndexRaw() {
+		await this.ensureClientForBucket();
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.bucket,
@@ -2128,6 +2210,7 @@ var ExportIndexStore = class {
 		}
 	}
 	async writeIndex(next, expectedEtag) {
+		await this.ensureClientForBucket();
 		const body = JSON.stringify(next, null, 2);
 		return (await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.bucket,
@@ -19655,18 +19738,175 @@ var ECSProvider = class {
 		};
 	}
 	/**
-	* Convert CFn Volumes to ECS SDK format
+	* Convert CFn Volumes to ECS SDK format.
+	*
+	* Every nested volume-configuration block is PascalCase in the CFn
+	* template and camelCase in the ECS SDK input, so each sub-block runs
+	* through a dedicated converter — the same PascalCase->camelCase trap
+	* already fixed for the ContainerDefinitions sub-arrays
+	* (convertEnvironment / convertSecrets / convertMountPoints etc.).
+	* Before issue #815, `Host` / `EFSVolumeConfiguration` were cast through
+	* raw (so their nested keys reached the SDK still PascalCase) and
+	* `DockerVolumeConfiguration` / `FSxWindowsFileServerVolumeConfiguration`
+	* were not mapped at all (silently dropped).
 	*/
 	convertVolumes(volumes) {
 		if (!volumes) return void 0;
 		return volumes.map((v) => ({
 			name: v["Name"],
-			host: v["Host"],
-			efsVolumeConfiguration: v["EFSVolumeConfiguration"],
+			host: this.convertVolumeHost(v["Host"]),
+			dockerVolumeConfiguration: this.convertDockerVolumeConfiguration(v["DockerVolumeConfiguration"]),
+			efsVolumeConfiguration: this.convertEFSVolumeConfiguration(v["EFSVolumeConfiguration"]),
+			fsxWindowsFileServerVolumeConfiguration: this.convertFSxWindowsVolumeConfiguration(v["FSxWindowsFileServerVolumeConfiguration"]),
 			configuredAtLaunch: this.coerceBool(v["ConfiguredAtLaunch"])
 		}));
 	}
 	/**
+	* Convert CFn Volumes[].Host to ECS SDK format.
+	* CFn: `{SourcePath}` -> SDK: `{sourcePath}`.
+	*/
+	convertVolumeHost(host) {
+		if (!host) return void 0;
+		return { sourcePath: host["SourcePath"] };
+	}
+	/**
+	* Convert CFn Volumes[].DockerVolumeConfiguration to ECS SDK format.
+	* CFn: `{Scope, Autoprovision, Driver, DriverOpts, Labels}`
+	* -> SDK: `{scope, autoprovision, driver, driverOpts, labels}`.
+	*/
+	convertDockerVolumeConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			scope: config["Scope"],
+			autoprovision: this.coerceBool(config["Autoprovision"]),
+			driver: config["Driver"],
+			driverOpts: config["DriverOpts"],
+			labels: config["Labels"]
+		};
+	}
+	/**
+	* Convert CFn Volumes[].EFSVolumeConfiguration to ECS SDK format.
+	* CFn: `{FilesystemId, RootDirectory, TransitEncryption,
+	* TransitEncryptionPort, AuthorizationConfig}`
+	* -> SDK: `{fileSystemId, rootDirectory, transitEncryption,
+	* transitEncryptionPort, authorizationConfig}`.
+	* Note the CFn property is `FilesystemId` (lowercase `s`) while the SDK
+	* field is `fileSystemId` — they are not a simple first-letter case flip.
+	*/
+	convertEFSVolumeConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			fileSystemId: config["FilesystemId"],
+			rootDirectory: config["RootDirectory"],
+			transitEncryption: config["TransitEncryption"],
+			transitEncryptionPort: config["TransitEncryptionPort"] !== void 0 ? Number(config["TransitEncryptionPort"]) : void 0,
+			authorizationConfig: this.convertEFSAuthorizationConfig(config["AuthorizationConfig"])
+		};
+	}
+	/**
+	* Convert CFn EFSVolumeConfiguration.AuthorizationConfig to ECS SDK format.
+	* CFn: `{AccessPointId, IAM}` -> SDK: `{accessPointId, iam}`.
+	* Note the CFn key is `IAM` (all caps), NOT `Iam` — not a simple
+	* first-letter case flip (verified against the CDK L1 `IAM` mapping).
+	*/
+	convertEFSAuthorizationConfig(config) {
+		if (!config) return void 0;
+		return {
+			accessPointId: config["AccessPointId"],
+			iam: config["IAM"]
+		};
+	}
+	/**
+	* Convert CFn Volumes[].FSxWindowsFileServerVolumeConfiguration to ECS
+	* SDK format.
+	* CFn: `{FileSystemId, RootDirectory, AuthorizationConfig}`
+	* -> SDK: `{fileSystemId, rootDirectory, authorizationConfig}`.
+	*/
+	convertFSxWindowsVolumeConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			fileSystemId: config["FileSystemId"],
+			rootDirectory: config["RootDirectory"],
+			authorizationConfig: this.convertFSxWindowsAuthorizationConfig(config["AuthorizationConfig"])
+		};
+	}
+	/**
+	* Convert CFn FSxWindowsFileServerVolumeConfiguration.AuthorizationConfig
+	* to ECS SDK format.
+	* CFn: `{CredentialsParameter, Domain}`
+	* -> SDK: `{credentialsParameter, domain}`.
+	*/
+	convertFSxWindowsAuthorizationConfig(config) {
+		if (!config) return void 0;
+		return {
+			credentialsParameter: config["CredentialsParameter"],
+			domain: config["Domain"]
+		};
+	}
+	/**
+	* Convert the camelCase SDK `volumes` shape returned by
+	* DescribeTaskDefinition back to the PascalCase CFn template form, so the
+	* `readCurrentState` snapshot matches the deploy-time template
+	* representation for drift comparison (issue #815). Only volume keys
+	* present on the SDK side are emitted, so a future field cdkd does not
+	* map cannot surface as phantom drift. TaskDefinitions are immutable
+	* replace-only today, so this is forward-looking normalization.
+	*/
+	volumesToCfn(volumes) {
+		if (!volumes) return [];
+		return volumes.map((v) => {
+			const out = {};
+			if (v.name !== void 0) out["Name"] = v.name;
+			if (v.host !== void 0) {
+				const host = {};
+				if (v.host.sourcePath !== void 0) host["SourcePath"] = v.host.sourcePath;
+				out["Host"] = host;
+			}
+			if (v.dockerVolumeConfiguration !== void 0) {
+				const d = v.dockerVolumeConfiguration;
+				const docker = {};
+				if (d.scope !== void 0) docker["Scope"] = d.scope;
+				if (d.autoprovision !== void 0) docker["Autoprovision"] = d.autoprovision;
+				if (d.driver !== void 0) docker["Driver"] = d.driver;
+				if (d.driverOpts !== void 0) docker["DriverOpts"] = d.driverOpts;
+				if (d.labels !== void 0) docker["Labels"] = d.labels;
+				out["DockerVolumeConfiguration"] = docker;
+			}
+			if (v.efsVolumeConfiguration !== void 0) {
+				const e = v.efsVolumeConfiguration;
+				const efs = {};
+				if (e.fileSystemId !== void 0) efs["FilesystemId"] = e.fileSystemId;
+				if (e.rootDirectory !== void 0) efs["RootDirectory"] = e.rootDirectory;
+				if (e.transitEncryption !== void 0) efs["TransitEncryption"] = e.transitEncryption;
+				if (e.transitEncryptionPort !== void 0) efs["TransitEncryptionPort"] = e.transitEncryptionPort;
+				if (e.authorizationConfig !== void 0) {
+					const a = e.authorizationConfig;
+					const auth = {};
+					if (a.accessPointId !== void 0) auth["AccessPointId"] = a.accessPointId;
+					if (a.iam !== void 0) auth["IAM"] = a.iam;
+					efs["AuthorizationConfig"] = auth;
+				}
+				out["EFSVolumeConfiguration"] = efs;
+			}
+			if (v.fsxWindowsFileServerVolumeConfiguration !== void 0) {
+				const f = v.fsxWindowsFileServerVolumeConfiguration;
+				const fsx = {};
+				if (f.fileSystemId !== void 0) fsx["FileSystemId"] = f.fileSystemId;
+				if (f.rootDirectory !== void 0) fsx["RootDirectory"] = f.rootDirectory;
+				if (f.authorizationConfig !== void 0) {
+					const a = f.authorizationConfig;
+					const auth = {};
+					if (a.credentialsParameter !== void 0) auth["CredentialsParameter"] = a.credentialsParameter;
+					if (a.domain !== void 0) auth["Domain"] = a.domain;
+					fsx["AuthorizationConfig"] = auth;
+				}
+				out["FSxWindowsFileServerVolumeConfiguration"] = fsx;
+			}
+			if (v.configuredAtLaunch !== void 0) out["ConfiguredAtLaunch"] = v.configuredAtLaunch;
+			return out;
+		});
+	}
+	/**
 	* Coerce a CFn boolean property to a real boolean at the wire boundary.
 	* CFn templates can carry booleans as the strings "true" / "false"
 	* (e.g. via Fn::Sub / parameter plumbing), so the SDK input must
@@ -19845,7 +20085,7 @@ var ECSProvider = class {
 		result["RequiresCompatibilities"] = td.requiresCompatibilities ? [...td.requiresCompatibilities] : [];
 		if (td.executionRoleArn !== void 0) result["ExecutionRoleArn"] = td.executionRoleArn;
 		if (td.taskRoleArn !== void 0) result["TaskRoleArn"] = td.taskRoleArn;
-		result["Volumes"] = td.volumes ?? [];
+		result["Volumes"] = this.volumesToCfn(td.volumes);
 		result["PlacementConstraints"] = td.placementConstraints ?? [];
 		if (td.runtimePlatform) result["RuntimePlatform"] = td.runtimePlatform;
 		if (td.proxyConfiguration) result["ProxyConfiguration"] = td.proxyConfiguration;
@@ -53550,7 +53790,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.220.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.220.5");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());