@go-to-k/cdkd 0.221.14 → 0.221.16

package/dist/cli.js

@@ -59,8 +59,8 @@ import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand,
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$9, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$10, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListVectorBucketsCommand, S3VectorsClient } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3tables";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$16 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.221.14";
+	return "0.221.16";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -9579,6 +9579,21 @@ var DynamoDBTableProvider = class {
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, previousProperties["Tags"], properties["Tags"]);
+			if (JSON.stringify(properties["BillingMode"]) !== JSON.stringify(previousProperties["BillingMode"]) || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"])) {
+				const billingMode = properties["BillingMode"];
+				const updateInput = { TableName: physicalId };
+				if (billingMode) updateInput.BillingMode = billingMode;
+				if (billingMode !== "PAY_PER_REQUEST" && properties["ProvisionedThroughput"]) {
+					const pt = properties["ProvisionedThroughput"];
+					updateInput.ProvisionedThroughput = {
+						ReadCapacityUnits: Number(pt["ReadCapacityUnits"] ?? 5),
+						WriteCapacityUnits: Number(pt["WriteCapacityUnits"] ?? 5)
+					};
+				}
+				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
+				await this.waitForTableActiveAfterUpdate(physicalId);
+				this.logger.debug(`Updated BillingMode/ProvisionedThroughput on DynamoDB table ${physicalId}`);
+			}
 			if (JSON.stringify(properties["OnDemandThroughput"]) !== JSON.stringify(previousProperties["OnDemandThroughput"])) {
 				if (properties["OnDemandThroughput"]) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -33133,15 +33148,79 @@ var S3VectorsProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	update(logicalId, _physicalId, resourceType, _properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
-			case "AWS::S3Vectors::VectorBucket": return Promise.resolve({
-				physicalId: _physicalId,
-				wasReplaced: false
-			});
-			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, _physicalId);
+			case "AWS::S3Vectors::VectorBucket": return this.updateVectorBucket(logicalId, physicalId, resourceType, properties, previousProperties);
+			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
+	/**
+	* The ONLY in-place-updatable property of `AWS::S3Vectors::VectorBucket` is
+	* `Tags` — `VectorBucketName` and `EncryptionConfiguration` are create-only
+	* (per the CFn registry schema), so a change to either drives a replacement
+	* (handled by the deploy engine, not here). Reaching `update()` therefore
+	* means a non-create-only diff, which can only be `Tags`.
+	*
+	* Pre-fix this method was a silent no-op (`return { wasReplaced: false }`),
+	* so a tag change was dropped while cdkd recorded the new Tags into state as
+	* if applied — the next deploy then saw no diff and the AWS-side tags stayed
+	* stale forever (the exact silent-drift failure mode documented in
+	* `feedback_tags_on_update_must_throw`). We now diff old vs new tags and
+	* apply them via TagResource / UntagResource, and any tag-API failure THROWS
+	* (state is NOT written, so the next deploy retries) rather than being
+	* swallowed. A non-Tags diff that somehow reaches here (immutable property)
+	* is surfaced as `ResourceUpdateNotSupportedError`.
+	*/
+	async updateVectorBucket(logicalId, physicalId, resourceType, properties, previousProperties) {
+		for (const createOnly of ["VectorBucketName", "EncryptionConfiguration"]) if (JSON.stringify(properties[createOnly]) !== JSON.stringify(previousProperties[createOnly])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `'${createOnly}' is immutable (create-only) on VectorBucket '${physicalId}'; a change requires replacement (cdkd deploy --replace)`);
+		const oldTags = this.cfnTagsToRecord(previousProperties["Tags"]);
+		const newTags = this.cfnTagsToRecord(properties["Tags"]);
+		const toSet = {};
+		for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) toSet[k] = v;
+		const toRemove = Object.keys(oldTags).filter((k) => !(k in newTags));
+		if (Object.keys(toSet).length === 0 && toRemove.length === 0) return {
+			physicalId,
+			wasReplaced: false
+		};
+		let resourceArn;
+		try {
+			resourceArn = (await this.getClient().send(new GetVectorBucketCommand({ vectorBucketName: physicalId }))).vectorBucket?.vectorBucketArn;
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}) before tag update: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
+		try {
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$16({
+				resourceArn,
+				tags: toSet
+			}));
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+				resourceArn,
+				tagKeys: toRemove
+			}));
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update tags for S3 VectorBucket ${logicalId} (${physicalId}): ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		this.logger.debug(`Updated tags for S3 VectorBucket ${logicalId} (${physicalId}): set ${Object.keys(toSet).length}, removed ${toRemove.length}`);
+		return {
+			physicalId,
+			wasReplaced: false
+		};
+	}
+	/**
+	* Convert a CFn `Tags: [{ Key, Value }]` list to the SDK
+	* `Record<string, string>` shape. Tolerates undefined / non-array input
+	* (returns an empty record) and skips entries missing Key or Value.
+	*/
+	cfnTagsToRecord(tags) {
+		if (!Array.isArray(tags)) return {};
+		return tags.reduce((acc, t) => {
+			if (t.Key !== void 0 && t.Value !== void 0) acc[t.Key] = t.Value;
+			return acc;
+		}, {});
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		switch (resourceType) {
 			case "AWS::S3Vectors::VectorBucket": return this.deleteVectorBucket(logicalId, physicalId, resourceType, context);
@@ -33153,11 +33232,8 @@ var S3VectorsProvider = class {
 		const vectorBucketName = properties["VectorBucketName"];
 		if (!vectorBucketName) throw new ProvisioningError(`VectorBucketName is required for S3 VectorBucket ${logicalId}`, resourceType, logicalId);
 		const encryptionConfiguration = properties["EncryptionConfiguration"];
-		const tagsArray = properties["Tags"];
-		const tags = tagsArray && tagsArray.length > 0 ? tagsArray.reduce((acc, t) => {
-			if (t.Key !== void 0 && t.Value !== void 0) acc[t.Key] = t.Value;
-			return acc;
-		}, {}) : void 0;
+		const tagRecord = this.cfnTagsToRecord(properties["Tags"]);
+		const tags = Object.keys(tagRecord).length > 0 ? tagRecord : void 0;
 		try {
 			const vectorBucketArn = (await this.getClient().send(new CreateVectorBucketCommand({
 				vectorBucketName,
@@ -34110,7 +34186,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$15({
+			await this.getClient().send(new UntagResourceCommand$16({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -34119,7 +34195,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$16({
+			await this.getClient().send(new TagResourceCommand$17({
 				resourceArn,
 				tags: upserts
 			}));
@@ -34151,7 +34227,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$15({
+			await this.getClient().send(new UntagResourceCommand$16({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -34160,7 +34236,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$16({
+			await this.getClient().send(new TagResourceCommand$17({
 				resourceArn,
 				tags: upserts
 			}));
@@ -54024,7 +54100,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.221.14");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.221.16");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());