@go-to-k/cdkd 0.221.3 → 0.221.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceNameWithFallback, C as StackHasActiveImportsError, F as getLiveRenderer, H as withStackName, I as PATTERN_B_NAME_PROPERTIES, L as PATTERN_B_RESOURCE_TYPES, M as getLogger, P as runStackBuffered, S as ResourceUpdateNotSupportedError, V as withSkipPrefix, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { A as AssetPublisher, B as getLegacyStateBucketName, C as DiffCalculator, D as S3StateBackend, E as LockManager, F as getDockerCmd, G as resolveStateBucketWithDefaultAndSource, H as resolveCaptureObservedState, I as runDockerForeground, J as CFN_TEMPLATE_URL_LIMIT, K as warnDeprecatedNoPrefixCliFlag, L as runDockerStreaming, M as WorkGraph, N as buildDockerImage, O as rebuildClientForBucketRegion, P as formatDockerLoginError, Q as AssemblyReader, R as Synthesizer, S as applyRoleArnIfSet, T as TemplateParser, U as resolveSkipPrefix, V as resolveApp, W as resolveStateBucketWithDefault, X as findLargeInlineResources, Y as MIGRATE_TMP_PREFIX, Z as uploadCfnTemplate, _ as collectInlinePolicyNamesManagedBySiblings, a as withRetry, b as CloudControlProvider, c as extractDeploymentEventError, d as cyan, et as resolveBucketRegion, f as gray, g as IAMRoleProvider, h as yellow, i as withResourceDeadline, j as stringifyValue, k as shouldRetainResource, l as formatResourceLine, m as red, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as green, q as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as bold, v as ProviderRegistry, w as DagBuilder, x as IntrinsicFunctionResolver, y as findActionableSilentDrops, z as getDefaultStateBucketName } from "./deploy-engine-CyPbcsXW.js";
+import { A as AssetPublisher, B as getLegacyStateBucketName, C as DiffCalculator, D as S3StateBackend, E as LockManager, F as getDockerCmd, G as resolveStateBucketWithDefaultAndSource, H as resolveCaptureObservedState, I as runDockerForeground, J as CFN_TEMPLATE_URL_LIMIT, K as warnDeprecatedNoPrefixCliFlag, L as runDockerStreaming, M as WorkGraph, N as buildDockerImage, O as rebuildClientForBucketRegion, P as formatDockerLoginError, Q as AssemblyReader, R as Synthesizer, S as applyRoleArnIfSet, T as TemplateParser, U as resolveSkipPrefix, V as resolveApp, W as resolveStateBucketWithDefault, X as findLargeInlineResources, Y as MIGRATE_TMP_PREFIX, Z as uploadCfnTemplate, _ as collectInlinePolicyNamesManagedBySiblings, a as withRetry, b as CloudControlProvider, c as extractDeploymentEventError, d as cyan, et as resolveBucketRegion, f as gray, g as IAMRoleProvider, h as yellow, i as withResourceDeadline, j as stringifyValue, k as shouldRetainResource, l as formatResourceLine, m as red, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as green, q as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as bold, v as ProviderRegistry, w as DagBuilder, x as IntrinsicFunctionResolver, y as findActionableSilentDrops, z as getDefaultStateBucketName } from "./deploy-engine-DlXVqVTW.js";
 import { t as ASGProvider } from "./asg-provider-B_hrCxRx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.221.3";
+	return "0.221.4";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -53802,7 +53802,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.221.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.221.4");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());

package/dist/{deploy-engine-CyPbcsXW.js → deploy-engine-DlXVqVTW.js}

@@ -4080,6 +4080,53 @@ var TemplateParser = class {
 	countResources(template) {
 		return Object.keys(template.Resources).length;
 	}
+	/**
+	* Produce a copy of the template with every resource whose `Condition:`
+	* key resolves to `false` removed from `Resources` (issue #840).
+	*
+	* CloudFormation does not strip condition-gated resources at synth time —
+	* CDK emits `PremiumOnlyParam` into `Resources` with a `Condition: IsPremium`
+	* key REGARDLESS of the parameter value, and the deploy engine (CFn, or in
+	* cdkd's case cdkd itself) is responsible for excluding the resource when
+	* its condition evaluates false. cdkd evaluates the `Conditions` section
+	* (for `Fn::If` resolution) but, before this helper, never consulted the
+	* resource-level `Condition:` key — so a condition-false resource was:
+	*   - CREATED anyway on first deploy (it sat in the desired set), and
+	*   - never DELETED when its condition flipped true -> false on a redeploy
+	*     (it stayed in the desired set, diffing as NO_CHANGE).
+	*
+	* By pruning condition-false resources here, the rest of the pipeline
+	* (type/property validation, DAG build, diff) sees the CFn-effective
+	* resource set: a now-condition-false resource that exists in prior state
+	* but is absent from the pruned template falls through the diff's existing
+	* "in state but not in desired template -> DELETE" path, exactly as CFn
+	* removes it. A resource whose `Condition` key names an unknown condition,
+	* or whose condition evaluated `true`, is kept.
+	*
+	* The returned template shares every untouched object reference with the
+	* input (only `Resources` is rebuilt) — callers must treat it as read-only,
+	* which the deploy pipeline already does.
+	*
+	* @param template The synthesized template (raw, with all condition-gated
+	*                 resources still present).
+	* @param conditions The evaluated `Conditions` map (name -> boolean) from
+	*                 `IntrinsicFunctionResolver.evaluateConditions`.
+	*/
+	filterResourcesByCondition(template, conditions) {
+		const filteredResources = {};
+		for (const [logicalId, resource] of Object.entries(template.Resources)) {
+			const conditionName = resource.Condition;
+			if (conditionName !== void 0 && conditions[conditionName] === false) {
+				this.logger.debug(`Excluding resource ${logicalId} — condition ${conditionName} is false`);
+				continue;
+			}
+			filteredResources[logicalId] = resource;
+		}
+		return {
+			...template,
+			Resources: filteredResources
+		};
+	}
 };
 
 //#endregion
@@ -5533,13 +5580,36 @@ var IntrinsicFunctionResolver = class {
 		const conditions = {};
 		const templateConditions = context.template.Conditions;
 		if (!templateConditions || typeof templateConditions !== "object") return conditions;
-		for (const [name, definition] of Object.entries(templateConditions)) try {
-			const result = await this.resolveValue(definition, context);
-			conditions[name] = Boolean(result);
-			this.logger.debug(`Evaluated condition ${name} = ${conditions[name]}`);
+		const inProgress = /* @__PURE__ */ new Set();
+		const evaluateByName = async (name) => {
+			if (name in conditions) return conditions[name];
+			if (inProgress.has(name)) throw new Error(`Circular condition reference detected involving condition "${name}"`);
+			const definition = templateConditions[name];
+			if (definition === void 0) {
+				this.logger.warn(`Condition ${name} not found in template, assuming false`);
+				conditions[name] = false;
+				return false;
+			}
+			inProgress.add(name);
+			try {
+				const result = await this.resolveValue(definition, {
+					...context,
+					conditionResolver: evaluateByName
+				});
+				const value = Boolean(result);
+				conditions[name] = value;
+				this.logger.debug(`Evaluated condition ${name} = ${value}`);
+				return value;
+			} finally {
+				inProgress.delete(name);
+			}
+		};
+		for (const name of Object.keys(templateConditions)) try {
+			await evaluateByName(name);
 		} catch (error) {
 			this.logger.warn(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`);
 			conditions[name] = false;
+			inProgress.delete(name);
 		}
 		return conditions;
 	}
@@ -5561,6 +5631,7 @@ var IntrinsicFunctionResolver = class {
 		if ("Fn::Split" in obj) return await this.resolveSplit(obj["Fn::Split"], context);
 		if ("Fn::If" in obj) return await this.resolveIf(obj["Fn::If"], context);
 		if ("Fn::Equals" in obj) return await this.resolveEquals(obj["Fn::Equals"], context);
+		if (context.conditionResolver && "Condition" in obj && Object.keys(obj).length === 1 && typeof obj["Condition"] === "string") return await this.resolveConditionReference(obj["Condition"], context);
 		if ("Fn::And" in obj) return await this.resolveAnd(obj["Fn::And"], context);
 		if ("Fn::Or" in obj) return await this.resolveOr(obj["Fn::Or"], context);
 		if ("Fn::Not" in obj) return await this.resolveNot(obj["Fn::Not"], context);
@@ -6006,6 +6077,23 @@ var IntrinsicFunctionResolver = class {
 		return result;
 	}
 	/**
+	* Resolve a `{Condition: <name>}` named-condition reference (issue #840).
+	*
+	* Inside `Fn::And` / `Fn::Or` / `Fn::Not` a CFn Condition may reference
+	* another named condition. When the resolver is mid-`evaluateConditions`
+	* the `conditionResolver` hook is present and lazily evaluates the
+	* referenced condition (recursing + memoizing + cycle-guarding) so the
+	* result is order-independent. Outside that context (which is invalid CFn
+	* but handled defensively) we fall back to the already-evaluated
+	* `conditions` map, matching `Fn::If`'s warn-and-assume-false behavior.
+	*/
+	async resolveConditionReference(conditionName, context) {
+		if (context.conditionResolver) return await context.conditionResolver(conditionName);
+		if (context.conditions && conditionName in context.conditions) return context.conditions[conditionName];
+		this.logger.warn(`Condition ${conditionName} not found in context, assuming false`);
+		return false;
+	}
+	/**
 	* Resolve Fn::And intrinsic function
 	*
 	* Returns true if all conditions evaluate to true
@@ -11574,6 +11662,7 @@ var DeployEngine = class {
 	lockManager;
 	dagBuilder;
 	diffCalculator;
+	templateParser = new TemplateParser();
 	providerRegistry;
 	options;
 	/**
@@ -11807,10 +11896,11 @@ var DeployEngine = class {
 			}, stackName);
 			const conditions = await this.resolver.evaluateConditions(context);
 			this.logger.debug(`Evaluated ${Object.keys(conditions).length} conditions: ${Object.keys(conditions).join(", ")}`);
-			const resourceTypes = new Set(Object.values(template.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
+			const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
+			const resourceTypes = new Set(Object.values(effectiveTemplate.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
 			this.providerRegistry.validateResourceTypes(resourceTypes);
 			this.logger.debug(`All resource types validated`);
-			const resourcesForPropertyCheck = Object.entries(template.Resources || {}).filter(([, r]) => r.Type !== "AWS::CDK::Metadata").map(([logicalId, r]) => ({
+			const resourcesForPropertyCheck = Object.entries(effectiveTemplate.Resources || {}).filter(([, r]) => r.Type !== "AWS::CDK::Metadata").map(([logicalId, r]) => ({
 				logicalId,
 				resourceType: r.Type,
 				properties: r.Properties,
@@ -11818,17 +11908,17 @@ var DeployEngine = class {
 			}));
 			this.providerRegistry.validateResourceProperties(resourcesForPropertyCheck);
 			this.logger.debug(`All resource properties validated`);
-			const dag = this.dagBuilder.buildGraph(template);
+			const dag = this.dagBuilder.buildGraph(effectiveTemplate);
 			const executionLevels = this.dagBuilder.getExecutionLevels(dag);
 			this.logger.debug(`Dependency graph: ${executionLevels.length} execution levels`);
 			const diffResolverContext = this.buildResolverContext({
-				template,
+				template: effectiveTemplate,
 				resources: currentState.resources,
 				parameters: parameterValues,
 				conditions
 			}, stackName);
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
-			const changes = await this.diffCalculator.calculateDiff(currentState, template, diffResolveFn);
+			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn);
 			if (!this.diffCalculator.hasChanges(changes)) {
 				this.logger.info("No changes detected. Stack is up to date.");
 				if (!this.options.dryRun && this.observedCaptureTasks.size > 0) {
@@ -11882,7 +11972,7 @@ var DeployEngine = class {
 				current: 0,
 				total: createChanges.length + updateChanges.length + deleteChanges.length
 			};
-			const { state: newState, actualCounts } = await this.executeDeployment(template, currentState, changes, dag, executionLevels, stackName, parameterValues, conditions, currentEtag, progress, migrationPending);
+			const { state: newState, actualCounts } = await this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, parameterValues, conditions, currentEtag, progress, migrationPending);
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(newState));
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
@@ -12800,4 +12890,4 @@ var DeployEngine = class {
 
 //#endregion
 export { clearBucketRegionCache as $, AssetPublisher as A, getLegacyStateBucketName as B, DiffCalculator as C, S3StateBackend as D, LockManager as E, getDockerCmd as F, resolveStateBucketWithDefaultAndSource as G, resolveCaptureObservedState as H, runDockerForeground as I, CFN_TEMPLATE_URL_LIMIT as J, warnDeprecatedNoPrefixCliFlag as K, runDockerStreaming as L, WorkGraph as M, buildDockerImage as N, rebuildClientForBucketRegion as O, formatDockerLoginError as P, AssemblyReader as Q, Synthesizer as R, applyRoleArnIfSet as S, TemplateParser as T, resolveSkipPrefix as U, resolveApp as V, resolveStateBucketWithDefault as W, findLargeInlineResources as X, MIGRATE_TMP_PREFIX as Y, uploadCfnTemplate as Z, collectInlinePolicyNamesManagedBySiblings as _, withRetry as a, CloudControlProvider as b, extractDeploymentEventError as c, cyan as d, resolveBucketRegion as et, gray as f, IAMRoleProvider as g, yellow as h, withResourceDeadline as i, stringifyValue as j, shouldRetainResource as k, formatResourceLine as l, red as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, green as p, CFN_TEMPLATE_BODY_LIMIT as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, bold as u, ProviderRegistry as v, DagBuilder as w, IntrinsicFunctionResolver as x, findActionableSilentDrops as y, getDefaultStateBucketName as z };
-//# sourceMappingURL=deploy-engine-CyPbcsXW.js.map
+//# sourceMappingURL=deploy-engine-DlXVqVTW.js.map