@go-to-k/cdkd 0.226.0 → 0.227.1

package/dist/{deploy-engine-DM557Qjg.js → deploy-engine-Bl_Ka0hj.js}

@@ -21,6 +21,8 @@ import { homedir, tmpdir } from "node:os";
 import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } from "@aws-sdk/client-route-53";
 import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBalancingV2Client } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
+import { readFile } from "fs/promises";
+import { join as join$1 } from "path";
 import { DescribeImagesCommand as DescribeImagesCommand$1, ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
 import { hostname } from "os";
 import graphlib from "graphlib";
@@ -2162,6 +2164,150 @@ function setsEqual(a, b) {
 	return true;
 }
 
+//#endregion
+//#region src/assets/asset-manifest-loader.ts
+/**
+* Whether a file asset's `source.path` is a CloudFormation template asset
+* (the stack template `<Stack>.template.json` or a nested-stack template
+* `<Stack>.<Nested>.nested.template.json`). cdkd deploys templates itself and
+* never needs them in the bootstrap bucket, so they are the ONLY file assets
+* excluded from publishing.
+*
+* `.template.json` is the reliable discriminator: a plain `.json` exclusion is
+* WRONG because a legitimate user file asset can be a `.json` file (e.g. a Step
+* Functions `DefinitionS3Location` ASL document, or an app config) whose source
+* path is `asset.<hash>.json` — those MUST be published. Shared by both file-
+* asset-selection sites ({@link AssetManifestLoader.getFileAssets} and
+* `AssetPublisher.addAssetsToGraph`) so they cannot drift.
+*/
+function isCfnTemplateAssetPath(sourcePath) {
+	return sourcePath.endsWith(".template.json");
+}
+/**
+* Asset manifest loader
+*
+* Loads and parses CDK asset manifests from the CDK output directory
+*/
+var AssetManifestLoader = class {
+	logger = getLogger().child("AssetManifestLoader");
+	/**
+	* Load asset manifest from CDK output directory
+	*
+	* @param cdkOutputDir CDK output directory (e.g., "cdk.out")
+	* @param stackName Stack name
+	* @returns Asset manifest or null if not found
+	*/
+	async loadManifest(cdkOutputDir, stackName) {
+		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
+		try {
+			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
+			const content = await readFile(manifestPath, "utf-8");
+			const manifest = JSON.parse(content);
+			this.logger.debug(`Loaded asset manifest: ${Object.keys(manifest.files).length} file assets, ${Object.keys(manifest.dockerImages).length} docker image assets`);
+			return manifest;
+		} catch (error) {
+			if (error.code === "ENOENT") {
+				this.logger.debug(`Asset manifest not found: ${manifestPath}`);
+				return null;
+			}
+			throw new Error(`Failed to load asset manifest from ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	/**
+	* Get file assets from manifest (excludes CloudFormation templates)
+	*
+	* @param manifest Asset manifest
+	* @returns Map of asset hash to file asset
+	*/
+	getFileAssets(manifest) {
+		const fileAssets = /* @__PURE__ */ new Map();
+		for (const [assetHash, asset] of Object.entries(manifest.files)) {
+			if (isCfnTemplateAssetPath(asset.source.path)) {
+				this.logger.debug(`Skipping CloudFormation template asset: ${asset.displayName}`);
+				continue;
+			}
+			fileAssets.set(assetHash, asset);
+		}
+		this.logger.debug(`Found ${fileAssets.size} file assets (excluding templates)`);
+		return fileAssets;
+	}
+	/**
+	* Get asset source path (absolute path)
+	*
+	* @param cdkOutputDir CDK output directory
+	* @param asset File asset
+	* @returns Absolute path to asset source
+	*/
+	getAssetSourcePath(cdkOutputDir, asset) {
+		return join$1(cdkOutputDir, asset.source.path);
+	}
+	/**
+	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
+	*
+	* @param value Value with placeholders
+	* @param accountId AWS account ID
+	* @param region AWS region
+	* @param partition AWS partition (default: "aws")
+	* @returns Resolved value
+	*/
+	resolveAssetDestinationValue(value, accountId, region, partition = "aws") {
+		return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
+	}
+};
+/**
+* Look up the docker-image asset that backs a Lambda's `Code.ImageUri`.
+*
+* The CDK template synthesizes `Code.ImageUri` as a `Fn::Sub` whose body
+* references the bootstrap ECR repo and ends in `:<hash>` — that hash is
+* the same key used in `manifest.dockerImages[<hash>]`. cdkd extracts the
+* hash by walking known image-URI shapes; on miss, when the manifest has
+* exactly one Docker image, we fall back to it (single-asset heuristic) so
+* locally-built non-bootstrapped images still work. This is documented as
+* a v1 limitation; immutable digest pins (`@sha256:<digest>`) hit the same
+* fallback path.
+*
+* Returns the `(hash, asset)` pair when matched, or `undefined` when both
+* the regex AND the single-asset fallback miss (typically: 0 docker assets,
+* or 2+ docker assets with no hash match — the caller should treat this as
+* "fall through to the ECR-pull path").
+*
+* Exported as a free function (not a method) so the local-invoke modules
+* can reuse it without depending on the `AssetManifestLoader` instance —
+* the manifest itself is a plain JSON shape.
+*/
+function getDockerImageBySourceHash(manifest, imageUri) {
+	const dockerImages = manifest.dockerImages ?? {};
+	const entries = Object.entries(dockerImages);
+	if (entries.length === 0) return void 0;
+	const hash = extractHashFromImageUri(imageUri);
+	if (hash !== void 0) {
+		const asset = dockerImages[hash];
+		if (asset) return {
+			hash,
+			asset
+		};
+	}
+	if (entries.length === 1) {
+		const [singleHash, singleAsset] = entries[0];
+		return {
+			hash: singleHash,
+			asset: singleAsset
+		};
+	}
+}
+/**
+* Extract the source hash from a Lambda `Code.ImageUri` string. CDK's
+* bootstrap layout ends every image URI in `:<hex-hash>`, and that hash
+* is the same key used in the asset manifest's `dockerImages` map.
+*
+* Returns `undefined` for shapes we can't parse (digest pins, missing tag,
+* etc.) — the caller falls back to the single-asset heuristic.
+*/
+function extractHashFromImageUri(imageUri) {
+	if (imageUri.includes("@sha256:")) return void 0;
+	return /:([a-f0-9]{8,})$/.exec(imageUri)?.[1];
+}
+
 //#endregion
 //#region src/assets/file-asset-publisher.ts
 /**
@@ -2870,7 +3016,7 @@ var AssetPublisher = class {
 		const cdkOutputDir = manifestPath.replace(/\/[^/]+$/, "");
 		const prefix = options.nodePrefix || "";
 		const nodeIds = [];
-		const fileAssets = Object.entries(manifest.files || {}).filter(([, asset]) => !asset.source.path.endsWith(".json") && !asset.source.path.endsWith(".template.json"));
+		const fileAssets = Object.entries(manifest.files || {}).filter(([, asset]) => !isCfnTemplateAssetPath(asset.source.path));
 		for (const [hash, asset] of fileAssets) {
 			const nodeId = `asset-publish:${prefix}file:${hash}`;
 			graph.addNode({
@@ -4625,6 +4771,35 @@ var DagBuilder = class {
 * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html
 */
 /**
+* Conditional-replacement predicate for `AWS::DynamoDB::Table.AttributeDefinitions`.
+*
+* Returns true only when an attribute present in BOTH the old and new definition
+* lists changed its `AttributeType` (e.g. `S` -> `N`). Adding a brand-new attribute
+* (to back a new GSI) or removing one (when a GSI is dropped) returns false — those
+* are in-place `UpdateTable` operations, matching CloudFormation's "No interruption"
+* update behavior for this property.
+*/
+function attributeTypeChangedForSharedAttribute(oldValue, newValue) {
+	const toTypeMap = (value) => {
+		const map = /* @__PURE__ */ new Map();
+		if (Array.isArray(value)) {
+			for (const def of value) if (def && typeof def === "object") {
+				const name = def["AttributeName"];
+				const type = def["AttributeType"];
+				if (typeof name === "string" && typeof type === "string") map.set(name, type);
+			}
+		}
+		return map;
+	};
+	const oldTypes = toTypeMap(oldValue);
+	const newTypes = toTypeMap(newValue);
+	for (const [name, oldType] of oldTypes) {
+		const newType = newTypes.get(name);
+		if (newType !== void 0 && newType !== oldType) return true;
+	}
+	return false;
+}
+/**
 * Replacement rules registry
 *
 * Maps resource types to their replacement rules
@@ -4697,11 +4872,7 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::DynamoDB::Table", {
-			replacementProperties: new Set([
-				"TableName",
-				"KeySchema",
-				"AttributeDefinitions"
-			]),
+			replacementProperties: new Set(["TableName", "KeySchema"]),
 			updateableProperties: new Set([
 				"BillingMode",
 				"ProvisionedThroughput",
@@ -4712,7 +4883,8 @@ var ReplacementRulesRegistry = class {
 				"Tags",
 				"TimeToLiveSpecification",
 				"PointInTimeRecoverySpecification"
-			])
+			]),
+			conditionalReplacements: new Map([["AttributeDefinitions", attributeTypeChangedForSharedAttribute]])
 		});
 		this.rules.set("AWS::SQS::Queue", {
 			replacementProperties: new Set([
@@ -8810,7 +8982,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TreatMissingData",
 			"Unit"
 		]),
-		silentDrop: new Map([["EvaluationCriteria", "not yet implemented by cdkd"], ["EvaluationInterval", "not yet implemented by cdkd"]])
+		silentDrop: new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])
 	}],
 	["AWS::CodeBuild::Project", {
 		handled: new Set([
@@ -10276,6 +10448,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 	["AWS::StepFunctions::StateMachine", {
 		handled: new Set([
 			"Definition",
+			"DefinitionS3Location",
 			"DefinitionString",
 			"DefinitionSubstitutions",
 			"EncryptionConfiguration",
@@ -10286,7 +10459,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"TracingConfiguration"
 		]),
-		silentDrop: new Map([["DefinitionS3Location", "not yet implemented by cdkd"]])
+		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::WAFv2::WebACL", {
 		handled: new Set([
@@ -13237,5 +13410,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { AssemblyReader as $, shouldRetainResource as A, getDefaultStateBucketName as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, formatDockerLoginError as F, resolveStateBucketWithDefault as G, resolveApp as H, getDockerCmd as I, CFN_TEMPLATE_BODY_LIMIT as J, resolveStateBucketWithDefaultAndSource as K, runDockerForeground as L, stringifyValue as M, WorkGraph as N, S3StateBackend as O, buildDockerImage as P, uploadCfnTemplate as Q, runDockerStreaming as R, IntrinsicFunctionResolver as S, DagBuilder as T, resolveCaptureObservedState as U, getLegacyStateBucketName as V, resolveSkipPrefix as W, MIGRATE_TMP_PREFIX as X, CFN_TEMPLATE_URL_LIMIT as Y, findLargeInlineResources as Z, IAMRoleProvider as _, withRetry as a, findActionableSilentDrops as b, computeImplicitDeleteEdges as c, bold as d, clearBucketRegionCache as et, cyan as f, yellow as g, red as h, withResourceDeadline as i, AssetPublisher as j, rebuildClientForBucketRegion as k, extractDeploymentEventError as l, green as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, gray as p, warnDeprecatedNoPrefixCliFlag as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveBucketRegion as tt, formatResourceLine as u, collectInlinePolicyNamesManagedBySiblings as v, DiffCalculator as w, CloudControlProvider as x, ProviderRegistry as y, Synthesizer as z };
-//# sourceMappingURL=deploy-engine-DM557Qjg.js.map
+export { findLargeInlineResources as $, shouldRetainResource as A, getDockerImageBySourceHash as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, formatDockerLoginError as F, resolveCaptureObservedState as G, getDefaultStateBucketName as H, getDockerCmd as I, resolveStateBucketWithDefaultAndSource as J, resolveSkipPrefix as K, runDockerForeground as L, stringifyValue as M, WorkGraph as N, S3StateBackend as O, buildDockerImage as P, MIGRATE_TMP_PREFIX as Q, runDockerStreaming as R, IntrinsicFunctionResolver as S, DagBuilder as T, getLegacyStateBucketName as U, Synthesizer as V, resolveApp as W, CFN_TEMPLATE_BODY_LIMIT as X, warnDeprecatedNoPrefixCliFlag as Y, CFN_TEMPLATE_URL_LIMIT as Z, IAMRoleProvider as _, withRetry as a, findActionableSilentDrops as b, computeImplicitDeleteEdges as c, bold as d, uploadCfnTemplate as et, cyan as f, yellow as g, red as h, withResourceDeadline as i, AssetPublisher as j, rebuildClientForBucketRegion as k, extractDeploymentEventError as l, green as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, clearBucketRegionCache as nt, isRetryableTransientError as o, gray as p, resolveStateBucketWithDefault as q, DeployEngine as r, resolveBucketRegion as rt, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssemblyReader as tt, formatResourceLine as u, collectInlinePolicyNamesManagedBySiblings as v, DiffCalculator as w, CloudControlProvider as x, ProviderRegistry as y, AssetManifestLoader as z };
+//# sourceMappingURL=deploy-engine-Bl_Ka0hj.js.map