@go-to-k/cdkd 0.227.0 → 0.228.0

package/dist/{deploy-engine-CBzCsd24.js → deploy-engine-BRZdKXDs.js}

@@ -1,7 +1,7 @@
 import { B as generateResourceNameWithFallback, E as SynthesisError, F as getLiveRenderer, H as withStackName, M as getLogger, R as applyDefaultNameForFallback, T as StateError, a as assertRegionMatch, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as resolveExplicitPhysicalId, k as normalizeAwsError, n as matchesCdkPath, o as disableInstanceApiTermination, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, x as ResourceTimeoutError } from "./import-helpers-wLipXr5g.js";
 import { r as getAwsClients } from "./aws-clients-pjPwZz1r.js";
 import { randomUUID } from "node:crypto";
-import { DeleteObjectCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, ListRolesCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
@@ -3641,6 +3641,37 @@ var S3StateBackend = class {
 		return keys;
 	}
 	/**
+	* Raw sidecar-object batch delete under the state bucket. Used by the
+	* deployment-events pruner (issue #885) to drop superseded `{runId}.jsonl`
+	* streams + their index. Chunked to the 1,000-key `DeleteObjects` ceiling.
+	* S3 `DeleteObjects` is idempotent — deleting a key that does not exist is
+	* not an error — so callers do not need to pre-filter for existence.
+	*
+	* `DeleteObjects` reports per-key failures (e.g. partial `AccessDenied`,
+	* `SlowDown`) in `response.Errors` rather than throwing — with `Quiet:
+	* true` only those error entries come back. We aggregate them across
+	* chunks and throw, so the explicit `cdkd events prune` purge does NOT
+	* report success while leaving orphaned streams behind (the writer's
+	* best-effort auto-prune swallows the throw via its write-chain catch).
+	*/
+	async deleteRawObjects(keys) {
+		if (keys.length === 0) return;
+		await this.ensureClientForBucket();
+		const failures = [];
+		for (let i = 0; i < keys.length; i += 1e3) {
+			const chunk = keys.slice(i, i + 1e3);
+			const response = await this.s3Client.send(new DeleteObjectsCommand({
+				Bucket: this.config.bucket,
+				Delete: {
+					Objects: chunk.map((Key) => ({ Key })),
+					Quiet: true
+				}
+			}));
+			for (const err of response.Errors ?? []) failures.push(`${err.Key ?? "<unknown>"} (${err.Code ?? "Error"}: ${err.Message ?? ""})`);
+		}
+		if (failures.length > 0) throw new StateError(`Failed to delete ${failures.length} object(s) from bucket '${this.config.bucket}': ${failures.join("; ")}`);
+	}
+	/**
 	* HeadObject probe — returns true on 200, false on NotFound. Other errors
 	* propagate so we don't accidentally swallow IAM denials.
 	*/
@@ -4771,6 +4802,35 @@ var DagBuilder = class {
 * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html
 */
 /**
+* Conditional-replacement predicate for `AWS::DynamoDB::Table.AttributeDefinitions`.
+*
+* Returns true only when an attribute present in BOTH the old and new definition
+* lists changed its `AttributeType` (e.g. `S` -> `N`). Adding a brand-new attribute
+* (to back a new GSI) or removing one (when a GSI is dropped) returns false — those
+* are in-place `UpdateTable` operations, matching CloudFormation's "No interruption"
+* update behavior for this property.
+*/
+function attributeTypeChangedForSharedAttribute(oldValue, newValue) {
+	const toTypeMap = (value) => {
+		const map = /* @__PURE__ */ new Map();
+		if (Array.isArray(value)) {
+			for (const def of value) if (def && typeof def === "object") {
+				const name = def["AttributeName"];
+				const type = def["AttributeType"];
+				if (typeof name === "string" && typeof type === "string") map.set(name, type);
+			}
+		}
+		return map;
+	};
+	const oldTypes = toTypeMap(oldValue);
+	const newTypes = toTypeMap(newValue);
+	for (const [name, oldType] of oldTypes) {
+		const newType = newTypes.get(name);
+		if (newType !== void 0 && newType !== oldType) return true;
+	}
+	return false;
+}
+/**
 * Replacement rules registry
 *
 * Maps resource types to their replacement rules
@@ -4843,11 +4903,7 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::DynamoDB::Table", {
-			replacementProperties: new Set([
-				"TableName",
-				"KeySchema",
-				"AttributeDefinitions"
-			]),
+			replacementProperties: new Set(["TableName", "KeySchema"]),
 			updateableProperties: new Set([
 				"BillingMode",
 				"ProvisionedThroughput",
@@ -4858,7 +4914,8 @@ var ReplacementRulesRegistry = class {
 				"Tags",
 				"TimeToLiveSpecification",
 				"PointInTimeRecoverySpecification"
-			])
+			]),
+			conditionalReplacements: new Map([["AttributeDefinitions", attributeTypeChangedForSharedAttribute]])
 		});
 		this.rules.set("AWS::SQS::Queue", {
 			replacementProperties: new Set([
@@ -13385,4 +13442,4 @@ var DeployEngine = class {
 
 //#endregion
 export { findLargeInlineResources as $, shouldRetainResource as A, getDockerImageBySourceHash as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, formatDockerLoginError as F, resolveCaptureObservedState as G, getDefaultStateBucketName as H, getDockerCmd as I, resolveStateBucketWithDefaultAndSource as J, resolveSkipPrefix as K, runDockerForeground as L, stringifyValue as M, WorkGraph as N, S3StateBackend as O, buildDockerImage as P, MIGRATE_TMP_PREFIX as Q, runDockerStreaming as R, IntrinsicFunctionResolver as S, DagBuilder as T, getLegacyStateBucketName as U, Synthesizer as V, resolveApp as W, CFN_TEMPLATE_BODY_LIMIT as X, warnDeprecatedNoPrefixCliFlag as Y, CFN_TEMPLATE_URL_LIMIT as Z, IAMRoleProvider as _, withRetry as a, findActionableSilentDrops as b, computeImplicitDeleteEdges as c, bold as d, uploadCfnTemplate as et, cyan as f, yellow as g, red as h, withResourceDeadline as i, AssetPublisher as j, rebuildClientForBucketRegion as k, extractDeploymentEventError as l, green as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, clearBucketRegionCache as nt, isRetryableTransientError as o, gray as p, resolveStateBucketWithDefault as q, DeployEngine as r, resolveBucketRegion as rt, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssemblyReader as tt, formatResourceLine as u, collectInlinePolicyNamesManagedBySiblings as v, DiffCalculator as w, CloudControlProvider as x, ProviderRegistry as y, AssetManifestLoader as z };
-//# sourceMappingURL=deploy-engine-CBzCsd24.js.map
+//# sourceMappingURL=deploy-engine-BRZdKXDs.js.map