@go-to-k/cdkd 0.229.7 → 0.230.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as findLargeInlineResources, A as shouldRetainResource, B as getDockerImageBySourceHash, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as formatDockerLoginError, G as resolveCaptureObservedState, H as getDefaultStateBucketName, I as getDockerCmd, J as resolveStateBucketWithDefaultAndSource, K as resolveSkipPrefix, L as runDockerForeground, M as stringifyValue, N as WorkGraph, O as S3StateBackend, P as buildDockerImage, Q as MIGRATE_TMP_PREFIX, R as runDockerStreaming, S as IntrinsicFunctionResolver, T as DagBuilder, U as getLegacyStateBucketName, V as Synthesizer, W as resolveApp, X as CFN_TEMPLATE_BODY_LIMIT, Y as warnDeprecatedNoPrefixCliFlag, Z as CFN_TEMPLATE_URL_LIMIT, _ as IAMRoleProvider, a as withRetry, b as findActionableSilentDrops, c as computeImplicitDeleteEdges, d as bold, et as uploadCfnTemplate, f as cyan, g as yellow, h as red, i as withResourceDeadline, j as AssetPublisher, k as rebuildClientForBucketRegion, l as extractDeploymentEventError, m as green, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as gray, q as resolveStateBucketWithDefault, r as DeployEngine, rt as resolveBucketRegion, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as AssemblyReader, u as formatResourceLine, v as collectInlinePolicyNamesManagedBySiblings, w as DiffCalculator, x as CloudControlProvider, y as ProviderRegistry, z as AssetManifestLoader } from "./deploy-engine-BIYc-qWo.js";
+import { $ as CFN_TEMPLATE_BODY_LIMIT, A as LockManager, B as runDockerForeground, C as findActionableSilentDrops, D as DiffCalculator, E as applyRoleArnIfSet, F as stringifyValue, G as getDefaultStateBucketName, H as AssetManifestLoader, I as WorkGraph, J as resolveCaptureObservedState, K as getLegacyStateBucketName, L as buildDockerImage, M as rebuildClientForBucketRegion, N as shouldRetainResource, O as DagBuilder, P as AssetPublisher, Q as warnDeprecatedNoPrefixCliFlag, R as formatDockerLoginError, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as getDockerImageBySourceHash, V as runDockerStreaming, W as Synthesizer, X as resolveStateBucketWithDefault, Y as resolveSkipPrefix, Z as resolveStateBucketWithDefaultAndSource, _ as green, a as withRetry, b as IAMRoleProvider, c as computeImplicitDeleteEdges, d as isStatefulRecreateTargetSync, et as CFN_TEMPLATE_URL_LIMIT, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as AssemblyReader, j as S3StateBackend, k as TemplateParser, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as findLargeInlineResources, o as isRetryableTransientError, ot as resolveBucketRegion, p as formatResourceLine, q as resolveApp, r as DeployEngine, rt as uploadCfnTemplate, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as MIGRATE_TMP_PREFIX, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as getDockerCmd } from "./deploy-engine-_N5kVjZN.js";
 import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -491,6 +491,7 @@ const recreateViaSdkProviderOption = new Option("--recreate-via-sdk-provider <lo
 * into a footgun; pretending to scope it per-resource is misleading).
 */
 const forceStatefulRecreationOption = new Option("--force-stateful-recreation", "Bypass the stateful-resource guard for --recreate-via-cc-api targets. Required when ANY named target is a stateful type (RDS / DynamoDB / EFS / S3 with data / Logs with retention / Cognito / Secrets / SSM / Glue / ECR / CloudFront / Kinesis / OpenSearch). Destroy + recreate loses ALL data in the resource — no automatic data migration. Triple-opt-in for CI use: --recreate-via-cc-api <id> --force-stateful-recreation --yes.").default(false);
+const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resource whose in-place update is rejected because an immutable property changed and AWS exposes no update API for it (e.g. Lambda LayerVersion content, EFS AccessPoint, ECS TaskDefinition, ApiGatewayV2 immutable fields). Without this flag such a change fails the deploy. Stateful types (RDS / DynamoDB / EFS / S3 with data / Logs with retention / etc.) ALSO require --force-stateful-recreation since the replacement is a data-losing DELETE + CREATE.").default(false);
 const deployOptions = [
 	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
 	new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
@@ -509,6 +510,7 @@ const deployOptions = [
 	recreateViaCcApiOption,
 	recreateViaSdkProviderOption,
 	forceStatefulRecreationOption,
+	replaceOption,
 	...resourceTimeoutOptions
 ];
 /**
@@ -983,119 +985,6 @@ function createListCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/provisioning/stateful-types.ts
-/**
-* Stateful-resource guard list (issue [#615]).
-*
-* `--recreate-via-cc-api <LogicalId>` destroys + recreates the named
-* resource in one deploy so a previously-silent-dropped top-level CFn
-* property reaches AWS via Cloud Control API. For most types this is
-* safe — destroying + recreating an IAM Role or a Lambda Function
-* loses no user data — but for **data-bearing** types the destroy
-* cycle loses everything in the resource: rows in a DynamoDB table,
-* objects in an S3 bucket, log lines in a LogGroup, images in an ECR
-* repository, etc.
-*
-* To avoid an accidental data-loss footgun, cdkd refuses to recreate
-* any resource whose type is in {@link STATEFUL_TYPES} unless the user
-* ALSO passes `--force-stateful-recreation`. The two-flag protection
-* mirrors `--remove-protection`'s pattern (see
-* `src/cli/commands/destroy-runner.ts`).
-*
-* The list is hand-curated and intentionally **conservative**: every
-* type here carries user data that the AWS service does NOT
-* automatically migrate to the replacement resource. Types that the
-* AWS service treats as ephemeral (e.g. Lambda Function, IAM Role)
-* are NOT in this list — recreate is cheap.
-*
-* Two entries are **conditionally stateful** — they only count when
-* the resource actually contains data:
-*
-*   - `AWS::S3::Bucket`: empty buckets are safe to recreate. The
-*     deploy engine probes `s3:ListObjectsV2` at plan time and only
-*     refuses when the bucket has at least one object.
-*   - `AWS::Logs::LogGroup`: a log group with `RetentionInDays`
-*     undefined or zero is functionally ephemeral. The deploy engine
-*     refuses only when `RetentionInDays > 0`.
-*
-* Both conditional checks live in {@link isStatefulRecreateTarget};
-* the bare {@link STATEFUL_TYPES} set is the type-only first-cut.
-*/
-const STATEFUL_TYPES = new Set([
-	"AWS::RDS::DBInstance",
-	"AWS::RDS::DBCluster",
-	"AWS::DocDB::DBInstance",
-	"AWS::DocDB::DBCluster",
-	"AWS::Neptune::DBInstance",
-	"AWS::Neptune::DBCluster",
-	"AWS::DynamoDB::Table",
-	"AWS::DynamoDB::GlobalTable",
-	"AWS::EFS::FileSystem",
-	"AWS::S3::Bucket",
-	"AWS::ECR::Repository",
-	"AWS::Kinesis::Stream",
-	"AWS::Elasticsearch::Domain",
-	"AWS::OpenSearchService::Domain",
-	"AWS::Cognito::UserPool",
-	"AWS::SecretsManager::Secret",
-	"AWS::SSM::Parameter",
-	"AWS::Glue::Database",
-	"AWS::Glue::Table",
-	"AWS::Logs::LogGroup",
-	"AWS::CloudFront::Distribution"
-]);
-/**
-* Multi-region resource types — `--recreate-via-cc-api` refuses these
-* outright in v1 regardless of `--force-stateful-recreation`. Design
-* doc §8 calls these "out of scope": the destroy + recreate cycle
-* across replica regions is more involved than a single-region
-* destroy-and-create (replica regions, automated backups, eventual
-* consistency across the replication mesh, etc.).
-*
-* Distinct from {@link STATEFUL_TYPES} — STATEFUL_TYPES gates on data
-* loss (bypassable with `--force-stateful-recreation`); this set is
-* an out-of-scope refusal (no bypass).
-*/
-const MULTI_REGION_RECREATE_BLOCKED_TYPES = new Set(["AWS::DynamoDB::GlobalTable"]);
-/**
-* Cheap, synchronous read of the resource's recorded properties only.
-* For `AWS::S3::Bucket` this returns `null` — the live `ListObjectsV2`
-* probe to distinguish empty buckets (safe to recreate) from
-* non-empty (data loss) lives in
-* `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
-* (issue [#648]) and runs after this sync first-cut. Sync callers can
-* still treat `null` as "not stateful" — the deploy command does both
-* passes back-to-back; only callers that explicitly opt out of the
-* async probe need to assume conservative "stateful" semantics.
-*
-* Returns the {@link StatefulReason} when the type is stateful (or
-* `null` for non-stateful types).
-*/
-function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
-	if (!STATEFUL_TYPES.has(resourceType)) return null;
-	if (resourceType === "AWS::Logs::LogGroup") {
-		const retention = recordedProperties?.["RetentionInDays"];
-		if (typeof retention === "number" && retention > 0) return "has-retention";
-		return null;
-	}
-	if (resourceType === "AWS::S3::Bucket") return null;
-	return "always";
-}
-/**
-* Human-readable rendering of {@link StatefulReason} for error
-* messages. Used by the pre-flight guard's "X resources require
-* --force-stateful-recreation" listing.
-*/
-function renderStatefulReason(reason) {
-	switch (reason) {
-		case "always": return "destroy loses all data in the resource";
-		case "has-objects": return "S3 bucket is non-empty";
-		case "has-retention": return "log group retains data (RetentionInDays > 0)";
-		case null: return "(not stateful)";
-	}
-}
-
 //#endregion
 //#region src/deployment/recreate-targets.ts
 /**
@@ -1556,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.229.7";
+	return "0.230.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -9629,12 +9518,15 @@ var LambdaLayerVersionProvider = class {
 	*     which is never what `--revert` should do.
 	*   - On the deploy path, content / runtime / arch changes flow
 	*     through CDK's hash-based logical naming, which produces a fresh
-	*     logical ID and a CREATE+DELETE in cdkd's diff — `update()` is
-	*     not the path taken in practice. Users who hit this on a non-CDK
-	*     template should re-deploy with `--replace`.
+	*     logical ID and a CREATE+DELETE in cdkd's diff. For a hand-authored
+	*     template that edits the SAME logical id in place, the replacement
+	*     rule for `AWS::Lambda::LayerVersion` (every property is
+	*     "Update requires: Replacement") drives a DELETE+CREATE before
+	*     `update()` is ever reached, so this method is a defensive fallback
+	*     that should not fire in normal use.
 	*/
 	async update(logicalId, _physicalId, resourceType, _properties, _previousProperties) {
-		return Promise.reject(new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS Lambda LayerVersion is immutable on AWS — there is no UpdateLayerVersion API; every change requires PublishLayerVersion (a new version with a new LayerVersionArn). Re-deploy with cdkd deploy --replace, or change the resource definition to publish a new version."));
+		return Promise.reject(new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS Lambda LayerVersion is immutable on AWS — there is no UpdateLayerVersion API; every change requires PublishLayerVersion (a new version with a new LayerVersionArn). cdkd normally classifies any LayerVersion property change as a replacement (DELETE + CREATE), so reaching this path is unexpected; re-run the deploy or change the resource definition to publish a new version."));
 	}
 	/**
 	* Delete a Lambda layer version
@@ -29210,7 +29102,7 @@ var GlueSecurityConfigurationProvider = class {
 	/**
 	* Read AWS-current SecurityConfiguration shape via
 	* `GetSecurityConfiguration`. Always emits the three CFn-modeled
-	* sub-configs (`S3Encryption: []`, `CloudWatchEncryption: {}`,
+	* sub-configs (`S3Encryptions: []`, `CloudWatchEncryption: {}`,
 	* `JobBookmarksEncryption: {}`) per PR #145 even when AWS reports
 	* nothing — closes the "console-side encryption enable on a previously
 	* default config" detection gap on the v3 baseline.
@@ -29273,13 +29165,14 @@ function sleep$1(ms) {
 /**
 * Build the SDK `EncryptionConfiguration` from the CFn-shape input
 * (`AWS::Glue::SecurityConfiguration.EncryptionConfiguration`). Each
-* sub-config (`S3Encryption[]` / `CloudWatchEncryption` /
-* `JobBookmarksEncryption`) field-renames are pure pass-through — the
-* CFn property names match the SDK member names verbatim.
+* sub-config (`S3Encryptions[]` / `CloudWatchEncryption` /
+* `JobBookmarksEncryption`) maps to the SDK member names — `CloudWatchEncryption`
+* / `JobBookmarksEncryption` match verbatim, but the CFn `S3Encryptions` (plural)
+* list maps to the SDK `S3Encryption` (singular) field.
 */
 function buildEncryptionConfiguration(input) {
 	const result = {};
-	if (Array.isArray(input["S3Encryption"])) result.S3Encryption = input["S3Encryption"].map((entry) => {
+	if (Array.isArray(input["S3Encryptions"])) result.S3Encryption = input["S3Encryptions"].map((entry) => {
 		const e = entry;
 		const item = {};
 		if (typeof e["S3EncryptionMode"] === "string") item.S3EncryptionMode = e["S3EncryptionMode"];
@@ -29305,7 +29198,7 @@ function buildEncryptionConfiguration(input) {
 /**
 * Reverse-map AWS's `EncryptionConfiguration` SDK shape into the CFn
 * shape with always-emit placeholders (PR #145):
-*   - `S3Encryption[]` → `?? []` (so console-side ADD is detectable)
+*   - `S3Encryptions[]` → `?? []` (so console-side ADD is detectable)
 *   - `CloudWatchEncryption` → `?? {}`
 *   - `JobBookmarksEncryption` → `?? {}`
 *   - `DataQualityEncryption` → silently dropped (not in CFn schema)
@@ -29313,7 +29206,7 @@ function buildEncryptionConfiguration(input) {
 function mapEncryptionConfigurationToCfn(cfg) {
 	const c = cfg ?? {};
 	return {
-		S3Encryption: (c.S3Encryption ?? []).map((entry) => {
+		S3Encryptions: (c.S3Encryption ?? []).map((entry) => {
 			const out = {};
 			if (entry.S3EncryptionMode !== void 0) out["S3EncryptionMode"] = entry.S3EncryptionMode;
 			if (entry.KmsKeyArn !== void 0) out["KmsKeyArn"] = entry.KmsKeyArn;
@@ -37069,6 +36962,8 @@ async function deployCommand(stacks, options) {
 					...eventRecorder && { eventRecorder },
 					...recreateViaCcApiTargets && recreateViaCcApiTargets.size > 0 && { recreateViaCcApiTargets },
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
+					...options.replace && { replace: true },
+					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
 					captureObservedState: resolveCaptureObservedState(options.captureObservedState),
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 					...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
@@ -55067,7 +54962,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.229.7");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());