@go-to-k/cdkd 0.229.8 → 0.230.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as findLargeInlineResources, A as shouldRetainResource, B as getDockerImageBySourceHash, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as formatDockerLoginError, G as resolveCaptureObservedState, H as getDefaultStateBucketName, I as getDockerCmd, J as resolveStateBucketWithDefaultAndSource, K as resolveSkipPrefix, L as runDockerForeground, M as stringifyValue, N as WorkGraph, O as S3StateBackend, P as buildDockerImage, Q as MIGRATE_TMP_PREFIX, R as runDockerStreaming, S as IntrinsicFunctionResolver, T as DagBuilder, U as getLegacyStateBucketName, V as Synthesizer, W as resolveApp, X as CFN_TEMPLATE_BODY_LIMIT, Y as warnDeprecatedNoPrefixCliFlag, Z as CFN_TEMPLATE_URL_LIMIT, _ as IAMRoleProvider, a as withRetry, b as findActionableSilentDrops, c as computeImplicitDeleteEdges, d as bold, et as uploadCfnTemplate, f as cyan, g as yellow, h as red, i as withResourceDeadline, j as AssetPublisher, k as rebuildClientForBucketRegion, l as extractDeploymentEventError, m as green, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as gray, q as resolveStateBucketWithDefault, r as DeployEngine, rt as resolveBucketRegion, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as AssemblyReader, u as formatResourceLine, v as collectInlinePolicyNamesManagedBySiblings, w as DiffCalculator, x as CloudControlProvider, y as ProviderRegistry, z as AssetManifestLoader } from "./deploy-engine-rMH9694Q.js";
+import { $ as CFN_TEMPLATE_BODY_LIMIT, A as LockManager, B as runDockerForeground, C as findActionableSilentDrops, D as DiffCalculator, E as applyRoleArnIfSet, F as stringifyValue, G as getDefaultStateBucketName, H as AssetManifestLoader, I as WorkGraph, J as resolveCaptureObservedState, K as getLegacyStateBucketName, L as buildDockerImage, M as rebuildClientForBucketRegion, N as shouldRetainResource, O as DagBuilder, P as AssetPublisher, Q as warnDeprecatedNoPrefixCliFlag, R as formatDockerLoginError, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as getDockerImageBySourceHash, V as runDockerStreaming, W as Synthesizer, X as resolveStateBucketWithDefault, Y as resolveSkipPrefix, Z as resolveStateBucketWithDefaultAndSource, _ as green, a as withRetry, b as IAMRoleProvider, c as computeImplicitDeleteEdges, d as isStatefulRecreateTargetSync, et as CFN_TEMPLATE_URL_LIMIT, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as AssemblyReader, j as S3StateBackend, k as TemplateParser, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as findLargeInlineResources, o as isRetryableTransientError, ot as resolveBucketRegion, p as formatResourceLine, q as resolveApp, r as DeployEngine, rt as uploadCfnTemplate, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as MIGRATE_TMP_PREFIX, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as getDockerCmd } from "./deploy-engine-_N5kVjZN.js";
 import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -491,6 +491,7 @@ const recreateViaSdkProviderOption = new Option("--recreate-via-sdk-provider <lo
 * into a footgun; pretending to scope it per-resource is misleading).
 */
 const forceStatefulRecreationOption = new Option("--force-stateful-recreation", "Bypass the stateful-resource guard for --recreate-via-cc-api targets. Required when ANY named target is a stateful type (RDS / DynamoDB / EFS / S3 with data / Logs with retention / Cognito / Secrets / SSM / Glue / ECR / CloudFront / Kinesis / OpenSearch). Destroy + recreate loses ALL data in the resource — no automatic data migration. Triple-opt-in for CI use: --recreate-via-cc-api <id> --force-stateful-recreation --yes.").default(false);
+const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resource whose in-place update is rejected because an immutable property changed and AWS exposes no update API for it (e.g. Lambda LayerVersion content, EFS AccessPoint, ECS TaskDefinition, ApiGatewayV2 immutable fields). Without this flag such a change fails the deploy. Stateful types (RDS / DynamoDB / EFS / S3 with data / Logs with retention / etc.) ALSO require --force-stateful-recreation since the replacement is a data-losing DELETE + CREATE.").default(false);
 const deployOptions = [
 	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
 	new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
@@ -509,6 +510,7 @@ const deployOptions = [
 	recreateViaCcApiOption,
 	recreateViaSdkProviderOption,
 	forceStatefulRecreationOption,
+	replaceOption,
 	...resourceTimeoutOptions
 ];
 /**
@@ -983,119 +985,6 @@ function createListCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/provisioning/stateful-types.ts
-/**
-* Stateful-resource guard list (issue [#615]).
-*
-* `--recreate-via-cc-api <LogicalId>` destroys + recreates the named
-* resource in one deploy so a previously-silent-dropped top-level CFn
-* property reaches AWS via Cloud Control API. For most types this is
-* safe — destroying + recreating an IAM Role or a Lambda Function
-* loses no user data — but for **data-bearing** types the destroy
-* cycle loses everything in the resource: rows in a DynamoDB table,
-* objects in an S3 bucket, log lines in a LogGroup, images in an ECR
-* repository, etc.
-*
-* To avoid an accidental data-loss footgun, cdkd refuses to recreate
-* any resource whose type is in {@link STATEFUL_TYPES} unless the user
-* ALSO passes `--force-stateful-recreation`. The two-flag protection
-* mirrors `--remove-protection`'s pattern (see
-* `src/cli/commands/destroy-runner.ts`).
-*
-* The list is hand-curated and intentionally **conservative**: every
-* type here carries user data that the AWS service does NOT
-* automatically migrate to the replacement resource. Types that the
-* AWS service treats as ephemeral (e.g. Lambda Function, IAM Role)
-* are NOT in this list — recreate is cheap.
-*
-* Two entries are **conditionally stateful** — they only count when
-* the resource actually contains data:
-*
-*   - `AWS::S3::Bucket`: empty buckets are safe to recreate. The
-*     deploy engine probes `s3:ListObjectsV2` at plan time and only
-*     refuses when the bucket has at least one object.
-*   - `AWS::Logs::LogGroup`: a log group with `RetentionInDays`
-*     undefined or zero is functionally ephemeral. The deploy engine
-*     refuses only when `RetentionInDays > 0`.
-*
-* Both conditional checks live in {@link isStatefulRecreateTarget};
-* the bare {@link STATEFUL_TYPES} set is the type-only first-cut.
-*/
-const STATEFUL_TYPES = new Set([
-	"AWS::RDS::DBInstance",
-	"AWS::RDS::DBCluster",
-	"AWS::DocDB::DBInstance",
-	"AWS::DocDB::DBCluster",
-	"AWS::Neptune::DBInstance",
-	"AWS::Neptune::DBCluster",
-	"AWS::DynamoDB::Table",
-	"AWS::DynamoDB::GlobalTable",
-	"AWS::EFS::FileSystem",
-	"AWS::S3::Bucket",
-	"AWS::ECR::Repository",
-	"AWS::Kinesis::Stream",
-	"AWS::Elasticsearch::Domain",
-	"AWS::OpenSearchService::Domain",
-	"AWS::Cognito::UserPool",
-	"AWS::SecretsManager::Secret",
-	"AWS::SSM::Parameter",
-	"AWS::Glue::Database",
-	"AWS::Glue::Table",
-	"AWS::Logs::LogGroup",
-	"AWS::CloudFront::Distribution"
-]);
-/**
-* Multi-region resource types — `--recreate-via-cc-api` refuses these
-* outright in v1 regardless of `--force-stateful-recreation`. Design
-* doc §8 calls these "out of scope": the destroy + recreate cycle
-* across replica regions is more involved than a single-region
-* destroy-and-create (replica regions, automated backups, eventual
-* consistency across the replication mesh, etc.).
-*
-* Distinct from {@link STATEFUL_TYPES} — STATEFUL_TYPES gates on data
-* loss (bypassable with `--force-stateful-recreation`); this set is
-* an out-of-scope refusal (no bypass).
-*/
-const MULTI_REGION_RECREATE_BLOCKED_TYPES = new Set(["AWS::DynamoDB::GlobalTable"]);
-/**
-* Cheap, synchronous read of the resource's recorded properties only.
-* For `AWS::S3::Bucket` this returns `null` — the live `ListObjectsV2`
-* probe to distinguish empty buckets (safe to recreate) from
-* non-empty (data loss) lives in
-* `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
-* (issue [#648]) and runs after this sync first-cut. Sync callers can
-* still treat `null` as "not stateful" — the deploy command does both
-* passes back-to-back; only callers that explicitly opt out of the
-* async probe need to assume conservative "stateful" semantics.
-*
-* Returns the {@link StatefulReason} when the type is stateful (or
-* `null` for non-stateful types).
-*/
-function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
-	if (!STATEFUL_TYPES.has(resourceType)) return null;
-	if (resourceType === "AWS::Logs::LogGroup") {
-		const retention = recordedProperties?.["RetentionInDays"];
-		if (typeof retention === "number" && retention > 0) return "has-retention";
-		return null;
-	}
-	if (resourceType === "AWS::S3::Bucket") return null;
-	return "always";
-}
-/**
-* Human-readable rendering of {@link StatefulReason} for error
-* messages. Used by the pre-flight guard's "X resources require
-* --force-stateful-recreation" listing.
-*/
-function renderStatefulReason(reason) {
-	switch (reason) {
-		case "always": return "destroy loses all data in the resource";
-		case "has-objects": return "S3 bucket is non-empty";
-		case "has-retention": return "log group retains data (RetentionInDays > 0)";
-		case null: return "(not stateful)";
-	}
-}
-
 //#endregion
 //#region src/deployment/recreate-targets.ts
 /**
@@ -1556,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.229.8";
+	return "0.230.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -29213,7 +29102,7 @@ var GlueSecurityConfigurationProvider = class {
 	/**
 	* Read AWS-current SecurityConfiguration shape via
 	* `GetSecurityConfiguration`. Always emits the three CFn-modeled
-	* sub-configs (`S3Encryption: []`, `CloudWatchEncryption: {}`,
+	* sub-configs (`S3Encryptions: []`, `CloudWatchEncryption: {}`,
 	* `JobBookmarksEncryption: {}`) per PR #145 even when AWS reports
 	* nothing — closes the "console-side encryption enable on a previously
 	* default config" detection gap on the v3 baseline.
@@ -29276,13 +29165,14 @@ function sleep$1(ms) {
 /**
 * Build the SDK `EncryptionConfiguration` from the CFn-shape input
 * (`AWS::Glue::SecurityConfiguration.EncryptionConfiguration`). Each
-* sub-config (`S3Encryption[]` / `CloudWatchEncryption` /
-* `JobBookmarksEncryption`) field-renames are pure pass-through — the
-* CFn property names match the SDK member names verbatim.
+* sub-config (`S3Encryptions[]` / `CloudWatchEncryption` /
+* `JobBookmarksEncryption`) maps to the SDK member names — `CloudWatchEncryption`
+* / `JobBookmarksEncryption` match verbatim, but the CFn `S3Encryptions` (plural)
+* list maps to the SDK `S3Encryption` (singular) field.
 */
 function buildEncryptionConfiguration(input) {
 	const result = {};
-	if (Array.isArray(input["S3Encryption"])) result.S3Encryption = input["S3Encryption"].map((entry) => {
+	if (Array.isArray(input["S3Encryptions"])) result.S3Encryption = input["S3Encryptions"].map((entry) => {
 		const e = entry;
 		const item = {};
 		if (typeof e["S3EncryptionMode"] === "string") item.S3EncryptionMode = e["S3EncryptionMode"];
@@ -29308,7 +29198,7 @@ function buildEncryptionConfiguration(input) {
 /**
 * Reverse-map AWS's `EncryptionConfiguration` SDK shape into the CFn
 * shape with always-emit placeholders (PR #145):
-*   - `S3Encryption[]` → `?? []` (so console-side ADD is detectable)
+*   - `S3Encryptions[]` → `?? []` (so console-side ADD is detectable)
 *   - `CloudWatchEncryption` → `?? {}`
 *   - `JobBookmarksEncryption` → `?? {}`
 *   - `DataQualityEncryption` → silently dropped (not in CFn schema)
@@ -29316,7 +29206,7 @@ function buildEncryptionConfiguration(input) {
 function mapEncryptionConfigurationToCfn(cfg) {
 	const c = cfg ?? {};
 	return {
-		S3Encryption: (c.S3Encryption ?? []).map((entry) => {
+		S3Encryptions: (c.S3Encryption ?? []).map((entry) => {
 			const out = {};
 			if (entry.S3EncryptionMode !== void 0) out["S3EncryptionMode"] = entry.S3EncryptionMode;
 			if (entry.KmsKeyArn !== void 0) out["KmsKeyArn"] = entry.KmsKeyArn;
@@ -35203,6 +35093,32 @@ var ECRProvider = class {
 		return this.client;
 	}
 	/**
+	* Map CFn `ImageScanningConfiguration` (PascalCase `{ ScanOnPush }`) to the
+	* SDK shape (camelCase `{ scanOnPush }`). The SDK input keys are camelCase;
+	* forwarding the CFn-cased object verbatim makes the SDK ignore the unknown
+	* `ScanOnPush` key and silently default `scanOnPush` to `false` — so
+	* `imageScanOnPush: true` never reached AWS. Returns `undefined` for an
+	* absent config so the caller can omit the field.
+	*/
+	toSdkScanningConfig(cfn) {
+		if (!cfn) return void 0;
+		return { scanOnPush: Boolean(cfn["ScanOnPush"]) };
+	}
+	/**
+	* Map CFn `EncryptionConfiguration` (PascalCase `{ EncryptionType, KmsKey }`)
+	* to the SDK shape (camelCase `{ encryptionType, kmsKey }`). Same casing trap
+	* as scanning config — a KMS repo's `KmsKey` would be silently dropped (and
+	* the type would fall back to AES256) without this mapping.
+	*/
+	toSdkEncryptionConfig(cfn) {
+		if (!cfn) return void 0;
+		const encryptionType = cfn["EncryptionType"];
+		if (!encryptionType) return void 0;
+		const out = { encryptionType };
+		if (encryptionType === "KMS" && cfn["KmsKey"]) out.kmsKey = cfn["KmsKey"];
+		return out;
+	}
+	/**
 	* Create an ECR Repository
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -35210,11 +35126,13 @@ var ECRProvider = class {
 		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 256 }).toLowerCase();
 		try {
 			const tags = properties["Tags"];
+			const scanningConfig = this.toSdkScanningConfig(properties["ImageScanningConfiguration"]);
+			const encryptionConfig = this.toSdkEncryptionConfig(properties["EncryptionConfiguration"]);
 			const repo = (await this.getClient().send(new CreateRepositoryCommand({
 				repositoryName,
-				...properties["ImageScanningConfiguration"] ? { imageScanningConfiguration: properties["ImageScanningConfiguration"] } : {},
+				...scanningConfig ? { imageScanningConfiguration: scanningConfig } : {},
 				...properties["ImageTagMutability"] ? { imageTagMutability: properties["ImageTagMutability"] } : {},
-				...properties["EncryptionConfiguration"] ? { encryptionConfiguration: properties["EncryptionConfiguration"] } : {},
+				...encryptionConfig ? { encryptionConfiguration: encryptionConfig } : {},
 				...tags ? { tags } : {}
 			}))).repository;
 			if (!repo?.repositoryName) throw new Error("CreateRepository did not return repository name");
@@ -35265,7 +35183,7 @@ var ECRProvider = class {
 			if (JSON.stringify(newScanConfig) !== JSON.stringify(oldScanConfig)) {
 				await this.getClient().send(new PutImageScanningConfigurationCommand({
 					repositoryName: physicalId,
-					imageScanningConfiguration: newScanConfig ?? { scanOnPush: false }
+					imageScanningConfiguration: this.toSdkScanningConfig(newScanConfig) ?? { scanOnPush: false }
 				}));
 				this.logger.debug(`Updated image scanning configuration for ${physicalId}`);
 			}
@@ -37072,6 +36990,8 @@ async function deployCommand(stacks, options) {
 					...eventRecorder && { eventRecorder },
 					...recreateViaCcApiTargets && recreateViaCcApiTargets.size > 0 && { recreateViaCcApiTargets },
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
+					...options.replace && { replace: true },
+					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
 					captureObservedState: resolveCaptureObservedState(options.captureObservedState),
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 					...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
@@ -55070,7 +54990,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.229.8");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());