@go-to-k/cdkd 0.230.12 → 0.230.14

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as CFN_TEMPLATE_BODY_LIMIT, A as LockManager, B as runDockerForeground, C as findActionableSilentDrops, D as DiffCalculator, E as applyRoleArnIfSet, F as stringifyValue, G as getDefaultStateBucketName, H as AssetManifestLoader, I as WorkGraph, J as resolveCaptureObservedState, K as getLegacyStateBucketName, L as buildDockerImage, M as rebuildClientForBucketRegion, N as shouldRetainResource, O as DagBuilder, P as AssetPublisher, Q as warnDeprecatedNoPrefixCliFlag, R as formatDockerLoginError, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as getDockerImageBySourceHash, V as runDockerStreaming, W as Synthesizer, X as resolveStateBucketWithDefault, Y as resolveSkipPrefix, Z as resolveStateBucketWithDefaultAndSource, _ as green, a as withRetry, b as IAMRoleProvider, c as computeImplicitDeleteEdges, d as isStatefulRecreateTargetSync, et as CFN_TEMPLATE_URL_LIMIT, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as AssemblyReader, j as S3StateBackend, k as TemplateParser, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as findLargeInlineResources, o as isRetryableTransientError, ot as resolveBucketRegion, p as formatResourceLine, q as resolveApp, r as DeployEngine, rt as uploadCfnTemplate, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as MIGRATE_TMP_PREFIX, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as getDockerCmd } from "./deploy-engine-CJs0dDvf.js";
+import { $ as CFN_TEMPLATE_BODY_LIMIT, A as LockManager, B as runDockerForeground, C as findActionableSilentDrops, D as DiffCalculator, E as applyRoleArnIfSet, F as stringifyValue, G as getDefaultStateBucketName, H as AssetManifestLoader, I as WorkGraph, J as resolveCaptureObservedState, K as getLegacyStateBucketName, L as buildDockerImage, M as rebuildClientForBucketRegion, N as shouldRetainResource, O as DagBuilder, P as AssetPublisher, Q as warnDeprecatedNoPrefixCliFlag, R as formatDockerLoginError, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as getDockerImageBySourceHash, V as runDockerStreaming, W as Synthesizer, X as resolveStateBucketWithDefault, Y as resolveSkipPrefix, Z as resolveStateBucketWithDefaultAndSource, _ as green, a as withRetry, b as IAMRoleProvider, c as computeImplicitDeleteEdges, d as isStatefulRecreateTargetSync, et as CFN_TEMPLATE_URL_LIMIT, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as AssemblyReader, j as S3StateBackend, k as TemplateParser, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as findLargeInlineResources, o as isRetryableTransientError, ot as resolveBucketRegion, p as formatResourceLine, q as resolveApp, r as DeployEngine, rt as uploadCfnTemplate, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as MIGRATE_TMP_PREFIX, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as getDockerCmd } from "./deploy-engine-xDAHmCZF.js";
 import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -1445,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.12";
+	return "0.230.14";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -55365,7 +55365,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.12");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.14");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());

package/dist/{deploy-engine-CJs0dDvf.js → deploy-engine-xDAHmCZF.js}

@@ -5014,6 +5014,70 @@ var ReplacementRulesRegistry = class {
 				"Tags"
 			])
 		});
+		this.rules.set("AWS::StepFunctions::StateMachine", {
+			replacementProperties: new Set(["StateMachineName", "StateMachineType"]),
+			updateableProperties: new Set([
+				"DefinitionString",
+				"DefinitionS3Location",
+				"Definition",
+				"DefinitionSubstitutions",
+				"RoleArn",
+				"LoggingConfiguration",
+				"TracingConfiguration",
+				"Tags",
+				"EncryptionConfiguration"
+			])
+		});
+		this.rules.set("AWS::Events::Rule", {
+			replacementProperties: new Set(["Name", "EventBusName"]),
+			updateableProperties: new Set([
+				"ScheduleExpression",
+				"EventPattern",
+				"State",
+				"Description",
+				"Targets",
+				"RoleArn"
+			])
+		});
+		this.rules.set("AWS::SSM::Parameter", {
+			replacementProperties: new Set(["Name"]),
+			updateableProperties: new Set([
+				"Value",
+				"Description",
+				"Type",
+				"Tier",
+				"AllowedPattern",
+				"Policies",
+				"DataType",
+				"Tags"
+			])
+		});
+		this.rules.set("AWS::CloudWatch::Alarm", {
+			replacementProperties: new Set(["AlarmName"]),
+			updateableProperties: new Set([
+				"ComparisonOperator",
+				"EvaluationPeriods",
+				"DatapointsToAlarm",
+				"Threshold",
+				"TreatMissingData",
+				"MetricName",
+				"Namespace",
+				"Period",
+				"Statistic",
+				"ExtendedStatistic",
+				"Dimensions",
+				"Metrics",
+				"AlarmDescription",
+				"ActionsEnabled",
+				"AlarmActions",
+				"OKActions",
+				"InsufficientDataActions",
+				"Unit",
+				"EvaluateLowSampleCountPercentile",
+				"ThresholdMetricId",
+				"Tags"
+			])
+		});
 		this.rules.set("AWS::ApiGateway::RestApi", {
 			replacementProperties: new Set(["Name"]),
 			updateableProperties: new Set([
@@ -5082,6 +5146,16 @@ var DiffCalculator = class DiffCalculator {
 		this.logger.debug(`Current resources: ${Object.keys(currentResources).length}`);
 		this.logger.debug(`Desired resources: ${Object.keys(desiredResources).length}`);
 		const processedLogicalIds = /* @__PURE__ */ new Set();
+		const rawGetAttRefs = /* @__PURE__ */ new Map();
+		for (const [logicalId, desiredResource] of Object.entries(desiredResources)) {
+			if (desiredResource.Type === "AWS::CDK::Metadata") continue;
+			const perProp = /* @__PURE__ */ new Map();
+			for (const [propKey, propValue] of Object.entries(desiredResource.Properties ?? {})) {
+				const refs = DiffCalculator.extractGetAttRefs(propValue);
+				if (refs.size > 0) perProp.set(propKey, refs);
+			}
+			if (perProp.size > 0) rawGetAttRefs.set(logicalId, perProp);
+		}
 		for (const [logicalId, desiredResource] of Object.entries(desiredResources)) {
 			if (desiredResource.Type === "AWS::CDK::Metadata") {
 				this.logger.debug(`Skipping metadata resource: ${logicalId}`);
@@ -5152,6 +5226,7 @@ var DiffCalculator = class DiffCalculator {
 			this.logger.debug(`DELETE: ${logicalId} (${currentResource.resourceType})`);
 		}
 		this.promoteReplacementDependents(changes, desiredTemplate);
+		this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs);
 		const summary = this.getSummary(changes);
 		this.logger.debug(`Diff calculated: ${summary.create} CREATE, ${summary.update} UPDATE, ${summary.delete} DELETE, ${summary.noChange} NO_CHANGE`);
 		return changes;
@@ -5248,6 +5323,135 @@ var DiffCalculator = class DiffCalculator {
 		}
 	}
 	/**
+	* Promote NO_CHANGE dependents of an IN-PLACE update whose referenced ATTRIBUTE
+	* actually changed (bug-hunt 2026-06-29).
+	*
+	* Distinct from {@link promoteReplacementDependents}: a replacement changes the
+	* physical id, so any reference is affected. An in-place update changes only
+	* specific properties, so a dependent is affected ONLY when it reads (via
+	* `Fn::GetAtt[Up, Attr]` or `Fn::Sub`'s `${Up.Attr}`) an attribute whose NAME
+	* matches a property that changed in `Up`'s update. (`Ref` resolves to the
+	* physical id, which an in-place update never moves, so Ref-only dependents are
+	* left NO_CHANGE; likewise a GetAtt of a computed / unchanged attribute.)
+	*
+	* Promotion is safe even when speculative: the deploy engine re-resolves the
+	* promoted resource against the in-flight state and skips the provider call
+	* when nothing actually changed.
+	*
+	* Single-hop by design (unlike {@link promoteReplacementDependents}, which is
+	* fully transitive via a worklist): `changedPropsByUpstream` is frozen at entry,
+	* so a chain `A(in-place) -> B(reads A's changed attr) -> C(reads B's now-changed
+	* attr)` promotes B but not C. Deep GetAtt-of-a-changed-attr chains are rare in
+	* practice; if one ever needs full transitivity, promote to a worklist that
+	* re-derives changed props as dependents are promoted.
+	*/
+	promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs) {
+		const changedPropsByUpstream = /* @__PURE__ */ new Map();
+		for (const [logicalId, change] of changes) {
+			if (change.changeType !== "UPDATE") continue;
+			const props = (change.propertyChanges ?? []).map((pc) => pc.path).filter((p) => typeof p === "string");
+			if (props.length > 0) changedPropsByUpstream.set(logicalId, new Set(props));
+		}
+		if (changedPropsByUpstream.size === 0) return;
+		for (const [dependentId, perProp] of rawGetAttRefs) {
+			const resource = desiredTemplate.Resources[dependentId];
+			if (!resource || resource.Type === "AWS::CDK::Metadata") continue;
+			const change = changes.get(dependentId);
+			if (!change) continue;
+			if (change.changeType !== "NO_CHANGE" && change.changeType !== "UPDATE") continue;
+			const existingPaths = new Set((change.propertyChanges ?? []).map((pc) => pc.path));
+			const syntheticChanges = [];
+			for (const [propKey, getAttRefs] of perProp) {
+				if (existingPaths.has(propKey)) continue;
+				let matched = false;
+				for (const [upstreamId, attrs] of getAttRefs) {
+					if (upstreamId === dependentId) continue;
+					const changedProps = changedPropsByUpstream.get(upstreamId);
+					if (!changedProps) continue;
+					if ([...attrs].some((attr) => changedProps.has(attr))) {
+						matched = true;
+						break;
+					}
+				}
+				if (!matched) continue;
+				syntheticChanges.push({
+					path: propKey,
+					oldValue: change.currentProperties?.[propKey],
+					newValue: change.desiredProperties?.[propKey],
+					requiresReplacement: this.replacementRules.requiresReplacement(change.resourceType, propKey, void 0, void 0)
+				});
+			}
+			if (syntheticChanges.length === 0) continue;
+			if (change.changeType === "NO_CHANGE") {
+				change.changeType = "UPDATE";
+				change.propertyChanges = syntheticChanges;
+				this.logger.debug(`UPDATE (in-place attr propagated): ${dependentId} reads a changed attribute of an updated resource`);
+			} else change.propertyChanges = [...change.propertyChanges ?? [], ...syntheticChanges];
+		}
+	}
+	/**
+	* Extract `Fn::GetAtt` / `Fn::Sub`-`${X.Attr}` references from a property value
+	* as a map of `referencedLogicalId -> set of referenced attribute names`.
+	* Plain `Ref` is intentionally NOT captured: it resolves to the physical id,
+	* which an in-place update never changes. Recurses into arrays / objects so
+	* intrinsics nested inside `Fn::Sub`'s variable map / `Fn::Join` etc. are seen.
+	*/
+	static extractGetAttRefs(value) {
+		const refs = /* @__PURE__ */ new Map();
+		const add = (id, attr) => {
+			if (id.startsWith("AWS::")) return;
+			let set = refs.get(id);
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				refs.set(id, set);
+			}
+			set.add(attr);
+		};
+		const walk = (v) => {
+			if (v === null || typeof v !== "object") return;
+			if (Array.isArray(v)) {
+				v.forEach(walk);
+				return;
+			}
+			const obj = v;
+			if ("Fn::GetAtt" in obj) {
+				const ga = obj["Fn::GetAtt"];
+				if (Array.isArray(ga) && typeof ga[0] === "string" && typeof ga[1] === "string") add(ga[0], ga[1]);
+				return;
+			}
+			if ("Fn::Sub" in obj) {
+				const sub = obj["Fn::Sub"];
+				let body;
+				let mapKeys;
+				if (typeof sub === "string") body = sub;
+				else if (Array.isArray(sub) && typeof sub[0] === "string") {
+					body = sub[0];
+					const vars = sub[1];
+					if (vars && typeof vars === "object" && !Array.isArray(vars)) {
+						mapKeys = new Set(Object.keys(vars));
+						Object.values(vars).forEach(walk);
+					}
+				}
+				if (body !== void 0) for (const m of body.matchAll(/\$\{(!)?([^}]+)\}/g)) {
+					if (m[1] === "!") continue;
+					const placeholder = m[2];
+					if (!placeholder) continue;
+					const dot = placeholder.indexOf(".");
+					if (dot < 0) continue;
+					const id = placeholder.slice(0, dot);
+					const attr = placeholder.slice(dot + 1);
+					if (!id || mapKeys?.has(id)) continue;
+					add(id, attr);
+				}
+				return;
+			}
+			if ("Ref" in obj && Object.keys(obj).length === 1) return;
+			Object.values(obj).forEach(walk);
+		};
+		walk(value);
+		return refs;
+	}
+	/**
 	* Best-effort resolution of template property intrinsics against current state.
 	*
 	* Iterates top-level properties and resolves each independently: if resolution
@@ -5258,7 +5462,7 @@ var DiffCalculator = class DiffCalculator {
 	async resolveBestEffort(properties, resolveFn) {
 		const resolved = {};
 		for (const [key, value] of Object.entries(properties)) try {
-			resolved[key] = await resolveFn(value);
+			resolved[key] = await resolveFn(structuredClone(value));
 		} catch {
 			resolved[key] = value;
 		}
@@ -13830,4 +14034,4 @@ var DeployEngine = class {
 
 //#endregion
 export { CFN_TEMPLATE_BODY_LIMIT as $, LockManager as A, runDockerForeground as B, findActionableSilentDrops as C, DiffCalculator as D, applyRoleArnIfSet as E, stringifyValue as F, getDefaultStateBucketName as G, AssetManifestLoader as H, WorkGraph as I, resolveCaptureObservedState as J, getLegacyStateBucketName as K, buildDockerImage as L, rebuildClientForBucketRegion as M, shouldRetainResource as N, DagBuilder as O, AssetPublisher as P, warnDeprecatedNoPrefixCliFlag as Q, formatDockerLoginError as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, getDockerImageBySourceHash as U, runDockerStreaming as V, Synthesizer as W, resolveStateBucketWithDefault as X, resolveSkipPrefix as Y, resolveStateBucketWithDefaultAndSource as Z, green as _, withRetry as a, clearBucketRegionCache as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, isStatefulRecreateTargetSync as d, CFN_TEMPLATE_URL_LIMIT as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, AssemblyReader as it, S3StateBackend as j, TemplateParser as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, findLargeInlineResources as nt, isRetryableTransientError as o, resolveBucketRegion as ot, formatResourceLine as p, resolveApp as q, DeployEngine as r, uploadCfnTemplate as rt, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, MIGRATE_TMP_PREFIX as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, getDockerCmd as z };
-//# sourceMappingURL=deploy-engine-CJs0dDvf.js.map
+//# sourceMappingURL=deploy-engine-xDAHmCZF.js.map