@go-to-k/cdkd 0.230.3 → 0.230.5

package/dist/{deploy-engine-BGL0DPBv.js → deploy-engine-DP5yW4f5.js}

@@ -12597,6 +12597,78 @@ var DeployEngine = class {
 		}
 	}
 	/**
+	* Build a sibling context for the deploy-time `observedProperties`
+	* capture of an IAM principal (`AWS::IAM::Role` / `::User` / `::Group`)
+	* so that inline policies managed by a SEPARATE `AWS::IAM::Policy`
+	* resource are filtered OUT of the captured `Policies` baseline —
+	* exactly as the `cdkd drift` read path already does via
+	* `buildReadCurrentStateContext`.
+	*
+	* Without this, the post-CREATE / post-UPDATE capture passes no
+	* context, so `collectInlinePolicyNamesManagedBySiblings` no-ops. The
+	* capture's `ListRolePolicies` then RACES the sibling
+	* `AWS::IAM::Policy`'s `PutRolePolicy`: when the read lands after the
+	* write, the sibling-managed `DefaultPolicy*` leaks into
+	* `observedProperties.Policies`. A later `cdkd drift` (whose AWS-current
+	* side filters it correctly) then reports phantom drift
+	* `- Policies:[DefaultPolicy] / + Policies:[]` — a systemic false
+	* positive that fires for essentially every Lambda / L2 construct whose
+	* grant emits a `Default Policy`.
+	*
+	* The sibling relationship is fully determined by the TEMPLATE (which
+	* `AWS::IAM::Policy` lists this principal in its `Roles`/`Users`/
+	* `Groups`), so this is built from the template — deploy-order-
+	* independent, immune to the race. Each matched sibling is synthesized
+	* into the resolved-property shape
+	* `collectInlinePolicyNamesManagedBySiblings` expects
+	* (`{ [attachmentField]: [thisPrincipalPhysicalId], PolicyName }`).
+	*
+	* Returns `undefined` (no context) for non-IAM-principal types and when
+	* no sibling policy attaches to the captured principal — both leave the
+	* capture behaving exactly as before.
+	*/
+	async buildObservedCaptureSiblings(resourceType, capturedLogicalId, capturedPhysicalId, template, stateResources, stackName, parameterValues, conditions) {
+		if (this.options.captureObservedState !== true) return void 0;
+		const attachmentField = resourceType === "AWS::IAM::Role" ? "Roles" : resourceType === "AWS::IAM::User" ? "Users" : resourceType === "AWS::IAM::Group" ? "Groups" : void 0;
+		if (!attachmentField) return void 0;
+		const resources = template?.Resources;
+		if (!resources) return void 0;
+		let resolverContext;
+		const isRefTo = (value, logicalId) => typeof value === "object" && value !== null && !Array.isArray(value) && value["Ref"] === logicalId;
+		const siblings = {};
+		for (const [lid, res] of Object.entries(resources)) {
+			if (lid === capturedLogicalId) continue;
+			if (res.Type !== "AWS::IAM::Policy") continue;
+			const props = res.Properties ?? {};
+			const attachments = props[attachmentField];
+			if (!Array.isArray(attachments)) continue;
+			if (!attachments.some((a) => isRefTo(a, capturedLogicalId) || a === capturedPhysicalId)) continue;
+			let policyName = props["PolicyName"];
+			if (policyName !== void 0 && typeof policyName !== "string") {
+				resolverContext ??= this.buildResolverContext({
+					template,
+					resources: stateResources,
+					...parameterValues && { parameters: parameterValues },
+					...conditions && { conditions }
+				}, stackName);
+				try {
+					policyName = await this.resolver.resolve(policyName, resolverContext);
+				} catch {
+					continue;
+				}
+			}
+			if (typeof policyName !== "string") continue;
+			siblings[lid] = {
+				resourceType: "AWS::IAM::Policy",
+				properties: {
+					[attachmentField]: [capturedPhysicalId],
+					PolicyName: policyName
+				}
+			};
+		}
+		return Object.keys(siblings).length > 0 ? { siblings } : void 0;
+	}
+	/**
 	* Kick off `provider.readCurrentState` for every resource in the
 	* loaded state that lacks `observedProperties` (e.g. state written
 	* by a pre-v3 binary, or a v3 record where a NO_CHANGE-skipped
@@ -13305,7 +13377,8 @@ var DeployEngine = class {
 					...templateAttrs,
 					provisionedBy: createDecision.provisionedBy
 				};
-				this.kickOffObservedCapture(createProvider, logicalId, result.physicalId, resourceType, resolvedProps);
+				const createCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
+				this.kickOffObservedCapture(createProvider, logicalId, result.physicalId, resourceType, resolvedProps, createCaptureSiblings);
 				if (counts) counts.created++;
 				if (progress) progress.current++;
 				const createPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
@@ -13468,7 +13541,8 @@ var DeployEngine = class {
 						...this.extractTemplateAttributes(template, logicalId),
 						provisionedBy: resultProvisionedBy
 					};
-					this.kickOffObservedCapture(updateProvider, logicalId, result.physicalId, resourceType, resolvedProps);
+					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
+					this.kickOffObservedCapture(updateProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
 					if (counts) counts.updated++;
 					if (progress) progress.current++;
 					const updatePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
@@ -13710,4 +13784,4 @@ var DeployEngine = class {
 
 //#endregion
 export { CFN_TEMPLATE_BODY_LIMIT as $, LockManager as A, runDockerForeground as B, findActionableSilentDrops as C, DiffCalculator as D, applyRoleArnIfSet as E, stringifyValue as F, getDefaultStateBucketName as G, AssetManifestLoader as H, WorkGraph as I, resolveCaptureObservedState as J, getLegacyStateBucketName as K, buildDockerImage as L, rebuildClientForBucketRegion as M, shouldRetainResource as N, DagBuilder as O, AssetPublisher as P, warnDeprecatedNoPrefixCliFlag as Q, formatDockerLoginError as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, getDockerImageBySourceHash as U, runDockerStreaming as V, Synthesizer as W, resolveStateBucketWithDefault as X, resolveSkipPrefix as Y, resolveStateBucketWithDefaultAndSource as Z, green as _, withRetry as a, clearBucketRegionCache as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, isStatefulRecreateTargetSync as d, CFN_TEMPLATE_URL_LIMIT as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, AssemblyReader as it, S3StateBackend as j, TemplateParser as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, findLargeInlineResources as nt, isRetryableTransientError as o, resolveBucketRegion as ot, formatResourceLine as p, resolveApp as q, DeployEngine as r, uploadCfnTemplate as rt, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, MIGRATE_TMP_PREFIX as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, getDockerCmd as z };
-//# sourceMappingURL=deploy-engine-BGL0DPBv.js.map
+//# sourceMappingURL=deploy-engine-DP5yW4f5.js.map