@go-to-k/cdkd 0.230.4 → 0.230.6

package/dist/cli.js

@@ -49,12 +49,12 @@ import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, Delet
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$12, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$14, UpdateShardCountCommand } from "@aws-sdk/client-kinesis";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$14, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$9, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
@@ -1445,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.4";
+	return "0.230.6";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -26102,6 +26102,35 @@ var WAFv2WebACLProvider = class {
 //#endregion
 //#region src/provisioning/providers/cognito-provider.ts
 /**
+* The standard (OIDC) Cognito User Pool attribute names. A Schema entry whose
+* Name is NOT in this set is a custom attribute (AWS stores it as
+* `custom:<name>`). Used by the update path to tell which added Schema entries
+* can be added in place via AddCustomAttributes (custom only) versus which
+* require replacement (standard attributes are immutable on update).
+*/
+const STANDARD_USER_POOL_ATTRIBUTES = new Set([
+	"address",
+	"birthdate",
+	"email",
+	"email_verified",
+	"family_name",
+	"gender",
+	"given_name",
+	"locale",
+	"middle_name",
+	"name",
+	"nickname",
+	"phone_number",
+	"phone_number_verified",
+	"picture",
+	"preferred_username",
+	"profile",
+	"sub",
+	"updated_at",
+	"website",
+	"zoneinfo"
+]);
+/**
 * Class 2 sanitize: empty `{}` placeholders that `readCurrentState` emits
 * for sub-objects whose AWS schema requires a sub-field would be rejected
 * by `UpdateUserPool` if shipped as-is. The known-rejected shapes:
@@ -26348,10 +26377,13 @@ var CognitoUserPoolProvider = class {
 	/**
 	* Update a Cognito User Pool
 	*
-	* Note: PoolName (UserPoolName) and Schema are immutable and cannot be changed after creation.
-	* Changes to these properties require resource replacement.
+	* Note: PoolName (UserPoolName) is immutable and cannot be changed after
+	* creation. The Schema (custom attributes) is partly mutable: AWS supports
+	* ADDING new custom attributes in place via AddCustomAttributes, but cannot
+	* modify or remove an existing attribute — those changes require replacement
+	* and are rejected with ResourceUpdateNotSupportedError.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
 		try {
 			const updateParams = { UserPoolId: physicalId };
@@ -26378,6 +26410,7 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsVerificationMessage"] !== void 0) updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
 			await this.getClient().send(new UpdateUserPoolCommand(updateParams));
+			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"]);
 			await this.applyMfaConfig(physicalId, properties);
 			this.logger.debug(`Successfully updated Cognito User Pool ${logicalId}`);
 			const userPool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
@@ -26395,11 +26428,56 @@ var CognitoUserPoolProvider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
+	* Reconcile a user pool's Schema custom attributes on update.
+	*
+	* AWS supports ADDING new custom attributes in place (AddCustomAttributes)
+	* but cannot modify or remove an existing attribute. Standard attributes are
+	* fully immutable. So:
+	*  - attributes present only in the new Schema (and custom) are added;
+	*  - removing or modifying an existing attribute, or adding a standard
+	*    attribute, requires replacement -> ResourceUpdateNotSupportedError.
+	* A byte-identical Schema is a no-op (no AddCustomAttributes call).
+	*/
+	async reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, newSchema, oldSchema) {
+		const newAttrs = newSchema ?? [];
+		const oldAttrs = oldSchema ?? [];
+		const byName = (attrs) => {
+			const map = /* @__PURE__ */ new Map();
+			for (const attr of attrs) if (attr.Name !== void 0) map.set(attr.Name, attr);
+			return map;
+		};
+		const oldByName = byName(oldAttrs);
+		const newByName = byName(newAttrs);
+		const added = [];
+		const modified = [];
+		for (const [name, attr] of newByName) {
+			const prev = oldByName.get(name);
+			if (!prev) added.push(attr);
+			else if (JSON.stringify(prev) !== JSON.stringify(attr)) modified.push(name);
+		}
+		const removed = [...oldByName.keys()].filter((n) => !newByName.has(n));
+		const addedStandard = added.filter((a) => a.Name !== void 0 && STANDARD_USER_POOL_ATTRIBUTES.has(a.Name)).map((a) => a.Name);
+		const immutableChanges = [
+			...removed.map((n) => `removed attribute '${n}'`),
+			...modified.map((n) => `modified attribute '${n}'`),
+			...addedStandard.map((n) => `added standard attribute '${n}'`)
+		];
+		if (immutableChanges.length > 0) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. Re-run with cdkd deploy --replace to recreate it (this deletes all users in the pool)`);
+		const addedCustom = added.filter((a) => a.Name !== void 0 && !STANDARD_USER_POOL_ATTRIBUTES.has(a.Name));
+		if (addedCustom.length === 0) return;
+		this.logger.debug(`Adding ${addedCustom.length} custom attribute(s) to ${physicalId}: ` + addedCustom.map((a) => a.Name).join(", "));
+		await this.getClient().send(new AddCustomAttributesCommand({
+			UserPoolId: physicalId,
+			CustomAttributes: addedCustom
+		}));
+	}
+	/**
 	* Delete a Cognito User Pool.
 	*
 	* When `context.removeProtection === true`, `DeletionProtection` is flipped
@@ -30918,15 +30996,29 @@ var KinesisStreamProvider = class {
 	/**
 	* Update a Kinesis stream
 	*
-	* Supports updating ShardCount for PROVISIONED mode streams.
-	* StreamMode and Name changes require replacement (handled by deployment layer).
+	* Supports switching StreamMode (PROVISIONED <-> ON_DEMAND, via
+	* UpdateStreamMode), updating ShardCount for PROVISIONED mode streams,
+	* RetentionPeriodHours, StreamEncryption, and Tags. Name changes require
+	* replacement (handled by the deployment layer).
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Kinesis stream ${logicalId}: ${physicalId}`);
 		try {
-			if ((properties["StreamModeDetails"]?.["StreamMode"] || "PROVISIONED") === "PROVISIONED") {
+			const streamMode = properties["StreamModeDetails"]?.["StreamMode"] || "PROVISIONED";
+			const oldStreamMode = previousProperties["StreamModeDetails"]?.["StreamMode"] || "PROVISIONED";
+			const modeChanged = oldStreamMode !== streamMode;
+			if (modeChanged) {
+				const streamArn = await this.resolveStreamArn(physicalId);
+				this.logger.debug(`Switching stream mode for ${physicalId}: ${oldStreamMode} -> ${streamMode}`);
+				await this.getClient().send(new UpdateStreamModeCommand({
+					StreamARN: streamArn,
+					StreamModeDetails: { StreamMode: streamMode }
+				}));
+				await this.waitForStreamActive(physicalId);
+			}
+			if (streamMode === "PROVISIONED") {
 				const newShardCount = Number(properties["ShardCount"] ?? 1);
-				const oldShardCount = Number(previousProperties["ShardCount"] ?? 1);
+				const oldShardCount = modeChanged ? await this.getOpenShardCount(physicalId) : Number(previousProperties["ShardCount"] ?? 1);
 				if (newShardCount !== oldShardCount) {
 					this.logger.debug(`Updating shard count for ${physicalId}: ${oldShardCount} -> ${newShardCount}`);
 					await this.getClient().send(new UpdateShardCountCommand({
@@ -31146,6 +31238,26 @@ var KinesisStreamProvider = class {
 		}
 		throw new Error(`Stream ${streamName} did not reach ACTIVE status within ${maxAttempts * 2} seconds`);
 	}
+	/**
+	* Resolve a stream's ARN from its name. UpdateStreamMode is one of the few
+	* Kinesis APIs that takes a StreamARN rather than a StreamName, so an
+	* update that switches StreamModeDetails needs the ARN.
+	*/
+	async resolveStreamArn(streamName) {
+		const arn = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }))).StreamDescriptionSummary?.StreamARN;
+		if (!arn) throw new Error(`Unable to resolve StreamARN for stream ${streamName}`);
+		return arn;
+	}
+	/**
+	* Read the stream's current open shard count. Used after an
+	* ON_DEMAND -> PROVISIONED mode switch, where previousProperties carries no
+	* ShardCount and AWS has assigned its own count, so reconciling against the
+	* live count (not the absent state value) is the only correct base.
+	*/
+	async getOpenShardCount(streamName) {
+		const response = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: streamName }));
+		return Number(response.StreamDescriptionSummary?.OpenShardCount ?? 1);
+	}
 };
 
 //#endregion
@@ -55195,7 +55307,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.6");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());