@go-to-k/cdkd 0.230.5 → 0.230.7

package/dist/cli.js

@@ -49,7 +49,7 @@ import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, Delet
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$12, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
@@ -1445,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.5";
+	return "0.230.7";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -26102,6 +26102,41 @@ var WAFv2WebACLProvider = class {
 //#endregion
 //#region src/provisioning/providers/cognito-provider.ts
 /**
+* The standard (OIDC) Cognito User Pool attribute names. A Schema entry whose
+* Name is NOT in this set is a custom attribute (AWS stores it as
+* `custom:<name>`). Used by the update path to tell which added Schema entries
+* can be added in place via AddCustomAttributes (custom only) versus which
+* require replacement (standard attributes are immutable on update).
+*
+* This list is a snapshot of AWS's standard claim set and may lag AWS. If AWS
+* ever adds a new standard attribute, a user adding it would be misclassified
+* as custom and routed to AddCustomAttributes — which AWS rejects with a clear
+* error (surfaced as a ProvisioningError, never a silent drop), so the failure
+* is loud and the fix is to append the new name here.
+*/
+const STANDARD_USER_POOL_ATTRIBUTES = new Set([
+	"address",
+	"birthdate",
+	"email",
+	"email_verified",
+	"family_name",
+	"gender",
+	"given_name",
+	"locale",
+	"middle_name",
+	"name",
+	"nickname",
+	"phone_number",
+	"phone_number_verified",
+	"picture",
+	"preferred_username",
+	"profile",
+	"sub",
+	"updated_at",
+	"website",
+	"zoneinfo"
+]);
+/**
 * Class 2 sanitize: empty `{}` placeholders that `readCurrentState` emits
 * for sub-objects whose AWS schema requires a sub-field would be rejected
 * by `UpdateUserPool` if shipped as-is. The known-rejected shapes:
@@ -26348,10 +26383,13 @@ var CognitoUserPoolProvider = class {
 	/**
 	* Update a Cognito User Pool
 	*
-	* Note: PoolName (UserPoolName) and Schema are immutable and cannot be changed after creation.
-	* Changes to these properties require resource replacement.
+	* Note: PoolName (UserPoolName) is immutable and cannot be changed after
+	* creation. The Schema (custom attributes) is partly mutable: AWS supports
+	* ADDING new custom attributes in place via AddCustomAttributes, but cannot
+	* modify or remove an existing attribute — those changes require replacement
+	* and are rejected with ResourceUpdateNotSupportedError.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
 		try {
 			const updateParams = { UserPoolId: physicalId };
@@ -26378,6 +26416,7 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsVerificationMessage"] !== void 0) updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
 			await this.getClient().send(new UpdateUserPoolCommand(updateParams));
+			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"]);
 			await this.applyMfaConfig(physicalId, properties);
 			this.logger.debug(`Successfully updated Cognito User Pool ${logicalId}`);
 			const userPool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
@@ -26395,11 +26434,57 @@ var CognitoUserPoolProvider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof ResourceUpdateNotSupportedError || error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	/**
+	* Reconcile a user pool's Schema custom attributes on update.
+	*
+	* AWS supports ADDING new custom attributes in place (AddCustomAttributes)
+	* but cannot modify or remove an existing attribute. Standard attributes are
+	* fully immutable. So:
+	*  - attributes present only in the new Schema (and custom) are added;
+	*  - removing or modifying an existing attribute, or adding a standard
+	*    attribute, requires replacement -> ResourceUpdateNotSupportedError.
+	* A byte-identical Schema is a no-op (no AddCustomAttributes call).
+	*/
+	async reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, newSchema, oldSchema) {
+		const newAttrs = newSchema ?? [];
+		const oldAttrs = oldSchema ?? [];
+		for (const attr of newAttrs) if (attr.Name === void 0) throw new ProvisioningError(`Cognito User Pool ${logicalId} has a Schema attribute with no Name — every Schema entry must have a Name`, resourceType, logicalId, physicalId);
+		const byName = (attrs) => {
+			const map = /* @__PURE__ */ new Map();
+			for (const attr of attrs) if (attr.Name !== void 0) map.set(attr.Name, attr);
+			return map;
+		};
+		const oldByName = byName(oldAttrs);
+		const newByName = byName(newAttrs);
+		const added = [];
+		const modified = [];
+		for (const [name, attr] of newByName) {
+			const prev = oldByName.get(name);
+			if (!prev) added.push(attr);
+			else if (JSON.stringify(prev) !== JSON.stringify(attr)) modified.push(name);
+		}
+		const removed = [...oldByName.keys()].filter((n) => !newByName.has(n));
+		const addedStandard = added.filter((a) => a.Name !== void 0 && STANDARD_USER_POOL_ATTRIBUTES.has(a.Name)).map((a) => a.Name);
+		const immutableChanges = [
+			...removed.map((n) => `removed attribute '${n}'`),
+			...modified.map((n) => `modified attribute '${n}'`),
+			...addedStandard.map((n) => `added standard attribute '${n}'`)
+		];
+		if (immutableChanges.length > 0) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. AWS::Cognito::UserPool is a stateful type, so re-run with cdkd deploy --replace --force-stateful-recreation to recreate it (this deletes all users in the pool)`);
+		const addedCustom = added.filter((a) => a.Name !== void 0 && !STANDARD_USER_POOL_ATTRIBUTES.has(a.Name));
+		if (addedCustom.length === 0) return;
+		this.logger.debug(`Adding ${addedCustom.length} custom attribute(s) to ${physicalId}: ` + addedCustom.map((a) => a.Name).join(", "));
+		await this.getClient().send(new AddCustomAttributesCommand({
+			UserPoolId: physicalId,
+			CustomAttributes: addedCustom
+		}));
+	}
+	/**
 	* Delete a Cognito User Pool.
 	*
 	* When `context.removeProtection === true`, `DeletionProtection` is flipped
@@ -55229,7 +55314,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.7");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());