@go-to-k/cdkd 0.259.0 → 0.260.0

package/README.md

@@ -83,7 +83,7 @@ Reproduce the first two with `./tests/benchmark/run-benchmark.sh all`. See [test
 - **S3-based state management**: No DynamoDB required, uses S3 conditional writes for locking
 - **DAG-based parallelization**: Analyze `Ref`/`Fn::GetAtt` dependencies and execute in parallel
 - **Rollback on failure**: When a deploy errors mid-stack, cdkd rolls back the resources it just created so the stack state stays consistent (CloudFormation parity — but cdkd does this without round-tripping through CFn). Pass `cdkd deploy --no-rollback` to skip rollback and keep the partial state for Terraform-style inspection / repair. See [Rollback behavior](#rollback-behavior).
-- **`--no-wait` for async resources**: Skip the multi-minute wait on CloudFront / RDS / ElastiCache / NAT Gateway and return as soon as the create call returns (CloudFormation always blocks)
+- **`--no-wait` for async resources**: Skip the multi-minute wait on CloudFront / RDS / ElastiCache / NAT Gateway / Lambda MicroVM Image and return as soon as the create call returns (CloudFormation always blocks)
 - **VPC route DependsOn relaxation (on by default)**: Drop CDK-injected defensive `DependsOn` edges from VPC Lambdas onto private-subnet routes so `CloudFront::Distribution` and `Lambda::Url` start their ~3-min propagation in parallel with NAT Gateway stabilization (~50% faster on VPC + Lambda + CloudFront stacks). Pass `--no-aggressive-vpc-parallel` to opt out.
 - **Local execution** (`cdkd local invoke` / `start-api` / `run-task` / `start-service` / `start-alb` / `start-cloudfront` / `invoke-agentcore` / `start-agentcore`): run Lambdas, API Gateway routes, ECS tasks, long-running ECS services, CloudFront distributions, and Bedrock AgentCore Runtimes from your CDK code. All AWS Lambda runtimes, container Lambdas, REST v1 / HTTP v2 / Function URL routes, Service Connect / Cloud Map, AgentCore HTTP / MCP / A2A / AGUI / WebSocket protocols (one-shot `invoke-agentcore` and long-running warm serve via `start-agentcore`, which serves the native contract — `POST /invocations` + `GET /ping`, MCP `/mcp`, A2A `/` — plus the `/ws` bridge for HTTP / AGUI). The Docker-backed commands work for both `cdkd deploy`-managed (`--from-state`) AND `cdk deploy`-managed (`--from-cfn-stack`) stacks; `start-cloudfront` serves the viewer-request -> S3 / Lambda Function URL origin -> viewer-response pipeline (CloudFront-Functions + S3-only distributions run in-process with no Docker). See [Local execution](#local-execution).
 - **Bidirectional CloudFormation migration**: `cdkd import --migrate-from-cloudformation` adopts existing CFn stacks (including `cdk deploy`-managed) into cdkd state without re-creating resources; `cdkd export` hands a cdkd stack back to CloudFormation when production-ready. See [Importing](#importing-existing-resources) / [Exporting](#exporting-a-stack-back-to-cloudformation).

package/dist/cli.js

@@ -22,7 +22,7 @@ import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsF
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
-import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ResourceNotFoundException as ResourceNotFoundException$7, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
+import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$7, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -60,7 +60,7 @@ import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand,
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$11, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
-import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
+import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$12, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
@@ -348,7 +348,7 @@ function ensureWarnAfter(opts) {
 }
 /**
 * Skip waiting for async-stabilization resources (CloudFront, RDS,
-* ElastiCache, NAT Gateway) on deploy. Setting the flag mutates
+* ElastiCache, NAT Gateway, Lambda MicroVM Image) on deploy. Setting the flag mutates
 * `process.env.CDKD_NO_WAIT='true'`; provider code checks that env
 * var, not the parsed CLI option (this lets nested call paths — e.g.
 * asset publish, lifecycle hooks — see the same setting without
@@ -360,7 +360,7 @@ function ensureWarnAfter(opts) {
 * destroy paths don't wait to begin with — so `destroy --no-wait`
 * would be a no-op flag.
 */
-const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (CloudFront, RDS, ElastiCache, NAT Gateway)");
+const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (CloudFront, RDS, ElastiCache, NAT Gateway, Lambda MicroVM Image)");
 /**
 * Drop the CDK-injected defensive `DependsOn` edges from VPC Lambdas (and
 * adjacent IAM Role / Policy / Lambda::Url / EventSourceMapping resources)
@@ -1901,7 +1901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.259.0";
+	return "0.260.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -8516,13 +8516,13 @@ var LambdaFunctionProvider = class {
 					Role: properties["Role"],
 					Handler: properties["Handler"],
 					Runtime: properties["Runtime"],
-					Timeout: properties["Timeout"],
-					MemorySize: properties["MemorySize"],
-					Description: properties["Description"],
-					Environment: properties["Environment"],
-					Layers: properties["Layers"],
-					TracingConfig: properties["TracingConfig"],
-					EphemeralStorage: properties["EphemeralStorage"],
+					Timeout: this.clearOnUpdateRemoval(properties["Timeout"], previousProperties["Timeout"], 3),
+					MemorySize: this.clearOnUpdateRemoval(properties["MemorySize"], previousProperties["MemorySize"], 128),
+					Description: this.clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], ""),
+					Environment: this.clearOnUpdateRemoval(properties["Environment"], previousProperties["Environment"], { Variables: {} }),
+					Layers: this.clearOnUpdateRemoval(properties["Layers"], previousProperties["Layers"], []),
+					TracingConfig: this.clearOnUpdateRemoval(properties["TracingConfig"], previousProperties["TracingConfig"], { Mode: "PassThrough" }),
+					EphemeralStorage: this.clearOnUpdateRemoval(properties["EphemeralStorage"], previousProperties["EphemeralStorage"], { Size: 512 }),
 					VpcConfig: this.buildVpcConfigForUpdate(properties["VpcConfig"], previousProperties["VpcConfig"]),
 					DeadLetterConfig: this.clearOnUpdateRemoval(properties["DeadLetterConfig"], previousProperties["DeadLetterConfig"], { TargetArn: "" }),
 					KMSKeyArn: this.clearOnUpdateRemoval(properties["KmsKeyArn"], previousProperties["KmsKeyArn"], ""),
@@ -8677,9 +8677,12 @@ var LambdaFunctionProvider = class {
 	* `UpdateFunctionConfiguration` treats an absent field as "no change", so
 	* passing `undefined` for a field the user just dropped from the template
 	* leaves the old value live on AWS — the update reports success while the
-	* field silently persists. For fields that support an explicit reset value
-	* (DeadLetterConfig `{TargetArn:''}`, KMSKeyArn `''`, FileSystemConfigs `[]`,
-	* ImageConfig `{}`, SnapStart `{ApplyOn:'None'}`) we send that reset when the
+	* field silently persists. For every optional config field we send its
+	* CFn-default / explicit reset value (e.g. Timeout `3`, MemorySize `128`,
+	* Environment `{Variables:{}}`, Layers `[]`, TracingConfig
+	* `{Mode:'PassThrough'}`, EphemeralStorage `{Size:512}`, DeadLetterConfig
+	* `{TargetArn:''}`, KMSKeyArn `''`, FileSystemConfigs `[]`, ImageConfig `{}`,
+	* SnapStart `{ApplyOn:'None'}`, LoggingConfig `{LogFormat:'Text'}`) when the
 	* field was present before and is now absent. Mirrors `buildVpcConfigForUpdate`.
 	*/
 	clearOnUpdateRemoval(newValue, previousValue, clearValue) {
@@ -10443,8 +10446,8 @@ var LambdaEventInvokeConfigProvider = class {
 var LambdaMicrovmImageProvider = class {
 	client;
 	logger = getLogger().child("LambdaMicrovmImageProvider");
-	maxPollAttempts = Number(process.env["CDKD_MICROVM_IMAGE_POLL_ATTEMPTS"] ?? 180);
-	pollIntervalMs = Number(process.env["CDKD_MICROVM_IMAGE_POLL_INTERVAL_MS"] ?? 1e4);
+	maxPollAttempts = positiveIntFromEnv(process.env["CDKD_MICROVM_IMAGE_POLL_ATTEMPTS"], 180);
+	pollIntervalMs = positiveIntFromEnv(process.env["CDKD_MICROVM_IMAGE_POLL_INTERVAL_MS"], 1e4);
 	constructor() {
 		this.client = getAwsClients().lambdaMicrovms;
 	}
@@ -10625,6 +10628,47 @@ var LambdaMicrovmImageProvider = class {
 			throw error;
 		}
 	}
+	/**
+	* Read the AWS-current MicroVM image state for `cdkd drift`.
+	*
+	* Only `Name` and `Tags` are readable back: `GetMicrovmImage` returns just
+	* `imageArn` / `name` / `state` / versions / timestamps / `tags`, so the
+	* build configuration (`BaseImageArn` / `BuildRoleArn` / `CodeArtifact` /
+	* `Logging` / `Hooks` / ...) never comes back. Those paths are excluded from
+	* the drift comparison via {@link getDriftUnknownPaths}; drift is therefore
+	* scoped to the mutable, readable surface (Tags — updated in place via
+	* TagResource/UntagResource).
+	*
+	* Tags are read via the dedicated `ListTags` (the authoritative tag source),
+	* not the `GetMicrovmImage` response's `tags` field, whose population is not
+	* guaranteed (the "type != populated" trap).
+	*
+	* Returns `undefined` when the image is gone.
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let name;
+		try {
+			name = (await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: physicalId }))).name;
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$7) return void 0;
+			throw error;
+		}
+		const result = {};
+		if (name !== void 0) result["Name"] = name;
+		result["Tags"] = normalizeAwsTagsToCfn((await this.client.send(new ListTagsCommand$1({ Resource: physicalId }))).Tags);
+		return result;
+	}
+	/**
+	* Drift comparison paths this provider cannot read back from AWS: the build
+	* configuration `GetMicrovmImage` never returns (its response carries only
+	* `imageArn` / `name` / `state` / versions / timestamps / `tags`). Only
+	* `Name` + `Tags` are read back (see {@link readCurrentState}), so every
+	* other managed property is declared unknown to avoid guaranteed
+	* false-positive drift on every run.
+	*/
+	getDriftUnknownPaths(_resourceType) {
+		return [...MICROVM_UNREADABLE_CFN_KEYS];
+	}
 	buildAttributes(imageArn, state, extra) {
 		const attributes = { ImageArn: imageArn };
 		if (state !== void 0) attributes["State"] = state;
@@ -10721,6 +10765,27 @@ const BUILD_AFFECTING_CFN_KEYS = [
 	"Hooks",
 	"EnvironmentVariables"
 ];
+/**
+* CFn property names `GetMicrovmImage` does NOT return (its response carries
+* only `imageArn` / `name` / `state` / versions / timestamps / `tags`), so
+* `cdkd drift` cannot read the build configuration back from AWS.
+* `getDriftUnknownPaths` declares them so they don't fire guaranteed
+* false-positive drift. Currently identical to {@link BUILD_AFFECTING_CFN_KEYS}
+* (the build config is exactly the set that is both rebuild-triggering and
+* unreadable) but kept separate as the two model different concerns
+* (drift-readability vs rebuild-triggering).
+*/
+const MICROVM_UNREADABLE_CFN_KEYS = BUILD_AFFECTING_CFN_KEYS;
+/**
+* Parse a positive-integer poll-config env var, falling back to `dflt` for an
+* unset / non-numeric / non-positive value (so a garbage override cannot yield
+* `NaN`, which would make the poll loop exit immediately with a spurious
+* timeout).
+*/
+function positiveIntFromEnv(value, dflt) {
+	const n = Number(value);
+	return Number.isFinite(n) && n > 0 ? n : dflt;
+}
 function sleep$2(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -37990,7 +38055,7 @@ var CloudTrailProvider = class {
 		result["InsightSelectors"] = insightSelectors;
 		let tags = [];
 		if (trail.TrailARN) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }))).ResourceTagList?.[0]?.TagsList);
+			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsCommand$2({ ResourceIdList: [trail.TrailARN] }))).ResourceTagList?.[0]?.TagsList);
 		} catch (err) {
 			this.logger.debug(`CloudTrail ListTags(${trail.TrailARN}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -61284,7 +61349,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.259.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.260.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());