@go-to-k/cdkd 0.259.1 → 0.260.1

package/README.md

@@ -83,7 +83,7 @@ Reproduce the first two with `./tests/benchmark/run-benchmark.sh all`. See [test
 - **S3-based state management**: No DynamoDB required, uses S3 conditional writes for locking
 - **DAG-based parallelization**: Analyze `Ref`/`Fn::GetAtt` dependencies and execute in parallel
 - **Rollback on failure**: When a deploy errors mid-stack, cdkd rolls back the resources it just created so the stack state stays consistent (CloudFormation parity — but cdkd does this without round-tripping through CFn). Pass `cdkd deploy --no-rollback` to skip rollback and keep the partial state for Terraform-style inspection / repair. See [Rollback behavior](#rollback-behavior).
-- **`--no-wait` for async resources**: Skip the multi-minute wait on CloudFront / RDS / ElastiCache / NAT Gateway and return as soon as the create call returns (CloudFormation always blocks)
+- **`--no-wait` for async resources**: Skip the multi-minute wait on CloudFront / RDS / ElastiCache / NAT Gateway / Lambda MicroVM Image and return as soon as the create call returns (CloudFormation always blocks)
 - **VPC route DependsOn relaxation (on by default)**: Drop CDK-injected defensive `DependsOn` edges from VPC Lambdas onto private-subnet routes so `CloudFront::Distribution` and `Lambda::Url` start their ~3-min propagation in parallel with NAT Gateway stabilization (~50% faster on VPC + Lambda + CloudFront stacks). Pass `--no-aggressive-vpc-parallel` to opt out.
 - **Local execution** (`cdkd local invoke` / `start-api` / `run-task` / `start-service` / `start-alb` / `start-cloudfront` / `invoke-agentcore` / `start-agentcore`): run Lambdas, API Gateway routes, ECS tasks, long-running ECS services, CloudFront distributions, and Bedrock AgentCore Runtimes from your CDK code. All AWS Lambda runtimes, container Lambdas, REST v1 / HTTP v2 / Function URL routes, Service Connect / Cloud Map, AgentCore HTTP / MCP / A2A / AGUI / WebSocket protocols (one-shot `invoke-agentcore` and long-running warm serve via `start-agentcore`, which serves the native contract — `POST /invocations` + `GET /ping`, MCP `/mcp`, A2A `/` — plus the `/ws` bridge for HTTP / AGUI). The Docker-backed commands work for both `cdkd deploy`-managed (`--from-state`) AND `cdk deploy`-managed (`--from-cfn-stack`) stacks; `start-cloudfront` serves the viewer-request -> S3 / Lambda Function URL origin -> viewer-response pipeline (CloudFront-Functions + S3-only distributions run in-process with no Docker). See [Local execution](#local-execution).
 - **Bidirectional CloudFormation migration**: `cdkd import --migrate-from-cloudformation` adopts existing CFn stacks (including `cdk deploy`-managed) into cdkd state without re-creating resources; `cdkd export` hands a cdkd stack back to CloudFormation when production-ready. See [Importing](#importing-existing-resources) / [Exporting](#exporting-a-stack-back-to-cloudformation).

package/dist/cli.js

@@ -22,7 +22,7 @@ import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsF
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
-import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ResourceNotFoundException as ResourceNotFoundException$7, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
+import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$7, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -60,7 +60,7 @@ import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand,
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$11, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
-import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
+import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$12, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
@@ -348,7 +348,7 @@ function ensureWarnAfter(opts) {
 }
 /**
 * Skip waiting for async-stabilization resources (CloudFront, RDS,
-* ElastiCache, NAT Gateway) on deploy. Setting the flag mutates
+* ElastiCache, NAT Gateway, Lambda MicroVM Image) on deploy. Setting the flag mutates
 * `process.env.CDKD_NO_WAIT='true'`; provider code checks that env
 * var, not the parsed CLI option (this lets nested call paths — e.g.
 * asset publish, lifecycle hooks — see the same setting without
@@ -360,7 +360,7 @@ function ensureWarnAfter(opts) {
 * destroy paths don't wait to begin with — so `destroy --no-wait`
 * would be a no-op flag.
 */
-const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (CloudFront, RDS, ElastiCache, NAT Gateway)");
+const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (CloudFront, RDS, ElastiCache, NAT Gateway, Lambda MicroVM Image)");
 /**
 * Drop the CDK-injected defensive `DependsOn` edges from VPC Lambdas (and
 * adjacent IAM Role / Policy / Lambda::Url / EventSourceMapping resources)
@@ -1901,7 +1901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.259.1";
+	return "0.260.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -8519,7 +8519,7 @@ var LambdaFunctionProvider = class {
 					Timeout: this.clearOnUpdateRemoval(properties["Timeout"], previousProperties["Timeout"], 3),
 					MemorySize: this.clearOnUpdateRemoval(properties["MemorySize"], previousProperties["MemorySize"], 128),
 					Description: this.clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], ""),
-					Environment: this.clearOnUpdateRemoval(properties["Environment"], previousProperties["Environment"], { Variables: {} }),
+					Environment: this.clearOnUpdateRemoval(this.normalizeEnvironmentForUpdate(properties["Environment"]), previousProperties["Environment"], { Variables: {} }),
 					Layers: this.clearOnUpdateRemoval(properties["Layers"], previousProperties["Layers"], []),
 					TracingConfig: this.clearOnUpdateRemoval(properties["TracingConfig"], previousProperties["TracingConfig"], { Mode: "PassThrough" }),
 					EphemeralStorage: this.clearOnUpdateRemoval(properties["EphemeralStorage"], previousProperties["EphemeralStorage"], { Size: 512 }),
@@ -8690,6 +8690,25 @@ var LambdaFunctionProvider = class {
 		if (previousValue !== void 0) return clearValue;
 	}
 	/**
+	* Normalize a template `Environment` block for UpdateFunctionConfiguration.
+	*
+	* `Environment: {}` (present, but no `Variables` key — a hand-written L1 /
+	* imported-template shape CDK never emits) passed through verbatim does NOT
+	* clear the live env vars: the API keeps the old `Variables` when the input
+	* `Environment` carries none (live-verified 2026-07-22, issue #1158). The
+	* template's declarative meaning is "no env vars", so a Variables-less
+	* block is rewritten to the explicit-clear `{Variables: {}}`. A present
+	* `Variables` map (even empty) and an absent `Environment` pass through
+	* unchanged — removal handling stays with `clearOnUpdateRemoval`. A `null`
+	* block (hand-written JSON) is treated like absent rather than crashing on
+	* the property read.
+	*/
+	normalizeEnvironmentForUpdate(environment) {
+		if (environment == null) return void 0;
+		if (environment.Variables === void 0) return { Variables: {} };
+		return environment;
+	}
+	/**
 	* Determine whether the function actually attaches to a VPC, i.e. has at
 	* least one Subnet ID. A bare VpcConfig with empty arrays does not create
 	* any ENIs, so we skip the wait in that case.
@@ -10446,8 +10465,8 @@ var LambdaEventInvokeConfigProvider = class {
 var LambdaMicrovmImageProvider = class {
 	client;
 	logger = getLogger().child("LambdaMicrovmImageProvider");
-	maxPollAttempts = Number(process.env["CDKD_MICROVM_IMAGE_POLL_ATTEMPTS"] ?? 180);
-	pollIntervalMs = Number(process.env["CDKD_MICROVM_IMAGE_POLL_INTERVAL_MS"] ?? 1e4);
+	maxPollAttempts = positiveIntFromEnv(process.env["CDKD_MICROVM_IMAGE_POLL_ATTEMPTS"], 180);
+	pollIntervalMs = positiveIntFromEnv(process.env["CDKD_MICROVM_IMAGE_POLL_INTERVAL_MS"], 1e4);
 	constructor() {
 		this.client = getAwsClients().lambdaMicrovms;
 	}
@@ -10628,6 +10647,47 @@ var LambdaMicrovmImageProvider = class {
 			throw error;
 		}
 	}
+	/**
+	* Read the AWS-current MicroVM image state for `cdkd drift`.
+	*
+	* Only `Name` and `Tags` are readable back: `GetMicrovmImage` returns just
+	* `imageArn` / `name` / `state` / versions / timestamps / `tags`, so the
+	* build configuration (`BaseImageArn` / `BuildRoleArn` / `CodeArtifact` /
+	* `Logging` / `Hooks` / ...) never comes back. Those paths are excluded from
+	* the drift comparison via {@link getDriftUnknownPaths}; drift is therefore
+	* scoped to the mutable, readable surface (Tags — updated in place via
+	* TagResource/UntagResource).
+	*
+	* Tags are read via the dedicated `ListTags` (the authoritative tag source),
+	* not the `GetMicrovmImage` response's `tags` field, whose population is not
+	* guaranteed (the "type != populated" trap).
+	*
+	* Returns `undefined` when the image is gone.
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let name;
+		try {
+			name = (await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: physicalId }))).name;
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$7) return void 0;
+			throw error;
+		}
+		const result = {};
+		if (name !== void 0) result["Name"] = name;
+		result["Tags"] = normalizeAwsTagsToCfn((await this.client.send(new ListTagsCommand$1({ Resource: physicalId }))).Tags);
+		return result;
+	}
+	/**
+	* Drift comparison paths this provider cannot read back from AWS: the build
+	* configuration `GetMicrovmImage` never returns (its response carries only
+	* `imageArn` / `name` / `state` / versions / timestamps / `tags`). Only
+	* `Name` + `Tags` are read back (see {@link readCurrentState}), so every
+	* other managed property is declared unknown to avoid guaranteed
+	* false-positive drift on every run.
+	*/
+	getDriftUnknownPaths(_resourceType) {
+		return [...MICROVM_UNREADABLE_CFN_KEYS];
+	}
 	buildAttributes(imageArn, state, extra) {
 		const attributes = { ImageArn: imageArn };
 		if (state !== void 0) attributes["State"] = state;
@@ -10724,6 +10784,27 @@ const BUILD_AFFECTING_CFN_KEYS = [
 	"Hooks",
 	"EnvironmentVariables"
 ];
+/**
+* CFn property names `GetMicrovmImage` does NOT return (its response carries
+* only `imageArn` / `name` / `state` / versions / timestamps / `tags`), so
+* `cdkd drift` cannot read the build configuration back from AWS.
+* `getDriftUnknownPaths` declares them so they don't fire guaranteed
+* false-positive drift. Currently identical to {@link BUILD_AFFECTING_CFN_KEYS}
+* (the build config is exactly the set that is both rebuild-triggering and
+* unreadable) but kept separate as the two model different concerns
+* (drift-readability vs rebuild-triggering).
+*/
+const MICROVM_UNREADABLE_CFN_KEYS = BUILD_AFFECTING_CFN_KEYS;
+/**
+* Parse a positive-integer poll-config env var, falling back to `dflt` for an
+* unset / non-numeric / non-positive value (so a garbage override cannot yield
+* `NaN`, which would make the poll loop exit immediately with a spurious
+* timeout).
+*/
+function positiveIntFromEnv(value, dflt) {
+	const n = Number(value);
+	return Number.isFinite(n) && n > 0 ? n : dflt;
+}
 function sleep$2(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -37993,7 +38074,7 @@ var CloudTrailProvider = class {
 		result["InsightSelectors"] = insightSelectors;
 		let tags = [];
 		if (trail.TrailARN) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }))).ResourceTagList?.[0]?.TagsList);
+			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsCommand$2({ ResourceIdList: [trail.TrailARN] }))).ResourceTagList?.[0]?.TagsList);
 		} catch (err) {
 			this.logger.debug(`CloudTrail ListTags(${trail.TrailARN}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -61287,7 +61368,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.259.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.260.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());