@go-to-k/cdkd 0.260.5 → 0.260.7

package/dist/cli.js

@@ -1901,7 +1901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.260.5";
+	return "0.260.7";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21875,6 +21875,22 @@ const DEPLOYMENT_CONFIG_PRESERVE_KEYS = /* @__PURE__ */ new Set(["HookDetails"])
 */
 const DEPLOYMENT_CONFIG_PRESERVE_KEYS_CAMEL = /* @__PURE__ */ new Set(["hookDetails"]);
 /**
+* Derive the cluster name from a long-format ECS Service ARN
+* (`arn:<partition>:ecs:<region>:<account>:service/<clusterName>/<serviceName>`)
+* so `DescribeServices` can be scoped to the right cluster (issue #1170).
+* Returns `undefined` for the legacy short-format ARN
+* (`.../service/<serviceName>`, which does not encode a cluster) or any input
+* that does not match the ARN shape — the caller then falls back to the default
+* cluster, matching what the short-format ARN implies.
+*/
+function clusterNameFromServiceArn(arn) {
+	const resource = arn.split(":")[5];
+	if (!resource) return void 0;
+	const segments = resource.split("/");
+	if (segments[0] !== "service") return void 0;
+	return segments.length >= 3 ? segments[1] : void 0;
+}
+/**
 * AWS ECS Provider
 *
 * Implements resource provisioning for ECS resources:
@@ -22277,7 +22293,10 @@ var ECSProvider = class {
 		}
 	}
 	async getServiceAttribute(physicalId, attributeName) {
-		const service = (await this.getClient().send(new DescribeServicesCommand({ services: [physicalId] }))).services?.[0];
+		const service = (await this.getClient().send(new DescribeServicesCommand({
+			cluster: clusterNameFromServiceArn(physicalId),
+			services: [physicalId]
+		}))).services?.[0];
 		if (!service) return void 0;
 		switch (attributeName) {
 			case "ServiceArn": return service.serviceArn;
@@ -22676,6 +22695,123 @@ var ECSProvider = class {
 		return out;
 	}
 	/**
+	* Reverse of `convertContainerDefinitions` for `readCurrentState` (issue
+	* #1169). Emits CFn PascalCase so the drift baseline (state `properties`
+	* PascalCase, or `observedProperties` captured via this same reader) compares
+	* apples-to-apples instead of phantom-drifting on the whole array — the drift
+	* comparator compares arrays wholesale via `deepEqual`, so the previous raw
+	* SDK camelCase read (`result['ContainerDefinitions'] = td.containerDefinitions`)
+	* never matched a PascalCase baseline.
+	*
+	* Two rules keep the read side matching a template that omits AWS's defaults:
+	*   1. Only the fields `convertContainerDefinitions` can SET are emitted, so
+	*      the round-trip is symmetric — a field cdkd cannot set is never surfaced
+	*      as drift against a template that lacks it.
+	*   2. AWS-defaulted-empty divergences are normalized away — `Cpu: 0`, empty
+	*      arrays (`PortMappings` / `Environment` / ...), and an empty
+	*      `LinuxParameters.Capabilities: {Add:[],Drop:[]}` are dropped so they
+	*      equal "absent" (what the template has). AWS returns these defaults on
+	*      EVERY read, so without this the `properties` fallback baseline
+	*      (pre-observedProperties state) would phantom-drift on every run; the
+	*      normalization trades that for a rare edge — a template that EXPLICITLY
+	*      sets one of these to its empty/zero default AND has no observed baseline
+	*      (CDK L2 never emits e.g. an explicit `Cpu: 0`). On the normal
+	*      `observedProperties` path both sides run through this reader, so the
+	*      snapshot is self-consistent regardless.
+	*
+	* Free-form maps (`DockerLabels`, `LogConfiguration.Options`) are copied
+	* verbatim — their keys are user data (log-driver options / container labels),
+	* NOT CFn property names, so they must not be case-flipped.
+	*/
+	containerDefinitionsToCfn(defs) {
+		if (!defs) return [];
+		return defs.map((c) => {
+			const out = {};
+			if (c.name !== void 0) out["Name"] = c.name;
+			if (c.image !== void 0) out["Image"] = c.image;
+			if (c.cpu !== void 0 && c.cpu !== 0) out["Cpu"] = c.cpu;
+			if (c.memory !== void 0) out["Memory"] = c.memory;
+			if (c.memoryReservation !== void 0) out["MemoryReservation"] = c.memoryReservation;
+			if (c.essential !== void 0) out["Essential"] = c.essential;
+			if (c.command && c.command.length > 0) out["Command"] = [...c.command];
+			if (c.entryPoint && c.entryPoint.length > 0) out["EntryPoint"] = [...c.entryPoint];
+			if (c.environment && c.environment.length > 0) out["Environment"] = c.environment.map((e) => ({
+				Name: e.name,
+				Value: e.value
+			}));
+			if (c.environmentFiles && c.environmentFiles.length > 0) out["EnvironmentFiles"] = c.environmentFiles.map((e) => ({
+				Type: e.type,
+				Value: e.value
+			}));
+			if (c.secrets && c.secrets.length > 0) out["Secrets"] = c.secrets.map((s) => ({
+				Name: s.name,
+				ValueFrom: s.valueFrom
+			}));
+			if (c.portMappings && c.portMappings.length > 0) out["PortMappings"] = camelToPascalCaseKeys(c.portMappings);
+			if (c.mountPoints && c.mountPoints.length > 0) out["MountPoints"] = camelToPascalCaseKeys(c.mountPoints);
+			if (c.volumesFrom && c.volumesFrom.length > 0) out["VolumesFrom"] = camelToPascalCaseKeys(c.volumesFrom);
+			if (c.dependsOn && c.dependsOn.length > 0) out["DependsOn"] = camelToPascalCaseKeys(c.dependsOn);
+			if (c.links && c.links.length > 0) out["Links"] = [...c.links];
+			if (c.workingDirectory !== void 0) out["WorkingDirectory"] = c.workingDirectory;
+			if (c.disableNetworking !== void 0) out["DisableNetworking"] = c.disableNetworking;
+			if (c.privileged !== void 0) out["Privileged"] = c.privileged;
+			if (c.readonlyRootFilesystem !== void 0) out["ReadonlyRootFilesystem"] = c.readonlyRootFilesystem;
+			if (c.user !== void 0) out["User"] = c.user;
+			if (c.ulimits && c.ulimits.length > 0) out["Ulimits"] = camelToPascalCaseKeys(c.ulimits);
+			if (c.logConfiguration) out["LogConfiguration"] = this.logConfigurationToCfn(c.logConfiguration);
+			if (c.healthCheck) out["HealthCheck"] = camelToPascalCaseKeys(c.healthCheck);
+			if (c.linuxParameters) {
+				const lp = this.linuxParametersToCfn(c.linuxParameters);
+				if (Object.keys(lp).length > 0) out["LinuxParameters"] = lp;
+			}
+			if (c.dockerLabels && Object.keys(c.dockerLabels).length > 0) out["DockerLabels"] = { ...c.dockerLabels };
+			if (c.startTimeout !== void 0) out["StartTimeout"] = c.startTimeout;
+			if (c.stopTimeout !== void 0) out["StopTimeout"] = c.stopTimeout;
+			if (c.interactive !== void 0) out["Interactive"] = c.interactive;
+			if (c.pseudoTerminal !== void 0) out["PseudoTerminal"] = c.pseudoTerminal;
+			return out;
+		});
+	}
+	/**
+	* Reverse of `convertLogConfiguration` for `containerDefinitionsToCfn`.
+	* `LogDriver` flips; `Options` is a free-form log-driver option map copied
+	* verbatim (its keys, e.g. `awslogs-group`, are NOT CFn property names);
+	* `SecretOptions` is a `{Name, ValueFrom}[]` list. Emit-when-present so an
+	* absent / empty sub-field does not phantom-drift.
+	*/
+	logConfigurationToCfn(lc) {
+		const out = {};
+		if (lc.logDriver !== void 0) out["LogDriver"] = lc.logDriver;
+		if (lc.options && Object.keys(lc.options).length > 0) out["Options"] = { ...lc.options };
+		if (lc.secretOptions && lc.secretOptions.length > 0) out["SecretOptions"] = lc.secretOptions.map((s) => ({
+			Name: s.name,
+			ValueFrom: s.valueFrom
+		}));
+		return out;
+	}
+	/**
+	* Reverse of `convertLinuxParameters` for `containerDefinitionsToCfn`. The
+	* SET side is a mechanical first-letter flip (`pascalToCamelCaseKeys`), so the
+	* read side is the inverse `camelToPascalCaseKeys` — plus normalization of the
+	* AWS-defaulted-empty `Capabilities` / `Devices` / `Tmpfs`: AWS returns
+	* `capabilities: {add:[], drop:[]}` even when the template set neither, so the
+	* empty `Add` / `Drop` (and an otherwise-empty `Capabilities`) and empty
+	* `Devices` / `Tmpfs` arrays are dropped to equal a template that omits them.
+	*/
+	linuxParametersToCfn(lp) {
+		const out = camelToPascalCaseKeys(lp);
+		const caps = out["Capabilities"];
+		if (caps) {
+			const normalized = {};
+			if (Array.isArray(caps["Add"]) && caps["Add"].length > 0) normalized["Add"] = caps["Add"];
+			if (Array.isArray(caps["Drop"]) && caps["Drop"].length > 0) normalized["Drop"] = caps["Drop"];
+			if (Object.keys(normalized).length > 0) out["Capabilities"] = normalized;
+			else delete out["Capabilities"];
+		}
+		for (const key of ["Devices", "Tmpfs"]) if (Array.isArray(out[key]) && out[key].length === 0) delete out[key];
+		return out;
+	}
+	/**
 	* Coerce a CFn boolean property to a real boolean at the wire boundary.
 	* CFn templates can carry booleans as the strings "true" / "false"
 	* (e.g. via Fn::Sub / parameter plumbing), so the SDK input must
@@ -22878,8 +23014,9 @@ var ECSProvider = class {
 	*
 	* Dispatches by resource type:
 	*   - `AWS::ECS::Cluster` → `DescribeClusters`
-	*   - `AWS::ECS::Service` → `DescribeServices`. Service physicalIds use
-	*     the composite form `<clusterArn>|<serviceName>`; we split on `|`.
+	*   - `AWS::ECS::Service` → `DescribeServices`. Service physicalIds come in
+	*     two forms — the service ARN (what `createService` stores) and the
+	*     composite `<clusterArn>|<serviceName>` — and both are accepted (#1170).
 	*   - `AWS::ECS::TaskDefinition` → `DescribeTaskDefinition`
 	*
 	* Each branch surfaces only the keys cdkd's `create()` accepts, mapping
@@ -22926,14 +23063,20 @@ var ECSProvider = class {
 		return result;
 	}
 	async readCurrentStateService(physicalId) {
+		let cluster;
+		let serviceName;
 		const sep = physicalId.indexOf("|");
-		if (sep < 0) return void 0;
-		const clusterArn = physicalId.substring(0, sep);
-		const serviceName = physicalId.substring(sep + 1);
+		if (sep >= 0) {
+			cluster = physicalId.substring(0, sep);
+			serviceName = physicalId.substring(sep + 1);
+		} else {
+			serviceName = physicalId;
+			cluster = clusterNameFromServiceArn(physicalId);
+		}
 		let resp;
 		try {
 			resp = await this.getClient().send(new DescribeServicesCommand({
-				cluster: clusterArn,
+				cluster,
 				services: [serviceName],
 				include: ["TAGS"]
 			}));
@@ -23001,7 +23144,7 @@ var ECSProvider = class {
 		if (td.ipcMode !== void 0) result["IpcMode"] = td.ipcMode;
 		if (td.ephemeralStorage?.sizeInGiB !== void 0) result["EphemeralStorage"] = { SizeInGiB: td.ephemeralStorage.sizeInGiB };
 		if (td.enableFaultInjection !== void 0) result["EnableFaultInjection"] = td.enableFaultInjection;
-		result["ContainerDefinitions"] = td.containerDefinitions ?? [];
+		result["ContainerDefinitions"] = this.containerDefinitionsToCfn(td.containerDefinitions);
 		result["Tags"] = normalizeAwsTagsToCfn(resp.tags);
 		return result;
 	}
@@ -23012,10 +23155,11 @@ var ECSProvider = class {
 	* `AWS::ECS::TaskDefinition` — all explicit-override only (see the
 	* per-branch notes on why the `aws:cdk:path` tag walk was removed).
 	*
-	* Service has a composite physical id of `<clusterArn>|<serviceName>`
-	* (the form ECSProvider uses internally for mutation operations),
-	* so the explicit-override path takes that composite form when
-	* supplied.
+	* `createService` stores the service ARN as the Service physical id (and
+	* the mutation ops pass it straight through as the `service` argument, with
+	* the cluster read from the template `Cluster` property). The explicit
+	* `--resource` override is honored verbatim, so a caller may also supply the
+	* composite `<clusterArn>|<serviceName>` form that `readCurrentState` accepts.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -61680,7 +61824,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.260.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.260.7");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());