@go-to-k/cdkd 0.268.0 → 0.268.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, $t as MissingCdkCliError, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalMigrateError, Y as rebuildClientForBucketRegion, Yt as LocalInvokeBuildError$1, Z as AssetPublisher, Zt as LocalStartServiceError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackHasActiveImportsError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as normalizeAwsError, dt as buildDockerImage, en as NestedStackChildDirectDestroyError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as withErrorHandling, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceUpdateNotSupportedError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ProvisioningError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackTerminationProtectionError, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceTimeoutError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as PartialFailureError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-B5cRuFij.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-BEjF-h_6.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-ZylgRJOY.js";
+import { t as ASGProvider } from "./asg-provider-gaXfXSH0.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15617,30 +15617,13 @@ var EC2Provider = class {
 				VpcId: properties["VpcId"] ?? void 0
 			}))).GroupId;
 			try {
-				await this.applyTags(groupId, properties, logicalId);
 				const ingressRules = properties["SecurityGroupIngress"];
-				if (ingressRules && Array.isArray(ingressRules)) for (const rule of ingressRules) await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
-					GroupId: groupId,
-					IpPermissions: [this.buildIpPermission(rule)]
-				}));
 				const egressRules = properties["SecurityGroupEgress"];
-				if (egressRules && Array.isArray(egressRules)) {
-					try {
-						await this.ec2Client.send(new RevokeSecurityGroupEgressCommand({
-							GroupId: groupId,
-							IpPermissions: [{
-								IpProtocol: "-1",
-								IpRanges: [{ CidrIp: "0.0.0.0/0" }]
-							}]
-						}));
-					} catch (error) {
-						if (!this.isNotFoundError(error)) throw error;
-					}
-					for (const rule of egressRules) await this.ec2Client.send(new AuthorizeSecurityGroupEgressCommand({
-						GroupId: groupId,
-						IpPermissions: [this.buildIpPermission(rule, "egress")]
-					}));
-				}
+				await Promise.all([
+					this.applyTags(groupId, properties, logicalId),
+					this.authorizeInlineIngress(groupId, ingressRules),
+					this.applyInlineEgress(groupId, egressRules)
+				]);
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteSecurityGroupCommand({ GroupId: groupId }));
@@ -15663,6 +15646,79 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create SecurityGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	/**
+	* Authorize a freshly-created security group's inline
+	* `SecurityGroupIngress` rules in a SINGLE `AuthorizeSecurityGroupIngress`
+	* call.
+	*
+	* The API takes an `IpPermissions` ARRAY; the previous per-rule loop paid
+	* one round trip per rule for no benefit. AWS applies the whole list
+	* atomically, so the resulting rule set is byte-identical — the only
+	* behavior difference is that a bad rule now rejects the batch instead of
+	* being preceded by its already-applied siblings, and the caller deletes
+	* the half-wired group in either case.
+	*/
+	async authorizeInlineIngress(groupId, ingressRules) {
+		if (!Array.isArray(ingressRules) || ingressRules.length === 0) return;
+		await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
+			GroupId: groupId,
+			IpPermissions: ingressRules.map((rule) => this.buildIpPermission(rule))
+		}));
+	}
+	/**
+	* Apply a freshly-created security group's inline `SecurityGroupEgress`
+	* rules.
+	*
+	* When a template specifies egress explicitly, CloudFormation replaces the
+	* AWS-default "allow all egress" rule (`-1` / `0.0.0.0/0`) with the
+	* supplied set, so cdkd revokes the default first and then authorizes the
+	* template's rules. Both steps are preserved, including for an EMPTY
+	* `SecurityGroupEgress: []` — that is a deliberate "no egress at all",
+	* which requires the revoke and no authorize.
+	*
+	* Two round trips are saved where they are provably redundant:
+	*
+	*   - The whole revoke+authorize pair is SKIPPED when the templated egress
+	*     is exactly the rule AWS already created by default. `isDefaultEgressRule`
+	*     is the exact comparator (protocol `-1`, `CidrIp 0.0.0.0/0`, no IPv6
+	*     range / peer group / prefix list / description, ports absent or `-1`)
+	*     and is the SAME predicate the drift reverse-mapper uses to recognize
+	*     the AWS default, so the two cannot disagree about what "default" means.
+	*     AWS creates exactly ONE default egress rule and it is IPv4-only (there
+	*     is no `::/0` default), which is why a single-element match is the right
+	*     shape. NOTE this deliberately does NOT fire for the CDK L2
+	*     `allowAllOutbound: true` shape, which stamps
+	*     `Description: 'Allow all outbound traffic by default'` — the AWS
+	*     default rule carries no description, so skipping there would leave the
+	*     group in a state CloudFormation would not produce AND would surface as
+	*     permanent phantom drift (`readCurrentState` would report no
+	*     Description while state records one).
+	*   - The remaining authorize is a SINGLE batched call rather than one per
+	*     rule (see {@link authorizeInlineIngress}).
+	*/
+	async applyInlineEgress(groupId, egressRules) {
+		if (!Array.isArray(egressRules)) return;
+		if (egressRules.length === 1 && isDefaultEgressRule(egressRules[0])) {
+			this.logger.debug(`SecurityGroup ${groupId} egress equals the AWS default allow-all rule; skipping the redundant revoke + re-authorize`);
+			return;
+		}
+		try {
+			await this.ec2Client.send(new RevokeSecurityGroupEgressCommand({
+				GroupId: groupId,
+				IpPermissions: [{
+					IpProtocol: "-1",
+					IpRanges: [{ CidrIp: "0.0.0.0/0" }]
+				}]
+			}));
+		} catch (error) {
+			if (!this.isNotFoundError(error)) throw error;
+		}
+		if (egressRules.length === 0) return;
+		await this.ec2Client.send(new AuthorizeSecurityGroupEgressCommand({
+			GroupId: groupId,
+			IpPermissions: egressRules.map((rule) => this.buildIpPermission(rule, "egress"))
+		}));
+	}
 	async updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating SecurityGroup ${logicalId}: ${physicalId}`);
 		try {
@@ -42953,6 +43009,39 @@ async function promptMigrationConfirm(renames, opts) {
 		rl.close();
 	}
 }
+/**
+* Build the `DeployEngineOptions.onCurrentStateLoaded` gate that runs the
+* prefix-migration check, or `undefined` when the check is inactive
+* (`skipPrefix === false`, i.e. the user opted back in to legacy prefixing).
+*
+* Why a gate rather than a pre-lock `getState`: prefix-skipping has been the
+* default since v0.94.0, so the previous shape issued an S3 GET on EVERY
+* deploy of EVERY stack — including brand-new stacks with no state at all —
+* and the deploy engine then read the very same object again immediately
+* after taking the lock. Running as the engine's post-lock gate reuses that
+* read. The contract the check actually depends on ("surface this before any
+* provider call runs") is preserved: the engine invokes the gate immediately
+* after loading state and before parsing, diffing, or provisioning anything.
+* Reading under the lock is also strictly more authoritative — no concurrent
+* deploy can mutate the state between the check and the diff it predicts.
+*
+* Declining the prompt raises {@link DeployCancelledError}, which the deploy
+* CLI unwinds quietly (no error output, no FAILED run event) — matching the
+* plain early `return` the pre-lock version used.
+*
+* The gate is scoped to `stackName`: nested-stack children inherit the parent
+* engine's option object, and the check is deliberately top-level-only (it was
+* never applied to children).
+*/
+function createPrefixMigrationGate(opts) {
+	if (!opts.skipPrefix) return void 0;
+	return async (gateStackName, state) => {
+		if (gateStackName !== opts.stackName) return;
+		const pending = findPendingPrefixRenames(opts.stackName, state);
+		if (pending.length === 0) return;
+		if (!await promptMigrationConfirm(pending, { ...opts.yes !== void 0 && { yes: opts.yes } })) throw new DeployCancelledError();
+	};
+}
 
 //#endregion
 //#region src/cli/commands/deploy.ts
@@ -43190,13 +43279,11 @@ async function deployCommand(stacks, options) {
 			});
 			let runResult = "SUCCEEDED";
 			try {
-				if (skipPrefix) {
-					const existing = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
-					const pending = findPendingPrefixRenames(stackInfo.stackName, existing?.state);
-					if (pending.length > 0) {
-						if (!await promptMigrationConfirm(pending, { yes: options.yes })) return;
-					}
-				}
+				const migrationGate = createPrefixMigrationGate({
+					stackName: stackInfo.stackName,
+					skipPrefix,
+					yes: options.yes
+				});
 				let recreateViaCcApiTargets;
 				let recreateViaSdkProviderTargets;
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
@@ -43248,6 +43335,7 @@ async function deployCommand(stacks, options) {
 					...options.roleArn && { roleArn: options.roleArn },
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
+					...migrationGate && { onCurrentStateLoaded: migrationGate },
 					...recreateViaCcApiTargets && recreateViaCcApiTargets.size > 0 && { recreateViaCcApiTargets },
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
 					...options.replace && { replace: true },
@@ -43296,6 +43384,7 @@ async function deployCommand(stacks, options) {
 					deleted: deployResult.deleted
 				}, deployResult.durationMs);
 			} catch (deployError) {
+				if (deployError instanceof DeployCancelledError) return;
 				runResult = "FAILED";
 				recordRunFailed(eventRecorder, stackInfo.stackName, deployError);
 				throw deployError;
@@ -62613,7 +62702,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.268.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.268.2");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;