@go-to-k/cdkd 0.269.1 → 0.269.3

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-DVP0nckx.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-B-igYtBj.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DoeGv39F.js";
+import { t as ASGProvider } from "./asg-provider-D-XHoXeI.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14935,7 +14935,7 @@ var EC2Provider = class {
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
 			case "AWS::EC2::VPC": return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::EC2::Subnet": return this.updateSubnet(logicalId, physicalId);
+			case "AWS::EC2::Subnet": return this.updateSubnet(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::InternetGateway": return this.updateInternetGateway(logicalId, physicalId);
 			case "AWS::EC2::EIP": return this.updateEip(logicalId, physicalId, properties, previousProperties);
 			case "AWS::EC2::VPCGatewayAttachment": return this.updateVpcGatewayAttachment(logicalId, physicalId);
@@ -15157,10 +15157,13 @@ var EC2Provider = class {
 			try {
 				await this.applyTags(subnetId, properties, logicalId);
 				const mapPublicIp = properties["MapPublicIpOnLaunch"];
-				if (mapPublicIp === true || mapPublicIp === "true") await this.ec2Client.send(new ModifySubnetAttributeCommand({
-					SubnetId: subnetId,
-					MapPublicIpOnLaunch: { Value: true }
-				}));
+				if (mapPublicIp === true || mapPublicIp === "true") {
+					await this.ec2Client.send(new ModifySubnetAttributeCommand({
+						SubnetId: subnetId,
+						MapPublicIpOnLaunch: { Value: true }
+					}));
+					await this.waitForSubnetMapPublicIp(subnetId, true);
+				}
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteSubnetCommand({ SubnetId: subnetId }));
@@ -15183,8 +15186,66 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create Subnet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	updateSubnet(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::Subnet", logicalId, "destroy + redeploy the Subnet (and the resources that depend on it). Subnet properties are immutable in AWS."));
+	async updateSubnet(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating Subnet ${logicalId}: ${physicalId}`);
+		try {
+			for (const createOnly of [
+				"VpcId",
+				"CidrBlock",
+				"AvailabilityZone"
+			]) {
+				const next = properties[createOnly];
+				const prev = previousProperties[createOnly];
+				if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `destroy + redeploy the Subnet (and the resources that depend on it). ${createOnly} is immutable in AWS`);
+			}
+			const asBool = (v) => v === true || v === "true";
+			const newMapPublicIp = asBool(properties["MapPublicIpOnLaunch"]);
+			if (newMapPublicIp !== asBool(previousProperties["MapPublicIpOnLaunch"])) {
+				await this.ec2Client.send(new ModifySubnetAttributeCommand({
+					SubnetId: physicalId,
+					MapPublicIpOnLaunch: { Value: newMapPublicIp }
+				}));
+				await this.waitForSubnetMapPublicIp(physicalId, newMapPublicIp);
+			}
+			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
+			this.logger.debug(`Successfully updated Subnet ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update Subnet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Read back `MapPublicIpOnLaunch` until AWS reflects the value a
+	* `ModifySubnetAttribute` just wrote (issue #1299). EC2 `Describe*` is
+	* eventually consistent, so the deploy engine's async observed-state
+	* capture (`kickOffObservedCapture` → `readCurrentState` →
+	* `DescribeSubnets`), which fires milliseconds after `create()` /
+	* `update()` returns, could read the STALE pre-modify value and persist
+	* it as the drift baseline — every later `cdkd drift` then reported
+	* phantom `MapPublicIpOnLaunch` drift on a resource nothing touched.
+	*
+	* Bounded and best-effort: the first read usually already reflects the
+	* write (zero added latency beyond one DescribeSubnets round trip); on
+	* exhaustion we log and return — behavior then degrades to the pre-fix
+	* race instead of failing a deploy over a read-side consistency lag.
+	*/
+	async waitForSubnetMapPublicIp(subnetId, expected) {
+		const maxAttempts = 6;
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+			try {
+				if ((await this.ec2Client.send(new DescribeSubnetsCommand({ SubnetIds: [subnetId] }))).Subnets?.[0]?.MapPublicIpOnLaunch === expected) return;
+			} catch (error) {
+				this.logger.debug(`MapPublicIpOnLaunch read-back for ${subnetId} failed (attempt ${attempt}/${maxAttempts}): ${error instanceof Error ? error.message : String(error)}`);
+				return;
+			}
+			if (attempt < maxAttempts) await this.sleep(100 * 2 ** (attempt - 1));
+		}
+		this.logger.debug(`MapPublicIpOnLaunch=${expected} not yet visible on ${subnetId} after ${maxAttempts} reads — the observed-state capture may record the stale value (issue #1299)`);
 	}
 	async deleteSubnet(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Subnet ${logicalId}: ${physicalId}`);
@@ -16956,9 +17017,12 @@ var EC2Provider = class {
 	*
 	* Other EC2 types (`VPC` / `Subnet` / `InternetGateway` /
 	* `NatGateway` / `RouteTable` / `SecurityGroup` / `Instance` /
-	* `NetworkAcl`) have first-class Tags support via
-	* `DescribeTags` — they surface `Tags` directly in
-	* `readCurrentState` and don't need this declaration.
+	* `NetworkAcl`) have first-class Tags support on the WRITE side
+	* (create/update tag wiring) and don't need this declaration.
+	* NOTE: `readVpcCurrentState` / `readSubnetCurrentState` do NOT
+	* currently surface `Tags`, so Tags drift on those types is out of
+	* v1 drift scope — `AWS::EC2::Subnet`'s `updateableProperties:
+	* Tags` entry serves only the template-update path today.
 	*/
 	getDriftUnknownPaths(resourceType) {
 		switch (resourceType) {
@@ -42148,7 +42212,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		const retainedSuffix = result.retainedCount > 0 ? `, ${result.retainedCount} retained` : "";
 		if (!preserveState) logger.info(`\n${green("✓")} ${bold(`Stack ${stackName} destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${result.errorCount} errors)`);
 		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
-		else logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up.`);
+		else logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, 'cdkd state orphan ${stackName}' is the last resort: it removes the state record without deleting AWS resources.`);
 	} finally {
 		process.removeListener("SIGINT", sigintHandler);
 		renderer.stop();
@@ -46416,7 +46480,7 @@ async function destroyCommand(stackArgs, options) {
 			}, logger);
 			if (interrupted) break;
 		}
-		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry.`);
+		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
 	} finally {
 		awsClients.destroy();
@@ -49873,7 +49937,7 @@ async function stateDestroyCommand(stackArgs, options) {
 			}
 			if (interrupted) break;
 		}
-		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry.`);
+		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
 	} finally {
 		setup.dispose();
@@ -62870,7 +62934,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.269.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.269.3");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;