@go-to-k/cdkd 0.278.4 → 0.278.6

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-BEGqPEMI.js";
+import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-BKRlw9Hx.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-HQeXH4I8.js";
+import { t as ASGProvider } from "./asg-provider-CTMEDbqF.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9754,6 +9754,48 @@ function classifyEventSourceFromProperties(properties) {
 		DocumentDBEventSourceConfig: properties["DocumentDBEventSourceConfig"]
 	});
 }
+/**
+* CFn spells the self-managed-Kafka bootstrap-server list
+* `SelfManagedEventSource.Endpoints.KafkaBootstrapServers`, while the SDK
+* models `Endpoints` as `Partial<Record<EndPointType, string[]>>` keyed by the
+* enum VALUE `KAFKA_BOOTSTRAP_SERVERS` (`@aws-sdk/client-lambda`
+* `EndPointType`). Because `Endpoints` is a MAP rather than a modeled
+* structure, the serializer forwards the unknown CFn key verbatim and the
+* service rejects the whole request — so every CDK `SelfManagedKafkaEventSource`
+* user hit a hard `CreateEventSourceMapping` failure (issue #1384).
+*
+* Both directions are pure key renames of the ONE diverging key; every other
+* member of the blob (both inside `Endpoints` and beside it) is copied through
+* untouched. Note that a future `EndPointType` whose CFn spelling also diverges
+* would reproduce this bug exactly — it needs its own entry here, the pass-
+* through is not a general solution.
+*
+* Anything that is not a re-shapeable object — a non-object blob, a missing or
+* non-object `Endpoints`, an array `Endpoints` — is returned VERBATIM rather
+* than dropped. Dropping would be a silent-drop regression against the raw
+* pass-through this replaced: AWS must stay the one that rejects a malformed
+* template, not this layer.
+*/
+const CFN_KAFKA_ENDPOINTS_KEY = "KafkaBootstrapServers";
+const SDK_KAFKA_ENDPOINTS_KEY = "KAFKA_BOOTSTRAP_SERVERS";
+function renameEndpointsKey(selfManagedEventSource, from, to) {
+	if (typeof selfManagedEventSource !== "object" || selfManagedEventSource === null) return selfManagedEventSource;
+	const source = { ...selfManagedEventSource };
+	const endpoints = source["Endpoints"];
+	if (typeof endpoints !== "object" || endpoints === null || Array.isArray(endpoints)) return source;
+	const renamed = {};
+	for (const [key, value] of Object.entries(endpoints)) renamed[key === from ? to : key] = value;
+	source["Endpoints"] = renamed;
+	return source;
+}
+/** CFn property bag -> `CreateEventSourceMapping` input shape. */
+function toSdkSelfManagedEventSource(selfManagedEventSource) {
+	return renameEndpointsKey(selfManagedEventSource, CFN_KAFKA_ENDPOINTS_KEY, SDK_KAFKA_ENDPOINTS_KEY);
+}
+/** `GetEventSourceMapping` response -> CFn property shape (drift readback). */
+function toCfnSelfManagedEventSource(selfManagedEventSource) {
+	return renameEndpointsKey(selfManagedEventSource, SDK_KAFKA_ENDPOINTS_KEY, CFN_KAFKA_ENDPOINTS_KEY);
+}
 const KINDS_WITH_FUNCTION_RESPONSE_TYPES = /* @__PURE__ */ new Set([
 	"sqs",
 	"kinesis",
@@ -9853,7 +9895,7 @@ var LambdaEventSourceMappingProvider = class {
 			if (properties["TumblingWindowInSeconds"]) params.TumblingWindowInSeconds = properties["TumblingWindowInSeconds"];
 			if (properties["FunctionResponseTypes"]) params.FunctionResponseTypes = properties["FunctionResponseTypes"];
 			if (properties["SourceAccessConfigurations"]) params.SourceAccessConfigurations = properties["SourceAccessConfigurations"];
-			if (properties["SelfManagedEventSource"]) params.SelfManagedEventSource = properties["SelfManagedEventSource"];
+			if (properties["SelfManagedEventSource"]) params.SelfManagedEventSource = toSdkSelfManagedEventSource(properties["SelfManagedEventSource"]);
 			if (properties["SelfManagedKafkaEventSourceConfig"]) params.SelfManagedKafkaEventSourceConfig = properties["SelfManagedKafkaEventSourceConfig"];
 			if (properties["AmazonManagedKafkaEventSourceConfig"]) params.AmazonManagedKafkaEventSourceConfig = properties["AmazonManagedKafkaEventSourceConfig"];
 			if (properties["DocumentDBEventSourceConfig"]) params.DocumentDBEventSourceConfig = properties["DocumentDBEventSourceConfig"];
@@ -10081,7 +10123,7 @@ var LambdaEventSourceMappingProvider = class {
 		else if (resp.FunctionResponseTypes !== void 0) result["FunctionResponseTypes"] = [...resp.FunctionResponseTypes];
 		if (KINDS_WITH_SOURCE_ACCESS_CONFIGURATIONS.has(kind)) result["SourceAccessConfigurations"] = resp.SourceAccessConfigurations ?? [];
 		else if (resp.SourceAccessConfigurations !== void 0) result["SourceAccessConfigurations"] = resp.SourceAccessConfigurations;
-		if (resp.SelfManagedEventSource !== void 0) result["SelfManagedEventSource"] = resp.SelfManagedEventSource;
+		if (resp.SelfManagedEventSource !== void 0) result["SelfManagedEventSource"] = toCfnSelfManagedEventSource(resp.SelfManagedEventSource);
 		if (resp.SelfManagedKafkaEventSourceConfig !== void 0) result["SelfManagedKafkaEventSourceConfig"] = resp.SelfManagedKafkaEventSourceConfig;
 		if (resp.AmazonManagedKafkaEventSourceConfig !== void 0) result["AmazonManagedKafkaEventSourceConfig"] = resp.AmazonManagedKafkaEventSourceConfig;
 		if (resp.DocumentDBEventSourceConfig !== void 0) result["DocumentDBEventSourceConfig"] = resp.DocumentDBEventSourceConfig;
@@ -42827,6 +42869,40 @@ var ECRProvider = class {
 		return out;
 	}
 	/**
+	* Map CFn `ImageTagMutabilityExclusionFilters`
+	* (`[{ ImageTagMutabilityExclusionFilterType, ImageTagMutabilityExclusionFilterValue }]`)
+	* to the SDK shape (`[{ filterType, filter }]`). The member NAMES diverge —
+	* not just their casing — so forwarding the CFn-shaped array verbatim makes
+	* the SDK drop every member and send `[{}]`, and AWS rejects the call (or,
+	* worse, silently loses the exclusions). Returns `undefined` for an absent /
+	* empty list so the caller can omit the field entirely.
+	*/
+	toSdkTagMutabilityExclusionFilters(cfn) {
+		if (!Array.isArray(cfn) || cfn.length === 0) return void 0;
+		return cfn.map((entry) => {
+			const e = entry ?? {};
+			return {
+				filterType: e["ImageTagMutabilityExclusionFilterType"],
+				filter: e["ImageTagMutabilityExclusionFilterValue"]
+			};
+		});
+	}
+	/**
+	* Inverse of {@link toSdkTagMutabilityExclusionFilters}: SDK
+	* `[{ filterType, filter }]` back to the CFn property shape, so
+	* `cdkd drift` compares the AWS-current exclusions against the
+	* template-shaped baseline instead of a guaranteed false positive.
+	* Returns `undefined` for an absent / empty list so `readCurrentState`
+	* omits the key (a repository with no exclusions).
+	*/
+	toCfnTagMutabilityExclusionFilters(sdk) {
+		if (!sdk || sdk.length === 0) return void 0;
+		return sdk.map((f) => ({
+			...f.filterType !== void 0 && { ImageTagMutabilityExclusionFilterType: f.filterType },
+			...f.filter !== void 0 && { ImageTagMutabilityExclusionFilterValue: f.filter }
+		}));
+	}
+	/**
 	* Create an ECR Repository
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -42836,10 +42912,12 @@ var ECRProvider = class {
 			const tags = properties["Tags"];
 			const scanningConfig = this.toSdkScanningConfig(properties["ImageScanningConfiguration"]);
 			const encryptionConfig = this.toSdkEncryptionConfig(properties["EncryptionConfiguration"]);
+			const exclusionFilters = this.toSdkTagMutabilityExclusionFilters(properties["ImageTagMutabilityExclusionFilters"]);
 			const repo = (await this.getClient().send(new CreateRepositoryCommand({
 				repositoryName,
 				...scanningConfig ? { imageScanningConfiguration: scanningConfig } : {},
 				...properties["ImageTagMutability"] ? { imageTagMutability: properties["ImageTagMutability"] } : {},
+				...exclusionFilters ? { imageTagMutabilityExclusionFilters: exclusionFilters } : {},
 				...encryptionConfig ? { encryptionConfiguration: encryptionConfig } : {},
 				...tags ? { tags } : {}
 			}))).repository;
@@ -42880,7 +42958,8 @@ var ECRProvider = class {
 	* Update an ECR Repository
 	*
 	* Mutable properties: ImageScanningConfiguration, ImageTagMutability,
-	* LifecyclePolicy, RepositoryPolicyText, Tags.
+	* ImageTagMutabilityExclusionFilters, LifecyclePolicy, RepositoryPolicyText,
+	* Tags.
 	* Immutable: RepositoryName, EncryptionConfiguration (require replacement).
 	*/
 	async update(logicalId, physicalId, _resourceType, properties, previousProperties) {
@@ -42896,10 +42975,14 @@ var ECRProvider = class {
 				this.logger.debug(`Updated image scanning configuration for ${physicalId}`);
 			}
 			const newMutability = properties["ImageTagMutability"];
-			if (newMutability !== previousProperties["ImageTagMutability"]) {
+			const oldMutability = previousProperties["ImageTagMutability"];
+			const newExclusionFilters = this.toSdkTagMutabilityExclusionFilters(properties["ImageTagMutabilityExclusionFilters"]);
+			const oldExclusionFilters = this.toSdkTagMutabilityExclusionFilters(previousProperties["ImageTagMutabilityExclusionFilters"]);
+			if (newMutability !== oldMutability || JSON.stringify(newExclusionFilters) !== JSON.stringify(oldExclusionFilters)) {
 				await this.getClient().send(new PutImageTagMutabilityCommand({
 					repositoryName: physicalId,
-					imageTagMutability: newMutability ?? "MUTABLE"
+					imageTagMutability: newMutability ?? "MUTABLE",
+					...newExclusionFilters ? { imageTagMutabilityExclusionFilters: newExclusionFilters } : {}
 				}));
 				this.logger.debug(`Updated image tag mutability for ${physicalId}`);
 			}
@@ -43009,17 +43092,20 @@ var ECRProvider = class {
 	* (which `DescribeRepositories` doesn't return).
 	*
 	* Surfaced keys: `RepositoryName`, `ImageTagMutability`,
-	* `ImageScanningConfiguration`, `EncryptionConfiguration`, `LifecyclePolicy`
-	* (when configured — `LifecyclePolicyNotFoundException` is caught and the
-	* key omitted, NOT propagated as repo-gone).
+	* `ImageTagMutabilityExclusionFilters` (when the repository has any —
+	* `DescribeRepositories` returns them on the `Repository` shape, mapped back
+	* to the CFn member names), `ImageScanningConfiguration`,
+	* `EncryptionConfiguration`, `LifecyclePolicy` (when configured —
+	* `LifecyclePolicyNotFoundException` is caught and the key omitted, NOT
+	* propagated as repo-gone).
 	*
 	* Intentionally omitted:
 	*   - `RepositoryPolicyText`: requires a separate `GetRepositoryPolicy`
 	*     round-trip; cdkd state holds the policy as either a string or an
 	*     object (depending on user input), and the comparator round-trip
 	*     is not yet handled here.
-	*   - `EmptyOnDelete` / `ImageTagMutabilityExclusionFilters`: not part
-	*     of the persisted AWS state visible via standard Describe.
+	*   - `EmptyOnDelete`: a cdkd/CDK delete-time intent flag, not part of the
+	*     persisted AWS state visible via standard Describe.
 	*
 	* `Tags` is surfaced via a follow-up `ListTagsForResource(arn)` call
 	* (using the repository ARN that `DescribeRepositories` returns). CDK's
@@ -43041,6 +43127,8 @@ var ECRProvider = class {
 		const result = {};
 		if (r.repositoryName !== void 0) result["RepositoryName"] = r.repositoryName;
 		if (r.imageTagMutability !== void 0) result["ImageTagMutability"] = r.imageTagMutability;
+		const cfnExclusionFilters = this.toCfnTagMutabilityExclusionFilters(r.imageTagMutabilityExclusionFilters);
+		if (cfnExclusionFilters) result["ImageTagMutabilityExclusionFilters"] = cfnExclusionFilters;
 		result["ImageScanningConfiguration"] = { ScanOnPush: r.imageScanningConfiguration?.scanOnPush ?? false };
 		{
 			const encType = r.encryptionConfiguration?.encryptionType ?? "AES256";
@@ -64366,7 +64454,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.6");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;