@go-to-k/cdkd 0.278.5 → 0.278.7

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-BWPBsNGL.js";
+import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-DQxqNiZR.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider--hs1COdE.js";
+import { t as ASGProvider } from "./asg-provider-Cqw9Gzck.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -42869,6 +42869,40 @@ var ECRProvider = class {
 		return out;
 	}
 	/**
+	* Map CFn `ImageTagMutabilityExclusionFilters`
+	* (`[{ ImageTagMutabilityExclusionFilterType, ImageTagMutabilityExclusionFilterValue }]`)
+	* to the SDK shape (`[{ filterType, filter }]`). The member NAMES diverge —
+	* not just their casing — so forwarding the CFn-shaped array verbatim makes
+	* the SDK drop every member and send `[{}]`, and AWS rejects the call (or,
+	* worse, silently loses the exclusions). Returns `undefined` for an absent /
+	* empty list so the caller can omit the field entirely.
+	*/
+	toSdkTagMutabilityExclusionFilters(cfn) {
+		if (!Array.isArray(cfn) || cfn.length === 0) return void 0;
+		return cfn.map((entry) => {
+			const e = entry ?? {};
+			return {
+				filterType: e["ImageTagMutabilityExclusionFilterType"],
+				filter: e["ImageTagMutabilityExclusionFilterValue"]
+			};
+		});
+	}
+	/**
+	* Inverse of {@link toSdkTagMutabilityExclusionFilters}: SDK
+	* `[{ filterType, filter }]` back to the CFn property shape, so
+	* `cdkd drift` compares the AWS-current exclusions against the
+	* template-shaped baseline instead of a guaranteed false positive.
+	* Returns `undefined` for an absent / empty list so `readCurrentState`
+	* omits the key (a repository with no exclusions).
+	*/
+	toCfnTagMutabilityExclusionFilters(sdk) {
+		if (!sdk || sdk.length === 0) return void 0;
+		return sdk.map((f) => ({
+			...f.filterType !== void 0 && { ImageTagMutabilityExclusionFilterType: f.filterType },
+			...f.filter !== void 0 && { ImageTagMutabilityExclusionFilterValue: f.filter }
+		}));
+	}
+	/**
 	* Create an ECR Repository
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -42878,10 +42912,12 @@ var ECRProvider = class {
 			const tags = properties["Tags"];
 			const scanningConfig = this.toSdkScanningConfig(properties["ImageScanningConfiguration"]);
 			const encryptionConfig = this.toSdkEncryptionConfig(properties["EncryptionConfiguration"]);
+			const exclusionFilters = this.toSdkTagMutabilityExclusionFilters(properties["ImageTagMutabilityExclusionFilters"]);
 			const repo = (await this.getClient().send(new CreateRepositoryCommand({
 				repositoryName,
 				...scanningConfig ? { imageScanningConfiguration: scanningConfig } : {},
 				...properties["ImageTagMutability"] ? { imageTagMutability: properties["ImageTagMutability"] } : {},
+				...exclusionFilters ? { imageTagMutabilityExclusionFilters: exclusionFilters } : {},
 				...encryptionConfig ? { encryptionConfiguration: encryptionConfig } : {},
 				...tags ? { tags } : {}
 			}))).repository;
@@ -42922,7 +42958,8 @@ var ECRProvider = class {
 	* Update an ECR Repository
 	*
 	* Mutable properties: ImageScanningConfiguration, ImageTagMutability,
-	* LifecyclePolicy, RepositoryPolicyText, Tags.
+	* ImageTagMutabilityExclusionFilters, LifecyclePolicy, RepositoryPolicyText,
+	* Tags.
 	* Immutable: RepositoryName, EncryptionConfiguration (require replacement).
 	*/
 	async update(logicalId, physicalId, _resourceType, properties, previousProperties) {
@@ -42938,10 +42975,14 @@ var ECRProvider = class {
 				this.logger.debug(`Updated image scanning configuration for ${physicalId}`);
 			}
 			const newMutability = properties["ImageTagMutability"];
-			if (newMutability !== previousProperties["ImageTagMutability"]) {
+			const oldMutability = previousProperties["ImageTagMutability"];
+			const newExclusionFilters = this.toSdkTagMutabilityExclusionFilters(properties["ImageTagMutabilityExclusionFilters"]);
+			const oldExclusionFilters = this.toSdkTagMutabilityExclusionFilters(previousProperties["ImageTagMutabilityExclusionFilters"]);
+			if (newMutability !== oldMutability || JSON.stringify(newExclusionFilters) !== JSON.stringify(oldExclusionFilters)) {
 				await this.getClient().send(new PutImageTagMutabilityCommand({
 					repositoryName: physicalId,
-					imageTagMutability: newMutability ?? "MUTABLE"
+					imageTagMutability: newMutability ?? "MUTABLE",
+					...newExclusionFilters ? { imageTagMutabilityExclusionFilters: newExclusionFilters } : {}
 				}));
 				this.logger.debug(`Updated image tag mutability for ${physicalId}`);
 			}
@@ -43051,17 +43092,20 @@ var ECRProvider = class {
 	* (which `DescribeRepositories` doesn't return).
 	*
 	* Surfaced keys: `RepositoryName`, `ImageTagMutability`,
-	* `ImageScanningConfiguration`, `EncryptionConfiguration`, `LifecyclePolicy`
-	* (when configured — `LifecyclePolicyNotFoundException` is caught and the
-	* key omitted, NOT propagated as repo-gone).
+	* `ImageTagMutabilityExclusionFilters` (when the repository has any —
+	* `DescribeRepositories` returns them on the `Repository` shape, mapped back
+	* to the CFn member names), `ImageScanningConfiguration`,
+	* `EncryptionConfiguration`, `LifecyclePolicy` (when configured —
+	* `LifecyclePolicyNotFoundException` is caught and the key omitted, NOT
+	* propagated as repo-gone).
 	*
 	* Intentionally omitted:
 	*   - `RepositoryPolicyText`: requires a separate `GetRepositoryPolicy`
 	*     round-trip; cdkd state holds the policy as either a string or an
 	*     object (depending on user input), and the comparator round-trip
 	*     is not yet handled here.
-	*   - `EmptyOnDelete` / `ImageTagMutabilityExclusionFilters`: not part
-	*     of the persisted AWS state visible via standard Describe.
+	*   - `EmptyOnDelete`: a cdkd/CDK delete-time intent flag, not part of the
+	*     persisted AWS state visible via standard Describe.
 	*
 	* `Tags` is surfaced via a follow-up `ListTagsForResource(arn)` call
 	* (using the repository ARN that `DescribeRepositories` returns). CDK's
@@ -43083,6 +43127,8 @@ var ECRProvider = class {
 		const result = {};
 		if (r.repositoryName !== void 0) result["RepositoryName"] = r.repositoryName;
 		if (r.imageTagMutability !== void 0) result["ImageTagMutability"] = r.imageTagMutability;
+		const cfnExclusionFilters = this.toCfnTagMutabilityExclusionFilters(r.imageTagMutabilityExclusionFilters);
+		if (cfnExclusionFilters) result["ImageTagMutabilityExclusionFilters"] = cfnExclusionFilters;
 		result["ImageScanningConfiguration"] = { ScanOnPush: r.imageScanningConfiguration?.scanOnPush ?? false };
 		{
 			const encType = r.encryptionConfiguration?.encryptionType ?? "AES256";
@@ -64408,7 +64454,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.7");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;