@go-to-k/cdkd 0.280.12 → 0.280.14

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as applyRoleArnIfSet, A as red, At as AssetManifestLoader, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefault, C as isStatefulRecreateTargetSync, Ct as validateAssetBucketName, D as cyan, Dn as withErrorHandling, Dt as getDockerCmd, E as bold, En as normalizeAwsError, Et as formatDockerLoginError, F as ProviderRegistry, Ft as getLegacyStateBucketName, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_BODY_LIMIT, H as cfnRefValueFromPhysicalId, Ht as resolveUseCdkBootstrapAssets, I as findActionableSilentDrops, It as resolveApp, J as readConfigString, Jt as findLargeInlineResources, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_URL_LIMIT, L as CloudControlProvider, Lt as resolveAutoAssetStorage, M as IAMRoleProvider, Mt as Synthesizer, N as collectInlinePolicyNamesManagedBySiblings, Nt as synthesisStatusMessage, O as gray, Ot as runDockerForeground, P as clearOnUpdateRemoval, Pt as getDefaultStateBucketName, Q as requireConfigString, Qt as processStackMessages, R as slowCcOperationTimeoutMs, Rt as resolveCaptureObservedState, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as parseBootstrapMarker, T as formatResourceLine, Tt as buildDockerImage, U as refStateLookupFromResource, Ut as stateBucketExistenceConfirmed, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefaultAndSource, W as WAFv2WebACLProvider, Wt as warnDeprecatedNoPrefixCliFlag, X as requireConfigArray, Xt as expectedOwnerParam, Y as replayWarn, Yt as uploadCfnTemplate, Z as requireConfigObject, Zt as AssemblyReader, _ as createPreDeleteFinalSnapshot, _n as ProvisioningError, _t as rewriteTemplateAssetReferences, a as DeploymentEventsStore, at as DagBuilder, b as unsupportedFinalSnapshotError, bn as StackHasActiveImportsError, bt as ensureAssetStorage, c as replayFailedOperations, ct as S3StateBackend, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalMigrateError, dt as AssetPublisher, en as resolveBucketRegion, et as DiffCalculator, f as computeImplicitDeleteEdges, fn as LocalStartServiceError, ft as stringifyValue, g as ccRoutedFinalSnapshotError, gn as PartialFailureError, gt as loadPublishableAssetManifest, h as buildFinalSnapshotIdentifier, hn as NestedStackChildDirectDestroyError, ht as createAssetRedirectResolver, i as DeploymentEventsReader, in as setAwsClients, it as isThrottlingError, j as yellow, jt as getDockerImageBySourceHash, k as green, kt as runDockerStreaming, l as replayRollback, ln as DeployCancelledError, lt as rebuildClientForBucketRegion, m as PRE_DELETE_SNAPSHOT_TYPES, mn as MissingCdkCliError, mt as buildAssetRedirectMap, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getAwsClients, nt as withRetry, o as planFailedOps, on as CdkdError, ot as TemplateParser, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as WorkGraph, q as assertRegionMatch, qt as MIGRATE_TMP_PREFIX, r as DeployEngine, rn as resetAwsClients, rt as isRetryableTransientError, s as planRollback, st as LockManager, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AwsClients, tt as describeTypeWithThrottleRetry, u as withResourceDeadline, un as LocalInvokeBuildError$1, ut as shouldRetainResource, v as isFinalSnapshotError, vn as ResourceTimeoutError, vt as AssetModeResolver, w as renderStatefulReason, wt as validateContainerRepoName, x as extractDeploymentEventError, xn as StackTerminationProtectionError, xt as getBootstrapMarkerKey, y as refusesFinalSnapshot, yn as ResourceUpdateNotSupportedError, yt as BOOTSTRAP_MARKER_PREFIX, z as disableInstanceApiTermination, zt as resolveSkipPrefix } from "./deploy-engine-CHhLFsDu.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-D4VaoTK7.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BjmkUhRq.js";
+import { t as ASGProvider } from "./asg-provider-DIMKyE07.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5065,6 +5065,40 @@ var S3BucketProvider = class S3BucketProvider {
 		this.logger.debug(`Applied CORS configuration to bucket ${bucketName}`);
 	}
 	/**
+	* The per-item / per-rule STRING guard, with the applier's own SKIP as the
+	* replay downgrade (issue #1595).
+	*
+	* Four per-item reads in this file refuse a malformed configuration ITEM
+	* through a `readConfigString` that carries no `onUnusable`, so they threw on
+	* the state-replay paths too — the un-rollbackable refusal every container
+	* guard beside them exists to avoid. What they must NOT do instead is take
+	* `readConfigString`'s own downgrade: its fallback is applied to a LIVE
+	* resource, and each of these defaults ENABLES something (a lifecycle
+	* expiration rule, an intelligent-tiering transition, a replication rule),
+	* so warn-and-default is worse than the refusal it replaces. The correct
+	* downgrade is the SKIP the sibling container guards already perform, with
+	* the same per-applier unit — whole Put where the Put replaces every rule,
+	* the single configuration item where the Put is per-Id.
+	*
+	* Returns `true` when the caller must skip. On the CREATE path (`onUnusable`
+	* absent) it always returns `false` and the original read below still
+	* throws, so template-borne behavior is unchanged.
+	*
+	* No `ConfigStringOptions` passthrough, and that is a decision rather than an
+	* omission: a probe whose relaxations disagree with the read it fronts would
+	* refuse exactly where the read accepts. All four sites are ENUM-valued
+	* (`Status` / `IncludedObjectVersions`), so `coerceNumber` is wrong for them
+	* by the rule in `config-shape.ts`'s header — a number where an enum belongs
+	* is a bug. A site that ever needs an option must thread the SAME bag here.
+	*/
+	skipOnUnusableConfigString(container, key, fallback, containerPath, skipClause, onUnusable) {
+		if (!onUnusable) return false;
+		const refusal = configStringRefusal(container, key, fallback, containerPath);
+		if (refusal === void 0) return false;
+		onUnusable(`${refusal}. ${skipClause}; the same value is REFUSED on a template-path create`);
+		return true;
+	}
+	/**
 	* Apply lifecycle configuration
 	*
 	* CFn property: LifecycleConfiguration.Rules[]
@@ -5083,6 +5117,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (rawTagFilters != null) {
 				if (requireConfigArray(rawTagFilters, "AWS::S3::Bucket LifecycleConfiguration.Rules[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
 			}
+			if (this.skipOnUnusableConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket LifecycleConfiguration.Rules[]", "Leaving the whole lifecycle configuration unapplied here", onUnusable)) return;
 		}
 		const gatherScope = (rule) => {
 			const filter = rule["Filter"];
@@ -5511,6 +5546,7 @@ var S3BucketProvider = class S3BucketProvider {
 	async applyIntelligentTieringConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
+			if (this.skipOnUnusableConfigString(config, "Status", "Enabled", "AWS::S3::Bucket IntelligentTieringConfigurations[]", "Skipping this intelligent tiering configuration", onUnusable)) continue;
 			const tierings = config["Tierings"];
 			const itConfig = {
 				Id: id,
@@ -5547,6 +5583,7 @@ var S3BucketProvider = class S3BucketProvider {
 	async applyInventoryConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
+			if (this.skipOnUnusableConfigString(config, "IncludedObjectVersions", "All", "AWS::S3::Bucket InventoryConfigurations[]", "Skipping this inventory configuration", onUnusable)) continue;
 			const inventoryDestPath = "AWS::S3::Bucket InventoryConfigurations[].Destination";
 			const rawDest = config["Destination"];
 			const s3Dest = this.resolveS3BucketDestination(rawDest, inventoryDestPath, onUnusable);
@@ -5635,6 +5672,7 @@ var S3BucketProvider = class S3BucketProvider {
 		for (const rule of rules || []) {
 			const rawFilter = rule["Filter"];
 			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket ReplicationConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
+			if (this.skipOnUnusableConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket ReplicationConfiguration.Rules[]", "Leaving the whole replication configuration unapplied here", onUnusable)) return;
 		}
 		await this.s3Client.send(new PutBucketReplicationCommand({
 			Bucket: bucketName,
@@ -50504,32 +50542,57 @@ function isIntrinsic(value) {
 	return keys.length === 1 && INTRINSIC_KEYS.has(keys[0]);
 }
 /**
-* Strip unchanged and intrinsic-only values from a diff value.
-*
-* Recursively compares `value` against `other` and keeps only the keys whose
-* values actually differ (excluding intrinsic vs resolved mismatches). This
-* produces a minimal diff showing only real changes.
+* Per-side rendering rule for a diff side that is NOT a plain object pair
+* (primitives, arrays, intrinsics). The both-plain-objects case is handled
+* jointly by {@link stripUnchangedValuePair}, which never delegates it here.
 */
 function stripUnchangedValues(value, other) {
 	if (value === null || value === void 0 || typeof value !== "object") return value;
 	if (Array.isArray(value)) return value;
 	if (isIntrinsic(value)) return void 0;
 	if (isIntrinsic(other)) return void 0;
-	if (other === null || other === void 0 || typeof other !== "object" || Array.isArray(other)) return value;
-	const valObj = value;
-	const otherObj = other;
-	const result = {};
-	for (const key of Object.keys(valObj)) {
-		const v = valObj[key];
-		const o = otherObj[key];
-		if (isIntrinsic(v) || isIntrinsic(o)) continue;
-		if (JSON.stringify(v) === JSON.stringify(o)) continue;
-		if (typeof v === "object" && v !== null && typeof o === "object" && o !== null) {
-			const filtered = stripUnchangedValues(v, o);
-			if (filtered !== void 0 && JSON.stringify(filtered) !== "{}") result[key] = filtered;
-		} else result[key] = v;
+	return value;
+}
+function isPlainNonIntrinsicObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && !isIntrinsic(value);
+}
+/**
+* Strip unchanged and intrinsic-only keys from BOTH sides of a property
+* change in ONE walk, so the two rendered sides stay symmetric (issue #1608).
+*
+* {@link stripUnchangedValues} runs per side, so a PURE KEY ADDITION pruned
+* the new side down to the added key while the old side — whose own keys are
+* all unchanged — hit the empty-result fallback and printed the FULL object.
+* That asymmetry reads as "the whole object is replaced by just the added
+* key" (i.e. everything else removed), the opposite of what deploy does.
+* Walking the UNION of keys once yields `old: {}` / `new: {AddedKey: ...}`
+* for an addition (and the mirror for a removal); the full-value fallback —
+* kept for sides differing only in key order or intrinsic-valued keys — now
+* fires only when BOTH sides pruned to nothing, so it can never be one-sided.
+* Non-object sides (primitives, arrays, intrinsics) keep the existing
+* per-side semantics via {@link stripUnchangedValues}.
+*/
+function stripUnchangedValuePair(oldValue, newValue) {
+	if (!isPlainNonIntrinsicObject(oldValue) || !isPlainNonIntrinsicObject(newValue)) return [stripUnchangedValues(oldValue, newValue), stripUnchangedValues(newValue, oldValue)];
+	const oldResult = {};
+	const newResult = {};
+	const keys = [...Object.keys(oldValue), ...Object.keys(newValue).filter((k) => !Object.hasOwn(oldValue, k))];
+	for (const key of keys) {
+		const o = oldValue[key];
+		const n = newValue[key];
+		if (isIntrinsic(o) || isIntrinsic(n)) continue;
+		if (JSON.stringify(o) === JSON.stringify(n)) continue;
+		if (isPlainNonIntrinsicObject(o) && isPlainNonIntrinsicObject(n)) {
+			const [fo, fn] = stripUnchangedValuePair(o, n);
+			if (fo !== void 0 && JSON.stringify(fo) !== "{}") oldResult[key] = fo;
+			if (fn !== void 0 && JSON.stringify(fn) !== "{}") newResult[key] = fn;
+		} else {
+			if (Object.hasOwn(oldValue, key)) oldResult[key] = o;
+			if (Object.hasOwn(newValue, key)) newResult[key] = n;
+		}
 	}
-	return Object.keys(result).length > 0 ? result : value;
+	if (Object.keys(oldResult).length === 0 && Object.keys(newResult).length === 0) return [oldValue, newValue];
+	return [oldResult, newResult];
 }
 /**
 * Render one side of a property change for the diff output.
@@ -50538,18 +50601,18 @@ function stripUnchangedValues(value, other) {
 * against current state — most commonly a `Ref` / `Fn::GetAtt` to a resource
 * this same deploy will CREATE (the CDK logical-id-churn dance: an
 * `AWS::ApiGateway::Deployment` hash rotation, a `fn.currentVersion` Lambda
-* Version). Rendering that via {@link stripUnchangedValues} collapsed it to
+* Version). Rendering that via the strip-unchanged pass collapsed it to
 * the literal string `undefined`, which reads as "this property is being
 * removed" (issue #1017). Instead, render the raw intrinsic compactly and —
 * on the NEW side — annotate that the value only exists after the deploy.
-* Everything else keeps the existing strip-unchanged rendering.
+* Everything else renders the pre-filtered value computed jointly for both
+* sides by {@link stripUnchangedValuePair}.
 */
-function renderDiffValue(own, opposite, indent, isNewSide) {
+function renderDiffValue(own, filtered, indent, isNewSide) {
 	if (isIntrinsic(own)) {
 		const suffix = isNewSide ? " (known after deploy)" : "";
 		return `${JSON.stringify(own)}${suffix}`;
 	}
-	const filtered = stripUnchangedValues(own, opposite);
 	return (JSON.stringify(filtered, null, 2) ?? "undefined").replace(/\n/g, `\n${indent}`);
 }
 /**
@@ -50584,8 +50647,9 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 				const requiresReplace = propChange.requiresReplacement ? " [requires replacement]" : "";
 				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : "";
 				const indent = "              ";
-				const oldStr = renderDiffValue(propChange.oldValue, propChange.newValue, indent, false);
-				const newStr = renderDiffValue(propChange.newValue, propChange.oldValue, indent, true);
+				const [oldFiltered, newFiltered] = stripUnchangedValuePair(propChange.oldValue, propChange.newValue);
+				const oldStr = renderDiffValue(propChange.oldValue, oldFiltered, indent, false);
+				const newStr = renderDiffValue(propChange.newValue, newFiltered, indent, true);
 				logFn(`      - ${propChange.path}:${requiresReplace}${propagated}`);
 				logFn(`          old: ${oldStr}`);
 				logFn(`          new: ${newStr}`);
@@ -69161,7 +69225,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.12");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.14");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;