@go-to-k/cdkd 0.280.16 → 0.280.17

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-1eZqhWKB.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-tCcs8UGn.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-4pPwAL_v.js";
+import { t as ASGProvider } from "./asg-provider-DQLjoTQ3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -22462,6 +22462,7 @@ var ApiGatewayV2Provider = class {
 		const apiId = properties["ApiId"];
 		const integrationType = properties["IntegrationType"];
 		if (!apiId || !integrationType) throw new ProvisioningError(`ApiId and IntegrationType are required for API Gateway V2 Integration ${logicalId}`, resourceType, logicalId);
+		this.warnTlsConfigIgnoredIfPublic(logicalId, properties);
 		try {
 			const integrationId = (await this.getClient().send(new CreateIntegrationCommand({
 				ApiId: apiId,
@@ -22630,6 +22631,30 @@ var ApiGatewayV2Provider = class {
 	*     each uses `properties.ApiId` (passed through PR G's signature
 	*     extension) to issue the appropriate `Get*` call.
 	*/
+	/**
+	* `TlsConfig` is meaningful ONLY for a private (VPC-Link) integration.
+	* On a public one (`ConnectionType` absent or `INTERNET`) AWS SILENTLY
+	* IGNORES the field — it is absent from both the `CreateIntegration`
+	* echo and the `GetIntegration` read-back (direct A/B, 2026-08-11
+	* us-east-1) — so the provider can never read it back and a template
+	* that declares it would report permanent phantom drift on the
+	* `properties`-fallback baseline, with `--revert` re-sending a value AWS
+	* discards on every run (issue #1602). The path is scoped by the
+	* resource's own `ConnectionType` via the optional `properties` bag: a
+	* VPC_LINK integration keeps full `TlsConfig` drift coverage (AWS
+	* returns the field there). Without a USABLE properties bag the answer
+	* stays empty — comparing is the safe default, since hiding a private
+	* integration's real `TlsConfig` drift is worse than a false positive on
+	* a caller that could not supply the bag. An EMPTY bag counts as unusable
+	* for the same reason: the caller passes `resource.properties ?? {}`, so
+	* `{}` means "nothing recorded", not "ConnectionType is absent, therefore
+	* public" (an empty bag also has no `TlsConfig` key for the comparator to
+	* walk, so refusing to declare costs nothing).
+	*/
+	getDriftUnknownPaths(resourceType, properties) {
+		if (resourceType === "AWS::ApiGatewayV2::Integration" && properties !== void 0 && Object.keys(properties).length > 0 && properties["ConnectionType"] !== "VPC_LINK") return ["TlsConfig"];
+		return [];
+	}
 	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.readApi(physicalId);
@@ -22707,7 +22732,7 @@ var ApiGatewayV2Provider = class {
 			if (resp.IntegrationSubtype !== void 0) result["IntegrationSubtype"] = resp.IntegrationSubtype;
 			if (resp.PassthroughBehavior !== void 0) result["PassthroughBehavior"] = resp.PassthroughBehavior;
 			if (resp.RequestTemplates !== void 0) result["RequestTemplates"] = resp.RequestTemplates;
-			if (resp.ResponseParameters !== void 0) result["ResponseParameters"] = this.toCfnResponseParameters(resp.ResponseParameters);
+			if (resp.ResponseParameters !== void 0) result["ResponseParameters"] = this.toCfnResponseParameters(resp.ResponseParameters, properties?.["ResponseParameters"]);
 			if (resp.TemplateSelectionExpression !== void 0) result["TemplateSelectionExpression"] = resp.TemplateSelectionExpression;
 			if (resp.TlsConfig !== void 0) result["TlsConfig"] = resp.TlsConfig;
 			return result;
@@ -23082,6 +23107,7 @@ var ApiGatewayV2Provider = class {
 			changed = true;
 		}
 		if (properties["TlsConfig"] != null && !this.deepEqual(properties["TlsConfig"], previousProperties["TlsConfig"])) {
+			this.warnTlsConfigIgnoredIfPublic(logicalId, properties);
 			input.TlsConfig = properties["TlsConfig"];
 			changed = true;
 		}
@@ -23435,6 +23461,22 @@ var ApiGatewayV2Provider = class {
 		return merged;
 	}
 	/**
+	* Announce a `TlsConfig` that AWS will silently discard (issue #1602):
+	* the field is only honored on a private (VPC-Link) integration, and on a
+	* public one (`ConnectionType` absent or `INTERNET`) AWS accepts the value
+	* and drops it — it never appears on the `GetIntegration` read-back
+	* (direct A/B, 2026-08-11 us-east-1). cdkd still sends the field (parity:
+	* CloudFormation forwards it too and AWS accepts it), but the never-silent
+	* policy requires saying so. The matching drift false positive is closed
+	* by {@link getDriftUnknownPaths}. A WARN on both create and update, never
+	* a throw — the update path can be a state-record replay
+	* (`rollback-executor.ts` / `drift --revert`) where a refusal would leave
+	* the resource un-revertable.
+	*/
+	warnTlsConfigIgnoredIfPublic(logicalId, properties) {
+		if (properties["TlsConfig"] != null && properties["ConnectionType"] !== "VPC_LINK") this.logger.warn(`AWS::ApiGatewayV2::Integration ${logicalId}: TlsConfig is only honored on a VPC_LINK (private) integration — AWS silently ignores it on a public one, and the value will never be readable back from AWS (issue #1602).`);
+	}
+	/**
 	* `ResponseParameters` is the one `AWS::ApiGatewayV2::Integration` property
 	* whose CFn shape does NOT match the SDK's, so forwarding it verbatim is not
 	* an option (issue #609). CloudFormation models it as
@@ -23493,26 +23535,87 @@ var ApiGatewayV2Provider = class {
 	* baseline carries the CFn list-of-pairs, and every `cdkd drift` run would
 	* report permanent phantom drift on a resource nobody touched.
 	*
-	* The pairs are sorted by `Destination` because this turns an UNORDERED SDK
-	* map into an ARRAY, and `calculateResourceDrift` compares arrays
-	* POSITIONALLY — AWS does not guarantee map readback order, so an unsorted
-	* rebuild would trade the shape-mismatch phantom drift for an ordering one
-	* (and `--revert` would re-push an identical value forever). Same reasoning
-	* as `src/analyzer/drift-normalize.ts`, applied at the source instead.
-	*/
-	toCfnResponseParameters(value) {
+	* Order matters because this turns an UNORDERED SDK map into an ARRAY, and
+	* `calculateResourceDrift` compares arrays POSITIONALLY — AWS does not
+	* guarantee map readback order, so an arbitrary rebuild would trade the
+	* shape-mismatch phantom drift for an ordering one (and `--revert` would
+	* re-push an identical value forever). Declared destinations therefore keep
+	* their DECLARED position and anything else is sorted; both are stable
+	* across reads. Same reasoning as `src/analyzer/drift-normalize.ts`,
+	* applied at the source instead.
+	*
+	* `declared` (the state-recorded desired `ResponseParameters` block, when
+	* the caller has it) makes the inverse MIRROR the template's spelling per
+	* status code (issue #1602): {@link toSdkResponseParameters} accepts an
+	* ALREADY-FLAT block (`{ "<status>": { "<Destination>": "<Source>" } }` —
+	* the SDK spelling a hand-written template may use) and passes it through,
+	* which made the pair non-injective — this method always rebuilt the CFn
+	* list shape, so a flat-spelled baseline could never compare equal to the
+	* read-back and reported permanent phantom drift. For a status code whose
+	* DECLARED block matches the flat-passthrough branch of
+	* {@link toSdkResponseParameters} (an object without an array
+	* `ResponseParameters` member), the read-back now stays flat too; every
+	* other status code (declared CFn shape, declared absent, no `declared` at
+	* all) keeps the CFn list shape. Object comparison is key-based, so the
+	* flat map round-trips without the sort the list shape needs.
+	*
+	* The CFn arm mirrors the declared block too, in the two ways the
+	* `properties`-fallback baseline is compared on: ENTRY ORDER (the
+	* comparator walks arrays positionally, and the template's order is
+	* whatever the author wrote — sorting only the read side is the mistake
+	* `drift-normalize.ts`'s header records) and SCALAR TYPE (CFn types
+	* `Source` as free-form and cdkd coerces a number to a string on the way
+	* out, so re-emitting AWS's string against a numeric declaration is
+	* permanent phantom drift). Declared destinations keep their declared
+	* position and their declared scalar whenever the value still agrees with
+	* AWS; a destination AWS returns that the template never declared is
+	* appended in sorted order, so the result stays deterministic across reads.
+	*/
+	toCfnResponseParameters(value, declared) {
 		if (value == null) return void 0;
+		const declaredBlocks = declared != null && typeof declared === "object" && !Array.isArray(declared) ? declared : void 0;
 		const out = {};
 		for (const [statusCode, flat] of Object.entries(value)) {
 			if (flat == null || typeof flat !== "object" || Array.isArray(flat)) continue;
-			out[statusCode] = { ResponseParameters: Object.entries(flat).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([destination, source]) => ({
-				Destination: destination,
-				Source: source
-			})) };
+			const declaredBlock = declaredBlocks?.[statusCode];
+			const declaredIsBlock = declaredBlock != null && typeof declaredBlock === "object" && !Array.isArray(declaredBlock);
+			const declaredEntries = declaredIsBlock ? declaredBlock["ResponseParameters"] : void 0;
+			if (declaredIsBlock && !Array.isArray(declaredEntries)) {
+				out[statusCode] = flat;
+				continue;
+			}
+			out[statusCode] = { ResponseParameters: this.mirrorDeclaredResponsePairs(flat, declaredEntries) };
 		}
 		return out;
 	}
 	/**
+	* Rebuild one status code's CFn list-of-pairs from AWS's flat map, keeping
+	* the DECLARED entries' order and scalar types where they still agree with
+	* AWS. See {@link toCfnResponseParameters} for why both matter.
+	*/
+	mirrorDeclaredResponsePairs(flat, declaredEntries) {
+		const remaining = new Map(Object.entries(flat));
+		const pairs = [];
+		if (Array.isArray(declaredEntries)) for (const entry of declaredEntries) {
+			if (entry == null || typeof entry !== "object" || Array.isArray(entry)) continue;
+			const destination = entry["Destination"];
+			if (typeof destination !== "string" || !remaining.has(destination)) continue;
+			const awsSource = remaining.get(destination);
+			remaining.delete(destination);
+			const declaredSource = entry["Source"];
+			const declaredDenotesSame = (typeof declaredSource === "number" || typeof declaredSource === "boolean") && String(declaredSource) === awsSource;
+			pairs.push({
+				Destination: destination,
+				Source: declaredDenotesSame ? declaredSource : awsSource
+			});
+		}
+		for (const [destination, source] of [...remaining.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) pairs.push({
+			Destination: destination,
+			Source: source
+		});
+		return pairs;
+	}
+	/**
 	* Convert CloudFormation Tags (Array<{Key, Value}>) to SDK Tags (Record<string, string>).
 	*/
 	cfnTagsToRecord(tags) {
@@ -51937,7 +52040,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				});
 				continue;
 			}
-			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType) : [];
+			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType, resource.properties ?? {}) : [];
 			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
 			const useObserved = resource.observedProperties !== void 0;
 			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
@@ -69419,7 +69522,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.16");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.17");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;