@go-to-k/cdkd 0.280.22 → 0.280.24

package/dist/{deploy-engine-DObU-2va.js → deploy-engine-60FIug-P.js}

@@ -8421,9 +8421,15 @@ var DiffCalculator = class DiffCalculator {
 	*                  buried inside intrinsics (e.g. `Fn::Join` literal args) are detected.
 	*                  If resolution throws for a given property value, the unresolved
 	*                  value is used (falling back to the original "assume equal" behavior).
+	* @param canonicalizeProperties Optional per-type normalization applied to BOTH
+	*                  comparison sides (issue #1591) — see {@link CanonicalizePropertiesFn}
+	*                  for why one-sided normalization breaks the very population it is
+	*                  meant to fix. Injected as a function rather than as a provider
+	*                  registry so the analyzer layer keeps no dependency on the
+	*                  provisioning layer.
 	* @returns Map of logical ID to resource change
 	*/
-	async calculateDiff(currentState, desiredTemplate, resolveFn) {
+	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties) {
 		const changes = /* @__PURE__ */ new Map();
 		const currentResources = currentState.resources;
 		const desiredResources = desiredTemplate.Resources;
@@ -8475,8 +8481,11 @@ var DiffCalculator = class DiffCalculator {
 				this.logger.debug(`UPDATE (Type change): ${logicalId} (${currentResource.resourceType} -> ${desiredResource.Type})`);
 			} else {
 				const rawDesiredProps = desiredResource.Properties || {};
-				const desiredPropsForCompare = resolveFn ? await this.resolveBestEffort(rawDesiredProps, resolveFn) : rawDesiredProps;
-				const propertyChanges = await this.compareProperties(desiredResource.Type, currentResource.properties, desiredPropsForCompare);
+				const resolvedDesiredProps = resolveFn ? await this.resolveBestEffort(rawDesiredProps, resolveFn) : rawDesiredProps;
+				const desiredPropsForCompare = canonicalizeProperties ? canonicalizeProperties(desiredResource.Type, resolvedDesiredProps) : resolvedDesiredProps;
+				const currentPropsForCompare = canonicalizeProperties && currentResource.provisionedBy !== "cc-api" ? canonicalizeProperties(desiredResource.Type, currentResource.properties) : currentResource.properties;
+				if (canonicalizeProperties && !this.valuesEqual(desiredPropsForCompare, resolvedDesiredProps)) this.logger.warn(`${logicalId} (${desiredResource.Type}): part of the declared properties cannot be sent as declared and is ignored when comparing against deployed state — the provider narrows them. Fix the template to declare only what the resource supports; until then changes to the ignored keys have no effect.`);
+				const propertyChanges = await this.compareProperties(desiredResource.Type, currentPropsForCompare, desiredPropsForCompare);
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
 					changes.set(logicalId, {
@@ -12827,7 +12836,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DVoWhe5E.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dpx4B6UA.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -17810,6 +17819,36 @@ function extractDeploymentEventError(err) {
 	return result;
 }
 
+//#endregion
+//#region src/provisioning/canonicalize-properties.ts
+/**
+* Build the diff-time property normalizer from a provider registry (issue
+* #1591).
+*
+* ONE builder shared by `cdkd deploy` (the engine) and `cdkd diff` (the
+* command), because the two MUST agree: the diff is the preview of the deploy,
+* and a preview that narrows differently from the apply forecasts a change the
+* deploy will never make — the same class of bug as the phantom drift this
+* issue is about, moved one command over.
+*
+* Best-effort by construction. An unregistered type, a provider without the
+* hook, or a hook that throws all fall back to the properties unchanged — the
+* pre-#1591 behavior. A comparison refinement must never be able to take down
+* a deploy or a diff.
+*/
+function makeCanonicalizePropertiesFn(registry) {
+	const logger = getLogger().child("canonicalize-properties");
+	return (resourceType, properties) => {
+		try {
+			if (!registry.hasProvider(resourceType)) return properties;
+			return registry.getProvider(resourceType).canonicalizeDesiredProperties?.(resourceType, properties) ?? properties;
+		} catch (error) {
+			logger.debug(`canonicalizeDesiredProperties failed for ${resourceType}: ${error instanceof Error ? error.message : String(error)}`);
+			return properties;
+		}
+	};
+}
+
 //#endregion
 //#region src/provisioning/final-snapshot.ts
 /**
@@ -19313,7 +19352,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.280.22";
+	return "0.280.24";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -20236,7 +20275,7 @@ var DeployEngine = class {
 			}, stackName);
 			diffResolverContext.bestEffort = true;
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
-			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn);
+			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry));
 			if (!this.diffCalculator.hasChanges(changes)) {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
@@ -20933,7 +20972,7 @@ var DeployEngine = class {
 				stateResources[logicalId] = {
 					physicalId: result.physicalId,
 					resourceType,
-					properties: resolvedProps,
+					properties: this.propertiesToRecord(resolvedProps, result),
 					...result.attributes && { attributes: result.attributes },
 					...dependencies && dependencies.length > 0 && { dependencies },
 					...templateAttrs,
@@ -21090,7 +21129,7 @@ var DeployEngine = class {
 					stateResources[logicalId] = {
 						physicalId: createResult.physicalId,
 						resourceType,
-						properties: resolvedProps,
+						properties: this.propertiesToRecord(resolvedProps, createResult),
 						...createResult.attributes && { attributes: createResult.attributes },
 						...dependencies && dependencies.length > 0 && { dependencies },
 						...this.extractTemplateAttributes(template, logicalId),
@@ -21144,11 +21183,13 @@ var DeployEngine = class {
 							const replProvider = replDecision.provider;
 							const replProps = replDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
 							const createResult = await this.withRetry(() => replProvider.create(logicalId, resourceType, replProps), logicalId, void 0, void 0, replProvider);
-							result = {
+							const replacementResult = {
 								physicalId: createResult.physicalId,
-								attributes: createResult.attributes,
-								wasReplaced: true
+								wasReplaced: true,
+								...createResult.attributes && { attributes: createResult.attributes }
 							};
+							if (createResult.effectiveProperties) replacementResult.effectiveProperties = createResult.effectiveProperties;
+							result = replacementResult;
 							resultProvisionedBy = replDecision.provisionedBy;
 						} else throw updateError;
 					}
@@ -21157,7 +21198,7 @@ var DeployEngine = class {
 					stateResources[logicalId] = {
 						physicalId: result.physicalId,
 						resourceType,
-						properties: resolvedProps,
+						properties: this.propertiesToRecord(resolvedProps, result),
 						...carriedAttributes && { attributes: carriedAttributes },
 						...dependencies && dependencies.length > 0 && { dependencies },
 						...this.extractTemplateAttributes(template, logicalId),
@@ -21237,6 +21278,25 @@ var DeployEngine = class {
 		return deps.length > 0 ? deps : void 0;
 	}
 	/**
+	* The properties to RECORD in cdkd state for a just-provisioned resource.
+	*
+	* Normally the DESIRED (resolved) bag: state is the record of what the user
+	* asked for, and the #1160 absent-field removal derivation reads it as the
+	* previous side on the next deploy, so it must stay template-shaped.
+	*
+	* A provider may override it by returning `effectiveProperties` when it
+	* deliberately NARROWED what it sent (issue #1591). Recording the desired
+	* bag there would describe something AWS does not hold, and since
+	* `readCurrentState` can only return what AWS does hold, the difference is
+	* PERMANENT phantom drift — reported by every `cdkd drift`, and "repaired"
+	* by `drift --revert` into another `update()` that narrows and re-reports.
+	* The provider is the only layer that knows what it dropped, so it says so
+	* and the engine records that instead.
+	*/
+	propertiesToRecord(desiredProperties, result) {
+		return result.effectiveProperties ?? desiredProperties;
+	}
+	/**
 	* Read `DeletionPolicy` / `UpdateReplacePolicy` from the synth template
 	* so they can be persisted in `ResourceState` (schema v5+). Always returns
 	* both keys (`undefined` when the template does not carry the attribute)
@@ -21424,5 +21484,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { requireConfigString as $, processStackMessages as $t, red as A, runDockerStreaming as At, isTerminationProtectionPropagationError as B, resolveSkipPrefix as Bt, isStatefulRecreateTargetSync as C, StateError as Cn, parseBootstrapMarker as Ct, cyan as D, normalizeAwsError as Dn, formatDockerLoginError as Dt, bold as E, isCdkdError as En, buildDockerImage as Et, ProviderRegistry as F, getDefaultStateBucketName as Ft, normalizeAwsTagsToCfn as G, warnDeprecatedNoPrefixCliFlag as Gt, cfnRefValueFromPhysicalId as H, resolveStateBucketWithDefaultAndSource as Ht, findActionableSilentDrops as I, getLegacyStateBucketName as It, configStringRefusal as J, MIGRATE_TMP_PREFIX as Jt, resolveExplicitPhysicalId as K, CFN_TEMPLATE_BODY_LIMIT as Kt, CloudControlProvider as L, resolveApp as Lt, IAMRoleProvider as M, getDockerImageBySourceHash as Mt, collectInlinePolicyNamesManagedBySiblings as N, Synthesizer as Nt, gray as O, withErrorHandling as On, getDockerCmd as Ot, clearOnUpdateRemoval as P, synthesisStatusMessage as Pt, requireConfigObject as Q, AssemblyReader as Qt, slowCcOperationTimeoutMs as R, resolveAutoAssetStorage as Rt, MULTI_REGION_RECREATE_BLOCKED_TYPES as S, StackTerminationProtectionError as Sn, getBootstrapMarkerKey as St, formatResourceLine as T, formatError as Tn, validateContainerRepoName as Tt, refStateLookupFromResource as U, resolveUseCdkBootstrapAssets as Ut, IntrinsicFunctionResolver as V, resolveStateBucketWithDefault as Vt, WAFv2WebACLProvider as W, stateBucketExistenceConfirmed as Wt, replayWarn as X, uploadCfnTemplate as Xt, readConfigString as Y, findLargeInlineResources as Yt, requireConfigArray as Z, expectedOwnerParam as Zt, createPreDeleteFinalSnapshot as _, PartialFailureError as _n, loadPublishableAssetManifest as _t, DeploymentEventsStore as a, setAwsClients as an, isThrottlingError as at, unsupportedFinalSnapshotError as b, ResourceUpdateNotSupportedError as bn, BOOTSTRAP_MARKER_PREFIX as bt, replayFailedOperations as c, ConfigError as cn, LockManager as ct, IMPLICIT_DELETE_DEPENDENCIES as d, LocalInvokeBuildError as dn, shouldRetainResource as dt, clearBucketRegionCache as en, applyRoleArnIfSet as et, computeImplicitDeleteEdges as f, LocalMigrateError as fn, AssetPublisher as ft, ccRoutedFinalSnapshotError as g, NestedStackChildDirectDestroyError as gn, createAssetRedirectResolver as gt, buildFinalSnapshotIdentifier as h, MissingCdkCliError as hn, buildAssetRedirectMap as ht, DeploymentEventsReader as i, resetAwsClients as in, isRetryableTransientError as it, yellow as j, AssetManifestLoader as jt, green as k, __exportAll as kn, runDockerForeground as kt, replayRollback as l, DependencyError as ln, S3StateBackend as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LockError as mn, WorkGraph as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AwsClients as nn, describeTypeWithThrottleRetry as nt, planFailedOps as o, AssetError as on, DagBuilder as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalStartServiceError as pn, stringifyValue as pt, assertRegionMatch as q, CFN_TEMPLATE_URL_LIMIT as qt, DeployEngine as r, getAwsClients as rn, withRetry as rt, planRollback as s, CdkdError as sn, TemplateParser as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveBucketRegion as tn, DiffCalculator as tt, withResourceDeadline as u, DeployCancelledError as un, rebuildClientForBucketRegion as ut, isFinalSnapshotError as v, ProvisioningError as vn, rewriteTemplateAssetReferences as vt, renderStatefulReason as w, SynthesisError as wn, validateAssetBucketName as wt, extractDeploymentEventError as x, StackHasActiveImportsError as xn, ensureAssetStorage as xt, refusesFinalSnapshot as y, ResourceTimeoutError as yn, AssetModeResolver as yt, disableInstanceApiTermination as z, resolveCaptureObservedState as zt };
-//# sourceMappingURL=deploy-engine-DObU-2va.js.map
+export { requireConfigObject as $, AssemblyReader as $t, green as A, __exportAll as An, runDockerForeground as At, disableInstanceApiTermination as B, resolveCaptureObservedState as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, StackTerminationProtectionError as Cn, getBootstrapMarkerKey as Ct, bold as D, isCdkdError as Dn, buildDockerImage as Dt, formatResourceLine as E, formatError as En, validateContainerRepoName as Et, clearOnUpdateRemoval as F, synthesisStatusMessage as Ft, WAFv2WebACLProvider as G, stateBucketExistenceConfirmed as Gt, IntrinsicFunctionResolver as H, resolveStateBucketWithDefault as Ht, ProviderRegistry as I, getDefaultStateBucketName as It, assertRegionMatch as J, CFN_TEMPLATE_URL_LIMIT as Jt, normalizeAwsTagsToCfn as K, warnDeprecatedNoPrefixCliFlag as Kt, findActionableSilentDrops as L, getLegacyStateBucketName as Lt, yellow as M, AssetManifestLoader as Mt, IAMRoleProvider as N, getDockerImageBySourceHash as Nt, cyan as O, normalizeAwsError as On, formatDockerLoginError as Ot, collectInlinePolicyNamesManagedBySiblings as P, Synthesizer as Pt, requireConfigArray as Q, expectedOwnerParam as Qt, CloudControlProvider as R, resolveApp as Rt, extractDeploymentEventError as S, StackHasActiveImportsError as Sn, ensureAssetStorage as St, renderStatefulReason as T, SynthesisError as Tn, validateAssetBucketName as Tt, cfnRefValueFromPhysicalId as U, resolveStateBucketWithDefaultAndSource as Ut, isTerminationProtectionPropagationError as V, resolveSkipPrefix as Vt, refStateLookupFromResource as W, resolveUseCdkBootstrapAssets as Wt, readConfigString as X, findLargeInlineResources as Xt, configStringRefusal as Y, MIGRATE_TMP_PREFIX as Yt, replayWarn as Z, uploadCfnTemplate as Zt, createPreDeleteFinalSnapshot as _, NestedStackChildDirectDestroyError as _n, createAssetRedirectResolver as _t, DeploymentEventsStore as a, resetAwsClients as an, isRetryableTransientError as at, unsupportedFinalSnapshotError as b, ResourceTimeoutError as bn, AssetModeResolver as bt, replayFailedOperations as c, CdkdError as cn, TemplateParser as ct, IMPLICIT_DELETE_DEPENDENCIES as d, DeployCancelledError as dn, rebuildClientForBucketRegion as dt, processStackMessages as en, requireConfigString as et, computeImplicitDeleteEdges as f, LocalInvokeBuildError as fn, shouldRetainResource as ft, ccRoutedFinalSnapshotError as g, MissingCdkCliError as gn, buildAssetRedirectMap as gt, buildFinalSnapshotIdentifier as h, LockError as hn, WorkGraph as ht, DeploymentEventsReader as i, getAwsClients as in, withRetry as it, red as j, runDockerStreaming as jt, gray as k, withErrorHandling as kn, getDockerCmd as kt, replayRollback as l, ConfigError as ln, LockManager as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalStartServiceError as mn, stringifyValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveBucketRegion as nn, DiffCalculator as nt, planFailedOps as o, setAwsClients as on, isThrottlingError as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalMigrateError as pn, AssetPublisher as pt, resolveExplicitPhysicalId as q, CFN_TEMPLATE_BODY_LIMIT as qt, DeployEngine as r, AwsClients as rn, describeTypeWithThrottleRetry as rt, planRollback as s, AssetError as sn, DagBuilder as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, clearBucketRegionCache as tn, applyRoleArnIfSet as tt, withResourceDeadline as u, DependencyError as un, S3StateBackend as ut, isFinalSnapshotError as v, PartialFailureError as vn, loadPublishableAssetManifest as vt, isStatefulRecreateTargetSync as w, StateError as wn, parseBootstrapMarker as wt, makeCanonicalizePropertiesFn as x, ResourceUpdateNotSupportedError as xn, BOOTSTRAP_MARKER_PREFIX as xt, refusesFinalSnapshot as y, ProvisioningError as yn, rewriteTemplateAssetReferences as yt, slowCcOperationTimeoutMs as z, resolveAutoAssetStorage as zt };
+//# sourceMappingURL=deploy-engine-60FIug-P.js.map