@go-to-k/cdkd 0.280.24 → 0.280.25

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-60FIug-P.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-DOjLU2Et.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Dpx4B6UA.js";
+import { t as ASGProvider } from "./asg-provider-Do4MnkQh.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -35641,6 +35641,31 @@ var AppSyncProvider = class {
 		throw new ProvisioningError(message, resourceType, options?.logicalId ?? "");
 	}
 	/**
+	* CFn declares `DeltaSyncConfig.BaseTableTTL` / `.DeltaSyncTableTTL` as
+	* STRINGS (CDK's L1 types them `string` too) while the SDK models both as
+	* longs, so the value needs a real conversion rather than a cast — a string
+	* handed to the number member is dropped by the serializer, which is the
+	* silent-drop shape this batch closes.
+	*
+	* A non-numeric value is refused LOUDLY: `Number('abc')` is `NaN`, and NaN
+	* would serialize to `null` and reach AWS as a confusing type error far from
+	* the template line that caused it.
+	*
+	* `Number()` alone is NOT that refusal, which is the trap this guard exists
+	* for: it coerces `''` / `'  '` / `null` / `[]` / `false` to `0` and `true`
+	* to `1`, all of which are finite. An unresolved intrinsic or an empty CFn
+	* value would therefore have deployed a live data source with a ZERO-minute
+	* delta-sync TTL — the "validate the FIELD, not just the container" class in
+	* .claude/rules/providers.md. So the accepted shapes are enumerated instead:
+	* a finite NUMBER, or a NON-BLANK string that parses to one.
+	*/
+	toDeltaSyncTtl(value, path, logicalId, resourceType) {
+		const numeric = typeof value === "number" ? value : typeof value === "string" ? value.trim() : void 0;
+		const parsed = numeric === void 0 || numeric === "" ? NaN : Number(numeric);
+		if (!Number.isFinite(parsed)) throw new ProvisioningError(`${resourceType} ${path} must be a number of minutes (CFn types it as a string), got ${JSON.stringify(value)} — cdkd refuses to drop it silently`, resourceType, logicalId);
+		return parsed;
+	}
+	/**
 	* NOTE: `awsRegion` / `defaultAction` are passed through VERBATIM, including
 	* when the template omits them. cdkd deliberately does NOT substitute a
 	* default: `DefaultAction` decides whether an unauthenticated request is
@@ -35985,15 +36010,40 @@ var AppSyncProvider = class {
 		if (properties["Description"] !== void 0) input.description = properties["Description"];
 		if (properties["ServiceRoleArn"] !== void 0) input.serviceRoleArn = properties["ServiceRoleArn"];
 		const dynamo = this.asObject(properties["DynamoDBConfig"], "DynamoDBConfig", { logicalId }, resourceType);
-		if (dynamo) input.dynamodbConfig = {
-			tableName: dynamo["TableName"],
-			awsRegion: dynamo["AwsRegion"],
-			...dynamo["UseCallerCredentials"] !== void 0 ? { useCallerCredentials: dynamo["UseCallerCredentials"] } : {}
-		};
+		if (dynamo) {
+			const ddbConfig = {
+				tableName: dynamo["TableName"],
+				awsRegion: dynamo["AwsRegion"],
+				...dynamo["UseCallerCredentials"] !== void 0 ? { useCallerCredentials: dynamo["UseCallerCredentials"] } : {},
+				...dynamo["Versioned"] !== void 0 ? { versioned: dynamo["Versioned"] } : {}
+			};
+			const delta = this.asObject(dynamo["DeltaSyncConfig"], "DynamoDBConfig.DeltaSyncConfig", { logicalId }, resourceType);
+			if (delta) {
+				const deltaConfig = {};
+				if (delta["BaseTableTTL"] !== void 0) deltaConfig.baseTableTTL = this.toDeltaSyncTtl(delta["BaseTableTTL"], "DynamoDBConfig.DeltaSyncConfig.BaseTableTTL", logicalId, resourceType);
+				if (delta["DeltaSyncTableName"] !== void 0) deltaConfig.deltaSyncTableName = delta["DeltaSyncTableName"];
+				if (delta["DeltaSyncTableTTL"] !== void 0) deltaConfig.deltaSyncTableTTL = this.toDeltaSyncTtl(delta["DeltaSyncTableTTL"], "DynamoDBConfig.DeltaSyncConfig.DeltaSyncTableTTL", logicalId, resourceType);
+				ddbConfig.deltaSyncConfig = deltaConfig;
+			}
+			input.dynamodbConfig = ddbConfig;
+		}
 		const lambda = this.asObject(properties["LambdaConfig"], "LambdaConfig", { logicalId }, resourceType);
 		if (lambda) input.lambdaConfig = { lambdaFunctionArn: lambda["LambdaFunctionArn"] };
 		const http = this.asObject(properties["HttpConfig"], "HttpConfig", { logicalId }, resourceType);
-		if (http) input.httpConfig = { endpoint: http["Endpoint"] };
+		if (http) {
+			const httpConfig = { endpoint: http["Endpoint"] };
+			const auth = this.asObject(http["AuthorizationConfig"], "HttpConfig.AuthorizationConfig", { logicalId }, resourceType);
+			if (auth) {
+				const authConfig = { authorizationType: auth["AuthorizationType"] };
+				const iam = this.asObject(auth["AwsIamConfig"], "HttpConfig.AuthorizationConfig.AwsIamConfig", { logicalId }, resourceType);
+				if (iam) authConfig.awsIamConfig = {
+					...iam["SigningRegion"] !== void 0 ? { signingRegion: iam["SigningRegion"] } : {},
+					...iam["SigningServiceName"] !== void 0 ? { signingServiceName: iam["SigningServiceName"] } : {}
+				};
+				httpConfig.authorizationConfig = authConfig;
+			}
+			input.httpConfig = httpConfig;
+		}
 		const es = this.asObject(properties["ElasticsearchConfig"], "ElasticsearchConfig", { logicalId }, resourceType);
 		if (es) input.elasticsearchConfig = {
 			endpoint: es["Endpoint"],
@@ -36470,10 +36520,36 @@ var AppSyncProvider = class {
 			if (ds.dynamodbConfig.tableName !== void 0) dynamo["TableName"] = ds.dynamodbConfig.tableName;
 			if (ds.dynamodbConfig.awsRegion !== void 0) dynamo["AwsRegion"] = ds.dynamodbConfig.awsRegion;
 			if (ds.dynamodbConfig.useCallerCredentials !== void 0) dynamo["UseCallerCredentials"] = ds.dynamodbConfig.useCallerCredentials;
+			if (ds.dynamodbConfig.versioned !== void 0) dynamo["Versioned"] = ds.dynamodbConfig.versioned;
+			const delta = ds.dynamodbConfig.deltaSyncConfig;
+			if (delta) {
+				const deltaOut = {};
+				if (delta.baseTableTTL !== void 0) deltaOut["BaseTableTTL"] = String(delta.baseTableTTL);
+				if (delta.deltaSyncTableName !== void 0) deltaOut["DeltaSyncTableName"] = delta.deltaSyncTableName;
+				if (delta.deltaSyncTableTTL !== void 0) deltaOut["DeltaSyncTableTTL"] = String(delta.deltaSyncTableTTL);
+				if (Object.keys(deltaOut).length > 0) dynamo["DeltaSyncConfig"] = deltaOut;
+			}
 			if (Object.keys(dynamo).length > 0) result["DynamoDBConfig"] = dynamo;
 		}
 		if (ds.lambdaConfig?.lambdaFunctionArn !== void 0) result["LambdaConfig"] = { LambdaFunctionArn: ds.lambdaConfig.lambdaFunctionArn };
-		if (ds.httpConfig?.endpoint !== void 0) result["HttpConfig"] = { Endpoint: ds.httpConfig.endpoint };
+		if (ds.httpConfig) {
+			const httpOut = {};
+			if (ds.httpConfig.endpoint !== void 0) httpOut["Endpoint"] = ds.httpConfig.endpoint;
+			const authRead = ds.httpConfig.authorizationConfig;
+			if (authRead) {
+				const authOut = {};
+				if (authRead.authorizationType !== void 0) authOut["AuthorizationType"] = authRead.authorizationType;
+				const iamRead = authRead.awsIamConfig;
+				if (iamRead) {
+					const iamOut = {};
+					if (iamRead.signingRegion !== void 0) iamOut["SigningRegion"] = iamRead.signingRegion;
+					if (iamRead.signingServiceName !== void 0) iamOut["SigningServiceName"] = iamRead.signingServiceName;
+					if (Object.keys(iamOut).length > 0) authOut["AwsIamConfig"] = iamOut;
+				}
+				if (Object.keys(authOut).length > 0) httpOut["AuthorizationConfig"] = authOut;
+			}
+			if (Object.keys(httpOut).length > 0) result["HttpConfig"] = httpOut;
+		}
 		if (ds.elasticsearchConfig) {
 			const es = {};
 			if (ds.elasticsearchConfig.endpoint !== void 0) es["Endpoint"] = ds.elasticsearchConfig.endpoint;
@@ -70341,7 +70417,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.24");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.25");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;