@go-to-k/cdkd 0.280.29 → 0.280.30

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-wfKhhyCg.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-POCXyXPl.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CcomwF89.js";
+import { t as ASGProvider } from "./asg-provider-DZ05yRbJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17989,6 +17989,67 @@ function narrowRouteDestinations(properties) {
 		narrowed
 	};
 }
+/** The `AuthorizeSecurityGroupIngress` default protocol: "all protocols". */
+const SG_INGRESS_IP_PROTOCOL_DEFAULT = "-1";
+/** The refusal path both the create guard and the canonicalizer report under. */
+const SG_INGRESS_IP_PROTOCOL_PATH = "AWS::EC2::SecurityGroupIngress IpProtocol";
+/**
+* Resolve the `IpProtocol` an `AWS::EC2::SecurityGroupIngress` rule actually
+* SENDS, plus the bag that describes it (issue #1633).
+*
+* ONE source for a decision three call sites have to agree on, exactly as
+* `narrowRouteDestinations` is for the Route destinations: the create arm
+* (which authorizes the rule), the update arm (which revokes then re-creates
+* it), and the DIFF-side canonicalizer. If those disagreed, state and template
+* would each be normalized to a different protocol and the fix would become
+* the bug — the lesson `.claude/rules/providers.md` records from #1591.
+*
+* Two shapes reach the wire as something other than what the template wrote,
+* and BOTH have to be recorded or they become permanent phantom drift, because
+* `readSecurityGroupIngressCurrentState` can only ever return what AWS holds:
+*
+* - a MALFORMED value (`''` / `{}` / `true` / an explicit `null`), which
+*   `requireConfigString` refuses on the template-path create and — under
+*   `onUnusable` — warn-substitutes the default on the replay-reachable paths;
+* - a finite NUMBER, the accepted-by-design shape from an unquoted YAML
+*   `IpProtocol: -1` (issue #1513), which is stringified before it is sent.
+*
+* The second is not announced by a warning, and does not need to be: unlike a
+* dropped destination key it loses NOTHING — `-1` and `'-1'` name the same
+* protocol — so there is no silent loss for `effectiveProperties` to launder
+* into a clean record, which is the hazard the "already ANNOUNCED" clause of
+* the `effectiveProperties` contract exists to guard against. Recording the
+* string additionally fixes the delete path, which forwards the state record
+* to `buildIpPermission` and would otherwise hand the EC2 API a number.
+*
+* `narrowed` is a FRESH object only when the sent value differs from the
+* declared one, so an ordinary `IpProtocol: 'tcp'` bag is returned untouched
+* and compares byte-for-byte as before.
+*
+* @param onUnusable Passed straight through to `requireConfigString`: absent,
+*   a malformed value THROWS (the template-path create, where the user can fix
+*   the template); supplied, it warns and takes the default. The canonicalizer
+*   passes a no-op — a diff must never throw, and it must never warn either,
+*   since the provisioning path already announces the same substitution.
+*/
+function narrowIngressIpProtocol(properties, onUnusable) {
+	const declared = properties["IpProtocol"];
+	const ipProtocol = requireConfigString(declared, SG_INGRESS_IP_PROTOCOL_DEFAULT, SG_INGRESS_IP_PROTOCOL_PATH, {
+		coerceNumber: true,
+		...onUnusable && { onUnusable }
+	});
+	if (declared === void 0 || declared === ipProtocol) return {
+		ipProtocol,
+		narrowed: properties
+	};
+	return {
+		ipProtocol,
+		narrowed: {
+			...properties,
+			IpProtocol: ipProtocol
+		}
+	};
+}
 /**
 * AWS EC2 Networking Provider
 *
@@ -19170,10 +19231,8 @@ var EC2Provider = class {
 		this.logger.debug(`Creating SecurityGroupIngress ${logicalId}`);
 		const groupId = properties["GroupId"];
 		if (!groupId) throw new ProvisioningError(`GroupId is required for SecurityGroupIngress ${logicalId}`, resourceType, logicalId);
-		const ipProtocol = requireConfigString(properties["IpProtocol"], "-1", "AWS::EC2::SecurityGroupIngress IpProtocol", {
-			coerceNumber: true,
-			...onUnusableProtocol && { onUnusable: onUnusableProtocol }
-		});
+		const { ipProtocol, narrowed } = narrowIngressIpProtocol(properties, onUnusableProtocol);
+		const effectiveProperties = narrowed === properties ? void 0 : narrowed;
 		const fromPort = properties["FromPort"];
 		const toPort = properties["ToPort"];
 		try {
@@ -19188,7 +19247,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created SecurityGroupIngress ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
-				attributes: {}
+				attributes: {},
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof Error && error.message.includes("already exists")) {
@@ -19196,7 +19256,8 @@ var EC2Provider = class {
 				this.logger.debug(`SecurityGroupIngress ${logicalId} already exists, treating as success`);
 				return {
 					physicalId,
-					attributes: {}
+					attributes: {},
+					...effectiveProperties && { effectiveProperties }
 				};
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -19215,7 +19276,8 @@ var EC2Provider = class {
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
-				...createResult.attributes && { attributes: createResult.attributes }
+				...createResult.attributes && { attributes: createResult.attributes },
+				...createResult.effectiveProperties && { effectiveProperties: createResult.effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
@@ -20293,7 +20355,9 @@ var EC2Provider = class {
 		}
 	}
 	/**
-	* The diff-side half of the Route multi-destination narrowing (issue #1591).
+	* The diff-side half of the two EC2 narrowings that report
+	* `effectiveProperties` — Route multi-destination (issue #1591) and
+	* SecurityGroupIngress `IpProtocol` (issue #1633).
 	*
 	* `createRoute` sends exactly one destination key and reports the narrowed
 	* bag via `effectiveProperties`, so state carries one key. Without the same
@@ -20306,8 +20370,21 @@ var EC2Provider = class {
 	*
 	* Shares `narrowRouteDestinations` with the provisioning path so the two
 	* cannot disagree about which key survives.
+	*
+	* The SecurityGroupIngress arm is the same shape and needs the same second
+	* half for the same reason: `IpProtocol` is create-only on that type in the
+	* registry schema, so normalizing state alone would make the template's
+	* original value read as a changed immutable property — a REPLACEMENT, whose
+	* create passes no context and so gets no `onUnusable` downgrade, turning a
+	* previously-green no-op deploy into a hard failure. Normalizing BOTH sides
+	* is also what keeps the fix correct for records written BEFORE it existed,
+	* which still carry the un-narrowed value.
 	*/
 	canonicalizeDesiredProperties(resourceType, properties) {
+		if (resourceType === "AWS::EC2::SecurityGroupIngress") {
+			const { narrowed } = narrowIngressIpProtocol(properties, () => {});
+			return narrowed;
+		}
 		if (resourceType !== "AWS::EC2::Route") return properties;
 		const { declared, narrowed } = narrowRouteDestinations(properties);
 		return declared.length > 1 ? narrowed : properties;
@@ -20789,12 +20866,33 @@ function flattenIpPermissions(perms, direction) {
 * Direction-sensitive: ingress uses `Source*` fields, egress uses
 * `Destination*`.
 */
+/**
+* The `IpProtocol` component of a security-group rule identity key.
+*
+* A NUMBER is stringified so a record written BEFORE issue #1633 still matches:
+* AWS always reports the protocol as a string, so a legacy record holding the
+* number `-1` keyed as `{"p":-1}` against AWS's `{"p":"-1"}` and matched
+* nothing — `readSecurityGroupIngressCurrentState` returned `undefined` and
+* `cdkd drift` reported the rule as GONE, forever. The canonicalizer makes such
+* a record's diff NO_CHANGE, so no deploy ever rewrites it either; normalizing
+* at the KEY is what heals the existing population with no migration.
+*
+* Anything that is neither a string nor a number is passed through UNCHANGED
+* rather than blanket-`String()`-ed: a malformed object would otherwise key as
+* the useless `'[object Object]'`, silently collapsing every malformed record
+* onto one bucket. Such a rule matches nothing either way — this keeps the
+* non-match honest instead of manufacturing a fake identity.
+*/
+function sgProtocolKey(value) {
+	if (typeof value === "number") return String(value);
+	return value ?? "-1";
+}
 function sgRuleKey(rule, direction) {
 	const peerKey = direction === "egress" ? rule["DestinationSecurityGroupId"] : rule["SourceSecurityGroupId"];
 	const prefixKey = direction === "egress" ? rule["DestinationPrefixListId"] : rule["SourcePrefixListId"];
 	const peerOwner = direction === "ingress" ? rule["SourceSecurityGroupOwnerId"] : void 0;
 	return JSON.stringify({
-		p: rule["IpProtocol"] ?? "-1",
+		p: sgProtocolKey(rule["IpProtocol"]),
 		f: rule["FromPort"] ?? null,
 		t: rule["ToPort"] ?? null,
 		c4: rule["CidrIp"] ?? null,
@@ -70704,7 +70802,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.29");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.30");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;