@go-to-k/cdkd 0.280.30 → 0.280.32

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-POCXyXPl.js";
-import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DZ05yRbJ.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-REAC5UGa.js";
+import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
+import { t as ASGProvider } from "./asg-provider-l4OlfWQo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -52990,7 +52990,7 @@ async function driftCommand(stacks, options) {
 			return;
 		}
 		if (options.accept) await runAccept(reports, stateBackend, stateConfig, awsClients, options);
-		else await runRevert(reports, providerRegistry, stateConfig, awsClients, options);
+		else await runRevert(reports, providerRegistry, stateBackend, stateConfig, awsClients, options);
 	} finally {
 		awsClients.destroy();
 	}
@@ -53716,6 +53716,69 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties, opti
 	return result;
 }
 /**
+* The top-level keys a provider NARROWED on the revert path (issue #1644).
+*
+* `provider.update()` may answer with `effectiveProperties` — the bag it
+* ACTUALLY delivered, which is what AWS now holds. `DeployEngine` records that
+* in place of the desired bag (`propertiesToRecord`), and `--revert` used to
+* throw the return value away: state kept the un-narrowed value, so the very
+* next `cdkd drift` reported the same difference and `--revert` re-issued the
+* same call — the loop `effectiveProperties` exists to break, still live on
+* this one command.
+*
+* Returns a per-key DELTA rather than the whole bag, and that is the load-
+* bearing part. The bag handed to `update()` here is
+* {@link buildRevertNewProperties}'s output — AWS-current values for every
+* non-drifted key merged with the state baseline for the drifted ones — so
+* writing it back wholesale would import AWS-authored values into state for
+* keys nobody reverted, quietly turning `--revert` into `--accept`. Only the
+* keys the PROVIDER changed between what it was handed and what it delivered
+* belong in state.
+*
+* A key present in `sent` but absent from `effective` is a DROP: the provider
+* did not deliver it, so AWS does not hold it, and the baseline must lose it
+* too. That is represented by an explicit `undefined` value, which the caller
+* turns into a `delete` — a plain `{...baseline, ...delta}` spread would leave
+* an `undefined`-valued key in the JSON instead. Presence is decided by
+* `key in effective`, NOT by comparing against `undefined`: a provider that
+* delivers an explicit `undefined` and one that omits the key both mean "AWS
+* does not hold it", while a key whose value genuinely IS `null` on both sides
+* must not read as a drop.
+*
+* The comparison is a key-order-INDEPENDENT deep equality rather than
+* `JSON.stringify`. A provider that rebuilds a nested object while delivering
+* the same members would otherwise register as a change, and the value written
+* back for such a key is the one that was SENT — for a non-drifted key that is
+* the AWS-current value, i.e. the `--accept` behavior this delta exists to
+* prevent.
+*/
+function collectNarrowedTopLevelKeys(sent, effective) {
+	const delta = {};
+	for (const key of /* @__PURE__ */ new Set([...Object.keys(sent), ...Object.keys(effective)])) {
+		const inSent = key in sent;
+		const inEffective = key in effective;
+		if (inSent && inEffective && deepEqualUnordered(sent[key], effective[key])) continue;
+		if (!inSent && !inEffective) continue;
+		delta[key] = inEffective ? effective[key] : void 0;
+	}
+	return delta;
+}
+/** Deep equality that does not depend on object key ORDER. */
+function deepEqualUnordered(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== "object" || typeof b !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => deepEqualUnordered(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	return ak.every((k) => Object.prototype.hasOwnProperty.call(bo, k) && deepEqualUnordered(ao[k], bo[k]));
+}
+/**
 * `--revert`: AWS ← state.
 *
 * For each drifted resource, call `provider.update(logicalId, physicalId,
@@ -53731,13 +53794,15 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties, opti
 *     truth, captured during the drift read so we don't re-issue it).
 *
 * Per-resource failures are collected and surface as `PartialFailureError`
-* (exit 2) at the end. State is NOT updated by `--revert` — once the
-* update succeeds, AWS values match state by definition.
+* (exit 2) at the end. State is otherwise NOT updated by `--revert` — once the
+* update succeeds, AWS values match state by definition. The ONE exception is
+* a provider-reported NARROWING (issue #1644): see
+* {@link collectNarrowedTopLevelKeys}.
 *
 * The per-stack lock is acquired before any update so a concurrent
 * `cdkd deploy` cannot race the in-flight property changes.
 */
-async function runRevert(reports, providerRegistry, stateConfig, awsClients, options) {
+async function runRevert(reports, providerRegistry, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
 	printRevertPlan(reports);
 	if (options.dryRun) {
@@ -53760,6 +53825,7 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 		const driftedOutcomes = report.outcomes.filter((o) => o.kind === "drifted");
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
+		const narrowedByLogicalId = /* @__PURE__ */ new Map();
 		try {
 			await runWithConcurrency(driftedOutcomes.map((outcome) => async () => {
 				const stateResource = report.state.resources[outcome.logicalId];
@@ -53775,9 +53841,17 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 				const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
 				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
 				try {
-					await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
+					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
 					totalSucceeded++;
 					logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
+					try {
+						if (updateResult?.effectiveProperties) {
+							const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
+							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, delta);
+						}
+					} catch (captureErr) {
+						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${captureErr instanceof Error ? captureErr.message : String(captureErr)}`);
+					}
 				} catch (err) {
 					if (err instanceof ResourceUpdateNotSupportedError) {
 						totalUnsupported++;
@@ -53789,6 +53863,52 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 				}
 			}), concurrency);
+			if (narrowedByLogicalId.size > 0) {
+				const resources = { ...report.state.resources };
+				let recordedCount = 0;
+				for (const [logicalId, delta] of narrowedByLogicalId) {
+					const existing = resources[logicalId];
+					if (!existing) continue;
+					const hasObserved = existing.observedProperties !== void 0;
+					const baselineSource = hasObserved ? existing.observedProperties : existing.properties;
+					const newBaseline = JSON.parse(JSON.stringify(baselineSource ?? {}));
+					let changed = false;
+					for (const [key, value] of Object.entries(delta)) {
+						if (!Object.prototype.hasOwnProperty.call(newBaseline, key)) continue;
+						if (value === void 0) {
+							delete newBaseline[key];
+							changed = true;
+							continue;
+						}
+						if (!hasObserved) continue;
+						newBaseline[key] = value;
+						changed = true;
+					}
+					if (!changed) continue;
+					recordedCount++;
+					resources[logicalId] = hasObserved ? {
+						...existing,
+						observedProperties: newBaseline
+					} : {
+						...existing,
+						properties: newBaseline
+					};
+				}
+				if (recordedCount === 0) continue;
+				const newState = {
+					...report.state,
+					resources,
+					lastModified: Date.now()
+				};
+				const saveOptions = { expectedEtag: report.etag };
+				if (report.migrationPending) saveOptions.migrateLegacy = true;
+				try {
+					await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
+					logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded the value the provider actually applied on ${recordedCount} resource(s).`);
+				} catch (err) {
+					logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — re-run 'cdkd drift ${report.stackName} --revert' once the state write can succeed.`);
+				}
+			}
 		} finally {
 			await lockManager.releaseLock(report.stackName, report.region).catch((err) => {
 				logger.warn(`Failed to release lock for ${report.stackName} (${report.region}): ` + (err instanceof Error ? err.message : String(err)));
@@ -70802,7 +70922,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.30");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.32");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;