@go-to-k/cdkd 0.281.16 → 0.281.18

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as AssetModeResolver, D as bold, Dt as parseBootstrapMarker, E as formatResourceLine, En as StackTerminationProtectionError, Et as getBootstrapMarkerKey, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateAssetBucketName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as rewriteTemplateAssetReferences, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as ensureAssetStorage, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as stringifyValue, a as DeploymentEventsStore, an as resolveBucketRegion, at as DiffCalculator, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as createAssetRedirectResolver, c as replayFailedOperations, cn as resetAwsClients, ct as isRetryableTransientError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as TemplateParser, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as LockManager, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as AssetPublisher, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as shouldRetainResource, i as DeploymentEventsReader, it as applyRoleArnIfSet, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as validateContainerRepoName, l as replayRollback, ln as setAwsClients, lt as isThrottlingError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as rebuildClientForBucketRegion, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as describeTypeWithThrottleRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as S3StateBackend, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as derivePartitionAndUrlSuffix, s as planRollback, sn as getAwsClients, st as withRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as DagBuilder, v as isFinalSnapshotError, vt as WorkGraph, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as BOOTSTRAP_MARKER_PREFIX, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as loadPublishableAssetManifest, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as buildAssetRedirectMap, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-CfnMSwyx.js";
+import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, En as StackTerminationProtectionError, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as WorkGraph, a as DeploymentEventsStore, an as resolveBucketRegion, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as resetAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as LockManager, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as AssetPublisher, i as DeploymentEventsReader, it as DiffCalculator, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as derivePartitionAndUrlSuffix, l as replayRollback, ln as setAwsClients, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as applyRoleArnIfSet, s as planRollback, sn as getAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as TemplateParser, v as isFinalSnapshotError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-D-0t_IlI.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-B1pHGT_X.js";
+import { t as ASGProvider } from "./asg-provider-CRgl7pV6.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14256,13 +14256,17 @@ var DynamoDBGlobalTableProvider = class {
 		if (!attributeDefinitions) throw new ProvisioningError(`AttributeDefinitions is required for DynamoDB GlobalTable ${logicalId}`, resourceType, logicalId);
 		let billingMode;
 		let billingModeSubstituted = false;
+		let billingModeAbsentOnReplay = false;
 		try {
 			const billingReplayWarn = replayWarn(this.logger, context).onUnusable;
 			billingMode = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", billingReplayWarn ? { onUnusable: (message) => {
 				billingModeSubstituted = true;
 				billingReplayWarn(message);
 			} } : {});
-			if (billingReplayWarn && properties["BillingMode"] === void 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
+			if (billingReplayWarn && properties["BillingMode"] === void 0) {
+				billingModeAbsentOnReplay = true;
+				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
+			}
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -14277,10 +14281,11 @@ var DynamoDBGlobalTableProvider = class {
 		const diagnostics = [];
 		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "min", diagnostics);
 		let effectiveProperties;
-		if (billingModeSubstituted) effectiveProperties = {
+		if (billingModeSubstituted) effectiveProperties = stripProvisionedCapacityKeys({
 			...properties,
 			BillingMode: billingMode
-		};
+		});
+		else if (billingModeAbsentOnReplay) effectiveProperties = stripProvisionedCapacityKeys(properties);
 		const streamSpecInput = properties["StreamSpecification"];
 		const needsStream = replicas.some((r) => r["Region"] !== currentRegion) || replicas.length > 1;
 		if (streamSpecInput != null) {
@@ -14311,12 +14316,28 @@ var DynamoDBGlobalTableProvider = class {
 			};
 		}
 		let sdkIndexes;
+		let indexesOmitted = false;
 		try {
 			const onUnusableCreateIndexes = replayWarn(this.logger, context).onUnusable;
-			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, onUnusableCreateIndexes && ((message) => onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`)));
+			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, onUnusableCreateIndexes && ((message) => {
+				indexesOmitted = true;
+				onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
+			}));
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
+		if (indexesOmitted) {
+			effectiveProperties = { ...effectiveProperties ?? properties };
+			delete effectiveProperties["GlobalSecondaryIndexes"];
+			const replicasForOmit = effectiveProperties["Replicas"];
+			if (Array.isArray(replicasForOmit)) effectiveProperties["Replicas"] = replicasForOmit.map((entry) => {
+				const replica = asRecord$1(entry);
+				if (!replica || replica["Region"] !== currentRegion) return entry;
+				const copy = { ...replica };
+				delete copy["GlobalSecondaryIndexes"];
+				return copy;
+			});
+		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 		if (properties["SSESpecification"]) {
@@ -16462,6 +16483,82 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 	return result;
 }
 /**
+* Remove every PROVISIONED-only capacity member from a desired-property bag
+* (issue #1726).
+*
+* Used by `create()`'s `BillingMode` warn-and-SUBSTITUTE arm and by its ABSENT
+* sibling: whenever the create resolves to `PAY_PER_REQUEST` on a bag that was
+* not written for it, the same create skips `createParams.ProvisionedThroughput`
+* and every per-index / per-replica provisioned member is dropped before the
+* call (each of the reads below is gated on `billingMode === 'PROVISIONED'`).
+* Recording those keys describes capacity AWS never received.
+*
+* The set is the intersection of two questions, and BOTH are needed — taking
+* either alone is what the review of the first cut corrected:
+*
+* - **what could not have been SENT** — every member `toSdkGlobalSecondaryIndexes`
+*   / `toSdkReplicaThroughputOverrides` read behind a PROVISIONED gate, which
+*   includes the two legacy SDK-shaped spellings a pre-#1387 cdkd wrote into
+*   state (`GlobalSecondaryIndexes[].ProvisionedThroughput`,
+*   `Replicas[].ProvisionedThroughputOverride`). A state replay is exactly that
+*   population, so leaving them out made the strip narrower than its own rule.
+* - **what `readCurrentState` can REPORT under the new mode** — the top-level
+*   `WriteProvisionedThroughputSettings` emits `{}` for an on-demand table and
+*   every other member here is omitted entirely, so a surviving key is a record
+*   the readback can never match.
+*
+* DELIBERATELY NOT removed: every `*OnDemand*` member. `OnDemandThroughput` is
+* attached to `CreateTable` precisely when the mode is not PROVISIONED, so those
+* WERE sent — a blanket "strip anything throughput-shaped" would record a loss
+* that did not happen, and a unit row plus an integ phase fence exactly that.
+*
+* Pure and non-mutating at every level — the caller's bag is
+* `previousState.properties` on the replay path and the rollback executor
+* spreads the answer shallowly, so an in-place edit would corrupt a record the
+* caller still holds.
+*/
+function stripProvisionedCapacityKeys(properties) {
+	const result = { ...properties };
+	delete result["WriteProvisionedThroughputSettings"];
+	const indexes = result["GlobalSecondaryIndexes"];
+	if (Array.isArray(indexes)) result["GlobalSecondaryIndexes"] = indexes.map((entry) => {
+		const gsi = asRecord$1(entry);
+		if (!gsi) return entry;
+		const copy = { ...gsi };
+		delete copy["WriteProvisionedThroughputSettings"];
+		delete copy["ReadProvisionedThroughputSettings"];
+		delete copy["ProvisionedThroughput"];
+		return copy;
+	});
+	const replicas = result["Replicas"];
+	if (Array.isArray(replicas)) result["Replicas"] = replicas.map((entry) => {
+		const replica = asRecord$1(entry);
+		if (!replica) return entry;
+		const copy = { ...replica };
+		delete copy["ReadProvisionedThroughputSettings"];
+		delete copy["ProvisionedThroughputOverride"];
+		const replicaIndexes = copy["GlobalSecondaryIndexes"];
+		if (Array.isArray(replicaIndexes)) {
+			const kept = replicaIndexes.map((indexEntry) => {
+				const gsi = asRecord$1(indexEntry);
+				if (!gsi) return indexEntry;
+				const indexCopy = { ...gsi };
+				delete indexCopy["ReadProvisionedThroughputSettings"];
+				delete indexCopy["ProvisionedThroughputOverride"];
+				return indexCopy;
+			}).filter((entry) => {
+				const gsi = asRecord$1(entry);
+				if (!gsi) return true;
+				return Object.keys(gsi).some((k) => k !== "IndexName");
+			});
+			if (kept.length > 0) copy["GlobalSecondaryIndexes"] = kept;
+			else delete copy["GlobalSecondaryIndexes"];
+		}
+		return copy;
+	});
+	return result;
+}
+/**
 * True when a CFn sub-object is nothing but an unresolved intrinsic
 * (`{"Fn::If": […]}` / `{"Ref": …}`), i.e. the template DID declare the block
 * but its value could not be resolved to a shape with members.
@@ -35556,8 +35653,9 @@ var CognitoUserPoolProvider = class {
 			createdUserPoolId = userPoolId;
 			const userPoolArn = userPool.Arn;
 			const region = await this.getClient().config.region();
-			const providerName = `cognito-idp.${region}.amazonaws.com/${userPoolId}`;
-			const providerUrl = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+			const { urlSuffix } = derivePartitionAndUrlSuffix(region);
+			const providerName = `cognito-idp.${region}.${urlSuffix}/${userPoolId}`;
+			const providerUrl = `https://cognito-idp.${region}.${urlSuffix}/${userPoolId}`;
 			await this.applyMfaConfig(userPoolId, properties);
 			this.logger.debug(`Successfully created Cognito User Pool ${logicalId}: ${userPoolId}`);
 			return {
@@ -35650,8 +35748,9 @@ var CognitoUserPoolProvider = class {
 			this.logger.debug(`Successfully updated Cognito User Pool ${logicalId}`);
 			const userPool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
 			const region = await this.getClient().config.region();
-			const providerName = `cognito-idp.${region}.amazonaws.com/${physicalId}`;
-			const providerUrl = `https://cognito-idp.${region}.amazonaws.com/${physicalId}`;
+			const { urlSuffix } = derivePartitionAndUrlSuffix(region);
+			const providerName = `cognito-idp.${region}.${urlSuffix}/${physicalId}`;
+			const providerUrl = `https://cognito-idp.${region}.${urlSuffix}/${physicalId}`;
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -73965,7 +74064,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.16");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.18");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;