@go-to-k/cdkd 0.281.28 → 0.282.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-DnvhlIW5.js";
+import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as NestedStackChildDirectDestroyError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as ResourceUpdateNotSupportedError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceTimeoutError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Fn as withErrorHandling, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nt as getDockerCmd, O as cyan, On as StackHasActiveImportsError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as normalizeAwsError, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as MissingCdkCliError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ProvisioningError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as DeployCancelledError, _t as AssetPublisher, a as DeploymentEventsStore, an as AssemblyReader, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bn as LocalStartServiceError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as resolveBucketRegion, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as resetAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, fn as setAwsClients, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as derivePartitionAndUrlSuffix, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kn as StackTerminationProtectionError, kt as validateAssetBucketName, l as replayRollback, ln as AwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as CdkdError, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, on as processStackMessages, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as PARTITION_TABLE, rt as requireConfigObject, s as planRollback, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as getAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalInvokeBuildError$1, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as PartialFailureError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalMigrateError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-DGoHusjU.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CPA-dc1x.js";
+import { t as ASGProvider } from "./asg-provider-s09zJlib.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -56182,20 +56182,61 @@ function canonicalizeIdArraysDeep(v) {
 	return v;
 }
 /**
+* Suffix marking a provider-declared path entry as LEAF-ONLY — the path
+* itself, and nothing beneath it (issue
+* [#1783](https://github.com/go-to-k/cdkd/issues/1783)).
+*
+* Spelled `[]` because every real consumer is an ARRAY at the declared path
+* whose ELEMENTS must be left alone: `'GlobalSecondaryIndexes[]'` reads as
+* "the index list is an unordered set", which is exactly the claim being
+* made, while `'GlobalSecondaryIndexes'` would additionally claim it about
+* every array inside each element.
+*/
+const LEAF_ONLY_PATH_SUFFIX = "[]";
+/**
 * Match a dotted property path against a provider-declared path list.
 *
 * An entry matches when the path is exactly equal to it, OR when the entry is
-* a prefix followed by `.`. Every entry is therefore a SUBTREE declaration:
+* a prefix followed by `.` — so a plain entry is a SUBTREE declaration:
 * `'VpcConfig'` matches `VpcConfig`, `VpcConfig.SubnetIds`, and anything
-* deeper. There is no leaf-only form.
-*
-* Shared by the two provider-declared path lists so their semantics cannot
-* drift apart: `getDriftUnknownPaths` (via `isIgnoredPath` in
-* `drift-calculator.ts`) and `getDriftUnorderedPaths` (via
+* deeper.
+*
+* An entry ending in {@link LEAF_ONLY_PATH_SUFFIX} is LEAF-ONLY and matches
+* that one path exactly. It exists because a subtree declaration is the wrong
+* unit whenever a declared array's ELEMENTS contain a member the claim must
+* not extend to (issue [#1783](https://github.com/go-to-k/cdkd/issues/1783)):
+* `AWS::DynamoDB::Table.GlobalSecondaryIndexes` is an unordered set keyed by
+* `IndexName`, but each element carries a `KeySchema` that is order-SIGNIFICANT
+* (HASH before RANGE), and the unordered walk descends into array elements
+* giving them their parent's path — so `'GlobalSecondaryIndexes'` would sort
+* the per-index key schema too and HIDE a real key change. Declaring
+* `'GlobalSecondaryIndexes[]'` sorts the list and stops there.
+*
+* The marker is understood by BOTH provider-declared lists rather than only by
+* the one that needed it, so their spellings cannot diverge — which is the
+* whole reason this matcher is shared: `getDriftUnknownPaths` (via
+* `isIgnoredPath` in `drift-calculator.ts`) and `getDriftUnorderedPaths` (via
 * {@link canonicalizeUnorderedArraysAtPaths} below).
+*
+* A bare `'[]'` entry (empty base path) matches NOTHING. It would otherwise
+* name the root bag, which no caller can mean, and silently sorting a root
+* array is a worse answer than ignoring a malformed declaration.
+*
+* NOTE not every entry is a hand-written declaration: `drift.ts` also feeds
+* `undeclaredEmptyObservedKeys`' output (raw top-level STATE keys, issue
+* #1498) into the ignore-path list. Those are data-derived, so the marker
+* would be a misreading if a key could end in `[]` — it cannot, because a
+* CloudFormation property name is alphanumeric, so no state key reaches this
+* matcher carrying the suffix. Keep that true if the ignore-path list ever
+* gains a source with freer key syntax.
 */
 function matchesPathPrefix(path, entries) {
 	for (const entry of entries) {
+		if (entry.endsWith("[]")) {
+			const leaf = entry.slice(0, -2);
+			if (leaf !== "" && path === leaf) return true;
+			continue;
+		}
 		if (path === entry) return true;
 		if (path.startsWith(`${entry}.`)) return true;
 	}
@@ -56211,8 +56252,10 @@ function matchesPathPrefix(path, entries) {
 * Paths use dot-notation for nested keys and are matched by the shared
 * {@link matchesPathPrefix} rule, the same one `getDriftUnknownPaths` uses. So
 * `'WindowsConfiguration'` covers every plain-string array in that subtree, and
-* `'WindowsConfiguration.Aliases'` covers that path and everything beneath it
-* (every entry is a subtree declaration — there is no leaf-only form).
+* `'WindowsConfiguration.Aliases'` covers that path and everything beneath it.
+* Append {@link LEAF_ONLY_PATH_SUFFIX} to claim the path ALONE —
+* `'GlobalSecondaryIndexes[]'` sorts that list without reaching the arrays
+* inside its elements.
 *
 * One semantic DIVERGENCE from `getDriftUnknownPaths`, required for this pass
 * to work: `isIgnoredPath` never sees a path that crosses an array, because the
@@ -57236,7 +57279,11 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
 			const normalized = await canonicalizePrincipalUniqueIds(baseline, aws, resolvePrincipalUniqueId);
 			const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
-			const changes = calculateResourceDrift(protocolNormalized.baseline, protocolNormalized.aws, {
+			const canonicalized = provider.canonicalizeDriftProperties ? {
+				baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
+				aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
+			} : protocolNormalized;
+			const changes = calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
 				ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 				unionWalkObjects: useObserved,
 				unorderedPaths
@@ -63511,6 +63558,24 @@ function escapeRegExp(value) {
 */
 const KEY_TERMINATORS = "[^\\s\"'?]";
 /**
+* URL suffixes gc must match that {@link PARTITION_TABLE} does NOT carry.
+*
+* Empty today, and deliberately kept as a declared seam rather than dropped:
+* it is what makes gc able to LEAD the derive table (issue #1785) now that
+* {@link AWS_URL_SUFFIXES} is built from it. Two directions need it:
+*
+* - A partition cdkd has recorded state for but whose region prefix is not in
+*   the derive table yet. Adding it here is a one-line, reviewable change that
+*   does not have to wait on the partition-table row.
+* - A suffix RETIRED from the derive table. Coupling propagates additions, but
+*   a row EDITED or removed there would silently stop gc matching state files
+*   already written with the old suffix — the irreversible direction. Such a
+*   suffix moves here rather than disappearing. `tests/unit/cli/gc.test.ts`
+*   fences that with a hand-written floor of the suffixes known today, so a
+*   removal reds until it is carried over deliberately.
+*/
+const GC_EXTRA_URL_SUFFIXES = [];
+/**
 * `(?:amazonaws\.com\.cn|amazonaws\.com|...)` — {@link AWS_URL_SUFFIXES} as a
 * non-capturing alternation, LONGEST FIRST so `amazonaws.com.cn` is tried
 * before its own `amazonaws.com` prefix instead of relying on backtracking.
@@ -63521,15 +63586,7 @@ const KEY_TERMINATORS = "[^\\s\"'?]";
 * patterns. Making it capturing would shift every index by one and silently
 * collect the suffix as if it were a key.
 */
-const URL_SUFFIX_ALTERNATION = `(?:${[...[
-	"amazonaws.com",
-	"amazonaws.com.cn",
-	"amazonaws.eu",
-	"c2s.ic.gov",
-	"sc2s.sgov.gov",
-	"cloud.adc-e.uk",
-	"csp.hci.ic.gov"
-]].sort((a, b) => b.length - a.length).map(escapeRegExp).join("|")})`;
+const URL_SUFFIX_ALTERNATION = `(?:${[...[.../* @__PURE__ */ new Set([...PARTITION_TABLE.map((row) => row.urlSuffix), ...GC_EXTRA_URL_SUFFIXES])]].sort((a, b) => b.length - a.length).map(escapeRegExp).join("|")})`;
 /**
 * The HOST half of an ECR registry, as an alternation over the forms AWS
 * serves: `<acct>.dkr.ecr.<region>.<urlSuffix>`, its FIPS sibling
@@ -63547,9 +63604,10 @@ const URL_SUFFIX_ALTERNATION = `(?:${[...[
 * Account and region are matched loosely on purpose (see the extractor doc):
 * collecting a reference from another account's or region's URI can only KEEP
 * more, never delete more — which is also why the two extra forms are worth
-* carrying even though cdkd's own publisher writes the plain one. Issue #1785
+* carrying even though cdkd's own publisher writes the plain one. Issue #1793
 * tracks deriving these host forms from ONE place shared with
-* `src/utils/ecr-uri.ts` instead of two hand-kept copies.
+* `src/utils/ecr-uri.ts` instead of two hand-kept copies — that module matches
+* only the plain `dkr.ecr` form today, so the two already disagree.
 *
 * Every group is non-capturing, for the {@link URL_SUFFIX_ALTERNATION} reason.
 */
@@ -75436,7 +75494,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.28");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.1");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;