@go-to-k/cdkd 0.283.8 → 0.283.9

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveAutoAssetStorage, A as cyan, An as LocalMigrateError, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackTerminationProtectionError, Bt as buildDenyExternalAccessPolicy, C as makeCanonicalizePropertiesFn, Cn as setAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, Et as AssetPublisher, F as IAMRoleProvider, Fn as PartialFailureError, Ft as ensureAssetStorage, G as IntrinsicFunctionResolver, Gn as normalizeAwsError, Gt as runDockerStreaming, H as slowCcOperationTimeoutMs, Ht as formatDockerLoginError, I as collectInlinePolicyNamesManagedBySiblings, In as ProvisioningError, It as getBootstrapMarkerKey, J as refStateLookupFromResource, Jt as Synthesizer, K as cfnRefValueFromPhysicalId, Kn as withErrorHandling, Kt as AssetManifestLoader, L as clearOnUpdateRemoval, Ln as ResourceTimeoutError, Lt as parseBootstrapMarker, M as green, Mt as rewriteTemplateAssetReferences, N as red, Nn as MissingCdkCliError, Nt as AssetModeResolver, O as formatResourceLine, On as DeployCancelledError, Ot as WorkGraph, P as yellow, Pn as NestedStackChildDirectDestroyError, Pt as BOOTSTRAP_MARKER_PREFIX, Q as assertRegionMatch, Qt as resolveApp, R as ProviderRegistry, Rn as ResourceUpdateNotSupportedError, Rt as validateAssetBucketName, S as unsupportedFinalSnapshotError, Sn as resetAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as CdkdError, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as getDockerCmd, V as CloudControlProvider, Vt as buildDockerImage, W as isTerminationProtectionPropagationError, Wt as runDockerForeground, X as normalizeAwsTagsToCfn, Xt as getDefaultStateBucketName, Y as WAFv2WebACLProvider, Yt as synthesisStatusMessage, Z as resolveExplicitPhysicalId, Zt as getLegacyStateBucketName, _ as buildFinalSnapshotIdentifier, _n as processStackMessages, _t as isRetryableTransientError, a as DeploymentEventsStore, an as stateBucketExistenceConfirmed, at as requireConfigObject, b as isFinalSnapshotError, bn as AwsClients, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_URL_LIMIT, ct as s3BucketDomainName, d as deleteSkipReason, dn as uploadCfnTemplate, dt as s3BucketWebsiteUrl, en as resolveCaptureObservedState, et as configBooleanRefusal, f as withResourceDeadline, fn as expectedOwnerParam, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AssemblyReader, gt as isMarkedNonRetryable, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as derivePartitionAndUrlSuffix, ht as withRetry, i as DeploymentEventsReader, in as resolveUseCdkBootstrapAssets, it as requireConfigArray, j as gray, jn as LocalStartServiceError, jt as loadPublishableAssetManifest, k as bold, kn as LocalInvokeBuildError$1, kt as buildAssetRedirectMap, l as replayRollback, ln as MIGRATE_TMP_PREFIX, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as canonicalizeRegion, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefault, nt as readConfigString, o as planFailedOps, on as warnDeprecatedNoPrefixCliFlag, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as PARTITION_TABLE, pt as DiffCalculator, q as getAccountInfo, qt as getDockerImageBySourceHash, r as DeployEngine, rn as resolveStateBucketWithDefaultAndSource, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_BODY_LIMIT, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveSkipPrefix, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as findLargeInlineResources, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vt as isThrottlingError, w as extractDeploymentEventError, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as getAwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yn as resolveBucketRegion, yt as markNonRetryable, z as findActionableSilentDrops, zn as StackHasActiveImportsError, zt as validateContainerRepoName } from "./deploy-engine-D95wmKN8.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefaultAndSource, A as cyan, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as findSilentDropProperties, Bt as runDockerForeground, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalMigrateError, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as IntrinsicFunctionResolver, Gn as isThrottlingError, Gt as synthesisStatusMessage, H as slowCcOperationTimeoutMs, Hn as withErrorHandling, Ht as AssetManifestLoader, I as collectInlinePolicyNamesManagedBySiblings, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as refStateLookupFromResource, Jt as resolveApp, K as cfnRefValueFromPhysicalId, Kn as markNonRetryable, Kt as getDefaultStateBucketName, L as clearOnUpdateRemoval, Lt as buildDockerImage, M as green, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as red, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as formatResourceLine, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as assertRegionMatch, Qt as resolveStateBucketWithDefault, R as ProviderRegistry, Rt as formatDockerLoginError, S as unsupportedFinalSnapshotError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as isMarkedNonRetryable, Ut as getDockerImageBySourceHash, V as CloudControlProvider, Vn as normalizeAwsError, Vt as runDockerStreaming, W as isTerminationProtectionPropagationError, Wn as isRetryableTransientError, Wt as Synthesizer, X as normalizeAwsTagsToCfn, Xt as resolveCaptureObservedState, Y as WAFv2WebACLProvider, Yt as resolveAutoAssetStorage, Z as resolveExplicitPhysicalId, Zt as resolveSkipPrefix, _ as buildFinalSnapshotIdentifier, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as requireConfigObject, b as isFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketDomainName, d as deleteSkipReason, dn as derivePartitionAndUrlSuffix, dt as s3BucketWebsiteUrl, en as resolveUseCdkBootstrapAssets, et as configBooleanRefusal, f as withResourceDeadline, fn as AssemblyReader, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AwsClients, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveBucketRegion, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigArray, j as gray, jn as PartialFailureError, jt as ensureAssetStorage, k as bold, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as readConfigString, o as planFailedOps, on as findLargeInlineResources, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as processStackMessages, pt as DiffCalculator, q as getAccountInfo, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as replayWarn, s as planRollback, sn as uploadCfnTemplate, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as canonicalizeRegion, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as extractDeploymentEventError, wn as DeployCancelledError, wt as WorkGraph, x as refusesFinalSnapshot, xn as CdkdError, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as getDockerCmd } from "./deploy-engine-CWt7h7Nc.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Tu4sDbhu.js";
+import { t as ASGProvider } from "./asg-provider-D5ZBSgh2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15182,6 +15182,23 @@ var DynamoDBTableProvider = class {
 //#endregion
 //#region src/provisioning/providers/dynamodb-globaltable-provider.ts
 /**
+* The CLOSED path table {@link DynamoDBGlobalTableProvider.canonicalizeDriftProperties}
+* strips from BOTH drift comparison sides (issue #1742).
+*
+* One entry today: the AWS-computed `GlobalSecondaryIndexes[].WarmThroughput`.
+* A table rather than an inline check so a second per-array-element member
+* lands as a row instead of a second walk — and so the scope is READABLE as a
+* list of paths, which is what "closed table" means here. Deliberately does
+* NOT include `LocalSecondaryIndexes` (this provider's readback assigns the
+* raw SDK descriptions there, a wider divergence than one member) or
+* `Replicas[].GlobalSecondaryIndexes` (whose entries carry only the read-half
+* throughput blocks — no `WarmThroughput` is emitted or accepted there).
+*/
+const DRIFT_STRIPPED_INDEX_MEMBERS = [{
+	listKey: "GlobalSecondaryIndexes",
+	member: "WarmThroughput"
+}];
+/**
 * AWS DynamoDB GlobalTable Provider
 *
 * Implements resource provisioning for AWS::DynamoDB::GlobalTable using the
@@ -16635,7 +16652,12 @@ var DynamoDBGlobalTableProvider = class {
 					const entry = { IndexName: gsi.IndexName };
 					if (gsi.KeySchema) entry["KeySchema"] = gsi.KeySchema;
 					if (gsi.Projection) entry["Projection"] = gsi.Projection;
-					if (gsi.WarmThroughput) entry["WarmThroughput"] = gsi.WarmThroughput;
+					if (gsi.WarmThroughput) {
+						const warm = {};
+						if (gsi.WarmThroughput.ReadUnitsPerSecond !== void 0) warm["ReadUnitsPerSecond"] = gsi.WarmThroughput.ReadUnitsPerSecond;
+						if (gsi.WarmThroughput.WriteUnitsPerSecond !== void 0) warm["WriteUnitsPerSecond"] = gsi.WarmThroughput.WriteUnitsPerSecond;
+						if (Object.keys(warm).length > 0) entry["WarmThroughput"] = warm;
+					}
 					const replicaEntry = { IndexName: gsi.IndexName };
 					if (billingMode === "PROVISIONED") {
 						const writeAutoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:index:WriteCapacityUnits", void 0, gsi.IndexName);
@@ -16888,6 +16910,115 @@ var DynamoDBGlobalTableProvider = class {
 		return ["AttributeDefinitions"];
 	}
 	/**
+	* Strip the AWS-computed per-index `WarmThroughput` from BOTH drift
+	* comparison sides (issue #1742 defect 2, on the #1784 seam).
+	*
+	* `DescribeTable` reports a `WarmThroughput` for EVERY index whether or not
+	* the template asked for one — a default `{ReadUnitsPerSecond: 12000,
+	* WriteUnitsPerSecond: 4000, Status: 'ACTIVE'}`, measured us-east-1
+	* 2026-08-13 on the `rollback-replay-effective-props` fixture — so on a
+	* `properties`-only baseline (what a reverse-replacement rollback leaves
+	* behind, since `rollback-executor.ts` strips `observedProperties`) the
+	* member is a permanent one-sided difference: `cdkd drift` reports the table
+	* forever and `--revert` re-issues calls for it.
+	*
+	* Why this mechanism and not the two cheaper ones:
+	*
+	* - `getDriftUnknownPaths` (the #1760 answer for the sibling type's
+	*   TOP-LEVEL member) cannot express it. `calculateResourceDrift` compares
+	*   arrays wholesale, so `isIgnoredPath` is never asked about a path that
+	*   crosses one; the only expressible suppression is the WHOLE
+	*   `GlobalSecondaryIndexes` subtree, i.e. never detecting an index add /
+	*   remove / capacity change again — the #1420 stopgap already refused.
+	* - Gating the READBACK emission on the desired side (this issue's own
+	*   second candidate answer) removes the phantom for the `properties`
+	*   baseline and CREATES one for the far larger `observedProperties`
+	*   population: every bag already in S3 was written by a binary that emitted
+	*   the computed member, so the first `cdkd drift` after upgrading compares
+	*   a baseline that HAS it against a readback that does not, and reports the
+	*   whole array on an untouched table. It does not self-heal — the observed
+	*   capture only runs on CREATE / UPDATE. That attempt was implemented,
+	*   reviewed and REVERTED; do not re-propose it.
+	*
+	* Stripping from BOTH sides is what converges the two populations at once: a
+	* stale observed record and a fresh readback both lose the member, and a
+	* `properties` baseline that never had it now faces an AWS side without it.
+	*
+	* ACCEPTED COST, stated because it is a real loss: a template that DECLARES
+	* a per-index `WarmThroughput` no longer has changes to it REPORTED by
+	* `cdkd drift`. The value is still SENT (`toSdkGlobalSecondaryIndexes`
+	* forwards it on create and on a new index), so this is a detection gap, not
+	* a delivery one, and it is bounded by what cdkd could do about a difference
+	* anyway: warm throughput only ever GROWS on the AWS side and cannot be
+	* lowered, so `--revert` would issue a decrease AWS rejects — the residual
+	* issue #1768 records for the sibling type's declared arm. A per-index
+	* declared-gate is not expressible here in any case: this hook sees ONE bag
+	* with no `side` argument and no reference to the desired side, which is the
+	* symmetry the #1784 contract requires and the reason one-sided
+	* normalization is refused.
+	*
+	* Scope is a CLOSED table rather than a walk for any key named
+	* `WarmThroughput`: `Replicas[].GlobalSecondaryIndexes[]` entries carry only
+	* the read-half throughput blocks (no `WarmThroughput` is emitted or
+	* accepted there), and a blanket strip would remove a member from a path
+	* nobody measured. The table is a FLAT list of `{listKey, member}` pairs —
+	* the type is hardcoded one line below, not a key of it — and nothing
+	* mechanically fences it against `readCurrentState`: a future per-replica
+	* `WarmThroughput` emission would desync silently, so a member added to the
+	* readback needs a row added here in the same change.
+	*
+	* The `resourceType` guard is kept but is UNREACHABLE, and the earlier
+	* claim that it followed the #1784 CC-API-fallback caveat was WRONG — that
+	* caveat is about the BAG SHAPE when a type has no `readCurrentState`, and
+	* never produces a foreign `resourceType`. `drift.ts` resolves the provider
+	* by `(resourceType, provisionedBy)` and then passes that SAME type back in,
+	* and this provider is registered for exactly one type, so the `!==` arm
+	* cannot fire. It stays as a cheap shape guard for a future second
+	* registration, not because anything routes a foreign type here.
+	*
+	* UNCOVERED POPULATION, stated because the fix does NOT reach it: a
+	* cc-api-routed GlobalTable gets neither half. Top-level `WarmThroughput` is
+	* a `silentDrop` property for this type, so a template declaring it
+	* auto-routes the whole resource through Cloud Control (the #614 routing)
+	* and the route is STICKY — `drift.ts` then resolves `provider` to
+	* `CloudControlProvider`, this hook is never invoked, and the AWS side comes
+	* from CC's `GetResource`. So the `properties`-only-baseline phantom drift
+	* this closes survives there. Pre-existing, not introduced here.
+	*
+	* Note the trigger is the TOP-LEVEL `WarmThroughput`, NOT the per-index
+	* member this strips: a template declaring only the per-index member keeps
+	* `GlobalSecondaryIndexes` (a handled property), stays SDK-routed, and IS
+	* covered. Do not read this bound as "warm-throughput templates are
+	* uncovered" — an earlier draft of this comment said so and was wrong.
+	*
+	* Pure, non-mutating, and identity-returning when nothing applies: the input
+	* bag is the caller's state record / readback, an unaffected table pays
+	* nothing, and only the index entries that actually carry the member are
+	* rebuilt.
+	*/
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::DynamoDB::GlobalTable") return properties;
+		let result = properties;
+		for (const { listKey, member } of DRIFT_STRIPPED_INDEX_MEMBERS) {
+			const list = result[listKey];
+			if (!Array.isArray(list)) continue;
+			let stripped = false;
+			const canonical = list.map((element) => {
+				const entry = asRecord$1(element);
+				if (!entry || !(member in entry)) return element;
+				stripped = true;
+				const copy = { ...entry };
+				delete copy[member];
+				return copy;
+			});
+			if (stripped) result = {
+				...result,
+				[listKey]: canonical
+			};
+		}
+		return result;
+	}
+	/**
 	* Adopt an existing DynamoDB GlobalTable into cdkd state.
 	*
 	* Lookup order:
@@ -77189,7 +77320,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.8");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.9");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;