@go-to-k/cdkd 0.37.0 → 0.38.0

package/README.md

@@ -290,10 +290,16 @@ cdkd deploy MyStack \
 cdkd diff MyStack
 
 # Detect drift between cdkd state and AWS reality (state-only; no synth)
-# Exits 0 with no drift, 1 when drift is detected, 2 on error.
+# Exits 0 with no drift, 1 when drift is detected, 2 on partial revert failure.
 cdkd drift MyStack
 cdkd drift --all --json
 
+# Resolve drift: state ← AWS (catch up state with manual console changes)
+cdkd drift MyStack --accept --yes
+
+# Resolve drift: AWS ← state (push state values back into AWS via provider.update)
+cdkd drift MyStack --revert --yes
+
 # Dry run (plan only, no changes)
 cdkd deploy --dry-run
 

package/dist/cli.js

@@ -34066,6 +34066,7 @@ function createDiffCommand() {
 }
 
 // src/cli/commands/drift.ts
+import * as readline from "node:readline/promises";
 import { Command as Command6, Option as Option3 } from "commander";
 init_aws_clients();
 
@@ -34141,6 +34142,11 @@ async function driftCommand(stacks, options) {
   if (!options.all && stacks.length === 0) {
     throw new Error("Stack name is required. Usage: cdkd drift <stack> [<stack>...] | --all");
   }
+  if (options.accept && options.revert) {
+    throw new Error(
+      "--accept and --revert are mutually exclusive. Use --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS."
+    );
+  }
   await applyRoleArnIfSet({ roleArn: options.roleArn, region: options.region });
   const awsClients = new AwsClients({
     ...options.region && { region: options.region },
@@ -34151,14 +34157,11 @@ async function driftCommand(stacks, options) {
     const region = options.region || process.env["AWS_REGION"] || "us-east-1";
     const bucket = await resolveStateBucketWithDefault(options.stateBucket, region);
     const prefix = options.statePrefix;
-    const stateBackend = new S3StateBackend(
-      awsClients.s3,
-      { bucket, prefix },
-      {
-        region,
-        ...options.profile && { profile: options.profile }
-      }
-    );
+    const stateConfig = { bucket, prefix };
+    const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
+      region,
+      ...options.profile && { profile: options.profile }
+    });
     await stateBackend.verifyBucketExists();
     const providerRegistry = new ProviderRegistry();
     registerAllProviders(providerRegistry);
@@ -34186,8 +34189,22 @@ async function driftCommand(stacks, options) {
       writeHumanReport(reports);
     }
     const drifted = reports.some((r) => r.outcomes.some((o) => o.kind === "drifted"));
-    if (drifted) {
-      throw new DriftDetectedError();
+    if (!options.accept && !options.revert) {
+      if (drifted) {
+        throw new DriftDetectedError();
+      }
+      return;
+    }
+    if (!drifted) {
+      logger.info(
+        options.accept ? "No drift detected \u2014 nothing to accept." : "No drift detected \u2014 nothing to revert."
+      );
+      return;
+    }
+    if (options.accept) {
+      await runAccept(reports, stateBackend, stateConfig, awsClients, options);
+    } else {
+      await runRevert(reports, providerRegistry, stateConfig, awsClients, options);
     }
   } finally {
     awsClients.destroy();
@@ -34288,13 +34305,261 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
           kind: "drifted",
           logicalId,
           resourceType: resource.resourceType,
-          changes
+          changes,
+          awsProperties: aws
         });
       }
     }
-    return { stackName, region, outcomes };
+    return {
+      stackName,
+      region,
+      outcomes,
+      state,
+      etag: result.etag,
+      migrationPending: result.migrationPending ?? false
+    };
   });
 }
+function setAtPath(target, path, value) {
+  if (path.length === 0) {
+    return;
+  }
+  const segments = path.split(".");
+  let cursor = target;
+  for (let i = 0; i < segments.length - 1; i++) {
+    const key = segments[i];
+    const next = cursor[key];
+    if (next === void 0 || next === null || typeof next !== "object" || Array.isArray(next)) {
+      const fresh = {};
+      cursor[key] = fresh;
+      cursor = fresh;
+    } else {
+      cursor = next;
+    }
+  }
+  cursor[segments[segments.length - 1]] = value;
+}
+async function runAccept(reports, stateBackend, stateConfig, awsClients, options) {
+  const logger = getLogger();
+  printAcceptPlan(reports);
+  if (options.dryRun) {
+    logger.info("--dry-run: state will NOT be written. Re-run without --dry-run to apply.");
+    return;
+  }
+  if (!options.yes) {
+    const ok = await confirmPrompt(`Update cdkd state with the AWS-current values shown above?`);
+    if (!ok) {
+      logger.info("Aborted.");
+      return;
+    }
+  }
+  const lockManager = new LockManager(awsClients.s3, stateConfig);
+  const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
+  for (const report of reports) {
+    const driftedOutcomes = report.outcomes.filter(
+      (o) => o.kind === "drifted"
+    );
+    if (driftedOutcomes.length === 0) {
+      continue;
+    }
+    await lockManager.acquireLock(report.stackName, report.region, owner, "drift-accept");
+    try {
+      const resources = { ...report.state.resources };
+      for (const outcome of driftedOutcomes) {
+        const existing = resources[outcome.logicalId];
+        if (!existing)
+          continue;
+        const newProperties = JSON.parse(JSON.stringify(existing.properties ?? {}));
+        for (const change of outcome.changes) {
+          setAtPath(newProperties, change.path, change.awsValue);
+        }
+        resources[outcome.logicalId] = {
+          ...existing,
+          properties: newProperties
+        };
+      }
+      const newState = {
+        ...report.state,
+        resources,
+        lastModified: Date.now()
+      };
+      const saveOptions = {
+        expectedEtag: report.etag
+      };
+      if (report.migrationPending) {
+        saveOptions.migrateLegacy = true;
+      }
+      await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
+      logger.info(
+        `\u2713 State updated for ${report.stackName} (${report.region}): accepted drift on ${driftedOutcomes.length} resource(s).`
+      );
+    } finally {
+      await lockManager.releaseLock(report.stackName, report.region).catch((err) => {
+        logger.warn(
+          `Failed to release lock for ${report.stackName} (${report.region}): ` + (err instanceof Error ? err.message : String(err))
+        );
+      });
+    }
+  }
+}
+async function runRevert(reports, providerRegistry, stateConfig, awsClients, options) {
+  const logger = getLogger();
+  printRevertPlan(reports);
+  if (options.dryRun) {
+    logger.info("--dry-run: AWS will NOT be modified. Re-run without --dry-run to apply.");
+    return;
+  }
+  if (!options.yes) {
+    const ok = await confirmPrompt(
+      `Push cdkd state values back into AWS for the resources shown above?`
+    );
+    if (!ok) {
+      logger.info("Aborted.");
+      return;
+    }
+  }
+  const lockManager = new LockManager(awsClients.s3, stateConfig);
+  const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
+  const concurrency = Math.max(1, options.concurrency ?? 4);
+  let totalFailed = 0;
+  let totalSucceeded = 0;
+  for (const report of reports) {
+    const driftedOutcomes = report.outcomes.filter(
+      (o) => o.kind === "drifted"
+    );
+    if (driftedOutcomes.length === 0) {
+      continue;
+    }
+    await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
+    try {
+      const tasks = driftedOutcomes.map((outcome) => async () => {
+        const stateResource = report.state.resources[outcome.logicalId];
+        if (!stateResource) {
+          totalFailed++;
+          logger.error(
+            `  \u2717 ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): resource missing from state; skipped.`
+          );
+          return;
+        }
+        const provider = providerRegistry.getProvider(outcome.resourceType);
+        try {
+          await withRetry(
+            () => provider.update(
+              outcome.logicalId,
+              stateResource.physicalId,
+              outcome.resourceType,
+              stateResource.properties ?? {},
+              outcome.awsProperties
+            ),
+            outcome.logicalId,
+            { logger: { debug: (msg) => logger.debug(msg) } }
+          );
+          totalSucceeded++;
+          logger.info(
+            `  \u2713 ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`
+          );
+        } catch (err) {
+          totalFailed++;
+          const msg = err instanceof Error ? err.message : String(err);
+          logger.error(
+            `  \u2717 ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): ${msg}`
+          );
+        }
+      });
+      await runWithConcurrency(tasks, concurrency);
+    } finally {
+      await lockManager.releaseLock(report.stackName, report.region).catch((err) => {
+        logger.warn(
+          `Failed to release lock for ${report.stackName} (${report.region}): ` + (err instanceof Error ? err.message : String(err))
+        );
+      });
+    }
+  }
+  logger.info(`
+Revert summary: ${totalSucceeded} reverted, ${totalFailed} failed.`);
+  if (totalFailed > 0) {
+    throw new PartialFailureError(
+      `Revert completed with ${totalFailed} resource error(s). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`
+    );
+  }
+}
+function printAcceptPlan(reports) {
+  for (const report of reports) {
+    const drifted = report.outcomes.filter(
+      (o) => o.kind === "drifted"
+    );
+    if (drifted.length === 0)
+      continue;
+    process.stdout.write(
+      `
+Plan (--accept): update cdkd state for ${report.stackName} (${report.region}):
+`
+    );
+    for (const o of drifted) {
+      process.stdout.write(`  ~ ${o.logicalId} (${o.resourceType})
+`);
+      for (const change of o.changes) {
+        process.stdout.write(
+          `    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}
+`
+        );
+      }
+    }
+  }
+}
+function printRevertPlan(reports) {
+  for (const report of reports) {
+    const drifted = report.outcomes.filter(
+      (o) => o.kind === "drifted"
+    );
+    if (drifted.length === 0)
+      continue;
+    process.stdout.write(
+      `
+Plan (--revert): push cdkd state values back into AWS for ${report.stackName} (${report.region}):
+`
+    );
+    for (const o of drifted) {
+      const word = o.changes.length === 1 ? "property path" : "property paths";
+      process.stdout.write(
+        `  \u2192 provider.update on ${o.logicalId} (${o.resourceType}): revert ${o.changes.length} ${word}
+`
+      );
+      for (const change of o.changes) {
+        process.stdout.write(
+          `    ${change.path}: ${formatScalar(change.awsValue)} -> ${formatScalar(change.stateValue)}
+`
+        );
+      }
+    }
+  }
+}
+async function runWithConcurrency(tasks, concurrency) {
+  const queue = [...tasks];
+  const workers = [];
+  for (let i = 0; i < Math.min(concurrency, queue.length); i++) {
+    workers.push(
+      (async () => {
+        while (queue.length > 0) {
+          const task = queue.shift();
+          if (!task)
+            break;
+          await task();
+        }
+      })()
+    );
+  }
+  await Promise.all(workers);
+}
+async function confirmPrompt(prompt) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const ans = await rl.question(`${prompt} [y/N] `);
+    return /^y(es)?$/i.test(ans.trim());
+  } finally {
+    rl.close();
+  }
+}
 function writeJsonReport(reports) {
   const payload = reports.map((r) => {
     const drifted = r.outcomes.filter((o) => o.kind === "drifted").map((o) => ({ logicalId: o.logicalId, type: o.resourceType, changes: o.changes }));
@@ -34371,8 +34636,25 @@ function stackRegionOption() {
 }
 function createDriftCommand() {
   const cmd = new Command6("drift").description(
-    "Detect drift between cdkd state and AWS reality. Exits 0 when no drift, 1 when drift is detected."
-  ).argument("[stacks...]", "Stack name(s) to check (physical CloudFormation names)").option("--all", "Check every stack in the state bucket", false).option("--json", "Output as JSON", false).addOption(stackRegionOption()).action(withErrorHandling(driftCommand));
+    "Detect drift between cdkd state and AWS reality. Exits 0 when no drift, 1 when drift is detected. Pass --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS."
+  ).argument("[stacks...]", "Stack name(s) to check (physical CloudFormation names)").option("--all", "Check every stack in the state bucket", false).option("--json", "Output as JSON", false).option(
+    "--accept",
+    "Update cdkd state with the AWS-current values for every drifted property (state \u2190 AWS). Mutually exclusive with --revert.",
+    false
+  ).option(
+    "--revert",
+    "Push cdkd state values back into AWS via provider.update for every drifted resource (AWS \u2190 state). Mutually exclusive with --accept.",
+    false
+  ).option(
+    "--dry-run",
+    "Print the planned mutations without acquiring a lock or hitting AWS / S3. Honored by --accept and --revert.",
+    false
+  ).option(
+    "--concurrency <number>",
+    "Maximum concurrent provider.update calls during --revert",
+    (value) => parseInt(value, 10),
+    4
+  ).addOption(stackRegionOption()).action(withErrorHandling(driftCommand));
   [...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
   cmd.addOption(deprecatedRegionOption);
   return cmd;
@@ -34383,7 +34665,7 @@ import { Command as Command7 } from "commander";
 init_aws_clients();
 
 // src/cli/commands/destroy-runner.ts
-import * as readline from "node:readline/promises";
+import * as readline2 from "node:readline/promises";
 init_aws_clients();
 async function runDestroyForStack(stackName, state, ctx) {
   const logger = getLogger();
@@ -34409,7 +34691,7 @@ Resources to be deleted (${resourceCount}):`);
     logger.info(`  - ${logicalId} (${resource.resourceType})`);
   }
   if (!ctx.skipConfirmation) {
-    const rl = readline.createInterface({
+    const rl = readline2.createInterface({
       input: process.stdin,
       output: process.stdout
     });
@@ -34820,7 +35102,7 @@ function createDestroyCommand() {
 }
 
 // src/cli/commands/orphan.ts
-import * as readline2 from "node:readline/promises";
+import * as readline3 from "node:readline/promises";
 import { Command as Command8 } from "commander";
 init_aws_clients();
 
@@ -35353,7 +35635,7 @@ Re-run with --force to fall back to cached attribute values from state, or fix t
         return;
       }
       if (!options.yes && !options.force) {
-        const ok = await confirmPrompt(
+        const ok = await confirmPrompt2(
           `Orphan ${orphanLogicalIds.length} resource(s) from cdkd state for ${stackInfo.stackName} (${targetRegion})? AWS resources will NOT be deleted.`
         );
         if (!ok) {
@@ -35492,8 +35774,8 @@ function stringifyForAudit(value) {
     return JSON.stringify(value);
   return JSON.stringify(value);
 }
-async function confirmPrompt(prompt) {
-  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+async function confirmPrompt2(prompt) {
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const ans = await rl.question(`${prompt} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
@@ -35768,7 +36050,7 @@ function createForceUnlockCommand() {
 }
 
 // src/cli/commands/state.ts
-import * as readline4 from "node:readline/promises";
+import * as readline5 from "node:readline/promises";
 import { Command as Command12, Option as Option6 } from "commander";
 import {
   GetBucketLocationCommand as GetBucketLocationCommand2,
@@ -35778,7 +36060,7 @@ import {
 init_aws_clients();
 
 // src/cli/commands/state-migrate.ts
-import * as readline3 from "node:readline/promises";
+import * as readline4 from "node:readline/promises";
 import { Command as Command11 } from "commander";
 import {
   CopyObjectCommand,
@@ -35848,7 +36130,7 @@ async function stateMigrateCommand(options) {
       }
       if (!options.yes) {
         const action = options.removeLegacy ? "and DELETE the source bucket" : "(source bucket will be kept)";
-        const ok = await confirmPrompt2(
+        const ok = await confirmPrompt3(
           `Copy ${sourceObjects.length} object(s) from ${legacyBucket} -> ${newBucket} ${action}?`
         );
         if (!ok) {
@@ -36053,8 +36335,8 @@ async function emptyBucketAllVersions(s3, bucket) {
     versionIdMarker = resp.NextVersionIdMarker;
   } while (keyMarker || versionIdMarker);
 }
-async function confirmPrompt2(prompt) {
-  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+async function confirmPrompt3(prompt) {
+  const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const ans = await rl.question(`${prompt} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
@@ -36462,7 +36744,7 @@ Use 'cdkd destroy ${stackName}' if you want to delete the actual resources.
 
 `
         );
-        const rl = readline4.createInterface({
+        const rl = readline5.createInterface({
           input: process.stdin,
           output: process.stdout
         });
@@ -36553,7 +36835,7 @@ WARNING: This destroys ${stackNames.length} stack(s) and removes their state rec
 `);
       }
       process.stdout.write("\n");
-      const rl = readline4.createInterface({
+      const rl = readline5.createInterface({
         input: process.stdin,
         output: process.stdout
       });
@@ -36795,12 +37077,12 @@ function createStateCommand() {
 
 // src/cli/commands/import.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import * as readline6 from "node:readline/promises";
+import * as readline7 from "node:readline/promises";
 import { Command as Command13 } from "commander";
 init_aws_clients();
 
 // src/cli/commands/retire-cfn-stack.ts
-import * as readline5 from "node:readline/promises";
+import * as readline6 from "node:readline/promises";
 import {
   DescribeStacksCommand,
   DescribeStackResourcesCommand,
@@ -36845,7 +37127,7 @@ async function retireCloudFormationStack(options) {
   }
   const { body: newBody, modified } = injectRetainPolicies(tpl.TemplateBody, cfnStackName);
   if (!yes) {
-    const ok = await confirmPrompt3(
+    const ok = await confirmPrompt4(
       `Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', then delete the stack? AWS resources will NOT be deleted (cdkd state has been written).`
     );
     if (!ok) {
@@ -37005,8 +37287,8 @@ async function getCloudFormationResourceMapping(cfnStackName, cfnClient) {
   }
   return map;
 }
-async function confirmPrompt3(prompt) {
-  const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
+async function confirmPrompt4(prompt) {
+  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const ans = await rl.question(`${prompt} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
@@ -37205,7 +37487,7 @@ async function importCommand(stackArg, options) {
         const preservedCount = selectiveMode && existingState ? Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length : 0;
         const totalAfter = importedCount + preservedCount;
         const breakdown = preservedCount > 0 ? ` (${importedCount} new/overwritten + ${preservedCount} preserved)` : "";
-        const ok = await confirmPrompt4(
+        const ok = await confirmPrompt5(
           `Write state for ${stackInfo.stackName} (${targetRegion}) with ${totalAfter} resource(s)${breakdown}?`
         );
         if (!ok) {
@@ -37466,8 +37748,8 @@ function formatOutcome(outcome) {
       return "\u2717";
   }
 }
-async function confirmPrompt4(prompt) {
-  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+async function confirmPrompt5(prompt) {
+  const rl = readline7.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const ans = await rl.question(`${prompt} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
@@ -37544,7 +37826,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.37.0");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.38.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());