@go-to-k/cdkd 0.44.0 → 0.45.0

package/dist/cli.js

@@ -1187,6 +1187,22 @@ var PartialFailureError = class _PartialFailureError extends CdkdError {
     Object.setPrototypeOf(this, _PartialFailureError.prototype);
   }
 };
+var ResourceUpdateNotSupportedError = class _ResourceUpdateNotSupportedError extends CdkdError {
+  constructor(resourceType, logicalId, suggestion, cause) {
+    const tail = suggestion ? suggestion : "use cdkd deploy with --replace, or change the resource definition to create a new version";
+    super(
+      `${resourceType} (${logicalId}) cannot be updated in place: ${tail}.`,
+      "RESOURCE_UPDATE_NOT_SUPPORTED",
+      cause
+    );
+    this.resourceType = resourceType;
+    this.logicalId = logicalId;
+    this.suggestion = suggestion;
+    this.name = "ResourceUpdateNotSupportedError";
+    Object.setPrototypeOf(this, _ResourceUpdateNotSupportedError.prototype);
+  }
+  exitCode = 2;
+};
 function isCdkdError(error) {
   return error instanceof CdkdError;
 }
@@ -21335,20 +21351,22 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
     }
   }
   /**
-   * Update an API Gateway Authorizer
+   * Update an API Gateway Authorizer.
    *
-   * Authorizer updates are not commonly needed. For now, this is a no-op.
-   * The deployment engine handles replacement for immutable property changes.
+   * AWS exposes `UpdateAuthorizer` (PATCH) but cdkd does not yet plumb the
+   * patch-operations builder through. Authorizers are recreated by the
+   * deploy engine's immutable-property replacement path. `cdkd drift
+   * --revert` surfaces a clear "use --replace or re-deploy" message
+   * instead of silently no-op'ing the revert.
    */
-  updateAuthorizer(logicalId, physicalId, _resourceType) {
-    this.logger.debug(`Updating API Gateway Authorizer ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({
-      physicalId,
-      wasReplaced: false,
-      attributes: {
-        AuthorizerId: physicalId
-      }
-    });
+  updateAuthorizer(logicalId, _physicalId, _resourceType) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::ApiGateway::Authorizer",
+        logicalId,
+        "API Gateway Authorizer updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   /**
    * Delete an API Gateway Authorizer
@@ -21580,20 +21598,20 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
     }
   }
   /**
-   * Update an API Gateway Deployment
+   * Update an API Gateway Deployment.
    *
-   * Deployments are immutable - updates are not supported.
-   * The deployment engine should handle replacement if needed.
+   * Deployments are immutable — every property change requires a fresh
+   * Deployment. `cdkd drift --revert` therefore throws
+   * `ResourceUpdateNotSupportedError` instead of silently no-op'ing.
    */
-  updateDeployment(logicalId, physicalId, _resourceType) {
-    this.logger.debug(`Updating API Gateway Deployment ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({
-      physicalId,
-      wasReplaced: false,
-      attributes: {
-        DeploymentId: physicalId
-      }
-    });
+  updateDeployment(logicalId, _physicalId, _resourceType) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::ApiGateway::Deployment",
+        logicalId,
+        "API Gateway Deployment is immutable; re-deploy with cdkd deploy --replace, or change the resource definition to create a new Deployment"
+      )
+    );
   }
   /**
    * Delete an API Gateway Deployment
@@ -21894,17 +21912,22 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
     }
   }
   /**
-   * Update an API Gateway Method
+   * Update an API Gateway Method.
    *
-   * Methods are typically replaced via new deployment, so this is a no-op.
+   * AWS exposes `UpdateMethod` (PATCH) but cdkd does not yet plumb the
+   * patch-operations builder through. Methods are recreated by the deploy
+   * engine's immutable-property replacement path. `cdkd drift --revert`
+   * surfaces a clear "use --replace or re-deploy" message instead of
+   * silently no-op'ing the revert.
    */
-  updateMethod(logicalId, physicalId) {
-    this.logger.debug(`Updating API Gateway Method ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({
-      physicalId,
-      wasReplaced: false,
-      attributes: {}
-    });
+  updateMethod(logicalId, _physicalId) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::ApiGateway::Method",
+        logicalId,
+        "API Gateway Method updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   /**
    * Delete an API Gateway Method
@@ -22282,13 +22305,23 @@ var ApiGatewayV2Provider = class {
         );
     }
   }
-  update(logicalId, physicalId, resourceType, _properties, _previousProperties) {
-    this.logger.debug(`Updating ${resourceType} ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({
-      physicalId,
-      wasReplaced: false,
-      attributes: {}
-    });
+  /**
+   * HTTP API resources are treated as immutable by cdkd: the deploy engine
+   * recreates them on property changes via the immutable-property
+   * replacement path. AWS does expose `UpdateApi` / `UpdateRoute` /
+   * `UpdateIntegration` / `UpdateStage` / `UpdateAuthorizer`, but cdkd
+   * does not yet plumb them through. `cdkd drift --revert` surfaces a
+   * clear "use --replace or re-deploy" message instead of silently
+   * no-op'ing the revert.
+   */
+  update(logicalId, _physicalId, resourceType, _properties, _previousProperties) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        resourceType,
+        logicalId,
+        "API Gateway V2 (HTTP API) resources are recreated on property changes; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   async delete(logicalId, physicalId, resourceType, properties, context) {
     switch (resourceType) {
@@ -22964,6 +22997,7 @@ import {
   CreateCloudFrontOriginAccessIdentityCommand,
   DeleteCloudFrontOriginAccessIdentityCommand,
   GetCloudFrontOriginAccessIdentityCommand as GetCloudFrontOriginAccessIdentityCommand2,
+  UpdateCloudFrontOriginAccessIdentityCommand,
   NoSuchCloudFrontOriginAccessIdentity
 } from "@aws-sdk/client-cloudfront";
 init_aws_clients();
@@ -23019,17 +23053,61 @@ var CloudFrontOAIProvider = class {
     }
   }
   /**
-   * Update a CloudFront Origin Access Identity
+   * Update a CloudFront Origin Access Identity.
    *
-   * OAI config is effectively immutable (only Comment can change, which is cosmetic).
-   * No replacement needed for Comment changes.
+   * Only the `Comment` field is mutable on an OAI; `CallerReference` is set
+   * by cdkd at create time and cannot be changed. AWS exposes a single
+   * `UpdateCloudFrontOriginAccessIdentity` call that requires the current
+   * `ETag` (fetched via `GetCloudFrontOriginAccessIdentity`) and overwrites
+   * the entire `CloudFrontOriginAccessIdentityConfig`.
+   *
+   * Used by `cdkd drift --revert` to push the cdkd-state Comment back into
+   * AWS; on the normal deploy path this is also exercised when a user
+   * tweaks the Comment in their CDK code.
    */
-  update(logicalId, physicalId, _resourceType, _properties, _previousProperties) {
-    this.logger.debug(`Update requested for CloudFront OAI ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({
-      physicalId,
-      wasReplaced: false
-    });
+  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+    this.logger.debug(`Updating CloudFront OAI ${logicalId}: ${physicalId}`);
+    const config = properties["CloudFrontOriginAccessIdentityConfig"];
+    const comment = config?.["Comment"] ?? "";
+    try {
+      const getResponse = await this.cloudFrontClient.send(
+        new GetCloudFrontOriginAccessIdentityCommand2({ Id: physicalId })
+      );
+      const etag = getResponse.ETag;
+      if (!etag) {
+        throw new Error("GetCloudFrontOriginAccessIdentity did not return ETag");
+      }
+      await this.cloudFrontClient.send(
+        new UpdateCloudFrontOriginAccessIdentityCommand({
+          Id: physicalId,
+          IfMatch: etag,
+          CloudFrontOriginAccessIdentityConfig: {
+            // CallerReference is immutable; preserve whatever the OAI was
+            // created with so AWS does not reject the update.
+            CallerReference: getResponse.CloudFrontOriginAccessIdentity?.CloudFrontOriginAccessIdentityConfig?.CallerReference ?? logicalId,
+            Comment: comment
+          }
+        })
+      );
+      this.logger.debug(`Successfully updated CloudFront OAI ${logicalId}`);
+      return {
+        physicalId,
+        wasReplaced: false,
+        attributes: {
+          Id: physicalId,
+          S3CanonicalUserId: getResponse.CloudFrontOriginAccessIdentity?.S3CanonicalUserId
+        }
+      };
+    } catch (error) {
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to update CloudFront OAI ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
+        resourceType,
+        logicalId,
+        physicalId,
+        cause
+      );
+    }
   }
   /**
    * Delete a CloudFront Origin Access Identity
@@ -25570,34 +25648,14 @@ var ELBv2Provider = class {
       );
     }
   }
-  async updateLoadBalancer(logicalId, physicalId, resourceType, _properties) {
-    this.logger.debug(`Updating LoadBalancer ${logicalId}: ${physicalId}`);
-    try {
-      const describeResponse = await this.getClient().send(
-        new DescribeLoadBalancersCommand2({ LoadBalancerArns: [physicalId] })
-      );
-      const lb = describeResponse.LoadBalancers?.[0];
-      return {
-        physicalId,
-        wasReplaced: false,
-        attributes: {
-          DNSName: lb?.DNSName,
-          CanonicalHostedZoneID: lb?.CanonicalHostedZoneId,
-          LoadBalancerArn: physicalId,
-          LoadBalancerFullName: physicalId.split("/").slice(1).join("/"),
-          LoadBalancerName: lb?.LoadBalancerName
-        }
-      };
-    } catch (error) {
-      const cause = error instanceof Error ? error : void 0;
-      throw new ProvisioningError(
-        `Failed to update LoadBalancer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
-        resourceType,
+  updateLoadBalancer(logicalId, _physicalId, _resourceType, _properties) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::ElasticLoadBalancingV2::LoadBalancer",
         logicalId,
-        physicalId,
-        cause
-      );
-    }
+        "ELBv2 LoadBalancer in-place updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   async deleteLoadBalancer(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting LoadBalancer ${logicalId}: ${physicalId}`);
@@ -29590,15 +29648,14 @@ var ServiceDiscoveryProvider = class {
       );
     }
   }
-  updateNamespace(logicalId, physicalId) {
-    this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({
-      physicalId,
-      wasReplaced: false,
-      attributes: {
-        Id: physicalId
-      }
-    });
+  updateNamespace(logicalId, _physicalId) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::ServiceDiscovery::PrivateDnsNamespace",
+        logicalId,
+        "PrivateDnsNamespace updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   async deleteNamespace(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting private DNS namespace ${logicalId}: ${physicalId}`);
@@ -29693,15 +29750,14 @@ var ServiceDiscoveryProvider = class {
       );
     }
   }
-  updateService(logicalId, physicalId) {
-    this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({
-      physicalId,
-      wasReplaced: false,
-      attributes: {
-        Id: physicalId
-      }
-    });
+  updateService(logicalId, _physicalId) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::ServiceDiscovery::Service",
+        logicalId,
+        "ServiceDiscovery Service updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   async deleteService(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting service discovery service ${logicalId}: ${physicalId}`);
@@ -30049,9 +30105,22 @@ var AppSyncProvider = class {
         );
     }
   }
-  update(logicalId, physicalId, resourceType, _properties, _previousProperties) {
-    this.logger.debug(`Update for ${resourceType} ${logicalId} (${physicalId}) - no-op, immutable`);
-    return Promise.resolve({ physicalId, wasReplaced: false });
+  /**
+   * AppSync resources are treated as immutable by cdkd: every supported
+   * type (`GraphQLApi`, `GraphQLSchema`, `DataSource`, `Resolver`,
+   * `ApiKey`) is recreated on property changes via the deploy engine's
+   * immutable-property replacement path. There is no in-place update,
+   * so `cdkd drift --revert` surfaces a clear "use --replace or
+   * re-deploy" message instead of silently no-op'ing the revert.
+   */
+  update(logicalId, _physicalId, resourceType, _properties, _previousProperties) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        resourceType,
+        logicalId,
+        "AppSync resources are recreated on property changes; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   async delete(logicalId, physicalId, resourceType, _properties, context) {
     switch (resourceType) {
@@ -30788,10 +30857,11 @@ var GlueProvider = class {
   async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
     switch (resourceType) {
       case "AWS::Glue::Database":
-        this.logger.debug(
-          `Update for ${resourceType} ${logicalId} (${physicalId}) - no-op, immutable`
+        throw new ResourceUpdateNotSupportedError(
+          resourceType,
+          logicalId,
+          "Glue Database updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
         );
-        return { physicalId, wasReplaced: false };
       case "AWS::Glue::Table":
         return this.updateTable(logicalId, physicalId, resourceType, properties);
       default:
@@ -32414,8 +32484,15 @@ var EFSProvider = class {
         );
     }
   }
+  /**
+   * EFS resources are treated as immutable by cdkd's `update()`. The deploy
+   * engine recreates them on property changes via immutable-property
+   * detection. (AWS does expose `UpdateFileSystem` for ThroughputMode and
+   * `ModifyMountTargetSecurityGroups` for mount-target SGs — those are
+   * deferred to a follow-up PR.) `cdkd drift --revert` surfaces a clear
+   * "use --replace or re-deploy" message instead of silently no-op'ing.
+   */
   update(logicalId, physicalId, resourceType, _properties, _previousProperties) {
-    this.logger.debug(`Update for ${resourceType} ${logicalId} (${physicalId}) - no-op, immutable`);
     if (resourceType !== "AWS::EFS::FileSystem" && resourceType !== "AWS::EFS::MountTarget" && resourceType !== "AWS::EFS::AccessPoint") {
       throw new ProvisioningError(
         `Unsupported resource type: ${resourceType}`,
@@ -32424,7 +32501,13 @@ var EFSProvider = class {
         physicalId
       );
     }
-    return Promise.resolve({ physicalId, wasReplaced: false });
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        resourceType,
+        logicalId,
+        "EFS resources are recreated on property changes; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   async delete(logicalId, physicalId, resourceType, _properties, context) {
     switch (resourceType) {
@@ -33241,15 +33324,21 @@ var FirehoseProvider = class {
     }
   }
   /**
-   * Update a Firehose delivery stream
-   *
-   * Most changes require replacement, so this is a no-op.
+   * Firehose delivery streams are treated as immutable by cdkd. Most
+   * destination-config changes require replacement, and AWS's
+   * `UpdateDestination` API surface is deep enough that the deploy engine's
+   * immutable-property replacement path covers the common cases more
+   * reliably. `cdkd drift --revert` therefore surfaces a clear "use
+   * --replace or re-deploy" message instead of silently no-op'ing.
    */
-  update(logicalId, physicalId, resourceType, _properties, _previousProperties) {
-    this.logger.debug(
-      `Update for ${resourceType} ${logicalId} (${physicalId}) - no-op, most changes require replacement`
+  update(logicalId, _physicalId, resourceType, _properties, _previousProperties) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        resourceType,
+        logicalId,
+        "Firehose delivery streams are recreated on property changes; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
     );
-    return Promise.resolve({ physicalId, wasReplaced: false });
   }
   /**
    * Delete a Firehose delivery stream
@@ -38492,6 +38581,7 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
   const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
   const concurrency = Math.max(1, options.concurrency ?? 4);
   let totalFailed = 0;
+  let totalUnsupported = 0;
   let totalSucceeded = 0;
   for (const report of reports) {
     const driftedOutcomes = report.outcomes.filter(
@@ -38529,10 +38619,17 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
             `  \u2713 ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`
           );
         } catch (err) {
+          if (err instanceof ResourceUpdateNotSupportedError) {
+            totalUnsupported++;
+            logger.warn(
+              `  \u2298 ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not revert \u2014 ${err.message}`
+            );
+            return;
+          }
           totalFailed++;
           const msg = err instanceof Error ? err.message : String(err);
           logger.error(
-            `  \u2717 ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): ${msg}`
+            `  \u2717 ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed \u2014 ${msg}`
           );
         }
       });
@@ -38545,11 +38642,21 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
       });
     }
   }
+  const summaryParts = [`${totalSucceeded} reverted`];
+  if (totalUnsupported > 0)
+    summaryParts.push(`${totalUnsupported} update-not-supported`);
+  if (totalFailed > 0)
+    summaryParts.push(`${totalFailed} failed`);
   logger.info(`
-Revert summary: ${totalSucceeded} reverted, ${totalFailed} failed.`);
-  if (totalFailed > 0) {
+Revert summary: ${summaryParts.join(", ")}.`);
+  if (totalUnsupported > 0) {
+    logger.warn(
+      `${totalUnsupported} resource(s) cannot be reverted in place \u2014 re-deploy the stack with cdkd deploy --replace, or destroy + redeploy to push the cdkd-state values back into AWS.`
+    );
+  }
+  if (totalFailed > 0 || totalUnsupported > 0) {
     throw new PartialFailureError(
-      `Revert completed with ${totalFailed} resource error(s). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`
+      `Revert completed with ${totalFailed + totalUnsupported} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`
     );
   }
 }
@@ -41896,7 +42003,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.44.0");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.45.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());