@go-to-k/cdkd 0.62.0 → 0.63.0

package/dist/cli.js

@@ -42217,6 +42217,42 @@ var EC2Provider = class {
       throw err;
     }
   }
+  /**
+   * Drift-unknown paths per resource type.
+   *
+   * The 6 EC2 sub-resource types (`AWS::EC2::Route` /
+   * `VPCGatewayAttachment` / `SubnetRouteTableAssociation` /
+   * `SecurityGroupIngress` / `NetworkAclEntry` /
+   * `SubnetNetworkAclAssociation`) have NO AWS-side `Tags` API — the
+   * underlying AWS objects (route entries, NACL entries, route-table
+   * associations, NACL associations, IGW attachments) are not
+   * tag-bearing on AWS, and the corresponding CFn schemas do not model
+   * `Tags` either. Declaring `'Tags'` here is defense-in-depth: if a
+   * future CFn schema revision adds `Tags` to one of these types, or
+   * cdkd state somehow carries `Tags` for one of them via a custom
+   * property override, the drift comparator will skip the path
+   * instead of firing guaranteed false-positive drift on every clean
+   * run.
+   *
+   * Other EC2 types (`VPC` / `Subnet` / `InternetGateway` /
+   * `NatGateway` / `RouteTable` / `SecurityGroup` / `Instance` /
+   * `NetworkAcl`) have first-class Tags support via
+   * `DescribeTags` — they surface `Tags` directly in
+   * `readCurrentState` and don't need this declaration.
+   */
+  getDriftUnknownPaths(resourceType) {
+    switch (resourceType) {
+      case "AWS::EC2::Route":
+      case "AWS::EC2::VPCGatewayAttachment":
+      case "AWS::EC2::SubnetRouteTableAssociation":
+      case "AWS::EC2::SecurityGroupIngress":
+      case "AWS::EC2::NetworkAclEntry":
+      case "AWS::EC2::SubnetNetworkAclAssociation":
+        return ["Tags"];
+      default:
+        return [];
+    }
+  }
   async readVpcCurrentState(physicalId) {
     const resp = await this.ec2Client.send(new DescribeVpcsCommand2({ VpcIds: [physicalId] }));
     const vpc = resp.Vpcs?.[0];
@@ -57944,6 +57980,349 @@ var KinesisStreamProvider = class {
   }
 };
 
+// src/provisioning/providers/kinesis-streamconsumer-provider.ts
+import {
+  KinesisClient as KinesisClient2,
+  RegisterStreamConsumerCommand,
+  DeregisterStreamConsumerCommand,
+  DescribeStreamConsumerCommand,
+  ListTagsForResourceCommand as ListTagsForResourceCommand18,
+  TagResourceCommand as TagResourceCommand15,
+  UntagResourceCommand as UntagResourceCommand15,
+  ResourceNotFoundException as ResourceNotFoundException14
+} from "@aws-sdk/client-kinesis";
+var KinesisStreamConsumerProvider = class {
+  client;
+  providerRegion = process.env["AWS_REGION"];
+  logger = getLogger().child("KinesisStreamConsumerProvider");
+  handledProperties = /* @__PURE__ */ new Map([
+    ["AWS::Kinesis::StreamConsumer", /* @__PURE__ */ new Set(["ConsumerName", "StreamARN", "Tags"])]
+  ]);
+  getClient() {
+    if (!this.client) {
+      this.client = new KinesisClient2(this.providerRegion ? { region: this.providerRegion } : {});
+    }
+    return this.client;
+  }
+  /**
+   * Register a Kinesis stream consumer.
+   *
+   * Polls `DescribeStreamConsumer` until ConsumerStatus flips from
+   * `CREATING` to `ACTIVE` (matches CFn behavior). 1s polling interval
+   * is faster than the CC API exponential backoff used to be.
+   */
+  async create(logicalId, resourceType, properties) {
+    const consumerName = properties["ConsumerName"];
+    const streamArn = properties["StreamARN"];
+    if (!consumerName) {
+      throw new ProvisioningError(
+        "AWS::Kinesis::StreamConsumer requires ConsumerName",
+        resourceType,
+        logicalId
+      );
+    }
+    if (!streamArn) {
+      throw new ProvisioningError(
+        "AWS::Kinesis::StreamConsumer requires StreamARN",
+        resourceType,
+        logicalId
+      );
+    }
+    this.logger.debug(`Registering Kinesis stream consumer ${logicalId}: ${consumerName}`);
+    const tagList = Array.isArray(properties["Tags"]) ? properties["Tags"] : void 0;
+    const tagMap = tagListToMap(tagList);
+    try {
+      const resp = await this.getClient().send(
+        new RegisterStreamConsumerCommand({
+          StreamARN: streamArn,
+          ConsumerName: consumerName,
+          ...tagMap && Object.keys(tagMap).length > 0 ? { Tags: tagMap } : {}
+        })
+      );
+      const consumer = resp.Consumer;
+      if (!consumer?.ConsumerARN || !consumer.ConsumerName) {
+        throw new ProvisioningError(
+          "RegisterStreamConsumer did not return ConsumerARN/ConsumerName",
+          resourceType,
+          logicalId
+        );
+      }
+      const consumerArn = consumer.ConsumerARN;
+      await this.waitForConsumerActive(consumerArn);
+      this.logger.debug(`Successfully registered Kinesis stream consumer ${logicalId}`);
+      return {
+        physicalId: consumerArn,
+        attributes: {
+          ConsumerARN: consumerArn,
+          ConsumerName: consumer.ConsumerName,
+          ConsumerStatus: consumer.ConsumerStatus,
+          ConsumerCreationTimestamp: consumer.ConsumerCreationTimestamp?.toISOString() ?? void 0,
+          // CFn `Id` for StreamConsumer is the ConsumerARN (matches the
+          // CFn return-values doc).
+          Id: consumerArn,
+          StreamARN: streamArn
+        }
+      };
+    } catch (error) {
+      if (error instanceof ProvisioningError)
+        throw error;
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to register Kinesis stream consumer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
+        resourceType,
+        logicalId,
+        consumerName,
+        cause
+      );
+    }
+  }
+  /**
+   * Update is a no-op for the immutable `ConsumerName` / `StreamARN`
+   * fields (the deploy engine's replacement-detection layer triggers
+   * DELETE + CREATE for those changes). Tags ARE mutable via
+   * `TagResource` / `UntagResource` so the diff is applied here.
+   *
+   * If a non-Tags property changes, throw `ResourceUpdateNotSupportedError`
+   * — `cdkd drift --revert` will surface that to the user with the
+   * "use cdkd deploy --replace" suggestion.
+   */
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+    const newConsumerName = properties["ConsumerName"];
+    const oldConsumerName = previousProperties["ConsumerName"];
+    const newStreamArn = properties["StreamARN"];
+    const oldStreamArn = previousProperties["StreamARN"];
+    if (newConsumerName !== oldConsumerName || newStreamArn !== oldStreamArn) {
+      throw new ResourceUpdateNotSupportedError(
+        resourceType,
+        logicalId,
+        "AWS::Kinesis::StreamConsumer ConsumerName / StreamARN are immutable; re-deploy with cdkd deploy --replace, or destroy + redeploy"
+      );
+    }
+    await this.applyTagDiff(
+      physicalId,
+      previousProperties["Tags"],
+      properties["Tags"]
+    );
+    let attrs = {};
+    try {
+      const resp = await this.getClient().send(
+        new DescribeStreamConsumerCommand({ ConsumerARN: physicalId })
+      );
+      const desc = resp.ConsumerDescription;
+      if (desc) {
+        attrs = {
+          ConsumerARN: desc.ConsumerARN,
+          ConsumerName: desc.ConsumerName,
+          ConsumerStatus: desc.ConsumerStatus,
+          ConsumerCreationTimestamp: desc.ConsumerCreationTimestamp?.toISOString() ?? void 0,
+          Id: desc.ConsumerARN,
+          StreamARN: desc.StreamARN
+        };
+      }
+    } catch (err) {
+      this.logger.debug(
+        `DescribeStreamConsumer(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    return {
+      physicalId,
+      wasReplaced: false,
+      attributes: attrs
+    };
+  }
+  /**
+   * Deregister a Kinesis stream consumer.
+   *
+   * Per CFn semantics, DELETE returns once `DeregisterStreamConsumer`
+   * returns — AWS handles eventual disappearance asynchronously, but
+   * cdkd does not need to poll for that. `ResourceNotFoundException`
+   * is treated as idempotent success (subject to the standard region
+   * verification for delete idempotency).
+   */
+  async delete(logicalId, physicalId, resourceType, _properties, context) {
+    this.logger.debug(`Deregistering Kinesis stream consumer ${logicalId}: ${physicalId}`);
+    try {
+      await this.getClient().send(new DeregisterStreamConsumerCommand({ ConsumerARN: physicalId }));
+      this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
+    } catch (error) {
+      if (error instanceof ResourceNotFoundException14) {
+        const clientRegion = await this.getClient().config.region();
+        assertRegionMatch(
+          clientRegion,
+          context?.expectedRegion,
+          resourceType,
+          logicalId,
+          physicalId
+        );
+        this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
+        return;
+      }
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to deregister Kinesis stream consumer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
+        resourceType,
+        logicalId,
+        physicalId,
+        cause
+      );
+    }
+  }
+  async getAttribute(physicalId, _resourceType, attributeName) {
+    if (attributeName === "ConsumerARN" || attributeName === "Id") {
+      return physicalId;
+    }
+    const resp = await this.getClient().send(
+      new DescribeStreamConsumerCommand({ ConsumerARN: physicalId })
+    );
+    const desc = resp.ConsumerDescription;
+    if (!desc)
+      return void 0;
+    switch (attributeName) {
+      case "ConsumerName":
+        return desc.ConsumerName;
+      case "ConsumerStatus":
+        return desc.ConsumerStatus;
+      case "ConsumerCreationTimestamp":
+        return desc.ConsumerCreationTimestamp?.toISOString() ?? void 0;
+      case "StreamARN":
+        return desc.StreamARN;
+      default:
+        return void 0;
+    }
+  }
+  /**
+   * Read the AWS-current StreamConsumer configuration in CFn-property shape.
+   *
+   * Surfaces `ConsumerName` + `StreamARN` (the only user-controllable
+   * top-level CFn properties). AWS-managed read-only fields
+   * (`ConsumerARN`, `ConsumerCreationTimestamp`, `ConsumerStatus`) are
+   * omitted — they are not in `handledProperties` and surface only as
+   * `getAttribute` results.
+   *
+   * `Tags` are surfaced via `ListTagsForResource(ResourceARN=ConsumerARN)`
+   * with `aws:*` filtered out and the always-emit `[]` placeholder
+   * pattern (PR #145). The CFn schema for `AWS::Kinesis::StreamConsumer`
+   * does not currently model Tags as a top-level property, but cdkd
+   * surfaces it defensively so future schema revisions or custom
+   * property overrides can round-trip cleanly.
+   *
+   * Returns `undefined` when the consumer is gone
+   * (`ResourceNotFoundException`).
+   */
+  async readCurrentState(physicalId, _logicalId, resourceType) {
+    if (resourceType !== "AWS::Kinesis::StreamConsumer")
+      return void 0;
+    let desc;
+    try {
+      const resp = await this.getClient().send(
+        new DescribeStreamConsumerCommand({ ConsumerARN: physicalId })
+      );
+      desc = resp.ConsumerDescription;
+    } catch (err) {
+      if (err instanceof ResourceNotFoundException14)
+        return void 0;
+      throw err;
+    }
+    if (!desc)
+      return void 0;
+    const result = {};
+    if (desc.ConsumerName !== void 0)
+      result["ConsumerName"] = desc.ConsumerName;
+    if (desc.StreamARN !== void 0)
+      result["StreamARN"] = desc.StreamARN;
+    try {
+      const tagsResp = await this.getClient().send(
+        new ListTagsForResourceCommand18({ ResourceARN: physicalId })
+      );
+      result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
+    } catch (err) {
+      if (err instanceof ResourceNotFoundException14)
+        return void 0;
+      this.logger.debug(
+        `ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      result["Tags"] = [];
+    }
+    return result;
+  }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via Kinesis's
+   * generic `TagResource` (TagMap shape) / `UntagResource` (TagKeys list)
+   * APIs. Mirrors `KinesisStreamProvider.applyTagDiff`, except the
+   * Kinesis service splits the per-resource-type tag APIs vs the generic
+   * tag APIs — StreamConsumer uses the generic ones (which accept any
+   * Kinesis resource ARN).
+   */
+  async applyTagDiff(consumerArn, oldTagsRaw, newTagsRaw) {
+    const oldMap = tagListToMap(oldTagsRaw) ?? {};
+    const newMap = tagListToMap(newTagsRaw) ?? {};
+    const tagsToAdd = {};
+    for (const [k, v] of Object.entries(newMap)) {
+      if (oldMap[k] !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of Object.keys(oldMap)) {
+      if (!(k in newMap))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new UntagResourceCommand15({ ResourceARN: consumerArn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(
+        `Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`
+      );
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.getClient().send(
+        new TagResourceCommand15({ ResourceARN: consumerArn, Tags: tagsToAdd })
+      );
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Kinesis stream consumer ${consumerArn}`
+      );
+    }
+  }
+  /**
+   * Poll DescribeStreamConsumer until the consumer reaches `ACTIVE`.
+   *
+   * Uses 1s polling intervals — consumer registration is typically
+   * sub-second, but AWS can take up to ~30s under load. Caps at 60
+   * attempts (1 minute total) which is bounded above by the per-resource
+   * `--resource-timeout` deadline.
+   */
+  async waitForConsumerActive(consumerArn, maxAttempts = 60) {
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      const resp = await this.getClient().send(
+        new DescribeStreamConsumerCommand({ ConsumerARN: consumerArn })
+      );
+      const status = resp.ConsumerDescription?.ConsumerStatus;
+      this.logger.debug(
+        `Consumer ${consumerArn} status: ${status} (attempt ${attempt}/${maxAttempts})`
+      );
+      if (status === "ACTIVE")
+        return;
+      if (status !== "CREATING") {
+        throw new Error(`Unexpected consumer status: ${status}`);
+      }
+      await new Promise((resolve4) => setTimeout(resolve4, 1e3));
+    }
+    throw new Error(
+      `Consumer ${consumerArn} did not reach ACTIVE status within ${maxAttempts} seconds`
+    );
+  }
+};
+function tagListToMap(tags) {
+  if (!tags || tags.length === 0)
+    return void 0;
+  const out = {};
+  for (const t of tags) {
+    if (t.Key !== void 0 && t.Value !== void 0)
+      out[t.Key] = t.Value;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+
 // src/provisioning/providers/efs-provider.ts
 import {
   EFSClient,
@@ -58757,7 +59136,7 @@ import {
   DescribeDeliveryStreamCommand,
   ListDeliveryStreamsCommand,
   ListTagsForDeliveryStreamCommand,
-  ResourceNotFoundException as ResourceNotFoundException14
+  ResourceNotFoundException as ResourceNotFoundException15
 } from "@aws-sdk/client-firehose";
 var FirehoseProvider = class {
   client;
@@ -58990,7 +59369,7 @@ var FirehoseProvider = class {
       );
       this.logger.debug(`Successfully deleted Firehose delivery stream ${logicalId}`);
     } catch (error) {
-      if (error instanceof ResourceNotFoundException14) {
+      if (error instanceof ResourceNotFoundException15) {
         const clientRegion = await this.getClient().config.region();
         assertRegionMatch(
           clientRegion,
@@ -59169,7 +59548,7 @@ var FirehoseProvider = class {
       );
       desc = resp.DeliveryStreamDescription;
     } catch (err) {
-      if (err instanceof ResourceNotFoundException14)
+      if (err instanceof ResourceNotFoundException15)
         return void 0;
       throw err;
     }
@@ -59240,7 +59619,7 @@ var FirehoseProvider = class {
       );
       result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
     } catch (err) {
-      if (err instanceof ResourceNotFoundException14)
+      if (err instanceof ResourceNotFoundException15)
         return void 0;
       this.logger.debug(
         `Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -59284,7 +59663,7 @@ var FirehoseProvider = class {
         );
         return { physicalId: explicit, attributes: {} };
       } catch (err) {
-        if (err instanceof ResourceNotFoundException14)
+        if (err instanceof ResourceNotFoundException15)
           return null;
         throw err;
       }
@@ -59919,7 +60298,7 @@ import {
   UpdateProjectCommand,
   BatchGetProjectsCommand,
   ListProjectsCommand,
-  ResourceNotFoundException as ResourceNotFoundException15
+  ResourceNotFoundException as ResourceNotFoundException16
 } from "@aws-sdk/client-codebuild";
 var CodeBuildProvider = class {
   client;
@@ -60157,7 +60536,7 @@ var CodeBuildProvider = class {
       await this.getClient().send(new DeleteProjectCommand({ name: physicalId }));
       this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
     } catch (error) {
-      if (error instanceof ResourceNotFoundException15) {
+      if (error instanceof ResourceNotFoundException16) {
         const clientRegion = await this.getClient().config.region();
         assertRegionMatch(
           clientRegion,
@@ -60228,7 +60607,7 @@ var CodeBuildProvider = class {
       );
       project = resp.projects?.[0];
     } catch (err) {
-      if (err instanceof ResourceNotFoundException15)
+      if (err instanceof ResourceNotFoundException16)
         return void 0;
       throw err;
     }
@@ -60475,7 +60854,7 @@ var CodeBuildProvider = class {
         );
         return resp.projects?.[0]?.name ? { physicalId: explicit, attributes: {} } : null;
       } catch (err) {
-        if (err instanceof ResourceNotFoundException15)
+        if (err instanceof ResourceNotFoundException16)
           return null;
         throw err;
       }
@@ -60515,7 +60894,7 @@ import {
   GetVectorBucketCommand,
   ListIndexesCommand,
   ListVectorBucketsCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand18,
+  ListTagsForResourceCommand as ListTagsForResourceCommand19,
   DeleteIndexCommand
 } from "@aws-sdk/client-s3vectors";
 var S3VectorsProvider = class {
@@ -60749,7 +61128,7 @@ var S3VectorsProvider = class {
           continue;
         try {
           const tagsResp = await this.getClient().send(
-            new ListTagsForResourceCommand18({ resourceArn: bucket.vectorBucketArn })
+            new ListTagsForResourceCommand19({ resourceArn: bucket.vectorBucketArn })
           );
           if (tagsResp.tags?.[CDK_PATH_TAG] === input.cdkPath) {
             return { physicalId: bucket.vectorBucketName, attributes: {} };
@@ -61093,7 +61472,7 @@ import {
   ListNamespacesCommand as ListNamespacesCommand2,
   ListTablesCommand as ListTablesCommand2,
   ListTableBucketsCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand19,
+  ListTagsForResourceCommand as ListTagsForResourceCommand20,
   NotFoundException as NotFoundException6
 } from "@aws-sdk/client-s3tables";
 var S3TablesProvider = class {
@@ -61577,7 +61956,7 @@ var S3TablesProvider = class {
         if (input.cdkPath) {
           try {
             const tagsResp = await this.getClient().send(
-              new ListTagsForResourceCommand19({ resourceArn: bucket.arn })
+              new ListTagsForResourceCommand20({ resourceArn: bucket.arn })
             );
             if (tagsResp.tags?.[CDK_PATH_TAG] === input.cdkPath) {
               return { physicalId: bucket.arn, attributes: {} };
@@ -61657,7 +62036,7 @@ var S3TablesProvider = class {
                   continue;
                 try {
                   const tagsResp = await this.getClient().send(
-                    new ListTagsForResourceCommand19({ resourceArn: table.tableARN })
+                    new ListTagsForResourceCommand20({ resourceArn: table.tableARN })
                   );
                   if (tagsResp.tags?.[CDK_PATH_TAG] === input.cdkPath) {
                     return {
@@ -61742,8 +62121,8 @@ import {
   SetRepositoryPolicyCommand,
   PutImageScanningConfigurationCommand,
   PutImageTagMutabilityCommand,
-  TagResourceCommand as TagResourceCommand15,
-  ListTagsForResourceCommand as ListTagsForResourceCommand20,
+  TagResourceCommand as TagResourceCommand16,
+  ListTagsForResourceCommand as ListTagsForResourceCommand21,
   LifecyclePolicyNotFoundException,
   RepositoryNotFoundException
 } from "@aws-sdk/client-ecr";
@@ -61931,7 +62310,7 @@ var ECRProvider = class {
         const repoArn = describeResponse.repositories?.[0]?.repositoryArn;
         if (repoArn && newTags) {
           await this.getClient().send(
-            new TagResourceCommand15({
+            new TagResourceCommand16({
               resourceArn: repoArn,
               tags: newTags
             })
@@ -62073,7 +62452,7 @@ var ECRProvider = class {
     if (r.repositoryArn) {
       try {
         const tagsResp = await this.getClient().send(
-          new ListTagsForResourceCommand20({ resourceArn: r.repositoryArn })
+          new ListTagsForResourceCommand21({ resourceArn: r.repositoryArn })
         );
         const tags = normalizeAwsTagsToCfn(tagsResp.tags);
         result["Tags"] = tags;
@@ -62119,7 +62498,7 @@ var ECRProvider = class {
           continue;
         try {
           const tagsResp = await this.getClient().send(
-            new ListTagsForResourceCommand20({ resourceArn: repo.repositoryArn })
+            new ListTagsForResourceCommand21({ resourceArn: repo.repositoryArn })
           );
           if (matchesCdkPath(tagsResp.tags, input.cdkPath)) {
             return { physicalId: repo.repositoryName, attributes: {} };
@@ -63178,6 +63557,7 @@ function registerAllProviders(registry) {
   registry.register("AWS::KMS::Key", kmsProvider);
   registry.register("AWS::KMS::Alias", kmsProvider);
   registry.register("AWS::Kinesis::Stream", new KinesisStreamProvider());
+  registry.register("AWS::Kinesis::StreamConsumer", new KinesisStreamConsumerProvider());
   const efsProvider = new EFSProvider();
   registry.register("AWS::EFS::FileSystem", efsProvider);
   registry.register("AWS::EFS::MountTarget", efsProvider);
@@ -67993,7 +68373,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.62.0");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.63.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());