@go-to-k/cdkd 0.115.0 → 0.115.1

package/dist/cli.js

@@ -39987,19 +39987,52 @@ function resolveHttpApiAuthorizer(authorizerLogicalId, routeAuthorizationScopes,
 	throw new RouteDiscoveryError(`${stackName}/${authorizerLogicalId}: AWS::ApiGatewayV2::Authorizer.AuthorizerType '${String(authType)}' is not supported by cdkd local start-api (only REQUEST / JWT).`);
 }
 /**
+* Thrown by {@link resolveLambdaArn} when the authorizer's
+* `AuthorizerUri` intrinsic does not resolve to a same-template Lambda
+* (cross-stack reference, imported Lambda, hand-rolled `Fn::Sub` outside
+* the invoke-ARN wrapper).
+*
+* Caught by {@link attachAuthorizers} and converted into a per-route
+* `unsupported` flag — symmetric with how `route-discovery.ts` handles
+* an unresolvable `IntegrationUri`. The route appears in the route
+* table as `[501 Not Implemented]` and returns HTTP 501 + the
+* `reason` at request time. The alternative ("attach no authorizer,
+* leave route normal") would be **unsafe** — it would let a request
+* hit a user-protected route without any auth check just because the
+* authorizer Lambda lives in another stack.
+*
+* Private to this module: `attachAuthorizers` is the only legitimate
+* consumer.
+*/
+var AuthorizerLambdaUnresolvableError = class AuthorizerLambdaUnresolvableError extends RouteDiscoveryError {
+	reason;
+	constructor(reason) {
+		super(reason);
+		this.reason = reason;
+		this.name = "AuthorizerLambdaUnresolvableError";
+		Object.setPrototypeOf(this, AuthorizerLambdaUnresolvableError.prototype);
+	}
+};
+/**
 * Resolve a Lambda ARN intrinsic to its logical ID. Delegates to the
 * shared `resolveLambdaArnIntrinsic` in `intrinsic-lambda-arn.ts`
 * (extracted in issue #286 Gaps 3 / 4); accepts `Ref` /
 * `Fn::GetAtt: [..., 'Arn']` / the REST v1 invoke-ARN `Fn::Join` wrapper
 * (now also used by CDK 2.x's `HttpLambdaAuthorizer` for HTTP API v2 —
 * verified via real `cdk synth` 2026-05-12) / the `Fn::Sub` invoke-ARN
-* wrapper (both 1-arg and 2-arg forms). Any other shape hard-errors with
-* the offending route + raw intrinsic named.
+* wrapper (both 1-arg and 2-arg forms).
+*
+* On an unresolvable intrinsic throws {@link AuthorizerLambdaUnresolvableError}
+* (caught by `attachAuthorizers` and converted into a per-route
+* deferred-501) instead of the generic `RouteDiscoveryError`, so
+* `cdkd local start-api` can boot against an app with a cross-stack
+* authorizer Lambda — symmetric with the route-level `IntegrationUri`
+* unresolvable case (issue #431).
 */
 function resolveLambdaArn(value, location) {
 	const outcome = resolveLambdaArnIntrinsic(value);
 	if (outcome.kind === "resolved") return outcome.logicalId;
-	throw new RouteDiscoveryError(`${location}: ${outcome.detail} (got ${shortJson(value)}). Only { Ref }, { Fn::GetAtt: [..., 'Arn'] }, the REST v1 invoke-ARN Fn::Join wrapper, and the Fn::Sub invoke-ARN wrapper are supported.`);
+	throw new AuthorizerLambdaUnresolvableError(`${location}: ${outcome.detail} (got ${shortJson(value)}). Only { Ref }, { Fn::GetAtt: [..., 'Arn'] }, the REST v1 invoke-ARN Fn::Join wrapper, and the Fn::Sub invoke-ARN wrapper are supported.`);
 }
 /**
 * REST v1 IdentitySource for TOKEN authorizers must be exactly one
@@ -40187,6 +40220,13 @@ function attachAuthorizers(stacks, routes) {
 				...authorizer && { authorizer }
 			});
 		} catch (err) {
+			if (err instanceof AuthorizerLambdaUnresolvableError) {
+				out.push({ route: {
+					...route,
+					unsupported: { reason: `${route.declaredAt}: authorizer Lambda Arn unresolvable — ${err.reason}` }
+				} });
+				continue;
+			}
 			errors.push(err instanceof Error ? err.message : String(err));
 		}
 	}
@@ -45520,7 +45560,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.115.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.115.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());