@go-to-k/cdkd 0.151.1 → 0.152.1

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { _ as withSkipPrefix, a as runDockerStreaming, c as getLogger, d as getLiveRenderer, f as PATTERN_B_NAME_PROPERTIES, g as generateResourceNameWithFallback, h as generateResourceName, i as runDockerForeground, n as formatDockerLoginError, p as PATTERN_B_RESOURCE_TYPES, r as getDockerCmd, u as runStackBuffered, v as withStackName } from "./docker-cmd-EtWSTAje.js";
-import { A as AssetPublisher, B as resolveStateBucketWithDefault, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as getDefaultStateBucketName, G as MIGRATE_TMP_PREFIX, H as warnDeprecatedNoPrefixCliFlag, I as getLegacyStateBucketName, J as AssemblyReader, K as findLargeInlineResources, L as resolveApp, M as WorkGraph, N as buildDockerImage, O as S3StateBackend, P as Synthesizer, Q as CdkdError, R as resolveCaptureObservedState, S as IntrinsicFunctionResolver, T as DagBuilder, U as CFN_TEMPLATE_BODY_LIMIT, V as resolveStateBucketWithDefaultAndSource, W as CFN_TEMPLATE_URL_LIMIT, X as resolveBucketRegion, _ as normalizeAwsTagsToCfn, a as withRetry, at as MissingCdkCliError, b as CloudControlProvider, c as cyan, ct as ProvisioningError, d as red, dt as RouteDiscoveryError, f as yellow, ft as StackHasActiveImportsError, g as matchesCdkPath, h as CDK_PATH_TAG, i as withResourceDeadline, j as stringifyValue, k as shouldRetainResource, l as gray, lt as ResourceTimeoutError, m as collectInlinePolicyNamesManagedBySiblings, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LocalMigrateError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as NestedStackChildDirectDestroyError, p as IAMRoleProvider, pt as StackTerminationProtectionError, q as uploadCfnTemplate, r as DeployEngine, rt as LocalStartServiceError, s as bold, st as PartialFailureError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LocalInvokeBuildError, u as green, ut as ResourceUpdateNotSupportedError, v as resolveExplicitPhysicalId, vt as normalizeAwsError, w as DiffCalculator, x as assertRegionMatch, y as ProviderRegistry, yt as withErrorHandling, z as resolveSkipPrefix } from "./deploy-engine-CV51PIkg.js";
+import { A as AssetPublisher, B as resolveStateBucketWithDefault, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as getDefaultStateBucketName, G as MIGRATE_TMP_PREFIX, H as warnDeprecatedNoPrefixCliFlag, I as getLegacyStateBucketName, J as AssemblyReader, K as findLargeInlineResources, L as resolveApp, M as WorkGraph, N as buildDockerImage, O as S3StateBackend, P as Synthesizer, Q as CdkdError, R as resolveCaptureObservedState, S as IntrinsicFunctionResolver, T as DagBuilder, U as CFN_TEMPLATE_BODY_LIMIT, V as resolveStateBucketWithDefaultAndSource, W as CFN_TEMPLATE_URL_LIMIT, X as resolveBucketRegion, _ as normalizeAwsTagsToCfn, a as withRetry, at as MissingCdkCliError, b as CloudControlProvider, c as cyan, ct as ProvisioningError, d as red, dt as RouteDiscoveryError, f as yellow, ft as StackHasActiveImportsError, g as matchesCdkPath, h as CDK_PATH_TAG, i as withResourceDeadline, j as stringifyValue, k as shouldRetainResource, l as gray, lt as ResourceTimeoutError, m as collectInlinePolicyNamesManagedBySiblings, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LocalMigrateError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as NestedStackChildDirectDestroyError, p as IAMRoleProvider, pt as StackTerminationProtectionError, q as uploadCfnTemplate, r as DeployEngine, rt as LocalStartServiceError, s as bold, st as PartialFailureError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LocalInvokeBuildError, u as green, ut as ResourceUpdateNotSupportedError, v as resolveExplicitPhysicalId, vt as normalizeAwsError, w as DiffCalculator, x as assertRegionMatch, y as ProviderRegistry, yt as withErrorHandling, z as resolveSkipPrefix } from "./deploy-engine-CpPWAdiO.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-BF03Alpe.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -36677,6 +36677,29 @@ function flattenCdkdStateTreeLeafFirst(tree) {
 	}
 }
 /**
+* Flatten a {@link CdkdStateStackTree} into a depth-first list of
+* `(stackName, region)` pairs in **root-first** order — the inverse of
+* {@link flattenCdkdStateTreeLeafFirst}. Used by the parameter-resolution
+* pre-pass in `runPerStackImportLoop` (issue #464 follow-up): each child's
+* intrinsic-valued Parameters resolve against its parent's already-resolved
+* Parameters, so the parent must be visited first.
+*
+* Exported so callers (orchestrator parameter pre-pass, unit tests) can
+* iterate the tree in the same order without re-implementing the walk.
+*/
+function flattenCdkdStateTreeRootFirst(tree) {
+	const out = [];
+	walk(tree);
+	return out;
+	function walk(node) {
+		out.push({
+			stackName: node.stackName,
+			region: node.region
+		});
+		for (const child of node.nestedChildren.values()) walk(child);
+	}
+}
+/**
 * Map a cdkd stack name to a CloudFormation-compatible stack name.
 *
 * Required because the cdkd v6 state-key form `<parent>~<childLogicalId>`
@@ -37607,12 +37630,21 @@ async function collectImportFailureSummary(cfnClient, stackName) {
 * resolution. The tag accumulates across retries — harmless and easy to
 * reap manually under the `cdkd:` prefix.
 *
+* `parameters` must be the SAME Parameters the stack was just IMPORTed
+* with: a `UsePreviousTemplate: true` update on a stack that declares
+* Parameters (especially no-`Default` ones fed by a parent-side `Ref`)
+* is rejected by CFn with `Parameters: [X] must have values` unless every
+* Parameter is re-supplied. We re-send the resolved values verbatim (a
+* true no-op — same template, same params, only the flip Tag changes).
+* Empty array = the stack has no Parameters, so the field is omitted.
+*
 * Exported for unit testing.
 */
-async function flipStackToUpdateComplete(cfnClient, cfnStackName) {
+async function flipStackToUpdateComplete(cfnClient, cfnStackName, parameters) {
 	await cfnClient.send(new UpdateStackCommand({
 		StackName: cfnStackName,
 		UsePreviousTemplate: true,
+		...parameters.length > 0 && { Parameters: parameters },
 		Tags: [{
 			Key: "cdkd:nested-export-flip",
 			Value: `${(/* @__PURE__ */ new Date()).toISOString()}-${randomUUID().slice(0, 8)}`
@@ -37664,15 +37696,16 @@ async function fetchCfnStackTemplate(cfnClient, cfnStackName) {
 * cdkd must forward those values — otherwise the child template's
 * `Parameters` block goes unresolved and CFn rejects the changeset.
 *
-* Only literal-string Parameter values are forwarded today. Intrinsic
-* values (`{Ref: ...}` / `{Fn::GetAtt: ...}` referencing the parent's
-* own resources) are skipped with a `logger.warn`; if the child Parameter
-* has no `Default`, CFn will reject the IMPORT with a clear error. The
-* intrinsic-resolution path is a deferred follow-up (tracked under #464
-* post-PR-B2 backlog) because resolving parent-side intrinsics at
-* leaf-IMPORT time requires the deploy engine's full
-* `IntrinsicFunctionResolver` against the parent's own (yet-to-be-IMPORTed)
-* state — not in PR B2's scope.
+* This helper only classifies literal-string / number / boolean values
+* (forwarded directly) vs. intrinsic values (`{Ref: ...}` /
+* `{Fn::GetAtt: ...}` referencing the parent's own resources), which it
+* reports in `intrinsicSkipped`. Intrinsic resolution itself is layered on
+* top by {@link resolveChildImportParameters}, which runs the deploy
+* engine's `IntrinsicFunctionResolver` against the parent's state and only
+* falls back to "skip" (the original behavior) when the resolver cannot
+* handle a value. Callers that want resolved Parameters should use
+* {@link resolveChildImportParameters}; this sync helper stays for the
+* literal-classification step and its existing unit tests.
 *
 * Exported for unit testing.
 */
@@ -37714,6 +37747,140 @@ function extractChildImportParameters(parentTemplate, childLogicalId) {
 	};
 }
 /**
+* Async wrapper around {@link extractChildImportParameters} that resolves
+* intrinsic-valued (`{Ref: ...}` / `{Fn::GetAtt: ...}` / `Fn::Sub` etc.)
+* Parameters via the deploy engine's {@link IntrinsicFunctionResolver}
+* before falling back to the warn+skip path. This is the closing-loop
+* for the per-stack IMPORT design: CFn's atomic nested-stack create
+* implicitly resolved these against the parent's own scope, but cdkd's
+* leaf-first per-stack IMPORT loop submits each child as a standalone
+* stack — so AWS has no parent context to resolve against, and cdkd must
+* do the resolution itself.
+*
+* Behavior (Option 1 — CDK-compatible graceful degradation):
+*   - For each entry that {@link extractChildImportParameters} reported as
+*     `intrinsicSkipped`, look up the original intrinsic value in the
+*     parent template and call `resolver.resolve(value, parentContext)`.
+*   - On success: coerce the resolved scalar (string / number / boolean /
+*     array-of-strings) to a CFn Parameter string and append to `params`.
+*   - On throw OR on unsupported result shape (object / null / undefined):
+*     keep the key in `intrinsicSkipped` — the orchestrator's existing
+*     warn-then-fall-back-to-child-Default path takes over (matches the
+*     pre-resolver behavior for unresolvable cases, so adding the resolver
+*     never makes a working scenario regress).
+*
+* The `parentContext` must be built from the PARENT's data — its template,
+* its cdkd state's `resources` (for `Ref` to parent resources and
+* `Fn::GetAtt` to parent resource attributes), and its already-resolved
+* Parameter values (for `Ref` to parent Parameters). For nested grandparent
+* chains, the parent's resolved Parameters themselves come from the
+* top-down pre-pass in {@link buildResolvedParametersPerStack} — that's
+* why parameter resolution must happen ROOT-FIRST (parent before child),
+* even though the IMPORT loop itself is leaf-first.
+*
+* Exported for unit testing.
+*/
+async function resolveChildImportParameters(parentTemplate, parentResolverContext, childLogicalId, resolver) {
+	const base = extractChildImportParameters(parentTemplate, childLogicalId);
+	if (base.intrinsicSkipped.length === 0) return base;
+	const resources = parentTemplate["Resources"];
+	if (!resources || typeof resources !== "object" || Array.isArray(resources)) return base;
+	const row = resources[childLogicalId];
+	if (!row || typeof row !== "object" || Array.isArray(row)) return base;
+	const props = row.Properties;
+	if (!props || typeof props !== "object" || Array.isArray(props)) return base;
+	const rawParams = props.Parameters;
+	if (!rawParams || typeof rawParams !== "object" || Array.isArray(rawParams)) return base;
+	const resolvedParams = [...base.params];
+	const stillSkipped = [];
+	for (const key of base.intrinsicSkipped) {
+		const intrinsicValue = rawParams[key];
+		try {
+			const result = await resolver.resolve(intrinsicValue, parentResolverContext);
+			if (result === void 0 || result === null) {
+				stillSkipped.push(key);
+				continue;
+			}
+			if (typeof result === "string") resolvedParams.push({
+				ParameterKey: key,
+				ParameterValue: result
+			});
+			else if (typeof result === "number" || typeof result === "boolean") resolvedParams.push({
+				ParameterKey: key,
+				ParameterValue: String(result)
+			});
+			else if (Array.isArray(result)) resolvedParams.push({
+				ParameterKey: key,
+				ParameterValue: result.map((e) => String(e)).join(",")
+			});
+			else stillSkipped.push(key);
+		} catch {
+			stillSkipped.push(key);
+		}
+	}
+	return {
+		params: resolvedParams,
+		intrinsicSkipped: stillSkipped
+	};
+}
+/**
+* Top-down (root-first) pre-pass that resolves each cdkd stack's
+* child-IMPORT Parameters BEFORE the leaf-first IMPORT loop runs (issue
+* #464 follow-up — intrinsic Parameter resolution at leaf-IMPORT time).
+*
+* Why a separate pre-pass instead of resolving inline in the leaf-first
+* loop: a child's intrinsic-valued Parameter (`{Ref: ParentParam}`) resolves
+* against its PARENT's resolved Parameter values, and for a 3-level tree the
+* middle stack's Parameters are themselves resolved from the root's. So the
+* resolution dependency runs root → leaf, the opposite direction from the
+* IMPORT submission order (leaf → root). Resolving everything up front in
+* root-first order means each child always sees its parent's
+* already-resolved Parameters in `paramsByCdkdName`.
+*
+* Returns:
+*   - `paramsByCdkdName`: cdkdName → the CFn Parameters to submit for that
+*     stack's IMPORT. The root maps to `rootParameters` verbatim (CLI
+*     overrides + template defaults, resolved by the caller already); each
+*     non-root maps to its parent-extracted + intrinsic-resolved values.
+*   - `intrinsicSkippedByCdkdName`: cdkdName → the Parameter names that
+*     STILL could not be resolved (resolver threw / unsupported shape), for
+*     the orchestrator's per-stack warn + aggregate summary.
+*
+* Exported for unit testing.
+*/
+async function buildResolvedParametersPerStack(args) {
+	const paramsByCdkdName = /* @__PURE__ */ new Map();
+	const intrinsicSkippedByCdkdName = /* @__PURE__ */ new Map();
+	paramsByCdkdName.set(args.rootStackName, args.rootParameters);
+	const nodeByName = new Map(args.perStackNodes.map((n) => [n.cdkdName, n]));
+	for (const ref of flattenCdkdStateTreeRootFirst(args.tree)) {
+		if (ref.stackName === args.rootStackName) continue;
+		const node = nodeByName.get(ref.stackName);
+		if (!node) throw new Error(`buildResolvedParametersPerStack: tree node '${ref.stackName}' has no per-stack template/state entry. This is a cdkd bug.`);
+		const parentLogicalId = node.state.parentLogicalId;
+		const parentStackName = node.state.parentStack;
+		if (!parentLogicalId || !parentStackName) throw new Error(`buildResolvedParametersPerStack: child '${node.cdkdName}' state is missing parentLogicalId / parentStack (v6 fields). Re-deploy or re-import the parent stack.`);
+		const parentNode = nodeByName.get(parentStackName);
+		if (!parentNode) throw new Error(`buildResolvedParametersPerStack: child '${node.cdkdName}' references parent '${parentStackName}' which is not in the per-stack node list — tree shape is inconsistent.`);
+		const parentParamValues = {};
+		for (const p of paramsByCdkdName.get(parentStackName) ?? []) if (p.ParameterKey !== void 0) parentParamValues[p.ParameterKey] = p.ParameterValue;
+		const parentResolverContext = {
+			template: parentNode.template,
+			resources: parentNode.state.resources,
+			parameters: parentParamValues,
+			stackName: parentNode.cdkdName,
+			...args.stateBackend && { stateBackend: args.stateBackend }
+		};
+		const { params, intrinsicSkipped } = await resolveChildImportParameters(parentNode.template, parentResolverContext, parentLogicalId, args.resolver);
+		paramsByCdkdName.set(node.cdkdName, params);
+		if (intrinsicSkipped.length > 0) intrinsicSkippedByCdkdName.set(node.cdkdName, intrinsicSkipped);
+	}
+	return {
+		paramsByCdkdName,
+		intrinsicSkippedByCdkdName
+	};
+}
+/**
 * Per-stack IMPORT loop driving `cdkd export` for nested-stack trees
 * (issue #464 PR B2). Submits one IMPORT changeset per cdkd-managed stack
 * in leaf-first order. For non-leaf parents, each `AWS::CloudFormation::Stack`
@@ -37854,26 +38021,25 @@ async function runPerStackImportLoop(args) {
 		const cfnArnByCdkdName = /* @__PURE__ */ new Map();
 		const uploadCleanups = [];
 		const importedStacks = [];
-		const sessionIntrinsicSkipped = /* @__PURE__ */ new Map();
+		const paramResolver = new IntrinsicFunctionResolver(rootRegion);
+		const { paramsByCdkdName, intrinsicSkippedByCdkdName: sessionIntrinsicSkipped } = await buildResolvedParametersPerStack({
+			rootStackName,
+			rootParameters,
+			perStackNodes: perStackPlans.map((p) => ({
+				cdkdName: p.cdkdName,
+				template: p.template,
+				state: p.state
+			})),
+			tree,
+			resolver: paramResolver,
+			stateBackend: deps.stateBackend
+		});
+		for (const [cdkdName, skipped] of sessionIntrinsicSkipped) logger.warn(`  Child '${cdkdName}': could not resolve intrinsic-valued Parameter(s) ${skipped.join(", ")} at IMPORT time. The child template's Parameter Default values must cover these — otherwise CFn will reject the IMPORT.`);
 		try {
 			for (let i = 0; i < perStackPlans.length; i++) {
 				const plan = perStackPlans[i];
 				logger.info(`[${i + 1}/${perStackPlans.length}] Importing cdkd stack '${plan.cdkdName}' → CFn stack '${plan.cfnName}' (${plan.phase1Imports.length} leaf, ${plan.nestedStackRows.length} nested-child adoption)`);
-				let stackParameters;
-				if (plan.cdkdName === rootStackName) stackParameters = rootParameters;
-				else {
-					const parentLogicalId = plan.state.parentLogicalId;
-					const parentStackName = plan.state.parentStack;
-					if (!parentLogicalId || !parentStackName) throw new Error(`runPerStackImportLoop: child '${plan.cdkdName}' state is missing parentLogicalId / parentStack (v6 fields). Re-deploy or re-import the parent stack to refresh.`);
-					const parentPlan = perStackPlans.find((p) => p.cdkdName === parentStackName);
-					if (!parentPlan) throw new Error(`runPerStackImportLoop: child '${plan.cdkdName}' references parent '${parentStackName}' which is not in the per-stack plan list — tree shape is inconsistent.`);
-					const extracted = extractChildImportParameters(parentPlan.template, parentLogicalId);
-					if (extracted.intrinsicSkipped.length > 0) {
-						sessionIntrinsicSkipped.set(plan.cdkdName, extracted.intrinsicSkipped);
-						logger.warn(`  Child '${plan.cdkdName}': skipping intrinsic-valued Parameter(s) ${extracted.intrinsicSkipped.join(", ")} (intrinsic-resolution at leaf-IMPORT time is a deferred follow-up). The child template's Parameter Default values must cover these — otherwise CFn will reject the IMPORT.`);
-					}
-					stackParameters = extracted.params;
-				}
+				const stackParameters = paramsByCdkdName.get(plan.cdkdName) ?? [];
 				const phase1ATemplate = filterTemplateForImport(plan.template, plan.phase1Imports);
 				const phase1AResources = plan.phase1Imports.map((entry) => ({
 					ResourceType: entry.resourceType,
@@ -37900,7 +38066,7 @@ async function runPerStackImportLoop(args) {
 				logger.info(`  ✓ Phase 1A: CFn stack '${plan.cfnName}' created via IMPORT (${plan.phase1Imports.length} leaf resource(s)).`);
 				if (plan.cdkdName !== rootStackName) {
 					logger.info(`  Flipping '${plan.cfnName}' to UPDATE_COMPLETE so it can be adopted as a nested member by its parent's Phase 1B...`);
-					await flipStackToUpdateComplete(deps.cfnClient, plan.cfnName);
+					await flipStackToUpdateComplete(deps.cfnClient, plan.cfnName, stackParameters);
 				}
 				const rewrittenNestedRows = /* @__PURE__ */ new Map();
 				if (plan.nestedStackRows.length > 0) {
@@ -37941,7 +38107,7 @@ async function runPerStackImportLoop(args) {
 					logger.info(`  ✓ Phase 1B: parent '${plan.cfnName}' adopted ${plan.nestedStackRows.length} nested child(ren) via UPDATE-IMPORT.`);
 					if (plan.cdkdName !== rootStackName) {
 						logger.info(`  Flipping '${plan.cfnName}' back to UPDATE_COMPLETE so its own parent's Phase 1B can adopt it...`);
-						await flipStackToUpdateComplete(deps.cfnClient, plan.cfnName);
+						await flipStackToUpdateComplete(deps.cfnClient, plan.cfnName, stackParameters);
 					}
 				}
 				if (plan.recreateBeforePhase2.length > 0) for (const entry of plan.recreateBeforePhase2) {
@@ -37980,7 +38146,7 @@ async function runPerStackImportLoop(args) {
 			}
 			if (sessionIntrinsicSkipped.size > 0) {
 				const detail = [...sessionIntrinsicSkipped.entries()].map(([cdkdName, params]) => `${cdkdName} (${params.join(", ")})`).join("; ");
-				logger.warn(`${sessionIntrinsicSkipped.size} stack(s) had intrinsic-valued Parameter(s) skipped at IMPORT time: ${detail}. Verify each child template's Parameter Default values cover these before the first 'cdk deploy' — intrinsic resolution at leaf-IMPORT time is a deferred follow-up.`);
+				logger.warn(`${sessionIntrinsicSkipped.size} stack(s) had intrinsic-valued Parameter(s) that cdkd could not resolve at IMPORT time: ${detail}. Verify each child template's Parameter Default values cover these before the first 'cdk deploy'.`);
 			}
 			return {
 				outcome: "success",
@@ -57875,7 +58041,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.151.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.152.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());