@go-to-k/cdkd 0.159.2 → 0.160.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { _ as withSkipPrefix, a as runDockerStreaming, c as getLogger, d as getLiveRenderer, f as PATTERN_B_NAME_PROPERTIES, g as generateResourceNameWithFallback, h as generateResourceName, i as runDockerForeground, n as formatDockerLoginError, p as PATTERN_B_RESOURCE_TYPES, r as getDockerCmd, u as runStackBuffered, v as withStackName } from "./docker-cmd-iDMcWcre.js";
-import { $ as CdkdError, A as shouldRetainResource, B as resolveSkipPrefix, C as IntrinsicFunctionResolver, D as TemplateParser, E as DagBuilder, F as Synthesizer, G as CFN_TEMPLATE_URL_LIMIT, H as resolveStateBucketWithDefaultAndSource, I as getDefaultStateBucketName, J as uploadCfnTemplate, K as MIGRATE_TMP_PREFIX, L as getLegacyStateBucketName, M as stringifyValue, N as WorkGraph, O as LockManager, P as buildDockerImage, R as resolveApp, S as assertRegionMatch, T as DiffCalculator, U as warnDeprecatedNoPrefixCliFlag, V as resolveStateBucketWithDefault, W as CFN_TEMPLATE_BODY_LIMIT, Y as AssemblyReader, Z as resolveBucketRegion, _ as matchesCdkPath, a as withRetry, b as ProviderRegistry, bt as withErrorHandling, c as bold, ct as PartialFailureError, d as green, dt as ResourceUpdateNotSupportedError, f as red, ft as RouteDiscoveryError, g as CDK_PATH_TAG, h as collectInlinePolicyNamesManagedBySiblings, i as withResourceDeadline, it as LocalStartServiceError, j as AssetPublisher, k as S3StateBackend, l as cyan, lt as ProvisioningError, m as IAMRoleProvider, mt as StackTerminationProtectionError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LocalInvokeBuildError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as MissingCdkCliError, p as yellow, pt as StackHasActiveImportsError, q as findLargeInlineResources, r as DeployEngine, rt as LocalMigrateError, s as formatResourceLine, st as NestedStackChildDirectDestroyError, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, ut as ResourceTimeoutError, v as normalizeAwsTagsToCfn, w as applyRoleArnIfSet, x as CloudControlProvider, y as resolveExplicitPhysicalId, yt as normalizeAwsError, z as resolveCaptureObservedState } from "./deploy-engine-BzrECC3i.js";
+import { $ as CdkdError, A as shouldRetainResource, B as resolveSkipPrefix, C as IntrinsicFunctionResolver, D as TemplateParser, E as DagBuilder, F as Synthesizer, G as CFN_TEMPLATE_URL_LIMIT, H as resolveStateBucketWithDefaultAndSource, I as getDefaultStateBucketName, J as uploadCfnTemplate, K as MIGRATE_TMP_PREFIX, L as getLegacyStateBucketName, M as stringifyValue, N as WorkGraph, O as LockManager, P as buildDockerImage, R as resolveApp, S as assertRegionMatch, T as DiffCalculator, U as warnDeprecatedNoPrefixCliFlag, V as resolveStateBucketWithDefault, W as CFN_TEMPLATE_BODY_LIMIT, Y as AssemblyReader, Z as resolveBucketRegion, _ as matchesCdkPath, a as withRetry, b as ProviderRegistry, bt as withErrorHandling, c as bold, ct as PartialFailureError, d as green, dt as ResourceUpdateNotSupportedError, f as red, ft as RouteDiscoveryError, g as CDK_PATH_TAG, h as collectInlinePolicyNamesManagedBySiblings, i as withResourceDeadline, it as LocalStartServiceError, j as AssetPublisher, k as S3StateBackend, l as cyan, lt as ProvisioningError, m as IAMRoleProvider, mt as StackTerminationProtectionError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LocalInvokeBuildError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as MissingCdkCliError, p as yellow, pt as StackHasActiveImportsError, q as findLargeInlineResources, r as DeployEngine, rt as LocalMigrateError, s as formatResourceLine, st as NestedStackChildDirectDestroyError, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, ut as ResourceTimeoutError, v as normalizeAwsTagsToCfn, w as applyRoleArnIfSet, x as CloudControlProvider, y as resolveExplicitPhysicalId, yt as normalizeAwsError, z as resolveCaptureObservedState } from "./deploy-engine-BXWv-yRb.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -32190,7 +32190,10 @@ async function runDestroyForStack(stackName, state, ctx) {
 				const baseLabel = `Deleting ${logicalId} (${resource.resourceType})`;
 				renderer.addTask(logicalId, baseLabel);
 				try {
-					const provider = destroyProviderRegistry.getProvider(resource.resourceType);
+					const provider = destroyProviderRegistry.getProviderFor({
+						resourceType: resource.resourceType,
+						provisionedBy: resource.provisionedBy
+					}).provider;
 					const providerMinTimeoutMs = provider.getMinResourceTimeoutMs?.() ?? 0;
 					const warnAfterMs = ctx.resourceWarnAfterByType?.[resource.resourceType] ?? ctx.resourceWarnAfterMs ?? 3e5;
 					const globalTimeoutMs = ctx.resourceTimeoutMs ?? 18e5;
@@ -34306,7 +34309,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		region,
 		resources: {},
 		outputs: {},
-		version: 6,
+		version: 7,
 		lastModified: Date.now()
 	};
 }
@@ -35078,7 +35081,10 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			}
 			let provider;
 			try {
-				provider = providerRegistry.getProvider(resource.resourceType);
+				provider = providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
 			} catch {
 				outcomes.push({
 					kind: "unsupported",
@@ -35355,7 +35361,10 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): resource missing from state; skipped.`);
 					return;
 				}
-				const provider = providerRegistry.getProvider(outcome.resourceType);
+				const provider = providerRegistry.getProviderFor({
+					resourceType: outcome.resourceType,
+					provisionedBy: stateResource.provisionedBy
+				}).provider;
 				const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
 				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties);
 				try {
@@ -35871,7 +35880,10 @@ var AttributeFetcher = class {
 		};
 		let provider;
 		try {
-			provider = this.providerRegistry.getProvider(orphan.resourceType);
+			provider = this.providerRegistry.getProviderFor({
+				resourceType: orphan.resourceType,
+				provisionedBy: orphan.provisionedBy
+			}).provider;
 		} catch (err) {
 			return {
 				ok: false,
@@ -39741,6 +39753,8 @@ function renderStateBlock(state, lockInfo) {
 		lines.push(logicalId);
 		lines.push(`  Type: ${resource.resourceType}`);
 		lines.push(`  PhysicalID: ${resource.physicalId}`);
+		const provisionedBy = resource.provisionedBy ?? "(sdk, legacy default)";
+		lines.push(`  ProvisionedBy: ${provisionedBy}`);
 		const deps = resource.dependencies ?? [];
 		lines.push(`  Dependencies: ${deps.length > 0 ? deps.join(", ") : "(none)"}`);
 		const attrEntries = Object.entries(resource.attributes ?? {});
@@ -40371,7 +40385,10 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		for (const [, resource] of entries) {
 			let provider;
 			try {
-				provider = providerRegistry.getProvider(resource.resourceType);
+				provider = providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
 			} catch {
 				wouldUnsupported++;
 				continue;
@@ -40400,7 +40417,10 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 				}
 				let provider;
 				try {
-					provider = providerRegistry.getProvider(resource.resourceType);
+					provider = providerRegistry.getProviderFor({
+						resourceType: resource.resourceType,
+						provisionedBy: resource.provisionedBy
+					}).provider;
 				} catch {
 					unsupported++;
 					return;
@@ -40939,11 +40959,12 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 			resourceType: row.resourceType,
 			properties: tmplResource.Properties ?? {},
 			attributes: {},
-			dependencies: [...deps]
+			dependencies: [...deps],
+			provisionedBy: "sdk"
 		};
 	}
 	return {
-		version: 6,
+		version: 7,
 		stackName,
 		region,
 		resources,
@@ -41136,7 +41157,10 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
 		try {
-			const provider = providerRegistry.getProvider(resource.resourceType);
+			const provider = providerRegistry.getProviderFor({
+				resourceType: resource.resourceType,
+				provisionedBy: resource.provisionedBy
+			}).provider;
 			if (!provider.readCurrentState) return;
 			const observed = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(stackState, logicalId));
 			if (observed !== void 0) resource.observedProperties = observed;
@@ -54606,7 +54630,7 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 		const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
 		const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
 		const code = props["Code"] ?? {};
-		const imageUri = extractImageUri(code["ImageUri"]);
+		const imageUri = extractImageUri(code["ImageUri"], logicalId, stack.stackName, stack.template.Resources ?? {});
 		if (imageUri !== void 0) return resolveImageLambda({
 			stack,
 			logicalId,
@@ -54645,25 +54669,47 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 /**
 * Extract `Code.ImageUri` across the shapes CDK actually synthesizes.
 * Mirrors the simpler subset of `lambda-resolver.ts:extractImageUri`
-* scoped to the shapes `cdkd local start-api` consumes — flat string
-* and `Fn::Sub` (the canonical asset shape for
-* `lambda.DockerImageCode.fromImageAsset`). `Fn::Join` shapes for
-* `lambda.DockerImageCode.fromEcr` are deferred to a follow-up: the
-* start-api boot flow doesn't yet load cdkd state up front, and the
-* `Fn::Join` resolver needs it to recover same-stack ECR repository
-* URIs. When the user hits the unsupported shape, the downstream
-* resolveLocalBuildPlan / pullEcrImage path surfaces a clear error.
+* scoped to the shapes `cdkd local start-api` consumes — flat string,
+* `Fn::Sub` (the canonical asset shape for
+* `lambda.DockerImageCode.fromImageAsset`), and `Fn::Join` (the
+* canonical shape for `lambda.DockerImageCode.fromImageAsset` in
+* CDK 2.x, which emits a `Fn::Join` over the literal bootstrap ECR
+* URI with `${AWS::URLSuffix}` — issue #627).
+*
+* The `Fn::Join` arm routes through the shared
+* `tryResolveImageFnJoin` helper (`src/local/intrinsic-image.ts`) used
+* by `cdkd local invoke`. Like the sibling `lambda-resolver.ts`, we
+* pass `undefined` for the `ImageResolutionContext` — start-api
+* doesn't load cdkd state up front, so same-stack ECR refs surface
+* as `needs-state` and pseudo-parameter-only shapes (`Ref:
+* AWS::URLSuffix`) surface as `not-applicable`. Both cases throw a
+* clear error that names the actual root cause instead of falling
+* through to the ZIP branch's misleading "no Runtime" hard error.
+*
+* Pseudo-parameter substitution (`${AWS::URLSuffix}` → `amazonaws.com`)
+* is deliberately not implemented here — `lambda-resolver.ts` (the
+* canonical sibling) also defers it, and shipping one-sided support
+* would surprise users. Tracked separately as the issue's optional
+* follow-up.
 *
 * Returns `undefined` when the field is absent or non-recognized,
 * which routes the caller to the ZIP branch (with its existing
 * "no Runtime / no Handler" validations).
 */
-function extractImageUri(value) {
+function extractImageUri(value, logicalId, stackName, resources) {
 	if (typeof value === "string" && value.length > 0) return value;
 	if (value && typeof value === "object" && !Array.isArray(value)) {
-		const sub = value["Fn::Sub"];
+		const obj = value;
+		const sub = obj["Fn::Sub"];
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
+		if ("Fn::Join" in obj) {
+			const joinResolved = tryResolveImageFnJoin(value, resources, void 0);
+			if (joinResolved.kind === "resolved") return joinResolved.uri;
+			if (joinResolved.kind === "needs-state") throw new Error(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local start-api cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
+			if (joinResolved.kind === "unsupported-join") throw new Error(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. cdkd local start-api recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
+			throw new Error(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local start-api cannot resolve. The shape likely references AWS pseudo parameters (e.g. \${AWS::URLSuffix}) — the canonical CDK 2.x lambda.DockerImageCode.fromImageAsset synthesized shape. Workarounds: pin a fully-literal public image URI, or wait for the follow-up that substitutes \${AWS::URLSuffix} against the current region.`);
+		}
 	}
 }
 /**
@@ -59491,7 +59537,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.159.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.160.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());