@go-to-k/cdkd 0.160.0 → 0.161.1

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { _ as withSkipPrefix, a as runDockerStreaming, c as getLogger, d as getLiveRenderer, f as PATTERN_B_NAME_PROPERTIES, g as generateResourceNameWithFallback, h as generateResourceName, i as runDockerForeground, n as formatDockerLoginError, p as PATTERN_B_RESOURCE_TYPES, r as getDockerCmd, u as runStackBuffered, v as withStackName } from "./docker-cmd-iDMcWcre.js";
-import { $ as CdkdError, A as shouldRetainResource, B as resolveSkipPrefix, C as IntrinsicFunctionResolver, D as TemplateParser, E as DagBuilder, F as Synthesizer, G as CFN_TEMPLATE_URL_LIMIT, H as resolveStateBucketWithDefaultAndSource, I as getDefaultStateBucketName, J as uploadCfnTemplate, K as MIGRATE_TMP_PREFIX, L as getLegacyStateBucketName, M as stringifyValue, N as WorkGraph, O as LockManager, P as buildDockerImage, R as resolveApp, S as assertRegionMatch, T as DiffCalculator, U as warnDeprecatedNoPrefixCliFlag, V as resolveStateBucketWithDefault, W as CFN_TEMPLATE_BODY_LIMIT, Y as AssemblyReader, Z as resolveBucketRegion, _ as matchesCdkPath, a as withRetry, b as ProviderRegistry, bt as withErrorHandling, c as bold, ct as PartialFailureError, d as green, dt as ResourceUpdateNotSupportedError, f as red, ft as RouteDiscoveryError, g as CDK_PATH_TAG, h as collectInlinePolicyNamesManagedBySiblings, i as withResourceDeadline, it as LocalStartServiceError, j as AssetPublisher, k as S3StateBackend, l as cyan, lt as ProvisioningError, m as IAMRoleProvider, mt as StackTerminationProtectionError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LocalInvokeBuildError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as MissingCdkCliError, p as yellow, pt as StackHasActiveImportsError, q as findLargeInlineResources, r as DeployEngine, rt as LocalMigrateError, s as formatResourceLine, st as NestedStackChildDirectDestroyError, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, ut as ResourceTimeoutError, v as normalizeAwsTagsToCfn, w as applyRoleArnIfSet, x as CloudControlProvider, y as resolveExplicitPhysicalId, yt as normalizeAwsError, z as resolveCaptureObservedState } from "./deploy-engine-BXWv-yRb.js";
+import { A as S3StateBackend, B as resolveCaptureObservedState, C as assertRegionMatch, D as DagBuilder, E as DiffCalculator, F as buildDockerImage, G as CFN_TEMPLATE_BODY_LIMIT, H as resolveStateBucketWithDefault, I as Synthesizer, J as findLargeInlineResources, K as CFN_TEMPLATE_URL_LIMIT, L as getDefaultStateBucketName, M as AssetPublisher, N as stringifyValue, O as TemplateParser, P as WorkGraph, Q as resolveBucketRegion, R as getLegacyStateBucketName, S as CloudControlProvider, T as applyRoleArnIfSet, U as resolveStateBucketWithDefaultAndSource, V as resolveSkipPrefix, W as warnDeprecatedNoPrefixCliFlag, X as AssemblyReader, Y as uploadCfnTemplate, _ as matchesCdkPath, a as withRetry, at as LocalStartServiceError, b as ProviderRegistry, bt as normalizeAwsError, c as bold, ct as NestedStackChildDirectDestroyError, d as green, dt as ResourceTimeoutError, et as CdkdError, f as red, ft as ResourceUpdateNotSupportedError, g as CDK_PATH_TAG, h as collectInlinePolicyNamesManagedBySiblings, ht as StackTerminationProtectionError, i as withResourceDeadline, it as LocalMigrateError, j as shouldRetainResource, k as LockManager, l as cyan, lt as PartialFailureError, m as IAMRoleProvider, mt as StackHasActiveImportsError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as IMPLICIT_DELETE_DEPENDENCIES, p as yellow, pt as RouteDiscoveryError, q as MIGRATE_TMP_PREFIX, r as DeployEngine, rt as LocalInvokeBuildError, s as formatResourceLine, st as MissingCdkCliError, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, ut as ProvisioningError, v as normalizeAwsTagsToCfn, w as IntrinsicFunctionResolver, x as findActionableSilentDrops, xt as withErrorHandling, y as resolveExplicitPhysicalId, z as resolveApp } from "./deploy-engine-BC1Z7ABm.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -34360,6 +34360,7 @@ async function buildDiffTree(args) {
 		displayName,
 		region,
 		changes: await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator),
+		ccApiRoutes: collectCcApiRoutes(template, state),
 		children: []
 	};
 	if (!recursive) return node;
@@ -34403,6 +34404,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 		displayName: stackName,
 		region,
 		changes: await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator),
+		ccApiRoutes: /* @__PURE__ */ new Map(),
 		children: []
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
@@ -34411,6 +34413,52 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 	}
 	return node;
 }
+const EMPTY_ALLOW_SET = /* @__PURE__ */ new Set();
+/**
+* Walk every resource in `template` and return the logicalId → annotation
+* source map that #614's auto-fallback would route via Cloud Control API.
+*
+* Two annotation sources are merged into one map so the diff renderer
+* matches the live-progress label and the design §8 statement that the
+* `[via CC API: ...]` tag "stays visible whenever the resource has the
+* `provisionedBy: 'cc-api'` state field set OR is being introduced via the
+* auto-route":
+*
+*  - **Fresh hits**: a resource whose template uses one or more
+*    silent-drop top-level CFn properties. Annotation value is the list
+*    of property names (e.g. `LoggingConfig`).
+*  - **Sticky hits**: a resource whose deployed state records
+*    `provisionedBy: 'cc-api'` (from a prior deploy) even when the
+*    current template's silent-drop set is empty. Annotation value is
+*    the single token `sticky` so the renderer prints `[via CC API:
+*    sticky]` — the routing decision is unchanged but the tag stays
+*    visible per #614's sticky-state semantics.
+*
+* When both sources fire on the same resource, the fresh-hit prop list
+* wins (more informative). Empty allow-set:
+* `--allow-unsupported-properties` is a deploy-only flag, so diff
+* renders every actionable drop as an auto-route hint.
+*
+* Excludes `AWS::CDK::Metadata` (filtered like the deploy pre-flight); also
+* excludes `AWS::CloudFormation::Stack` rows since nested-stack children
+* recurse through their own templates rather than carrying CC-routable
+* properties on the parent's row.
+*/
+function collectCcApiRoutes(template, state) {
+	const hits = /* @__PURE__ */ new Map();
+	for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+		if (!resource) continue;
+		if (resource.Type === "AWS::CDK::Metadata") continue;
+		if (resource.Type === "AWS::CloudFormation::Stack") continue;
+		const drops = findActionableSilentDrops(resource.Type, resource.Properties, EMPTY_ALLOW_SET);
+		if (drops.length > 0) {
+			hits.set(logicalId, drops.map((d) => d.property));
+			continue;
+		}
+		if (state.resources[logicalId]?.provisionedBy === "cc-api") hits.set(logicalId, ["sticky"]);
+	}
+	return hits;
+}
 /** True when this node has at least one real (non-`NO_CHANGE`) change. */
 function nodeHasChanges(node) {
 	for (const change of node.changes.values()) if (change.changeType !== "NO_CHANGE") return true;
@@ -34431,12 +34479,14 @@ function diffTreeToJson(node) {
 	const changes = [];
 	for (const change of node.changes.values()) {
 		if (change.changeType === "NO_CHANGE") continue;
+		const ccApi = node.ccApiRoutes.get(change.logicalId);
 		changes.push({
 			logicalId: change.logicalId,
 			changeType: change.changeType,
 			resourceType: change.resourceType,
 			...change.propertyChanges && change.propertyChanges.length > 0 ? { propertyChanges: change.propertyChanges } : {},
-			...change.attributeChanges && change.attributeChanges.length > 0 ? { attributeChanges: change.attributeChanges } : {}
+			...change.attributeChanges && change.attributeChanges.length > 0 ? { attributeChanges: change.attributeChanges } : {},
+			...ccApi && ccApi.length > 0 ? { ccApi } : {}
 		});
 	}
 	return {
@@ -34500,19 +34550,30 @@ function stripUnchangedValues(value, other) {
 * Render one resource-change map into human-readable diff lines via `logFn`,
 * returning the per-type counts. Shared by the root stack block and every
 * nested-stack block.
+*
+* When `ccApiRoutes` is supplied, every CREATE / UPDATE line whose logical ID
+* appears in the map gets a `[via CC API: <props>]` suffix so the user sees
+* #614's auto-fallback decision at plan time. DELETE lines are not annotated
+* — the delete routing is recorded on each resource's `provisionedBy` state
+* field rather than re-derived from the template.
 */
-function renderChangeLines(changes, logFn) {
+function renderChangeLines(changes, logFn, ccApiRoutes) {
 	let createCount = 0;
 	let updateCount = 0;
 	let deleteCount = 0;
+	const annotateRouting = (logicalId) => {
+		const props = ccApiRoutes?.get(logicalId);
+		if (!props || props.length === 0) return "";
+		return ` [via CC API: ${props.join(", ")}]`;
+	};
 	for (const [logicalId, change] of changes.entries()) switch (change.changeType) {
 		case "CREATE":
 			createCount++;
-			logFn(`  [+] ${logicalId} (${change.resourceType})`);
+			logFn(`  [+] ${logicalId} (${change.resourceType})${annotateRouting(logicalId)}`);
 			break;
 		case "UPDATE":
 			updateCount++;
-			logFn(`  [~] ${logicalId} (${change.resourceType})`);
+			logFn(`  [~] ${logicalId} (${change.resourceType})${annotateRouting(logicalId)}`);
 			if (change.propertyChanges && change.propertyChanges.length > 0) for (const propChange of change.propertyChanges) {
 				const requiresReplace = propChange.requiresReplacement ? " [requires replacement]" : "";
 				const oldFiltered = stripUnchangedValues(propChange.oldValue, propChange.newValue);
@@ -34552,7 +34613,7 @@ function renderChangeLines(changes, logFn) {
 function renderDiffTree(node, isRoot, logFn) {
 	if (nodeHasChanges(node)) {
 		logFn(isRoot ? `\nStack ${node.stackName}:` : `\nNested stack: ${node.displayName}`);
-		const { create, update, delete: del } = renderChangeLines(node.changes, logFn);
+		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes);
 		logFn(`\n${create} to create, ${update} to update, ${del} to delete`);
 	}
 	for (const child of node.children) renderDiffTree(child, false, logFn);
@@ -42020,6 +42081,55 @@ function createLocalStateProvider(options, cdkdStackName, synthRegion) {
 //#endregion
 //#region src/local/intrinsic-image.ts
 /**
+* Derive the AWS pseudo parameters that are trivially knowable from the
+* deploy region alone, without any STS call or cdkd state load.
+* `urlSuffix` and `partition` follow the canonical AWS partition rules:
+*
+*   - region prefix `cn-*`        → partition `aws-cn`,     urlSuffix `amazonaws.com.cn`
+*   - region prefix `us-gov-*`    → partition `aws-us-gov`, urlSuffix `amazonaws.com`
+*   - region prefix `us-iso-*`    → partition `aws-iso`,    urlSuffix `c2s.ic.gov`
+*   - region prefix `us-isob-*`   → partition `aws-iso-b`,  urlSuffix `sc2s.sgov.gov`
+*   - everything else (`us-east-1` / `eu-west-2` / `ap-northeast-1` / etc.)
+*                                 → partition `aws`,        urlSuffix `amazonaws.com`
+*
+* `accountId` is optional pass-through (caller decides whether to populate
+* it). The bootstrap-ECR URI shape that `lambda.DockerImageCode.fromImageAsset`
+* synthesizes carries account-id + region as literal strings in the template,
+* so only `urlSuffix` / `partition` / `region` are required to resolve it
+* (issue #637).
+*
+* Returns `undefined` when `region` is undefined / empty so the caller can
+* fall through cleanly. The shape mirrors `ImageResolutionContext.pseudoParameters`
+* so the result drops straight into a context literal.
+*/
+function derivePseudoParametersFromRegion(region, accountId) {
+	if (!region || typeof region !== "string" || region.length === 0) return void 0;
+	let partition;
+	let urlSuffix;
+	if (region.startsWith("cn-")) {
+		partition = "aws-cn";
+		urlSuffix = "amazonaws.com.cn";
+	} else if (region.startsWith("us-gov-")) {
+		partition = "aws-us-gov";
+		urlSuffix = "amazonaws.com";
+	} else if (region.startsWith("us-isob-")) {
+		partition = "aws-iso-b";
+		urlSuffix = "sc2s.sgov.gov";
+	} else if (region.startsWith("us-iso-")) {
+		partition = "aws-iso";
+		urlSuffix = "c2s.ic.gov";
+	} else {
+		partition = "aws";
+		urlSuffix = "amazonaws.com";
+	}
+	return {
+		...accountId !== void 0 && { accountId },
+		region,
+		partition,
+		urlSuffix
+	};
+}
+/**
 * Resolve the canonical CDK 2.x `Fn::Join` shape emitted by
 * `ContainerImage.fromEcrRepository(repo, tag)` (ECS) and
 * `lambda.DockerImageCode.fromEcr(repo, { tagOrDigest })` (Lambda
@@ -42386,7 +42496,7 @@ function extractLambdaProperties(stack, logicalId, resource, resources) {
 	const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
 	const ephemeralStorageMb = extractEphemeralStorageMb(props, logicalId);
 	const code = props["Code"] ?? {};
-	const imageUri = extractImageUri$1(code["ImageUri"], logicalId, stack.stackName, resources);
+	const imageUri = extractImageUri$1(code["ImageUri"], logicalId, stack.stackName, resources, stack.region);
 	if (imageUri !== void 0) return extractImageLambdaProperties({
 		stack,
 		logicalId,
@@ -42483,7 +42593,7 @@ function extractEphemeralStorageMb(props, logicalId) {
 * for genuinely unrecognized shapes so the caller's downstream ZIP-vs-
 * IMAGE branching can route to its existing error path.
 */
-function extractImageUri$1(value, logicalId, stackName, resources) {
+function extractImageUri$1(value, logicalId, stackName, resources, region) {
 	if (typeof value === "string" && value.length > 0) return value;
 	if (value && typeof value === "object" && !Array.isArray(value)) {
 		const obj = value;
@@ -42491,11 +42601,12 @@ function extractImageUri$1(value, logicalId, stackName, resources) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const joinResolved = tryResolveImageFnJoin(value, resources, void 0);
+			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local invoke cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
 			if (joinResolved.kind === "unsupported-join") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. cdkd local invoke recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
-			throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local invoke cannot resolve. The shape likely references AWS pseudo parameters (e.g. \${AWS::URLSuffix}) for an imported ECR repository. Workarounds: rebuild via lambda.DockerImageCode.fromImageAsset, or pin a fully-literal public image URI.`);
+			throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local invoke cannot resolve${pseudoParameters ? " (likely ${AWS::AccountId}, which cdkd cannot derive without --from-state or STS)" : ` (cdkd could not derive AWS pseudo parameters because stack.region was undefined)`}. Workarounds: deploy first and run with --from-state, or pin a fully-literal public image URI.`);
 		}
 	}
 }
@@ -54630,7 +54741,7 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 		const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
 		const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
 		const code = props["Code"] ?? {};
-		const imageUri = extractImageUri(code["ImageUri"], logicalId, stack.stackName, stack.template.Resources ?? {});
+		const imageUri = extractImageUri(code["ImageUri"], logicalId, stack.stackName, stack.template.Resources ?? {}, stack.region);
 		if (imageUri !== void 0) return resolveImageLambda({
 			stack,
 			logicalId,
@@ -54674,29 +54785,24 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 * `lambda.DockerImageCode.fromImageAsset`), and `Fn::Join` (the
 * canonical shape for `lambda.DockerImageCode.fromImageAsset` in
 * CDK 2.x, which emits a `Fn::Join` over the literal bootstrap ECR
-* URI with `${AWS::URLSuffix}` — issue #627).
+* URI with `${AWS::URLSuffix}` — issues #627 + #637).
 *
 * The `Fn::Join` arm routes through the shared
 * `tryResolveImageFnJoin` helper (`src/local/intrinsic-image.ts`) used
-* by `cdkd local invoke`. Like the sibling `lambda-resolver.ts`, we
-* pass `undefined` for the `ImageResolutionContext` — start-api
-* doesn't load cdkd state up front, so same-stack ECR refs surface
-* as `needs-state` and pseudo-parameter-only shapes (`Ref:
-* AWS::URLSuffix`) surface as `not-applicable`. Both cases throw a
-* clear error that names the actual root cause instead of falling
-* through to the ZIP branch's misleading "no Runtime" hard error.
-*
-* Pseudo-parameter substitution (`${AWS::URLSuffix}` → `amazonaws.com`)
-* is deliberately not implemented here — `lambda-resolver.ts` (the
-* canonical sibling) also defers it, and shipping one-sided support
-* would surprise users. Tracked separately as the issue's optional
-* follow-up.
+* by `cdkd local invoke`. When the synth template recorded a deploy
+* region (`stack.region`), we derive `{ urlSuffix, partition, region }`
+* via `derivePseudoParametersFromRegion` and pass it as the resolver's
+* `pseudoParameters` block so the canonical `${AWS::URLSuffix}` shape
+* resolves cleanly (issue #637). Same-stack ECR refs still surface as
+* `needs-state` (those require `--from-state`); a Join that references
+* `${AWS::AccountId}` without state still surfaces as `not-applicable`
+* with a more specific error message naming the missing parameter.
 *
 * Returns `undefined` when the field is absent or non-recognized,
 * which routes the caller to the ZIP branch (with its existing
 * "no Runtime / no Handler" validations).
 */
-function extractImageUri(value, logicalId, stackName, resources) {
+function extractImageUri(value, logicalId, stackName, resources, region) {
 	if (typeof value === "string" && value.length > 0) return value;
 	if (value && typeof value === "object" && !Array.isArray(value)) {
 		const obj = value;
@@ -54704,11 +54810,12 @@ function extractImageUri(value, logicalId, stackName, resources) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const joinResolved = tryResolveImageFnJoin(value, resources, void 0);
+			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new Error(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local start-api cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
 			if (joinResolved.kind === "unsupported-join") throw new Error(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. cdkd local start-api recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
-			throw new Error(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local start-api cannot resolve. The shape likely references AWS pseudo parameters (e.g. \${AWS::URLSuffix}) — the canonical CDK 2.x lambda.DockerImageCode.fromImageAsset synthesized shape. Workarounds: pin a fully-literal public image URI, or wait for the follow-up that substitutes \${AWS::URLSuffix} against the current region.`);
+			throw new Error(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local start-api cannot resolve${pseudoParameters ? " (likely ${AWS::AccountId}, which cdkd cannot derive without --from-state or STS)" : ` (cdkd could not derive AWS pseudo parameters because stack.region was undefined)`}. Workarounds: deploy first and run with --from-state, or pin a fully-literal public image URI.`);
 		}
 	}
 }
@@ -59537,7 +59644,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.160.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.161.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());