@go-to-k/cdkd 0.161.0 → 0.161.1

package/dist/cli.js

@@ -42081,6 +42081,55 @@ function createLocalStateProvider(options, cdkdStackName, synthRegion) {
 //#endregion
 //#region src/local/intrinsic-image.ts
 /**
+* Derive the AWS pseudo parameters that are trivially knowable from the
+* deploy region alone, without any STS call or cdkd state load.
+* `urlSuffix` and `partition` follow the canonical AWS partition rules:
+*
+*   - region prefix `cn-*`        → partition `aws-cn`,     urlSuffix `amazonaws.com.cn`
+*   - region prefix `us-gov-*`    → partition `aws-us-gov`, urlSuffix `amazonaws.com`
+*   - region prefix `us-iso-*`    → partition `aws-iso`,    urlSuffix `c2s.ic.gov`
+*   - region prefix `us-isob-*`   → partition `aws-iso-b`,  urlSuffix `sc2s.sgov.gov`
+*   - everything else (`us-east-1` / `eu-west-2` / `ap-northeast-1` / etc.)
+*                                 → partition `aws`,        urlSuffix `amazonaws.com`
+*
+* `accountId` is optional pass-through (caller decides whether to populate
+* it). The bootstrap-ECR URI shape that `lambda.DockerImageCode.fromImageAsset`
+* synthesizes carries account-id + region as literal strings in the template,
+* so only `urlSuffix` / `partition` / `region` are required to resolve it
+* (issue #637).
+*
+* Returns `undefined` when `region` is undefined / empty so the caller can
+* fall through cleanly. The shape mirrors `ImageResolutionContext.pseudoParameters`
+* so the result drops straight into a context literal.
+*/
+function derivePseudoParametersFromRegion(region, accountId) {
+	if (!region || typeof region !== "string" || region.length === 0) return void 0;
+	let partition;
+	let urlSuffix;
+	if (region.startsWith("cn-")) {
+		partition = "aws-cn";
+		urlSuffix = "amazonaws.com.cn";
+	} else if (region.startsWith("us-gov-")) {
+		partition = "aws-us-gov";
+		urlSuffix = "amazonaws.com";
+	} else if (region.startsWith("us-isob-")) {
+		partition = "aws-iso-b";
+		urlSuffix = "sc2s.sgov.gov";
+	} else if (region.startsWith("us-iso-")) {
+		partition = "aws-iso";
+		urlSuffix = "c2s.ic.gov";
+	} else {
+		partition = "aws";
+		urlSuffix = "amazonaws.com";
+	}
+	return {
+		...accountId !== void 0 && { accountId },
+		region,
+		partition,
+		urlSuffix
+	};
+}
+/**
 * Resolve the canonical CDK 2.x `Fn::Join` shape emitted by
 * `ContainerImage.fromEcrRepository(repo, tag)` (ECS) and
 * `lambda.DockerImageCode.fromEcr(repo, { tagOrDigest })` (Lambda
@@ -42447,7 +42496,7 @@ function extractLambdaProperties(stack, logicalId, resource, resources) {
 	const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
 	const ephemeralStorageMb = extractEphemeralStorageMb(props, logicalId);
 	const code = props["Code"] ?? {};
-	const imageUri = extractImageUri$1(code["ImageUri"], logicalId, stack.stackName, resources);
+	const imageUri = extractImageUri$1(code["ImageUri"], logicalId, stack.stackName, resources, stack.region);
 	if (imageUri !== void 0) return extractImageLambdaProperties({
 		stack,
 		logicalId,
@@ -42544,7 +42593,7 @@ function extractEphemeralStorageMb(props, logicalId) {
 * for genuinely unrecognized shapes so the caller's downstream ZIP-vs-
 * IMAGE branching can route to its existing error path.
 */
-function extractImageUri$1(value, logicalId, stackName, resources) {
+function extractImageUri$1(value, logicalId, stackName, resources, region) {
 	if (typeof value === "string" && value.length > 0) return value;
 	if (value && typeof value === "object" && !Array.isArray(value)) {
 		const obj = value;
@@ -42552,11 +42601,12 @@ function extractImageUri$1(value, logicalId, stackName, resources) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const joinResolved = tryResolveImageFnJoin(value, resources, void 0);
+			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local invoke cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
 			if (joinResolved.kind === "unsupported-join") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. cdkd local invoke recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
-			throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local invoke cannot resolve. The shape likely references AWS pseudo parameters (e.g. \${AWS::URLSuffix}) for an imported ECR repository. Workarounds: rebuild via lambda.DockerImageCode.fromImageAsset, or pin a fully-literal public image URI.`);
+			throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local invoke cannot resolve${pseudoParameters ? " (likely ${AWS::AccountId}, which cdkd cannot derive without --from-state or STS)" : ` (cdkd could not derive AWS pseudo parameters because stack.region was undefined)`}. Workarounds: deploy first and run with --from-state, or pin a fully-literal public image URI.`);
 		}
 	}
 }
@@ -54691,7 +54741,7 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 		const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
 		const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
 		const code = props["Code"] ?? {};
-		const imageUri = extractImageUri(code["ImageUri"], logicalId, stack.stackName, stack.template.Resources ?? {});
+		const imageUri = extractImageUri(code["ImageUri"], logicalId, stack.stackName, stack.template.Resources ?? {}, stack.region);
 		if (imageUri !== void 0) return resolveImageLambda({
 			stack,
 			logicalId,
@@ -54735,29 +54785,24 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 * `lambda.DockerImageCode.fromImageAsset`), and `Fn::Join` (the
 * canonical shape for `lambda.DockerImageCode.fromImageAsset` in
 * CDK 2.x, which emits a `Fn::Join` over the literal bootstrap ECR
-* URI with `${AWS::URLSuffix}` — issue #627).
+* URI with `${AWS::URLSuffix}` — issues #627 + #637).
 *
 * The `Fn::Join` arm routes through the shared
 * `tryResolveImageFnJoin` helper (`src/local/intrinsic-image.ts`) used
-* by `cdkd local invoke`. Like the sibling `lambda-resolver.ts`, we
-* pass `undefined` for the `ImageResolutionContext` — start-api
-* doesn't load cdkd state up front, so same-stack ECR refs surface
-* as `needs-state` and pseudo-parameter-only shapes (`Ref:
-* AWS::URLSuffix`) surface as `not-applicable`. Both cases throw a
-* clear error that names the actual root cause instead of falling
-* through to the ZIP branch's misleading "no Runtime" hard error.
-*
-* Pseudo-parameter substitution (`${AWS::URLSuffix}` → `amazonaws.com`)
-* is deliberately not implemented here — `lambda-resolver.ts` (the
-* canonical sibling) also defers it, and shipping one-sided support
-* would surprise users. Tracked separately as the issue's optional
-* follow-up.
+* by `cdkd local invoke`. When the synth template recorded a deploy
+* region (`stack.region`), we derive `{ urlSuffix, partition, region }`
+* via `derivePseudoParametersFromRegion` and pass it as the resolver's
+* `pseudoParameters` block so the canonical `${AWS::URLSuffix}` shape
+* resolves cleanly (issue #637). Same-stack ECR refs still surface as
+* `needs-state` (those require `--from-state`); a Join that references
+* `${AWS::AccountId}` without state still surfaces as `not-applicable`
+* with a more specific error message naming the missing parameter.
 *
 * Returns `undefined` when the field is absent or non-recognized,
 * which routes the caller to the ZIP branch (with its existing
 * "no Runtime / no Handler" validations).
 */
-function extractImageUri(value, logicalId, stackName, resources) {
+function extractImageUri(value, logicalId, stackName, resources, region) {
 	if (typeof value === "string" && value.length > 0) return value;
 	if (value && typeof value === "object" && !Array.isArray(value)) {
 		const obj = value;
@@ -54765,11 +54810,12 @@ function extractImageUri(value, logicalId, stackName, resources) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const joinResolved = tryResolveImageFnJoin(value, resources, void 0);
+			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new Error(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local start-api cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
 			if (joinResolved.kind === "unsupported-join") throw new Error(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. cdkd local start-api recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
-			throw new Error(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local start-api cannot resolve. The shape likely references AWS pseudo parameters (e.g. \${AWS::URLSuffix}) — the canonical CDK 2.x lambda.DockerImageCode.fromImageAsset synthesized shape. Workarounds: pin a fully-literal public image URI, or wait for the follow-up that substitutes \${AWS::URLSuffix} against the current region.`);
+			throw new Error(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local start-api cannot resolve${pseudoParameters ? " (likely ${AWS::AccountId}, which cdkd cannot derive without --from-state or STS)" : ` (cdkd could not derive AWS pseudo parameters because stack.region was undefined)`}. Workarounds: deploy first and run with --from-state, or pin a fully-literal public image URI.`);
 		}
 	}
 }
@@ -59598,7 +59644,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.161.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.161.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());