@go-to-k/cdkd 0.161.0 → 0.161.2

package/dist/cli.js

@@ -42081,6 +42081,55 @@ function createLocalStateProvider(options, cdkdStackName, synthRegion) {
 //#endregion
 //#region src/local/intrinsic-image.ts
 /**
+* Derive the AWS pseudo parameters that are trivially knowable from the
+* deploy region alone, without any STS call or cdkd state load.
+* `urlSuffix` and `partition` follow the canonical AWS partition rules:
+*
+*   - region prefix `cn-*`        → partition `aws-cn`,     urlSuffix `amazonaws.com.cn`
+*   - region prefix `us-gov-*`    → partition `aws-us-gov`, urlSuffix `amazonaws.com`
+*   - region prefix `us-iso-*`    → partition `aws-iso`,    urlSuffix `c2s.ic.gov`
+*   - region prefix `us-isob-*`   → partition `aws-iso-b`,  urlSuffix `sc2s.sgov.gov`
+*   - everything else (`us-east-1` / `eu-west-2` / `ap-northeast-1` / etc.)
+*                                 → partition `aws`,        urlSuffix `amazonaws.com`
+*
+* `accountId` is optional pass-through (caller decides whether to populate
+* it). The bootstrap-ECR URI shape that `lambda.DockerImageCode.fromImageAsset`
+* synthesizes carries account-id + region as literal strings in the template,
+* so only `urlSuffix` / `partition` / `region` are required to resolve it
+* (issue #637).
+*
+* Returns `undefined` when `region` is undefined / empty so the caller can
+* fall through cleanly. The shape mirrors `ImageResolutionContext.pseudoParameters`
+* so the result drops straight into a context literal.
+*/
+function derivePseudoParametersFromRegion(region, accountId) {
+	if (!region || typeof region !== "string" || region.length === 0) return void 0;
+	let partition;
+	let urlSuffix;
+	if (region.startsWith("cn-")) {
+		partition = "aws-cn";
+		urlSuffix = "amazonaws.com.cn";
+	} else if (region.startsWith("us-gov-")) {
+		partition = "aws-us-gov";
+		urlSuffix = "amazonaws.com";
+	} else if (region.startsWith("us-isob-")) {
+		partition = "aws-iso-b";
+		urlSuffix = "sc2s.sgov.gov";
+	} else if (region.startsWith("us-iso-")) {
+		partition = "aws-iso";
+		urlSuffix = "c2s.ic.gov";
+	} else {
+		partition = "aws";
+		urlSuffix = "amazonaws.com";
+	}
+	return {
+		...accountId !== void 0 && { accountId },
+		region,
+		partition,
+		urlSuffix
+	};
+}
+/**
 * Resolve the canonical CDK 2.x `Fn::Join` shape emitted by
 * `ContainerImage.fromEcrRepository(repo, tag)` (ECS) and
 * `lambda.DockerImageCode.fromEcr(repo, { tagOrDigest })` (Lambda
@@ -42447,7 +42496,7 @@ function extractLambdaProperties(stack, logicalId, resource, resources) {
 	const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
 	const ephemeralStorageMb = extractEphemeralStorageMb(props, logicalId);
 	const code = props["Code"] ?? {};
-	const imageUri = extractImageUri$1(code["ImageUri"], logicalId, stack.stackName, resources);
+	const imageUri = extractImageUri$1(code["ImageUri"], logicalId, stack.stackName, resources, stack.region);
 	if (imageUri !== void 0) return extractImageLambdaProperties({
 		stack,
 		logicalId,
@@ -42544,7 +42593,7 @@ function extractEphemeralStorageMb(props, logicalId) {
 * for genuinely unrecognized shapes so the caller's downstream ZIP-vs-
 * IMAGE branching can route to its existing error path.
 */
-function extractImageUri$1(value, logicalId, stackName, resources) {
+function extractImageUri$1(value, logicalId, stackName, resources, region) {
 	if (typeof value === "string" && value.length > 0) return value;
 	if (value && typeof value === "object" && !Array.isArray(value)) {
 		const obj = value;
@@ -42552,11 +42601,12 @@ function extractImageUri$1(value, logicalId, stackName, resources) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const joinResolved = tryResolveImageFnJoin(value, resources, void 0);
+			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local invoke cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
 			if (joinResolved.kind === "unsupported-join") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. cdkd local invoke recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
-			throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local invoke cannot resolve. The shape likely references AWS pseudo parameters (e.g. \${AWS::URLSuffix}) for an imported ECR repository. Workarounds: rebuild via lambda.DockerImageCode.fromImageAsset, or pin a fully-literal public image URI.`);
+			throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local invoke cannot resolve${pseudoParameters ? " (likely ${AWS::AccountId}, which cdkd cannot derive without --from-state or STS)" : ` (cdkd could not derive AWS pseudo parameters because stack.region was undefined)`}. Workarounds: deploy first and run with --from-state, or pin a fully-literal public image URI.`);
 		}
 	}
 }
@@ -43056,9 +43106,14 @@ function substituteAgainstState(value, contextOrResources) {
 	if (intrinsic === "Fn::GetAtt") return resolveGetAtt(arg, context);
 	if (intrinsic === "Fn::Sub") return resolveSub(arg, context);
 	if (intrinsic === "Fn::Join") return resolveJoin(arg, context);
+	if (intrinsic === "Fn::Select") return resolveSelect(arg, context);
+	if (intrinsic === "Fn::Split") return {
+		kind: "unresolved",
+		reason: `Fn::Split returns an array, which is not a valid env-var value (use Fn::Select to pick one element)`
+	};
 	return {
 		kind: "unresolved",
-		reason: `unsupported intrinsic '${intrinsic}' (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join)`
+		reason: `unsupported intrinsic '${intrinsic}' (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::Select, Fn::Split)`
 	};
 }
 function isContext(v) {
@@ -43272,6 +43327,121 @@ function resolveJoin(arg, context) {
 	};
 }
 /**
+* `Fn::Select: [<index>, <list>]` — pick the indexed element of an
+* array. Mirrors the semantics of `resolveImageIntrinsic`'s `Fn::Select`
+* branch in `src/local/intrinsic-image.ts` so the two resolvers behave
+* the same way for the same template shape.
+*
+*   - Index may be a number (`0`) OR a numeric string (`'0'`) — CFn
+*     templates often carry the string form after a JSON round-trip.
+*   - List may be a resolved-array intrinsic (today only `Fn::Split`
+*     produces a `string[]`) OR a literal `[...]` array of intrinsics
+*     resolved on the fly.
+*   - Out-of-bounds / negative / non-finite index reports unresolved.
+*/
+function resolveSelect(arg, context) {
+	if (!Array.isArray(arg) || arg.length !== 2) return {
+		kind: "unresolved",
+		reason: `Fn::Select expects [index, list], got ${Array.isArray(arg) ? `array of length ${arg.length}` : typeof arg}`
+	};
+	const [rawIndex, listArg] = arg;
+	let index;
+	if (typeof rawIndex === "number") index = rawIndex;
+	else if (typeof rawIndex === "string" && /^-?\d+$/.test(rawIndex)) index = Number.parseInt(rawIndex, 10);
+	if (index === void 0 || !Number.isFinite(index)) return {
+		kind: "unresolved",
+		reason: `Fn::Select index must be a finite number (or numeric string), got ${typeof rawIndex}`
+	};
+	if (index < 0) return {
+		kind: "unresolved",
+		reason: `Fn::Select index must be non-negative, got ${index}`
+	};
+	const list = resolveAny(listArg, context);
+	if (list.kind === "unresolved") return {
+		kind: "unresolved",
+		reason: `Fn::Select list: ${list.reason}`
+	};
+	if (Array.isArray(list.value)) {
+		if (index >= list.value.length) return {
+			kind: "unresolved",
+			reason: `Fn::Select index ${index} out of bounds (list length ${list.value.length})`
+		};
+		return {
+			kind: "literal",
+			value: list.value[index]
+		};
+	}
+	return {
+		kind: "unresolved",
+		reason: `Fn::Select list must resolve to an array, got ${typeof list.value}`
+	};
+}
+/**
+* `Fn::Split: [<delimiter>, <string>]` — split a string into a
+* `string[]`. Only callable through `resolveAny` (i.e. inside
+* `Fn::Select`); the top-level dispatcher rejects bare `Fn::Split`
+* since an array cannot be an env-var value.
+*
+* The string argument can itself be an intrinsic (typical CDK shape:
+* `Fn::Split: [':', { 'Fn::GetAtt': [<Secret>, 'SecretArn'] }]`); it's
+* resolved through `substituteAgainstState` so we don't accidentally
+* admit nested-array shapes there.
+*/
+function resolveSplitAsArray(arg, context) {
+	if (!Array.isArray(arg) || arg.length !== 2) return {
+		kind: "unresolved",
+		reason: `Fn::Split expects [delimiter, string], got ${Array.isArray(arg) ? `array of length ${arg.length}` : typeof arg}`
+	};
+	const [delim, src] = arg;
+	if (typeof delim !== "string") return {
+		kind: "unresolved",
+		reason: `Fn::Split delimiter must be a string, got ${typeof delim}`
+	};
+	const sub = substituteAgainstState(src, context);
+	if (sub.kind !== "literal") return {
+		kind: "unresolved",
+		reason: `Fn::Split string argument: ${sub.reason}`
+	};
+	if (typeof sub.value !== "string") return {
+		kind: "unresolved",
+		reason: `Fn::Split string argument must resolve to a string, got ${typeof sub.value}`
+	};
+	return {
+		kind: "literal",
+		value: sub.value.split(delim)
+	};
+}
+/**
+* Array-tolerant resolver used by `Fn::Select`'s `list` argument.
+* Returns either the scalar `StateSubstitutionResult` shape (delegating
+* to `substituteAgainstState`) OR a `{kind: 'literal', value: string[]}`
+* when the node is `Fn::Split` / a literal array of intrinsics.
+*
+* Top-level `substituteAgainstState` deliberately doesn't go through
+* this helper — env-var values can't be arrays, and the asymmetry
+* matches `intrinsic-image.ts`'s `resolveImageIntrinsic` (scalar) vs
+* `resolveImageIntrinsicAny` (scalar OR array) split.
+*/
+function resolveAny(value, context) {
+	if (Array.isArray(value)) {
+		const out = [];
+		for (let i = 0; i < value.length; i += 1) {
+			const sub = substituteAgainstState(value[i], context);
+			if (sub.kind !== "literal") return {
+				kind: "unresolved",
+				reason: `list element [${i}]: ${sub.reason}`
+			};
+			out.push(String(sub.value));
+		}
+		return {
+			kind: "literal",
+			value: out
+		};
+	}
+	if (value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && Object.prototype.hasOwnProperty.call(value, "Fn::Split")) return resolveSplitAsArray(value["Fn::Split"], context);
+	return substituteAgainstState(value, context);
+}
+/**
 * Async sibling of {@link substituteAgainstState}. Same semantics for every
 * intrinsic the sync path supports; additionally consults the
 * `crossStackResolver` (when supplied on the context) for `Fn::ImportValue`
@@ -43301,12 +43471,12 @@ async function substituteAgainstStateAsync(value, contextOrResources) {
 	};
 	const intrinsic = keys[0];
 	const arg = obj[intrinsic];
-	if (intrinsic === "Ref" || intrinsic === "Fn::GetAtt" || intrinsic === "Fn::Sub" || intrinsic === "Fn::Join") return substituteAgainstState(value, context);
+	if (intrinsic === "Ref" || intrinsic === "Fn::GetAtt" || intrinsic === "Fn::Sub" || intrinsic === "Fn::Join" || intrinsic === "Fn::Select" || intrinsic === "Fn::Split") return substituteAgainstState(value, context);
 	if (intrinsic === "Fn::ImportValue") return resolveImportValueAsync(arg, context);
 	if (intrinsic === "Fn::GetStackOutput") return resolveGetStackOutputAsync(arg, context);
 	return {
 		kind: "unresolved",
-		reason: `unsupported intrinsic '${intrinsic}' (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::ImportValue, Fn::GetStackOutput)`
+		reason: `unsupported intrinsic '${intrinsic}' (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::Select, Fn::Split, Fn::ImportValue, Fn::GetStackOutput)`
 	};
 }
 /**
@@ -54691,7 +54861,7 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 		const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
 		const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
 		const code = props["Code"] ?? {};
-		const imageUri = extractImageUri(code["ImageUri"], logicalId, stack.stackName, stack.template.Resources ?? {});
+		const imageUri = extractImageUri(code["ImageUri"], logicalId, stack.stackName, stack.template.Resources ?? {}, stack.region);
 		if (imageUri !== void 0) return resolveImageLambda({
 			stack,
 			logicalId,
@@ -54735,29 +54905,24 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 * `lambda.DockerImageCode.fromImageAsset`), and `Fn::Join` (the
 * canonical shape for `lambda.DockerImageCode.fromImageAsset` in
 * CDK 2.x, which emits a `Fn::Join` over the literal bootstrap ECR
-* URI with `${AWS::URLSuffix}` — issue #627).
+* URI with `${AWS::URLSuffix}` — issues #627 + #637).
 *
 * The `Fn::Join` arm routes through the shared
 * `tryResolveImageFnJoin` helper (`src/local/intrinsic-image.ts`) used
-* by `cdkd local invoke`. Like the sibling `lambda-resolver.ts`, we
-* pass `undefined` for the `ImageResolutionContext` — start-api
-* doesn't load cdkd state up front, so same-stack ECR refs surface
-* as `needs-state` and pseudo-parameter-only shapes (`Ref:
-* AWS::URLSuffix`) surface as `not-applicable`. Both cases throw a
-* clear error that names the actual root cause instead of falling
-* through to the ZIP branch's misleading "no Runtime" hard error.
-*
-* Pseudo-parameter substitution (`${AWS::URLSuffix}` → `amazonaws.com`)
-* is deliberately not implemented here — `lambda-resolver.ts` (the
-* canonical sibling) also defers it, and shipping one-sided support
-* would surprise users. Tracked separately as the issue's optional
-* follow-up.
+* by `cdkd local invoke`. When the synth template recorded a deploy
+* region (`stack.region`), we derive `{ urlSuffix, partition, region }`
+* via `derivePseudoParametersFromRegion` and pass it as the resolver's
+* `pseudoParameters` block so the canonical `${AWS::URLSuffix}` shape
+* resolves cleanly (issue #637). Same-stack ECR refs still surface as
+* `needs-state` (those require `--from-state`); a Join that references
+* `${AWS::AccountId}` without state still surfaces as `not-applicable`
+* with a more specific error message naming the missing parameter.
 *
 * Returns `undefined` when the field is absent or non-recognized,
 * which routes the caller to the ZIP branch (with its existing
 * "no Runtime / no Handler" validations).
 */
-function extractImageUri(value, logicalId, stackName, resources) {
+function extractImageUri(value, logicalId, stackName, resources, region) {
 	if (typeof value === "string" && value.length > 0) return value;
 	if (value && typeof value === "object" && !Array.isArray(value)) {
 		const obj = value;
@@ -54765,11 +54930,12 @@ function extractImageUri(value, logicalId, stackName, resources) {
 		if (typeof sub === "string" && sub.length > 0) return sub;
 		if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0];
 		if ("Fn::Join" in obj) {
-			const joinResolved = tryResolveImageFnJoin(value, resources, void 0);
+			const pseudoParameters = derivePseudoParametersFromRegion(region);
+			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
 			if (joinResolved.kind === "needs-state") throw new Error(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local start-api cannot resolve the repository URI without state — deploy the stack first (so cdkd records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
 			if (joinResolved.kind === "unsupported-join") throw new Error(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. cdkd local start-api recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
-			throw new Error(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local start-api cannot resolve. The shape likely references AWS pseudo parameters (e.g. \${AWS::URLSuffix}) — the canonical CDK 2.x lambda.DockerImageCode.fromImageAsset synthesized shape. Workarounds: pin a fully-literal public image URI, or wait for the follow-up that substitutes \${AWS::URLSuffix} against the current region.`);
+			throw new Error(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that cdkd local start-api cannot resolve${pseudoParameters ? " (likely ${AWS::AccountId}, which cdkd cannot derive without --from-state or STS)" : ` (cdkd could not derive AWS pseudo parameters because stack.region was undefined)`}. Workarounds: deploy first and run with --from-state, or pin a fully-literal public image URI.`);
 		}
 	}
 }
@@ -59598,7 +59764,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.161.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.161.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());