@go-to-k/cdkd 0.18.0 → 0.19.0

package/dist/cli.js

@@ -537,10 +537,122 @@ var destroyOptions = [
   )
 ];
 
+// src/provisioning/resource-name.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
+var stackNameStore = new AsyncLocalStorage();
+function withStackName(stackName, fn) {
+  return stackNameStore.run(stackName, fn);
+}
+function getCurrentStackName() {
+  return stackNameStore.getStore();
+}
+function generateResourceName(name, options) {
+  const { maxLength, lowercase = false, allowedPattern = /[^a-zA-Z0-9-]/g } = options;
+  const currentStackName = stackNameStore.getStore();
+  const fullName = currentStackName ? `${currentStackName}-${name}` : name;
+  let sanitized = lowercase ? fullName.toLowerCase() : fullName;
+  sanitized = sanitized.replace(allowedPattern, "-");
+  sanitized = sanitized.replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+  if (sanitized.length <= maxLength) {
+    return sanitized;
+  }
+  const hash = createHash("sha256").update(fullName).digest("hex").substring(0, 8);
+  const maxPrefixLength = maxLength - hash.length - 1;
+  const prefix = sanitized.substring(0, maxPrefixLength).replace(/-+$/, "");
+  return `${prefix}-${hash}`;
+}
+var FALLBACK_NAME_RULES = {
+  "AWS::S3::Bucket": { nameProperty: "BucketName", options: { maxLength: 63, lowercase: true } },
+  "AWS::SQS::Queue": { nameProperty: "QueueName", options: { maxLength: 80 } },
+  "AWS::SNS::Topic": { nameProperty: "TopicName", options: { maxLength: 256 } },
+  "AWS::Lambda::Function": { nameProperty: "FunctionName", options: { maxLength: 64 } },
+  "AWS::Lambda::LayerVersion": { nameProperty: "LayerName", options: { maxLength: 64 } },
+  "AWS::IAM::Role": { nameProperty: "RoleName", options: { maxLength: 64 } },
+  "AWS::IAM::Policy": { nameProperty: "PolicyName", options: { maxLength: 64 } },
+  "AWS::IAM::User": { nameProperty: "UserName", options: { maxLength: 64 } },
+  "AWS::IAM::Group": { nameProperty: "GroupName", options: { maxLength: 128 } },
+  "AWS::IAM::InstanceProfile": {
+    nameProperty: "InstanceProfileName",
+    options: { maxLength: 128 }
+  },
+  "AWS::DynamoDB::Table": { nameProperty: "TableName", options: { maxLength: 255 } },
+  "AWS::ECR::Repository": {
+    nameProperty: "RepositoryName",
+    options: { maxLength: 256, lowercase: true }
+  },
+  "AWS::ECS::Cluster": { nameProperty: "ClusterName", options: { maxLength: 255 } },
+  "AWS::ECS::Service": { nameProperty: "ServiceName", options: { maxLength: 255 } },
+  "AWS::Logs::LogGroup": { nameProperty: "LogGroupName", options: { maxLength: 512 } },
+  "AWS::CloudWatch::Alarm": { nameProperty: "AlarmName", options: { maxLength: 256 } },
+  "AWS::Events::Rule": { nameProperty: "Name", options: { maxLength: 64 } },
+  "AWS::Events::EventBus": { nameProperty: "Name", options: { maxLength: 256 } },
+  "AWS::Kinesis::Stream": { nameProperty: "Name", options: { maxLength: 128 } },
+  "AWS::StepFunctions::StateMachine": {
+    nameProperty: "StateMachineName",
+    options: { maxLength: 80 }
+  },
+  "AWS::SecretsManager::Secret": {
+    nameProperty: "Name",
+    options: { maxLength: 512, allowedPattern: /[^a-zA-Z0-9-/_]/g }
+  },
+  "AWS::SSM::Parameter": { nameProperty: "Name", options: { maxLength: 2048 } },
+  "AWS::Cognito::UserPool": { nameProperty: "UserPoolName", options: { maxLength: 128 } },
+  "AWS::ElastiCache::SubnetGroup": {
+    nameProperty: "CacheSubnetGroupName",
+    options: { maxLength: 255, lowercase: true }
+  },
+  "AWS::ElastiCache::CacheCluster": {
+    nameProperty: "ClusterName",
+    options: { maxLength: 40, lowercase: true }
+  },
+  "AWS::RDS::DBSubnetGroup": {
+    nameProperty: "DBSubnetGroupName",
+    options: { maxLength: 255, lowercase: true }
+  },
+  "AWS::RDS::DBCluster": {
+    nameProperty: "DBClusterIdentifier",
+    options: { maxLength: 63, lowercase: true }
+  },
+  "AWS::RDS::DBInstance": {
+    nameProperty: "DBInstanceIdentifier",
+    options: { maxLength: 63, lowercase: true }
+  },
+  "AWS::ElasticLoadBalancingV2::LoadBalancer": {
+    nameProperty: "Name",
+    options: { maxLength: 32 }
+  },
+  "AWS::ElasticLoadBalancingV2::TargetGroup": {
+    nameProperty: "Name",
+    options: { maxLength: 32 }
+  },
+  "AWS::WAFv2::WebACL": { nameProperty: "Name", options: { maxLength: 128 } },
+  "AWS::CodeBuild::Project": { nameProperty: "Name", options: { maxLength: 255 } },
+  "AWS::S3Express::DirectoryBucket": {
+    nameProperty: "BucketName",
+    options: { maxLength: 63, lowercase: true }
+  }
+};
+function applyDefaultNameForFallback(logicalId, resourceType, properties) {
+  const rule = FALLBACK_NAME_RULES[resourceType];
+  if (!rule)
+    return properties;
+  if (properties[rule.nameProperty])
+    return properties;
+  const generatedName = generateResourceName(logicalId, rule.options);
+  return {
+    ...properties,
+    [rule.nameProperty]: generatedName
+  };
+}
+
 // src/utils/live-renderer.ts
 var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var FRAME_INTERVAL_MS = 80;
 var ESC = "\x1B[";
+function scopedKey(id, stackName) {
+  return stackName ? `${stackName}:${id}` : id;
+}
 var LiveRenderer = class {
   constructor(stream = process.stdout) {
     this.stream = stream;
@@ -594,12 +706,14 @@ var LiveRenderer = class {
     this.active = false;
   }
   addTask(id, label) {
-    this.tasks.set(id, { label, startedAt: Date.now() });
+    const stackName = getCurrentStackName();
+    this.tasks.set(scopedKey(id, stackName), { label, startedAt: Date.now(), stackName });
     if (this.active)
       this.draw();
   }
   removeTask(id) {
-    if (!this.tasks.delete(id))
+    const stackName = getCurrentStackName();
+    if (!this.tasks.delete(scopedKey(id, stackName)))
       return;
     if (this.active)
       this.draw();
@@ -635,11 +749,16 @@ var LiveRenderer = class {
       return;
     const frame = SPINNER_FRAMES[this.spinnerIndex % SPINNER_FRAMES.length];
     this.spinnerIndex++;
+    const distinctStacks = /* @__PURE__ */ new Set();
+    for (const task of this.tasks.values())
+      distinctStacks.add(task.stackName);
+    const showStackPrefix = distinctStacks.size > 1;
     const cols = this.stream.columns ?? 80;
     const lines = [];
     for (const task of this.tasks.values()) {
       const elapsed = ((Date.now() - task.startedAt) / 1e3).toFixed(1);
-      const raw = `  ${frame} ${task.label} (${elapsed}s)`;
+      const prefix = showStackPrefix && task.stackName ? `[${task.stackName}] ` : "";
+      const raw = `  ${frame} ${prefix}${task.label} (${elapsed}s)`;
       lines.push(this.truncate(raw, cols));
     }
     this.stream.write(lines.join("\n") + "\n");
@@ -672,6 +791,24 @@ function getLiveRenderer() {
   return globalRenderer;
 }
 
+// src/utils/stack-context.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var outputBufferStore = new AsyncLocalStorage2();
+async function runStackBuffered(fn) {
+  const buffer = { lines: [] };
+  return outputBufferStore.run(buffer, async () => {
+    try {
+      const result = await fn();
+      return { ok: true, result, lines: buffer.lines };
+    } catch (error) {
+      return { ok: false, error, lines: buffer.lines };
+    }
+  });
+}
+function getCurrentStackOutputBuffer() {
+  return outputBufferStore.getStore();
+}
+
 // src/utils/logger.ts
 var colors = {
   reset: "\x1B[0m",
@@ -726,28 +863,48 @@ var ConsoleLogger = class {
     }
     return `${message}${formattedArgs}`;
   }
+  /**
+   * Route a formatted log line. When a per-stack output buffer is active in
+   * the current async context (parallel multi-stack deploy), capture the
+   * line into the buffer so it can be flushed as one atomic block when the
+   * stack finishes. Otherwise fall through to the live renderer / console
+   * as before.
+   */
+  emit(level, formatted) {
+    const buffer = getCurrentStackOutputBuffer();
+    if (buffer) {
+      buffer.lines.push(formatted);
+      return;
+    }
+    getLiveRenderer().printAbove(() => {
+      if (level === "error")
+        console.error(formatted);
+      else if (level === "warn")
+        console.warn(formatted);
+      else if (level === "info")
+        console.info(formatted);
+      else
+        console.debug(formatted);
+    });
+  }
   debug(message, ...args) {
     if (this.shouldLog("debug")) {
-      const formatted = this.formatMessage("debug", message, ...args);
-      getLiveRenderer().printAbove(() => console.debug(formatted));
+      this.emit("debug", this.formatMessage("debug", message, ...args));
     }
   }
   info(message, ...args) {
     if (this.shouldLog("info")) {
-      const formatted = this.formatMessage("info", message, ...args);
-      getLiveRenderer().printAbove(() => console.info(formatted));
+      this.emit("info", this.formatMessage("info", message, ...args));
     }
   }
   warn(message, ...args) {
     if (this.shouldLog("warn")) {
-      const formatted = this.formatMessage("warn", message, ...args);
-      getLiveRenderer().printAbove(() => console.warn(formatted));
+      this.emit("warn", this.formatMessage("warn", message, ...args));
     }
   }
   error(message, ...args) {
     if (this.shouldLog("error")) {
-      const formatted = this.formatMessage("error", message, ...args);
-      getLiveRenderer().printAbove(() => console.error(formatted));
+      this.emit("error", this.formatMessage("error", message, ...args));
     }
   }
   /**
@@ -7765,112 +7922,6 @@ import {
 } from "@aws-sdk/client-iam";
 init_aws_clients();
 
-// src/provisioning/resource-name.ts
-import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash } from "node:crypto";
-var stackNameStore = new AsyncLocalStorage();
-function withStackName(stackName, fn) {
-  return stackNameStore.run(stackName, fn);
-}
-function generateResourceName(name, options) {
-  const { maxLength, lowercase = false, allowedPattern = /[^a-zA-Z0-9-]/g } = options;
-  const currentStackName = stackNameStore.getStore();
-  const fullName = currentStackName ? `${currentStackName}-${name}` : name;
-  let sanitized = lowercase ? fullName.toLowerCase() : fullName;
-  sanitized = sanitized.replace(allowedPattern, "-");
-  sanitized = sanitized.replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-  if (sanitized.length <= maxLength) {
-    return sanitized;
-  }
-  const hash = createHash("sha256").update(fullName).digest("hex").substring(0, 8);
-  const maxPrefixLength = maxLength - hash.length - 1;
-  const prefix = sanitized.substring(0, maxPrefixLength).replace(/-+$/, "");
-  return `${prefix}-${hash}`;
-}
-var FALLBACK_NAME_RULES = {
-  "AWS::S3::Bucket": { nameProperty: "BucketName", options: { maxLength: 63, lowercase: true } },
-  "AWS::SQS::Queue": { nameProperty: "QueueName", options: { maxLength: 80 } },
-  "AWS::SNS::Topic": { nameProperty: "TopicName", options: { maxLength: 256 } },
-  "AWS::Lambda::Function": { nameProperty: "FunctionName", options: { maxLength: 64 } },
-  "AWS::Lambda::LayerVersion": { nameProperty: "LayerName", options: { maxLength: 64 } },
-  "AWS::IAM::Role": { nameProperty: "RoleName", options: { maxLength: 64 } },
-  "AWS::IAM::Policy": { nameProperty: "PolicyName", options: { maxLength: 64 } },
-  "AWS::IAM::User": { nameProperty: "UserName", options: { maxLength: 64 } },
-  "AWS::IAM::Group": { nameProperty: "GroupName", options: { maxLength: 128 } },
-  "AWS::IAM::InstanceProfile": {
-    nameProperty: "InstanceProfileName",
-    options: { maxLength: 128 }
-  },
-  "AWS::DynamoDB::Table": { nameProperty: "TableName", options: { maxLength: 255 } },
-  "AWS::ECR::Repository": {
-    nameProperty: "RepositoryName",
-    options: { maxLength: 256, lowercase: true }
-  },
-  "AWS::ECS::Cluster": { nameProperty: "ClusterName", options: { maxLength: 255 } },
-  "AWS::ECS::Service": { nameProperty: "ServiceName", options: { maxLength: 255 } },
-  "AWS::Logs::LogGroup": { nameProperty: "LogGroupName", options: { maxLength: 512 } },
-  "AWS::CloudWatch::Alarm": { nameProperty: "AlarmName", options: { maxLength: 256 } },
-  "AWS::Events::Rule": { nameProperty: "Name", options: { maxLength: 64 } },
-  "AWS::Events::EventBus": { nameProperty: "Name", options: { maxLength: 256 } },
-  "AWS::Kinesis::Stream": { nameProperty: "Name", options: { maxLength: 128 } },
-  "AWS::StepFunctions::StateMachine": {
-    nameProperty: "StateMachineName",
-    options: { maxLength: 80 }
-  },
-  "AWS::SecretsManager::Secret": {
-    nameProperty: "Name",
-    options: { maxLength: 512, allowedPattern: /[^a-zA-Z0-9-/_]/g }
-  },
-  "AWS::SSM::Parameter": { nameProperty: "Name", options: { maxLength: 2048 } },
-  "AWS::Cognito::UserPool": { nameProperty: "UserPoolName", options: { maxLength: 128 } },
-  "AWS::ElastiCache::SubnetGroup": {
-    nameProperty: "CacheSubnetGroupName",
-    options: { maxLength: 255, lowercase: true }
-  },
-  "AWS::ElastiCache::CacheCluster": {
-    nameProperty: "ClusterName",
-    options: { maxLength: 40, lowercase: true }
-  },
-  "AWS::RDS::DBSubnetGroup": {
-    nameProperty: "DBSubnetGroupName",
-    options: { maxLength: 255, lowercase: true }
-  },
-  "AWS::RDS::DBCluster": {
-    nameProperty: "DBClusterIdentifier",
-    options: { maxLength: 63, lowercase: true }
-  },
-  "AWS::RDS::DBInstance": {
-    nameProperty: "DBInstanceIdentifier",
-    options: { maxLength: 63, lowercase: true }
-  },
-  "AWS::ElasticLoadBalancingV2::LoadBalancer": {
-    nameProperty: "Name",
-    options: { maxLength: 32 }
-  },
-  "AWS::ElasticLoadBalancingV2::TargetGroup": {
-    nameProperty: "Name",
-    options: { maxLength: 32 }
-  },
-  "AWS::WAFv2::WebACL": { nameProperty: "Name", options: { maxLength: 128 } },
-  "AWS::CodeBuild::Project": { nameProperty: "Name", options: { maxLength: 255 } },
-  "AWS::S3Express::DirectoryBucket": {
-    nameProperty: "BucketName",
-    options: { maxLength: 63, lowercase: true }
-  }
-};
-function applyDefaultNameForFallback(logicalId, resourceType, properties) {
-  const rule = FALLBACK_NAME_RULES[resourceType];
-  if (!rule)
-    return properties;
-  if (properties[rule.nameProperty])
-    return properties;
-  const generatedName = generateResourceName(logicalId, rule.options);
-  return {
-    ...properties,
-    [rule.nameProperty]: generatedName
-  };
-}
-
 // src/provisioning/import-helpers.ts
 function readNameProperty(input, propertyName) {
   const value = input.properties?.[propertyName];
@@ -14178,7 +14229,8 @@ var LogsLogGroupProvider = class {
 import {
   PutMetricAlarmCommand,
   DeleteAlarmsCommand,
-  DescribeAlarmsCommand
+  DescribeAlarmsCommand,
+  ListTagsForResourceCommand as ListTagsForResourceCommand3
 } from "@aws-sdk/client-cloudwatch";
 init_aws_clients();
 var CloudWatchAlarmProvider = class {
@@ -14396,6 +14448,62 @@ var CloudWatchAlarmProvider = class {
     }
     return params;
   }
+  /**
+   * Adopt an existing CloudWatch alarm into cdkd state.
+   *
+   * Lookup order:
+   *  1. `--resource` override or `Properties.AlarmName` → verify via `DescribeAlarms`.
+   *  2. `DescribeAlarms` paginated, then `ListTagsForResource(AlarmArn)` per
+   *     alarm to match `aws:cdk:path`.
+   */
+  async import(input) {
+    const explicit = resolveExplicitPhysicalId(input, "AlarmName");
+    if (explicit) {
+      try {
+        const resp = await this.cloudWatchClient.send(
+          new DescribeAlarmsCommand({ AlarmNames: [explicit] })
+        );
+        return resp.MetricAlarms?.[0] || resp.CompositeAlarms?.[0] ? { physicalId: explicit, attributes: {} } : null;
+      } catch (err) {
+        if (this.isNotFound(err))
+          return null;
+        throw err;
+      }
+    }
+    if (!input.cdkPath)
+      return null;
+    let nextToken;
+    do {
+      const list = await this.cloudWatchClient.send(
+        new DescribeAlarmsCommand({ ...nextToken && { NextToken: nextToken } })
+      );
+      const all = [...list.MetricAlarms ?? [], ...list.CompositeAlarms ?? []];
+      for (const a of all) {
+        if (!a.AlarmArn || !a.AlarmName)
+          continue;
+        try {
+          const tagsResp = await this.cloudWatchClient.send(
+            new ListTagsForResourceCommand3({ ResourceARN: a.AlarmArn })
+          );
+          if (matchesCdkPath(tagsResp.Tags, input.cdkPath)) {
+            return { physicalId: a.AlarmName, attributes: {} };
+          }
+        } catch (err) {
+          if (this.isNotFound(err))
+            continue;
+          throw err;
+        }
+      }
+      nextToken = list.NextToken;
+    } while (nextToken);
+    return null;
+  }
+  isNotFound(err) {
+    if (!(err instanceof Error))
+      return false;
+    const name = err.name ?? "";
+    return name === "ResourceNotFoundException" || name === "ResourceNotFound";
+  }
 };
 
 // src/provisioning/providers/secretsmanager-secret-provider.ts
@@ -14729,7 +14837,7 @@ var SecretsManagerSecretProvider = class {
 import {
   DescribeParametersCommand,
   GetParameterCommand as GetParameterCommand3,
-  ListTagsForResourceCommand as ListTagsForResourceCommand3,
+  ListTagsForResourceCommand as ListTagsForResourceCommand4,
   PutParameterCommand,
   DeleteParameterCommand,
   AddTagsToResourceCommand,
@@ -14977,7 +15085,7 @@ var SSMParameterProvider = class {
           continue;
         try {
           const tagsResp = await this.ssmClient.send(
-            new ListTagsForResourceCommand3({ ResourceType: "Parameter", ResourceId: p.Name })
+            new ListTagsForResourceCommand4({ ResourceType: "Parameter", ResourceId: p.Name })
           );
           if (matchesCdkPath(tagsResp.TagList, input.cdkPath)) {
             return { physicalId: p.Name, attributes: {} };
@@ -15292,7 +15400,7 @@ import {
   DescribeEventBusCommand,
   ListEventBusesCommand,
   ListRulesCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand4,
+  ListTagsForResourceCommand as ListTagsForResourceCommand5,
   RemoveTargetsCommand as RemoveTargetsCommand2,
   DeleteRuleCommand as DeleteRuleCommand2,
   ListTargetsByRuleCommand as ListTargetsByRuleCommand2,
@@ -15564,7 +15672,7 @@ var EventBridgeBusProvider = class {
           continue;
         try {
           const tagsResp = await this.eventBridgeClient.send(
-            new ListTagsForResourceCommand4({ ResourceARN: bus.Arn })
+            new ListTagsForResourceCommand5({ ResourceARN: bus.Arn })
           );
           if (matchesCdkPath(tagsResp.Tags, input.cdkPath)) {
             return { physicalId: bus.Name, attributes: {} };
@@ -18639,6 +18747,8 @@ import {
   DeleteRouteCommand as DeleteRouteCommand2,
   CreateAuthorizerCommand as CreateAuthorizerCommand2,
   DeleteAuthorizerCommand as DeleteAuthorizerCommand2,
+  GetApiCommand,
+  GetApisCommand,
   NotFoundException as NotFoundException4
 } from "@aws-sdk/client-apigatewayv2";
 var ApiGatewayV2Provider = class {
@@ -19172,6 +19282,56 @@ var ApiGatewayV2Provider = class {
       );
     }
   }
+  // ─── Import ───────────────────────────────────────────────────────
+  /**
+   * Adopt an existing API Gateway V2 resource into cdkd state.
+   *
+   * `AWS::ApiGatewayV2::Api` supports full tag-based auto-lookup via
+   * `GetApis` (`Tags` is a `Record<string,string>` map on each item).
+   *
+   * Sub-resources (`Stage`, `Integration`, `Route`, `Authorizer`) are
+   * scoped under a parent `ApiId`, and their physical ids are not
+   * globally unique — auto-lookup would need to walk every Api in the
+   * account and every sub-resource within. Explicit-override only;
+   * users adopt an existing HTTP API by passing
+   * `--resource <logicalId>=<physicalId>` for each sub-resource.
+   */
+  async import(input) {
+    if (input.resourceType !== "AWS::ApiGatewayV2::Api") {
+      if (input.knownPhysicalId) {
+        return { physicalId: input.knownPhysicalId, attributes: {} };
+      }
+      return null;
+    }
+    const explicit = resolveExplicitPhysicalId(input, null);
+    if (explicit) {
+      try {
+        await this.getClient().send(new GetApiCommand({ ApiId: explicit }));
+        return { physicalId: explicit, attributes: {} };
+      } catch (err) {
+        if (err instanceof NotFoundException4)
+          return null;
+        throw err;
+      }
+    }
+    if (!input.cdkPath)
+      return null;
+    let nextToken;
+    do {
+      const list = await this.getClient().send(
+        new GetApisCommand({ ...nextToken && { NextToken: nextToken } })
+      );
+      for (const api of list.Items ?? []) {
+        if (!api.ApiId)
+          continue;
+        if (api.Tags?.[CDK_PATH_TAG] === input.cdkPath) {
+          return { physicalId: api.ApiId, attributes: {} };
+        }
+      }
+      nextToken = list.NextToken;
+    } while (nextToken);
+    return null;
+  }
   // ─── Helpers ──────────────────────────────────────────────────────
   /**
    * Convert CloudFormation Tags (Array<{Key, Value}>) to SDK Tags (Record<string, string>).
@@ -19345,7 +19505,7 @@ import {
   GetDistributionCommand,
   GetDistributionConfigCommand,
   ListDistributionsCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand5,
+  ListTagsForResourceCommand as ListTagsForResourceCommand6,
   NoSuchDistribution
 } from "@aws-sdk/client-cloudfront";
 init_aws_clients();
@@ -19781,7 +19941,7 @@ var CloudFrontDistributionProvider = class {
           continue;
         try {
           const tagsResp = await this.cloudFrontClient.send(
-            new ListTagsForResourceCommand5({ Resource: d.ARN })
+            new ListTagsForResourceCommand6({ Resource: d.ARN })
           );
           if (matchesCdkPath(tagsResp.Tags?.Items, input.cdkPath)) {
             return { physicalId: d.Id, attributes: {} };
@@ -20288,7 +20448,7 @@ import {
   DescribeServicesCommand,
   ListClustersCommand,
   ListServicesCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand6
+  ListTagsForResourceCommand as ListTagsForResourceCommand7
 } from "@aws-sdk/client-ecs";
 function convertTags(tags) {
   if (!tags || tags.length === 0)
@@ -21066,7 +21226,7 @@ var ECSProvider = class {
       );
       for (const arn of list.clusterArns ?? []) {
         const tagsResp = await this.getClient().send(
-          new ListTagsForResourceCommand6({ resourceArn: arn })
+          new ListTagsForResourceCommand7({ resourceArn: arn })
         );
         if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) {
           const name = arn.substring(arn.lastIndexOf("/") + 1);
@@ -21099,7 +21259,7 @@ var ECSProvider = class {
           );
           for (const svcArn of svcList.serviceArns ?? []) {
             const tagsResp = await this.getClient().send(
-              new ListTagsForResourceCommand6({ resourceArn: svcArn })
+              new ListTagsForResourceCommand7({ resourceArn: svcArn })
             );
             if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) {
               const svcName = svcArn.substring(svcArn.lastIndexOf("/") + 1);
@@ -21673,7 +21833,7 @@ import {
   DeleteDBSubnetGroupCommand,
   DescribeDBSubnetGroupsCommand,
   ModifyDBSubnetGroupCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand7
+  ListTagsForResourceCommand as ListTagsForResourceCommand8
 } from "@aws-sdk/client-rds";
 var RDSProvider = class {
   rdsClient;
@@ -22314,7 +22474,7 @@ var RDSProvider = class {
         if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn)
           continue;
         const tagsResp = await this.getClient().send(
-          new ListTagsForResourceCommand7({ ResourceName: inst.DBInstanceArn })
+          new ListTagsForResourceCommand8({ ResourceName: inst.DBInstanceArn })
         );
         if (matchesCdkPath(tagsResp.TagList, input.cdkPath)) {
           return { physicalId: inst.DBInstanceIdentifier, attributes: {} };
@@ -22349,7 +22509,7 @@ var RDSProvider = class {
         if (!c.DBClusterIdentifier || !c.DBClusterArn)
           continue;
         const tagsResp = await this.getClient().send(
-          new ListTagsForResourceCommand7({ ResourceName: c.DBClusterArn })
+          new ListTagsForResourceCommand8({ ResourceName: c.DBClusterArn })
         );
         if (matchesCdkPath(tagsResp.TagList, input.cdkPath)) {
           return { physicalId: c.DBClusterIdentifier, attributes: {} };
@@ -22384,7 +22544,7 @@ var RDSProvider = class {
         if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn)
           continue;
         const tagsResp = await this.getClient().send(
-          new ListTagsForResourceCommand7({ ResourceName: sg.DBSubnetGroupArn })
+          new ListTagsForResourceCommand8({ ResourceName: sg.DBSubnetGroupArn })
         );
         if (matchesCdkPath(tagsResp.TagList, input.cdkPath)) {
           return { physicalId: sg.DBSubnetGroupName, attributes: {} };
@@ -23290,7 +23450,7 @@ import {
   UpdateUserPoolCommand,
   DescribeUserPoolCommand,
   ListUserPoolsCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand8,
+  ListTagsForResourceCommand as ListTagsForResourceCommand9,
   ResourceNotFoundException as ResourceNotFoundException12
 } from "@aws-sdk/client-cognito-identity-provider";
 var CognitoUserPoolProvider = class {
@@ -23675,7 +23835,7 @@ var CognitoUserPoolProvider = class {
             if (!arn)
               continue;
             const tagsResp = await this.getClient().send(
-              new ListTagsForResourceCommand8({ ResourceArn: arn })
+              new ListTagsForResourceCommand9({ ResourceArn: arn })
             );
             if (tagsResp.Tags?.[CDK_PATH_TAG] === input.cdkPath) {
               return { physicalId: pool.Id, attributes: {} };
@@ -24461,7 +24621,10 @@ import {
   DeleteResolverCommand,
   CreateApiKeyCommand,
   DeleteApiKeyCommand,
-  StartSchemaCreationCommand
+  StartSchemaCreationCommand,
+  GetGraphqlApiCommand,
+  ListGraphqlApisCommand,
+  NotFoundException as AppSyncNotFoundException
 } from "@aws-sdk/client-appsync";
 var AppSyncProvider = class {
   client;
@@ -24969,6 +25132,51 @@ var AppSyncProvider = class {
     const name = error.name ?? "";
     return message.includes("not found") || message.includes("does not exist") || name === "NotFoundException";
   }
+  /**
+   * Adopt an existing AppSync resource into cdkd state.
+   *
+   * `AWS::AppSync::GraphQLApi` supports full tag-based auto-lookup via
+   * `ListGraphqlApis` (each item carries a `tags` map). AppSync sub-resources
+   * (`GraphQLSchema`, `DataSource`, `Resolver`, `ApiKey`) are scoped under a
+   * parent `apiId` and cannot be discovered by tag at the account level —
+   * explicit-override only.
+   */
+  async import(input) {
+    if (input.resourceType !== "AWS::AppSync::GraphQLApi") {
+      if (input.knownPhysicalId) {
+        return { physicalId: input.knownPhysicalId, attributes: {} };
+      }
+      return null;
+    }
+    const explicit = resolveExplicitPhysicalId(input, null);
+    if (explicit) {
+      try {
+        await this.getClient().send(new GetGraphqlApiCommand({ apiId: explicit }));
+        return { physicalId: explicit, attributes: {} };
+      } catch (err) {
+        if (err instanceof AppSyncNotFoundException)
+          return null;
+        throw err;
+      }
+    }
+    if (!input.cdkPath)
+      return null;
+    let nextToken;
+    do {
+      const list = await this.getClient().send(
+        new ListGraphqlApisCommand({ ...nextToken && { nextToken } })
+      );
+      for (const api of list.graphqlApis ?? []) {
+        if (!api.apiId)
+          continue;
+        if (api.tags?.[CDK_PATH_TAG] === input.cdkPath) {
+          return { physicalId: api.apiId, attributes: {} };
+        }
+      }
+      nextToken = list.nextToken;
+    } while (nextToken);
+    return null;
+  }
 };
 
 // src/provisioning/providers/glue-provider.ts
@@ -26907,6 +27115,9 @@ import {
   StopLoggingCommand,
   PutEventSelectorsCommand,
   PutInsightSelectorsCommand,
+  GetTrailCommand,
+  ListTrailsCommand,
+  ListTagsCommand as ListTagsCommand2,
   TrailNotFoundException
 } from "@aws-sdk/client-cloudtrail";
 var CloudTrailProvider = class {
@@ -27138,6 +27349,54 @@ var CloudTrailProvider = class {
   getAttribute(_physicalId, _resourceType, attributeName) {
     return Promise.resolve(attributeName);
   }
+  /**
+   * Adopt an existing CloudTrail trail into cdkd state.
+   *
+   * Lookup order:
+   *  1. `--resource` override or `Properties.TrailName` → verify via `GetTrail`.
+   *  2. `ListTrails` + `ListTags` (CloudTrail uses `Tag[]` arrays per ARN),
+   *     match `aws:cdk:path` tag.
+   */
+  async import(input) {
+    const explicit = resolveExplicitPhysicalId(input, "TrailName");
+    if (explicit) {
+      try {
+        await this.getClient().send(new GetTrailCommand({ Name: explicit }));
+        return { physicalId: explicit, attributes: {} };
+      } catch (err) {
+        if (err instanceof TrailNotFoundException)
+          return null;
+        throw err;
+      }
+    }
+    if (!input.cdkPath)
+      return null;
+    let nextToken;
+    do {
+      const list = await this.getClient().send(
+        new ListTrailsCommand({ ...nextToken && { NextToken: nextToken } })
+      );
+      for (const trail of list.Trails ?? []) {
+        if (!trail.TrailARN || !trail.Name)
+          continue;
+        try {
+          const tagsResp = await this.getClient().send(
+            new ListTagsCommand2({ ResourceIdList: [trail.TrailARN] })
+          );
+          const list2 = tagsResp.ResourceTagList?.[0];
+          if (matchesCdkPath(list2?.TagsList, input.cdkPath)) {
+            return { physicalId: trail.Name, attributes: {} };
+          }
+        } catch (err) {
+          if (err instanceof TrailNotFoundException)
+            continue;
+          throw err;
+        }
+      }
+      nextToken = list.NextToken;
+    } while (nextToken);
+    return null;
+  }
 };
 
 // src/provisioning/providers/codebuild-provider.ts
@@ -27146,6 +27405,8 @@ import {
   CreateProjectCommand,
   DeleteProjectCommand,
   UpdateProjectCommand,
+  BatchGetProjectsCommand,
+  ListProjectsCommand,
   ResourceNotFoundException as ResourceNotFoundException15
 } from "@aws-sdk/client-codebuild";
 var CodeBuildProvider = class {
@@ -27404,6 +27665,54 @@ var CodeBuildProvider = class {
   getAttribute(_physicalId, _resourceType, attributeName) {
     return Promise.resolve(attributeName);
   }
+  /**
+   * Adopt an existing CodeBuild project into cdkd state.
+   *
+   * Lookup order:
+   *  1. `--resource` override or `Properties.Name` → verify via `BatchGetProjects`.
+   *  2. `ListProjects` + `BatchGetProjects` (CodeBuild uses lowercase
+   *     `key`/`value` tags, not the standard `Key`/`Value`), match
+   *     `aws:cdk:path` tag.
+   */
+  async import(input) {
+    const explicit = resolveExplicitPhysicalId(input, "Name");
+    if (explicit) {
+      try {
+        const resp = await this.getClient().send(
+          new BatchGetProjectsCommand({ names: [explicit] })
+        );
+        return resp.projects?.[0]?.name ? { physicalId: explicit, attributes: {} } : null;
+      } catch (err) {
+        if (err instanceof ResourceNotFoundException15)
+          return null;
+        throw err;
+      }
+    }
+    if (!input.cdkPath)
+      return null;
+    let nextToken;
+    do {
+      const list = await this.getClient().send(
+        new ListProjectsCommand({ ...nextToken && { nextToken } })
+      );
+      const names = (list.projects ?? []).filter((n) => typeof n === "string");
+      if (names.length > 0) {
+        const batch = await this.getClient().send(new BatchGetProjectsCommand({ names }));
+        for (const proj of batch.projects ?? []) {
+          if (!proj.name)
+            continue;
+          const tags = proj.tags ?? [];
+          for (const t of tags) {
+            if (t.key === CDK_PATH_TAG && t.value === input.cdkPath) {
+              return { physicalId: proj.name, attributes: {} };
+            }
+          }
+        }
+      }
+      nextToken = list.nextToken;
+    } while (nextToken);
+    return null;
+  }
 };
 
 // src/provisioning/providers/s3-vectors-provider.ts
@@ -28195,6 +28504,7 @@ import {
   PutImageScanningConfigurationCommand,
   PutImageTagMutabilityCommand,
   TagResourceCommand as TagResourceCommand7,
+  ListTagsForResourceCommand as ListTagsForResourceCommand10,
   RepositoryNotFoundException
 } from "@aws-sdk/client-ecr";
 var ECRProvider = class {
@@ -28428,6 +28738,56 @@ var ECRProvider = class {
       );
     }
   }
+  /**
+   * Adopt an existing ECR repository into cdkd state.
+   *
+   * Lookup order:
+   *  1. `--resource` override or `Properties.RepositoryName` → verify via
+   *     `DescribeRepositories`.
+   *  2. `DescribeRepositories` paginated, then `ListTagsForResource(arn)`
+   *     per repository to match `aws:cdk:path` (`Tag[]` array shape).
+   */
+  async import(input) {
+    const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
+    if (explicit) {
+      try {
+        const resp = await this.getClient().send(
+          new DescribeRepositoriesCommand({ repositoryNames: [explicit] })
+        );
+        return resp.repositories?.[0]?.repositoryName ? { physicalId: explicit, attributes: {} } : null;
+      } catch (err) {
+        if (err instanceof RepositoryNotFoundException)
+          return null;
+        throw err;
+      }
+    }
+    if (!input.cdkPath)
+      return null;
+    let nextToken;
+    do {
+      const list = await this.getClient().send(
+        new DescribeRepositoriesCommand({ ...nextToken && { nextToken } })
+      );
+      for (const repo of list.repositories ?? []) {
+        if (!repo.repositoryArn || !repo.repositoryName)
+          continue;
+        try {
+          const tagsResp = await this.getClient().send(
+            new ListTagsForResourceCommand10({ resourceArn: repo.repositoryArn })
+          );
+          if (matchesCdkPath(tagsResp.tags, input.cdkPath)) {
+            return { physicalId: repo.repositoryName, attributes: {} };
+          }
+        } catch (err) {
+          if (err instanceof RepositoryNotFoundException)
+            continue;
+          throw err;
+        }
+      }
+      nextToken = list.nextToken;
+    } while (nextToken);
+    return null;
+  }
 };
 
 // src/provisioning/register-providers.ts
@@ -29998,6 +30358,68 @@ async function deployCommand(stacks, options) {
     }
     const summary = workGraph.summary();
     logger.debug(`Work graph: ${summary["asset-publish"]} asset(s), ${summary["stack"]} stack(s)`);
+    const bufferStackOutput = targetStacks.length > 1;
+    const runStack = async (stackInfo) => {
+      const stackRegion = stackInfo.region || baseRegion;
+      logger.info(
+        `
+Deploying stack: ${stackInfo.stackName}${stackRegion !== baseRegion ? ` (region: ${stackRegion})` : ""}`
+      );
+      switchRegion(stackRegion);
+      const stackAwsClients = new AwsClients({
+        region: stackRegion,
+        ...options.profile && { profile: options.profile }
+      });
+      setAwsClients(stackAwsClients);
+      const stateS3Client = new AwsClients({
+        region: baseRegion,
+        ...options.profile && { profile: options.profile }
+      });
+      const stackStateBackend = new S3StateBackend(stateS3Client.s3, stateConfig, {
+        region: baseRegion,
+        ...options.profile && { profile: options.profile }
+      });
+      const stackLockManager = new LockManager(stateS3Client.s3, stateConfig);
+      const stackProviderRegistry = new ProviderRegistry();
+      registerAllProviders(stackProviderRegistry);
+      stackProviderRegistry.setCustomResourceResponseBucket(stateBucket, baseRegion);
+      const stackDeployEngine = new DeployEngine(
+        stackStateBackend,
+        stackLockManager,
+        dagBuilder,
+        diffCalculator,
+        stackProviderRegistry,
+        {
+          concurrency: options.concurrency,
+          dryRun: options.dryRun,
+          noRollback: !options.rollback
+        },
+        stackRegion
+      );
+      try {
+        const deployResult = await stackDeployEngine.deploy(
+          stackInfo.stackName,
+          stackInfo.template
+        );
+        logger.info("\nDeployment Summary:");
+        logger.info(`  Stack: ${deployResult.stackName}`);
+        logger.info(`  Created: ${deployResult.created}`);
+        logger.info(`  Updated: ${deployResult.updated}`);
+        logger.info(`  Deleted: ${deployResult.deleted}`);
+        logger.info(`  Unchanged: ${deployResult.unchanged}`);
+        logger.info(`  Duration: ${(deployResult.durationMs / 1e3).toFixed(2)}s`);
+        if (options.dryRun) {
+          logger.info("\n\u2713 Dry run completed - no actual changes made");
+        } else {
+          logger.info("\n\u2713 Deployment completed successfully");
+        }
+      } finally {
+        stackAwsClients.destroy();
+        stateS3Client.destroy();
+        switchRegion(baseRegion);
+        setAwsClients(awsClients);
+      }
+    };
     await workGraph.execute(
       {
         "asset-build": options.imageBuildConcurrency,
@@ -30009,65 +30431,16 @@ async function deployCommand(stacks, options) {
           await assetPublisher.executeNode(node);
         } else {
           const { stack: stackInfo } = node.data;
-          const stackRegion = stackInfo.region || baseRegion;
-          logger.info(
-            `
-Deploying stack: ${stackInfo.stackName}${stackRegion !== baseRegion ? ` (region: ${stackRegion})` : ""}`
-          );
-          switchRegion(stackRegion);
-          const stackAwsClients = new AwsClients({
-            region: stackRegion,
-            ...options.profile && { profile: options.profile }
-          });
-          setAwsClients(stackAwsClients);
-          const stateS3Client = new AwsClients({
-            region: baseRegion,
-            ...options.profile && { profile: options.profile }
-          });
-          const stackStateBackend = new S3StateBackend(stateS3Client.s3, stateConfig, {
-            region: baseRegion,
-            ...options.profile && { profile: options.profile }
-          });
-          const stackLockManager = new LockManager(stateS3Client.s3, stateConfig);
-          const stackProviderRegistry = new ProviderRegistry();
-          registerAllProviders(stackProviderRegistry);
-          stackProviderRegistry.setCustomResourceResponseBucket(stateBucket, baseRegion);
-          const stackDeployEngine = new DeployEngine(
-            stackStateBackend,
-            stackLockManager,
-            dagBuilder,
-            diffCalculator,
-            stackProviderRegistry,
-            {
-              concurrency: options.concurrency,
-              dryRun: options.dryRun,
-              noRollback: !options.rollback
-            },
-            stackRegion
-          );
-          try {
-            const deployResult = await stackDeployEngine.deploy(
-              stackInfo.stackName,
-              stackInfo.template
-            );
-            logger.info("\nDeployment Summary:");
-            logger.info(`  Stack: ${deployResult.stackName}`);
-            logger.info(`  Created: ${deployResult.created}`);
-            logger.info(`  Updated: ${deployResult.updated}`);
-            logger.info(`  Deleted: ${deployResult.deleted}`);
-            logger.info(`  Unchanged: ${deployResult.unchanged}`);
-            logger.info(`  Duration: ${(deployResult.durationMs / 1e3).toFixed(2)}s`);
-            if (options.dryRun) {
-              logger.info("\n\u2713 Dry run completed - no actual changes made");
-            } else {
-              logger.info("\n\u2713 Deployment completed successfully");
-            }
-          } finally {
-            stackAwsClients.destroy();
-            stateS3Client.destroy();
-            switchRegion(baseRegion);
-            setAwsClients(awsClients);
+          if (!bufferStackOutput) {
+            await runStack(stackInfo);
+            return;
+          }
+          const outcome = await runStackBuffered(() => runStack(stackInfo));
+          if (outcome.lines.length > 0) {
+            process.stdout.write(outcome.lines.join("\n") + "\n");
           }
+          if (!outcome.ok)
+            throw outcome.error;
         }
       }
     );
@@ -32326,7 +32699,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command13();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.18.0");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.19.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());