@go-to-k/cdkd 0.2.0 → 0.3.1

package/dist/index.js

@@ -3139,6 +3139,62 @@ var TemplateParser = class {
 
 // src/analyzer/dag-builder.ts
 import graphlib from "graphlib";
+
+// src/analyzer/lambda-vpc-deps.ts
+function extractLambdaVpcDeleteDeps(resources) {
+  const edges = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [lambdaId, resource] of Object.entries(resources)) {
+    if (resource.Type !== "AWS::Lambda::Function")
+      continue;
+    const vpcConfig = (resource.Properties ?? {})["VpcConfig"];
+    if (!isObject(vpcConfig))
+      continue;
+    const targets = /* @__PURE__ */ new Set();
+    collectRefIds(vpcConfig["SubnetIds"], targets);
+    collectRefIds(vpcConfig["SecurityGroupIds"], targets);
+    for (const targetId of targets) {
+      if (targetId === lambdaId)
+        continue;
+      if (!(targetId in resources))
+        continue;
+      const key = `${lambdaId}\0${targetId}`;
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      edges.push({ before: lambdaId, after: targetId });
+    }
+  }
+  return edges;
+}
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function collectRefIds(value, out) {
+  if (value === null || value === void 0)
+    return;
+  if (Array.isArray(value)) {
+    for (const item of value)
+      collectRefIds(item, out);
+    return;
+  }
+  if (!isObject(value))
+    return;
+  if (typeof value["Ref"] === "string") {
+    const ref = value["Ref"];
+    if (!ref.startsWith("AWS::"))
+      out.add(ref);
+    return;
+  }
+  if (Array.isArray(value["Fn::GetAtt"])) {
+    const arr = value["Fn::GetAtt"];
+    if (typeof arr[0] === "string")
+      out.add(arr[0]);
+    return;
+  }
+}
+
+// src/analyzer/dag-builder.ts
 var { Graph, alg } = graphlib;
 var IAM_ROLE_POLICY_TYPES = /* @__PURE__ */ new Set([
   "AWS::IAM::Policy",
@@ -3186,6 +3242,7 @@ var DagBuilder = class {
     }
     this.logger.debug(`Dependency graph built: ${resourceIds.length} nodes, ${edgeCount} edges`);
     edgeCount += this.addCustomResourcePolicyEdges(graph, template);
+    edgeCount += this.addLambdaVpcEdges(graph, template);
     if (!alg.isAcyclic(graph)) {
       const cycles = this.findCycles(graph);
       throw new DependencyError(
@@ -3378,6 +3435,41 @@ var DagBuilder = class {
     }
     return added;
   }
+  /**
+   * Add edges from Subnets / SecurityGroups referenced by an
+   * AWS::Lambda::Function VpcConfig to the Lambda itself.
+   *
+   * Same direction as a normal `Ref`-derived edge (Subnet -> Lambda), so for
+   * deploy this just duplicates what extractDependencies already produced.
+   * The point is robustness: if a future template massages the VpcConfig
+   * shape in a way the recursive extractor doesn't anticipate, this pass
+   * still ties the Lambda to its networking resources so that the
+   * deletion-time reverse traversal continues to delete Lambda before
+   * Subnet / SecurityGroup.
+   *
+   * Returns the number of NEW edges added (existing edges are skipped).
+   */
+  addLambdaVpcEdges(graph, template) {
+    const edges = extractLambdaVpcDeleteDeps(template.Resources);
+    if (edges.length === 0)
+      return 0;
+    let added = 0;
+    for (const edge of edges) {
+      const depId = edge.after;
+      const dependentId = edge.before;
+      if (!graph.hasNode(depId) || !graph.hasNode(dependentId))
+        continue;
+      if (graph.hasEdge(depId, dependentId))
+        continue;
+      graph.setEdge(depId, dependentId);
+      added++;
+      this.logger.debug(`Added implicit edge (lambda vpc): ${depId} -> ${dependentId}`);
+    }
+    if (added > 0) {
+      this.logger.debug(`Added ${added} implicit edges for Lambda VpcConfig`);
+    }
+    return added;
+  }
   isCustomResourceType(type) {
     return type === "AWS::CloudFormation::CustomResource" || type.startsWith("Custom::");
   }
@@ -7082,6 +7174,44 @@ var DagExecutor = class {
   }
 };
 
+// src/analyzer/implicit-delete-deps.ts
+var IMPLICIT_DELETE_DEPENDENCIES = {
+  // IGW must be deleted AFTER VPCGatewayAttachment
+  "AWS::EC2::InternetGateway": ["AWS::EC2::VPCGatewayAttachment"],
+  // EventBus must be deleted AFTER Rules on that bus
+  "AWS::Events::EventBus": ["AWS::Events::Rule"],
+  // Athena workgroup must be deleted AFTER its named queries
+  "AWS::Athena::WorkGroup": ["AWS::Athena::NamedQuery"],
+  // CloudFront managed-policy-style resources must be deleted AFTER
+  // any Distribution that references them
+  "AWS::CloudFront::ResponseHeadersPolicy": ["AWS::CloudFront::Distribution"],
+  "AWS::CloudFront::CachePolicy": ["AWS::CloudFront::Distribution"],
+  "AWS::CloudFront::OriginAccessControl": ["AWS::CloudFront::Distribution"],
+  // VPC must be deleted AFTER all VPC-dependent resources
+  "AWS::EC2::VPC": [
+    "AWS::EC2::Subnet",
+    "AWS::EC2::SecurityGroup",
+    "AWS::EC2::InternetGateway",
+    "AWS::EC2::EgressOnlyInternetGateway",
+    "AWS::EC2::VPCGatewayAttachment",
+    "AWS::EC2::RouteTable"
+  ],
+  // Subnet must be deleted AFTER any Lambda that may still hold an ENI
+  // in it. Lambda DELETE returns immediately but the ENI is detached
+  // asynchronously by AWS, so deleting the Subnet first races the detach
+  // and yields "DependencyViolation".
+  "AWS::EC2::Subnet": ["AWS::EC2::SubnetRouteTableAssociation", "AWS::Lambda::Function"],
+  // RouteTable must be deleted AFTER Route and Association
+  "AWS::EC2::RouteTable": ["AWS::EC2::Route", "AWS::EC2::SubnetRouteTableAssociation"],
+  // SecurityGroup must be deleted AFTER any Lambda whose ENI is bound
+  // to it (same ENI-detach race as Subnet above).
+  "AWS::EC2::SecurityGroup": [
+    "AWS::EC2::SecurityGroupIngress",
+    "AWS::EC2::SecurityGroupEgress",
+    "AWS::Lambda::Function"
+  ]
+};
+
 // src/deployment/deploy-engine.ts
 var InterruptedError = class extends Error {
   constructor() {
@@ -7089,7 +7219,7 @@ var InterruptedError = class extends Error {
     this.name = "InterruptedError";
   }
 };
-var DeployEngine = class _DeployEngine {
+var DeployEngine = class {
   constructor(stateBackend, lockManager, dagBuilder, diffCalculator, providerRegistry, options = {}, stackRegion) {
     this.stateBackend = stateBackend;
     this.lockManager = lockManager;
@@ -7926,36 +8056,9 @@ var DeployEngine = class _DeployEngine {
     const deps = parser.extractDependencies(resource);
     return deps.size > 0 ? [...deps] : void 0;
   }
-  /**
-   * Implicit dependency map for correct deletion order.
-   *
-   * Key = resource type that must be deleted AFTER all value types are deleted.
-   * Value = resource types that must be deleted BEFORE the key type.
-   *
-   * Example: InternetGateway depends on VPCGatewayAttachment being deleted first,
-   * because AWS won't let you delete an IGW while it's still attached to a VPC.
-   */
-  static IMPLICIT_DELETE_DEPENDENCIES = {
-    // IGW must be deleted AFTER VPCGatewayAttachment
-    "AWS::EC2::InternetGateway": ["AWS::EC2::VPCGatewayAttachment"],
-    // EventBus must be deleted AFTER Rules on that bus
-    "AWS::Events::EventBus": ["AWS::Events::Rule"],
-    // VPC must be deleted AFTER all VPC-dependent resources
-    "AWS::EC2::VPC": [
-      "AWS::EC2::Subnet",
-      "AWS::EC2::SecurityGroup",
-      "AWS::EC2::InternetGateway",
-      "AWS::EC2::EgressOnlyInternetGateway",
-      "AWS::EC2::VPCGatewayAttachment",
-      "AWS::EC2::RouteTable"
-    ],
-    // Subnet must be deleted AFTER RouteTableAssociation
-    "AWS::EC2::Subnet": ["AWS::EC2::SubnetRouteTableAssociation"],
-    // RouteTable must be deleted AFTER Route and Association
-    "AWS::EC2::RouteTable": ["AWS::EC2::Route", "AWS::EC2::SubnetRouteTableAssociation"],
-    // SecurityGroup must be deleted AFTER SecurityGroupIngress/Egress
-    "AWS::EC2::SecurityGroup": ["AWS::EC2::SecurityGroupIngress", "AWS::EC2::SecurityGroupEgress"]
-  };
+  // Type-based implicit deletion ordering rules are defined in
+  // src/analyzer/implicit-delete-deps.ts so the deploy DELETE phase and the
+  // standalone destroy command apply the same rules.
   /**
    * Build a per-resource map of "must be deleted before me" dependencies for
    * the DELETE phase, derived from state-recorded dependencies plus implicit
@@ -8021,7 +8124,7 @@ var DeployEngine = class _DeployEngine {
       const resource = state.resources[id];
       if (!resource)
         continue;
-      const mustDeleteAfter = _DeployEngine.IMPLICIT_DELETE_DEPENDENCIES[resource.resourceType];
+      const mustDeleteAfter = IMPLICIT_DELETE_DEPENDENCIES[resource.resourceType];
       if (!mustDeleteAfter)
         continue;
       for (const depType of mustDeleteAfter) {