@go-to-k/cdkd 0.207.0 → 0.207.2

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-DWUnLza1.js";
-import { $ as uploadCfnTemplate, A as S3StateBackend, At as PATTERN_B_NAME_PROPERTIES, B as Synthesizer, C as assertRegionMatch, Ct as normalizeAwsError, D as DagBuilder, E as DiffCalculator, Et as getLogger, F as buildDockerImage, Ft as withStackName, G as resolveSkipPrefix, H as getLegacyStateBucketName, I as formatDockerLoginError, J as warnDeprecatedNoPrefixCliFlag, K as resolveStateBucketWithDefault, L as getDockerCmd, M as AssetPublisher, Mt as generateResourceName, N as stringifyValue, Nt as generateResourceNameWithFallback, O as TemplateParser, Ot as runStackBuffered, P as WorkGraph, Pt as withSkipPrefix, Q as findLargeInlineResources, R as runDockerForeground, S as CloudControlProvider, T as applyRoleArnIfSet, U as resolveApp, V as getDefaultStateBucketName, W as resolveCaptureObservedState, X as CFN_TEMPLATE_URL_LIMIT, Y as CFN_TEMPLATE_BODY_LIMIT, Z as MIGRATE_TMP_PREFIX, _ as matchesCdkPath, _t as StackHasActiveImportsError, a as withRetry, b as ProviderRegistry, c as bold, ct as LocalMigrateError, d as green, dt as MissingCdkCliError, et as AssemblyReader, f as red, ft as NestedStackChildDirectDestroyError, g as CDK_PATH_TAG, gt as ResourceUpdateNotSupportedError, h as collectInlinePolicyNamesManagedBySiblings, ht as ResourceTimeoutError, i as withResourceDeadline, it as CdkdError, j as shouldRetainResource, jt as PATTERN_B_RESOURCE_TYPES, k as LockManager, kt as getLiveRenderer, l as cyan, lt as LocalStartServiceError, m as IAMRoleProvider, mt as ProvisioningError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as resolveBucketRegion, o as IMPLICIT_DELETE_DEPENDENCIES, p as yellow, pt as PartialFailureError, q as resolveStateBucketWithDefaultAndSource, r as DeployEngine, s as formatResourceLine, st as LocalInvokeBuildError$1, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, v as normalizeAwsTagsToCfn, vt as StackTerminationProtectionError, w as IntrinsicFunctionResolver, wt as withErrorHandling, x as findActionableSilentDrops, y as resolveExplicitPhysicalId, z as runDockerStreaming } from "./deploy-engine-CuJDHhTs.js";
+import { $ as findLargeInlineResources, A as LockManager, At as getLiveRenderer, B as runDockerStreaming, C as CloudControlProvider, D as DiffCalculator, Dt as getLogger, E as applyRoleArnIfSet, F as WorkGraph, Ft as withSkipPrefix, G as resolveCaptureObservedState, H as getDefaultStateBucketName, I as buildDockerImage, It as withStackName, J as resolveStateBucketWithDefaultAndSource, K as resolveSkipPrefix, L as formatDockerLoginError, M as shouldRetainResource, Mt as PATTERN_B_RESOURCE_TYPES, N as AssetPublisher, Nt as generateResourceName, O as DagBuilder, P as stringifyValue, Pt as generateResourceNameWithFallback, Q as MIGRATE_TMP_PREFIX, R as getDockerCmd, S as findActionableSilentDrops, T as IntrinsicFunctionResolver, Tt as withErrorHandling, U as getLegacyStateBucketName, V as Synthesizer, W as resolveApp, X as CFN_TEMPLATE_BODY_LIMIT, Y as warnDeprecatedNoPrefixCliFlag, Z as CFN_TEMPLATE_URL_LIMIT, _ as CDK_PATH_TAG, _t as ResourceUpdateNotSupportedError, a as withRetry, at as CdkdError, b as resolveExplicitPhysicalId, c as formatResourceLine, ct as LocalInvokeBuildError$1, d as gray, et as uploadCfnTemplate, f as green, ft as MissingCdkCliError, g as collectInlinePolicyNamesManagedBySiblings, gt as ResourceTimeoutError, h as IAMRoleProvider, ht as ProvisioningError, i as withResourceDeadline, j as S3StateBackend, jt as PATTERN_B_NAME_PROPERTIES, k as TemplateParser, kt as runStackBuffered, l as bold, lt as LocalMigrateError, m as yellow, mt as PartialFailureError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as red, pt as NestedStackChildDirectDestroyError, q as resolveStateBucketWithDefault, r as DeployEngine, rt as resolveBucketRegion, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as AssemblyReader, u as cyan, ut as LocalStartServiceError, v as matchesCdkPath, vt as StackHasActiveImportsError, w as assertRegionMatch, wt as normalizeAwsError, x as ProviderRegistry, y as normalizeAwsTagsToCfn, yt as StackTerminationProtectionError, z as runDockerForeground } from "./deploy-engine-DQzo06ax.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1857,6 +1857,95 @@ var ExportIndexStore = class {
 	}
 };
 
+//#endregion
+//#region src/analyzer/cross-stack-deps.ts
+/**
+* Infer cross-stack ordering edges that CDK's manifest dependency graph
+* (`stack.dependencyNames`, surfaced from `addDependency`) does NOT capture.
+*
+* Two stacks can be linked by a RAW cross-stack reference —
+* `cdk.Fn.importValue('<exportName>')` (→ `Fn::ImportValue`) or
+* `Fn::GetStackOutput` — WITHOUT an explicit `addDependency`. CDK only emits a
+* manifest dependency when the reference goes through its own
+* `exportValue` / strong-reference machinery; a hand-written
+* `Fn.importValue` of a literal export name produces no manifest edge. Under
+* concurrent `--all` deploys that lets the consumer race ahead of the
+* producer and fail (`export not found` / `stack not found`); on `--all`
+* destroy it lets the producer be deleted while a consumer still imports it.
+*
+* This helper closes that gap by scanning the synthesized templates directly
+* (NOT the runtime S3 export index, which is empty on a fresh multi-stack
+* deploy). It returns, per consumer stackName, the set of OTHER stackNames in
+* the SAME input set that it depends on (consumer → producer edges).
+*
+* Rules (mirroring deploy.ts's existing `if (stackMap.has(depName))` guard):
+* - Edges are only added between stacks BOTH present in the input set. A
+*   producer outside the set = no edge — its export resolves at runtime from
+*   already-deployed state, which is correct.
+* - `Fn::ImportValue` with a literal-string export name matches against the
+*   `Export.Name` of every OTHER stack's outputs. An import whose export name
+*   no stack in the set produces (external / pre-existing export) is ignored.
+* - `Fn::GetStackOutput`'s `StackName` argument names the producer stack
+*   DIRECTLY (the intrinsic arg is an object `{ StackName, OutputName,
+*   Region?, RoleArn? }` — see
+*   `src/deployment/intrinsic-function-resolver.ts`). If that stack is in the
+*   set, add the edge.
+* - Non-literal `Fn::ImportValue` / `Fn::GetStackOutput` args (intrinsic
+*   nesting, etc.) are skipped without crashing — they cannot be statically
+*   resolved to a producer stack name here.
+*
+* @param stacks the stacks being deployed / destroyed together (the `--all`
+*   set, or the auto-include-dependency-expanded target set).
+* @returns Map<consumerStackName, Set<producerStackName>>. Consumers with no
+*   inferred cross-stack producer get an empty set entry.
+*/
+function inferCrossStackStackDeps(stacks) {
+	const exportOwner = /* @__PURE__ */ new Map();
+	for (const stack of stacks) {
+		const outputs = stack.template.Outputs;
+		if (!outputs) continue;
+		for (const output of Object.values(outputs)) {
+			const name = output?.Export?.Name;
+			if (typeof name === "string" && name !== "") {
+				if (!exportOwner.has(name)) exportOwner.set(name, stack.stackName);
+			}
+		}
+	}
+	const stackNames = new Set(stacks.map((s) => s.stackName));
+	const result = /* @__PURE__ */ new Map();
+	for (const stack of stacks) {
+		const producers = /* @__PURE__ */ new Set();
+		collectCrossStackRefs(stack.template, (kind, value) => {
+			let producer;
+			if (kind === "ImportValue") {
+				if (typeof value === "string") producer = exportOwner.get(value);
+			} else if (value && typeof value === "object" && !Array.isArray(value)) {
+				const sn = value["StackName"];
+				if (typeof sn === "string") producer = sn;
+			}
+			if (producer && producer !== stack.stackName && stackNames.has(producer)) producers.add(producer);
+		});
+		result.set(stack.stackName, producers);
+	}
+	return result;
+}
+/**
+* Recursively walk a template node, invoking `onRef` for every
+* `Fn::ImportValue` / `Fn::GetStackOutput` intrinsic encountered. The
+* callback receives the discriminator and the raw (unresolved) argument.
+*/
+function collectCrossStackRefs(node, onRef) {
+	if (!node || typeof node !== "object") return;
+	if (Array.isArray(node)) {
+		for (const item of node) collectCrossStackRefs(item, onRef);
+		return;
+	}
+	const obj = node;
+	if ("Fn::ImportValue" in obj) onRef("ImportValue", obj["Fn::ImportValue"]);
+	if ("Fn::GetStackOutput" in obj) onRef("GetStackOutput", obj["Fn::GetStackOutput"]);
+	for (const value of Object.values(obj)) collectCrossStackRefs(value, onRef);
+}
+
 //#endregion
 //#region src/provisioning/providers/iam-policy-provider.ts
 /**
@@ -33930,7 +34019,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 						} catch (retryError) {
 							lastDeleteError = retryError;
 							const msg = retryError instanceof Error ? retryError.message : String(retryError);
-							if (!(msg.includes("Too Many Requests") || msg.includes("has dependencies") || msg.includes("can't be deleted since") || msg.includes("DependencyViolation")) || attempt >= maxAttempts) break;
+							if (!(isRetryableTransientError(retryError, msg) || msg.includes("Too Many Requests")) || attempt >= maxAttempts) break;
 							const delay = 5e3 * Math.pow(2, attempt);
 							logger.debug(`  ⏳ Retrying delete ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxAttempts})`);
 							await new Promise((resolve) => setTimeout(resolve, delay));
@@ -34961,13 +35050,19 @@ async function deployCommand(stacks, options) {
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 		if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+		const inferredCrossStackDeps = inferCrossStackStackDeps(allStacks);
+		const effectiveStackDeps = (stackName, deps) => {
+			const union = new Set(deps);
+			for (const producer of inferredCrossStackDeps.get(stackName) ?? []) union.add(producer);
+			return union;
+		};
 		if (!options.exclusively) {
 			const targetNames = new Set(targetStacks.map((s) => s.stackName));
 			const allStackMap = new Map(allStacks.map((s) => [s.stackName, s]));
 			const addDependencies = (stackName) => {
 				const stack = allStackMap.get(stackName);
 				if (!stack) return;
-				for (const depName of stack.dependencyNames) if (!targetNames.has(depName)) {
+				for (const depName of effectiveStackDeps(stackName, stack.dependencyNames)) if (!targetNames.has(depName)) {
 					const depStack = allStackMap.get(depName);
 					if (depStack) {
 						targetNames.add(depName);
@@ -35012,7 +35107,7 @@ async function deployCommand(stacks, options) {
 			} catch (error) {
 				if (error.code !== "ENOENT") throw error;
 			}
-			for (const depName of stack.dependencyNames) if (stackMap.has(depName)) stackDeps.add(`stack:${depName}`);
+			for (const depName of effectiveStackDeps(stack.stackName, stack.dependencyNames)) if (stackMap.has(depName)) stackDeps.add(`stack:${depName}`);
 			workGraph.addNode({
 				id: stackNodeId,
 				type: "stack",
@@ -37369,6 +37464,39 @@ function createDriftCommand() {
 //#endregion
 //#region src/cli/commands/destroy.ts
 /**
+* Topologically order `stackNames` so that every consumer is destroyed BEFORE
+* its producers. `consumerToProducers` maps consumer → set of producer stack
+* names (the deploy-direction edges from `inferCrossStackStackDeps`); destroy
+* is the reverse, so a stack must appear before all of its producers.
+*
+* Kahn-style with a deterministic tie-break: among nodes currently free to be
+* emitted (no remaining unemitted consumer pointing at them), pick the one
+* earliest in the original `stackNames` order so the output is stable and the
+* original order is preserved whenever there are no cross-stack edges. A cycle
+* (should not happen for valid templates) degrades gracefully — any leftover
+* nodes are appended in original order rather than dropped.
+*/
+function orderConsumersBeforeProducers(stackNames, consumerToProducers) {
+	const pendingConsumers = /* @__PURE__ */ new Map();
+	for (const name of stackNames) pendingConsumers.set(name, /* @__PURE__ */ new Set());
+	for (const [consumer, producers] of consumerToProducers) for (const producer of producers) pendingConsumers.get(producer)?.add(consumer);
+	const emitted = /* @__PURE__ */ new Set();
+	const ordered = [];
+	while (ordered.length < stackNames.length) {
+		const next = stackNames.find((name) => !emitted.has(name) && [...pendingConsumers.get(name) ?? []].every((c) => emitted.has(c)));
+		if (!next) {
+			for (const name of stackNames) if (!emitted.has(name)) {
+				emitted.add(name);
+				ordered.push(name);
+			}
+			break;
+		}
+		emitted.add(next);
+		ordered.push(next);
+	}
+	return ordered;
+}
+/**
 * Destroy command implementation
 */
 async function destroyCommand(stackArgs, options) {
@@ -37414,21 +37542,27 @@ async function destroyCommand(stackArgs, options) {
 		if (options.allowUnsupportedTypes?.length) providerRegistry.allowUnsupportedTypes(options.allowUnsupportedTypes);
 		const appCmd = options.app || resolveApp();
 		let appStacks = [];
+		let synthScanStacks = [];
 		if (appCmd) try {
 			const synthesizer = new Synthesizer();
 			const context = parseContextOptions(options.context);
-			appStacks = (await synthesizer.synthesize({
+			const result = await synthesizer.synthesize({
 				app: appCmd,
 				output: options.output || "cdk.out",
 				...Object.keys(context).length > 0 && { context },
 				stateBucket,
 				...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
-			})).stacks.map((s) => ({
+			});
+			appStacks = result.stacks.map((s) => ({
 				stackName: s.stackName,
 				displayName: s.displayName,
 				...s.region && { region: s.region },
 				...s.terminationProtection !== void 0 && { terminationProtection: s.terminationProtection }
 			}));
+			synthScanStacks = result.stacks.map((s) => ({
+				stackName: s.stackName,
+				template: s.template
+			}));
 		} catch {
 			logger.debug("Could not synthesize app, falling back to state-based stack list");
 		}
@@ -37475,6 +37609,11 @@ async function destroyCommand(stackArgs, options) {
 			logger.info("No matching stacks found in state");
 			return;
 		}
+		if (synthScanStacks.length > 0 && stackNames.length > 1) {
+			const inSet = new Set(stackNames);
+			const inferred = inferCrossStackStackDeps(synthScanStacks.filter((s) => inSet.has(s.stackName)));
+			stackNames = orderConsumersBeforeProducers(stackNames, inferred);
+		}
 		logger.info(`Found ${stackNames.length} stack(s) to destroy: ${stackNames.join(", ")}`);
 		const accountId = "unknown";
 		const stateRefsByName = /* @__PURE__ */ new Map();
@@ -52557,7 +52696,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.207.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.207.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());