@go-to-k/cdkd 0.221.8 → 0.221.10

package/dist/{deploy-engine-DCkhw7i7.js → deploy-engine-U63EpLKn.js}

@@ -7,7 +7,7 @@ import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRo
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client } from "@aws-sdk/client-ec2";
+import { DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client } from "@aws-sdk/client-ec2";
 import { DescribeTableCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeTypeCommand, GetTemplateCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
@@ -5463,6 +5463,15 @@ const cachedAvailabilityZones = {};
 */
 const cachedDynamicReferences = {};
 /**
+* Cache for EC2 instance attributes that require a live DescribeInstances
+* lookup (PrivateIp / PublicIp / PrivateDnsName / PublicDnsName /
+* AvailabilityZone). Keyed by `${physicalId}#${attributeName}`. The IP /
+* DNS attributes are not derivable from the instance id, so they are read
+* back from AWS once per (instance, attribute) and memoized for the deploy
+* lifetime.
+*/
+const cachedEc2InstanceAttributes = {};
+/**
 * Get AWS account information from STS
 */
 async function getAccountInfo(overrideRegion) {
@@ -5859,6 +5868,10 @@ var IntrinsicFunctionResolver = class {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
 			default: return physicalId;
 		}
+		if (resourceType === "AWS::CloudWatch::CompositeAlarm") switch (attributeName) {
+			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
+			default: return physicalId;
+		}
 		if (resourceType === "AWS::RDS::DBInstance" || resourceType === "AWS::DocDB::DBInstance" || resourceType === "AWS::Neptune::DBInstance") switch (attributeName) {
 			case "DBInstanceArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:db:${physicalId}`;
@@ -5929,6 +5942,47 @@ var IntrinsicFunctionResolver = class {
 			case "SubnetId": return physicalId;
 			default: return physicalId;
 		}
+		if (resourceType === "AWS::EC2::Instance") switch (attributeName) {
+			case "PrivateIp":
+			case "PublicIp":
+			case "PrivateDnsName":
+			case "PublicDnsName":
+			case "AvailabilityZone": {
+				const cacheKey = `${physicalId}#${attributeName}`;
+				const cached = cachedEc2InstanceAttributes[cacheKey];
+				if (cached !== void 0) return cached;
+				try {
+					const instance = (await getAwsClients().ec2.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
+					let value;
+					switch (attributeName) {
+						case "PrivateIp":
+							value = instance?.PrivateIpAddress;
+							break;
+						case "PublicIp":
+							value = instance?.PublicIpAddress;
+							break;
+						case "PrivateDnsName":
+							value = instance?.PrivateDnsName;
+							break;
+						case "PublicDnsName":
+							value = instance?.PublicDnsName;
+							break;
+						case "AvailabilityZone":
+							value = instance?.Placement?.AvailabilityZone;
+							break;
+					}
+					if (value !== void 0 && value !== null && value !== "") {
+						cachedEc2InstanceAttributes[cacheKey] = value;
+						return value;
+					}
+					this.logger.warn(`DescribeInstances(${physicalId}) returned no ${attributeName}; returning physical ID`);
+				} catch (err) {
+					this.logger.warn(`DescribeInstances(${physicalId}) failed for ${attributeName}: ${err instanceof Error ? err.message : String(err)}`);
+				}
+				return physicalId;
+			}
+			default: return physicalId;
+		}
 		if (resourceType === "AWS::EC2::LaunchTemplate") {
 			if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
 				try {
@@ -6555,6 +6609,13 @@ var IntrinsicFunctionResolver = class {
 	* SECRET_ID can be a simple name or an ARN (arn:aws:secretsmanager:REGION:ACCOUNT:secret:NAME)
 	* which contains colons, so we cannot simply split on ':'.
 	* Instead, we find ':SecretString:' or ':SecretBinary:' as the delimiter.
+	*
+	* The whole-secret form omits everything after the type segment and carries no trailing
+	* colon: "secretsmanager:SECRET_ID:SecretString" (returns the full secret string). We detect
+	* it with an end-anchored check so that, for the whole-secret form, a SECRET_ID that merely
+	* contains ":SecretString" mid-name is not split incorrectly. (The end-anchored fallback only
+	* runs when no mid-string ":SecretString:" delimiter is present, so the json-key / version
+	* forms are unaffected.)
 	*/
 	async resolveSecretsManagerReference(inner) {
 		const afterService = inner.substring(15);
@@ -6562,10 +6623,20 @@ var IntrinsicFunctionResolver = class {
 		let jsonKey = "";
 		let versionStage = "";
 		let versionId = "";
-		const secretStringIdx = afterService.indexOf(":SecretString:");
-		const secretBinaryIdx = afterService.indexOf(":SecretBinary:");
+		let secretStringIdx = afterService.indexOf(":SecretString:");
+		let secretBinaryIdx = afterService.indexOf(":SecretBinary:");
+		let delimiterLenAtBinary = 14;
+		let delimiterLenAtString = 14;
+		if (secretStringIdx < 0 && afterService.endsWith(":SecretString")) {
+			secretStringIdx = afterService.length - 13;
+			delimiterLenAtString = 13;
+		}
+		if (secretBinaryIdx < 0 && afterService.endsWith(":SecretBinary")) {
+			secretBinaryIdx = afterService.length - 13;
+			delimiterLenAtBinary = 13;
+		}
 		const delimiterIdx = secretStringIdx >= 0 && secretBinaryIdx >= 0 ? Math.min(secretStringIdx, secretBinaryIdx) : secretStringIdx >= 0 ? secretStringIdx : secretBinaryIdx;
-		const delimiterLen = delimiterIdx >= 0 && delimiterIdx === secretBinaryIdx ? 14 : 14;
+		const delimiterLen = delimiterIdx >= 0 && delimiterIdx === secretBinaryIdx ? delimiterLenAtBinary : delimiterLenAtString;
 		if (delimiterIdx >= 0) {
 			secretId = afterService.substring(0, delimiterIdx);
 			const remainingParts = afterService.substring(delimiterIdx + delimiterLen).split(":");
@@ -11435,6 +11506,84 @@ const IMPLICIT_DELETE_DEPENDENCIES = {
 		"AWS::Lambda::Function"
 	]
 };
+/**
+* Matches one alarm-state function token in a CompositeAlarm `AlarmRule`:
+*   ALARM("name") | OK('name') | INSUFFICIENT_DATA(name)
+* The argument is captured raw (with any surrounding quotes) and trimmed /
+* unquoted by {@link extractReferencedAlarmNames}. CloudWatch also accepts the
+* boolean literals TRUE / FALSE which carry no argument, so they never match.
+*/
+const ALARM_RULE_FUNCTION_REGEX = /\b(?:ALARM|OK|INSUFFICIENT_DATA)\s*\(\s*([^)]*?)\s*\)/gi;
+/**
+* Extract every alarm NAME (or ARN) referenced by a CompositeAlarm `AlarmRule`
+* string. The rule references its child alarms by NAME (or ARN) as a plain
+* string — there is no `Ref` / `Fn::GetAtt`, so cdkd's DAG sees no dependency
+* edge from these references. We parse them out so a delete-ordering edge can be
+* synthesized (CloudWatch refuses to delete a metric alarm while a composite
+* alarm still references it).
+*
+* Handles the three alarm-state functions (`ALARM` / `OK` / `INSUFFICIENT_DATA`)
+* and both the bare-name and quoted-name forms. An ARN argument
+* (`arn:aws:cloudwatch:...:alarm:<name>`) is reduced to its trailing `<name>`
+* so it can be matched against a referenced alarm's `AlarmName` / physical id
+* the same way a bare name is.
+*/
+function extractReferencedAlarmNames(alarmRule) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of alarmRule.matchAll(ALARM_RULE_FUNCTION_REGEX)) {
+		let arg = (match[1] ?? "").trim();
+		if (arg.length === 0) continue;
+		if (arg.startsWith("\"") && arg.endsWith("\"") || arg.startsWith("'") && arg.endsWith("'")) arg = arg.slice(1, -1);
+		if (arg.length === 0) continue;
+		const arnAlarmMatch = /:alarm:(.+)$/.exec(arg);
+		if (arnAlarmMatch?.[1]) names.add(arnAlarmMatch[1]);
+		else names.add(arg);
+	}
+	return [...names];
+}
+/**
+* Compute per-resource delete-ordering edges that cannot be inferred from
+* Ref / Fn::GetAtt edges or from the type-pair {@link IMPLICIT_DELETE_DEPENDENCIES}
+* table.
+*
+* Currently this synthesizes edges for `AWS::CloudWatch::CompositeAlarm`: a
+* composite alarm references its child alarms (metric `AWS::CloudWatch::Alarm`
+* or other composite alarms) by NAME inside its `AlarmRule` string. Because the
+* reference is a plain string (no `Ref` / `Fn::GetAtt`), cdkd's DAG sees no
+* dependency edge, so without this the metric alarm can be scheduled for
+* deletion while the composite still exists — and CloudWatch rejects that with
+* `Cannot delete <alarm> as there are composite alarm(s) depending on it.`
+* We therefore emit an edge making the composite alarm delete BEFORE every
+* alarm its `AlarmRule` references (handling composite-of-composite too).
+*
+* @param resources logical id -> resource (the subset of resources participating
+*   in the delete). Only entries whose logical id is a key in this record are
+*   considered as edge endpoints.
+*/
+function computeImplicitDeleteEdges(resources) {
+	const edges = [];
+	const alarmTypes = new Set(["AWS::CloudWatch::Alarm", "AWS::CloudWatch::CompositeAlarm"]);
+	const nameToLogicalId = /* @__PURE__ */ new Map();
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		if (!alarmTypes.has(resource.resourceType)) continue;
+		const alarmName = typeof resource.properties?.["AlarmName"] === "string" ? resource.properties["AlarmName"] : resource.physicalId;
+		if (alarmName) nameToLogicalId.set(alarmName, logicalId);
+	}
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		if (resource.resourceType !== "AWS::CloudWatch::CompositeAlarm") continue;
+		const alarmRule = resource.properties?.["AlarmRule"];
+		if (typeof alarmRule !== "string") continue;
+		for (const referencedName of extractReferencedAlarmNames(alarmRule)) {
+			const referencedLogicalId = nameToLogicalId.get(referencedName);
+			if (!referencedLogicalId || referencedLogicalId === logicalId) continue;
+			edges.push({
+				before: logicalId,
+				after: referencedLogicalId
+			});
+		}
+	}
+	return edges;
+}
 
 //#endregion
 //#region src/deployment/retryable-errors.ts
@@ -12850,6 +12999,18 @@ var DeployEngine = class {
 				}
 			}
 		}
+		const scoped = {};
+		for (const id of deleteIds) {
+			const resource = state.resources[id];
+			if (resource) scoped[id] = resource;
+		}
+		for (const { before, after } of computeImplicitDeleteEdges(scoped)) {
+			if (!dependedBy.has(after)) dependedBy.set(after, /* @__PURE__ */ new Set());
+			if (!dependedBy.get(after).has(before)) {
+				dependedBy.get(after).add(before);
+				this.logger.debug(`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
+			}
+		}
 	}
 	/**
 	* Prepare a property map for a Cloud Control API call. When a Tier 1
@@ -12933,5 +13094,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { clearBucketRegionCache as $, AssetPublisher as A, getLegacyStateBucketName as B, DiffCalculator as C, S3StateBackend as D, LockManager as E, getDockerCmd as F, resolveStateBucketWithDefaultAndSource as G, resolveCaptureObservedState as H, runDockerForeground as I, CFN_TEMPLATE_URL_LIMIT as J, warnDeprecatedNoPrefixCliFlag as K, runDockerStreaming as L, WorkGraph as M, buildDockerImage as N, rebuildClientForBucketRegion as O, formatDockerLoginError as P, AssemblyReader as Q, Synthesizer as R, applyRoleArnIfSet as S, TemplateParser as T, resolveSkipPrefix as U, resolveApp as V, resolveStateBucketWithDefault as W, findLargeInlineResources as X, MIGRATE_TMP_PREFIX as Y, uploadCfnTemplate as Z, collectInlinePolicyNamesManagedBySiblings as _, withRetry as a, CloudControlProvider as b, extractDeploymentEventError as c, cyan as d, resolveBucketRegion as et, gray as f, IAMRoleProvider as g, yellow as h, withResourceDeadline as i, stringifyValue as j, shouldRetainResource as k, formatResourceLine as l, red as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, green as p, CFN_TEMPLATE_BODY_LIMIT as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, bold as u, ProviderRegistry as v, DagBuilder as w, IntrinsicFunctionResolver as x, findActionableSilentDrops as y, getDefaultStateBucketName as z };
-//# sourceMappingURL=deploy-engine-DCkhw7i7.js.map
+export { AssemblyReader as $, shouldRetainResource as A, getDefaultStateBucketName as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, formatDockerLoginError as F, resolveStateBucketWithDefault as G, resolveApp as H, getDockerCmd as I, CFN_TEMPLATE_BODY_LIMIT as J, resolveStateBucketWithDefaultAndSource as K, runDockerForeground as L, stringifyValue as M, WorkGraph as N, S3StateBackend as O, buildDockerImage as P, uploadCfnTemplate as Q, runDockerStreaming as R, IntrinsicFunctionResolver as S, DagBuilder as T, resolveCaptureObservedState as U, getLegacyStateBucketName as V, resolveSkipPrefix as W, MIGRATE_TMP_PREFIX as X, CFN_TEMPLATE_URL_LIMIT as Y, findLargeInlineResources as Z, IAMRoleProvider as _, withRetry as a, findActionableSilentDrops as b, computeImplicitDeleteEdges as c, bold as d, clearBucketRegionCache as et, cyan as f, yellow as g, red as h, withResourceDeadline as i, AssetPublisher as j, rebuildClientForBucketRegion as k, extractDeploymentEventError as l, green as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, gray as p, warnDeprecatedNoPrefixCliFlag as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveBucketRegion as tt, formatResourceLine as u, collectInlinePolicyNamesManagedBySiblings as v, DiffCalculator as w, CloudControlProvider as x, ProviderRegistry as y, Synthesizer as z };
+//# sourceMappingURL=deploy-engine-U63EpLKn.js.map