@go-to-k/cdkd 0.229.2 → 0.229.4

package/dist/{deploy-engine-DGgI1zCL.js → deploy-engine-Bqy4oNkR.js}

@@ -1,4 +1,4 @@
-import { B as generateResourceNameWithFallback, E as SynthesisError, F as getLiveRenderer, H as withStackName, M as getLogger, R as applyDefaultNameForFallback, T as StateError, a as assertRegionMatch, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as resolveExplicitPhysicalId, k as normalizeAwsError, n as matchesCdkPath, o as disableInstanceApiTermination, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, x as ResourceTimeoutError } from "./import-helpers-wLipXr5g.js";
+import { E as SynthesisError, F as getLiveRenderer, M as getLogger, T as StateError, U as withStackName, V as generateResourceNameWithFallback, a as assertRegionMatch, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as resolveExplicitPhysicalId, k as normalizeAwsError, n as matchesCdkPath, o as disableInstanceApiTermination, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, x as ResourceTimeoutError, z as applyDefaultNameForFallback } from "./import-helpers-DayvBD4T.js";
 import { r as getAwsClients } from "./aws-clients-pjPwZz1r.js";
 import { randomUUID } from "node:crypto";
 import { DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5598,10 +5598,20 @@ async function applyRoleArnIfSet(opts) {
 const AWS_NO_VALUE = Symbol("AWS::NoValue");
 /**
 * Resource types whose CloudFormation `Ref` returns the segment AFTER the pipe
-* in cdkd's compound Cloud Control physical id `<restApiId>|<ref>` (rather than
-* the whole physical id). See {@link IntrinsicFunctionResolver.resolveRefValue}.
-*/
-const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set(["AWS::ApiGateway::Model", "AWS::ApiGateway::RequestValidator"]);
+* in cdkd's compound Cloud Control physical id `<parent>|<ref>` (rather than the
+* whole physical id). These are Cloud-Control-provisioned types whose CC
+* primaryIdentifier is compound `<parentId>|<ref>` while CFn's `Ref` returns
+* only the trailing `<ref>` component:
+*   - AWS::ApiGateway::Model            `<restApiId>|<modelName>`     -> model name
+*   - AWS::ApiGateway::RequestValidator `<restApiId>|<validatorId>`   -> validator id
+*   - AWS::Cognito::UserPoolClient      `<userPoolId>|<clientId>`     -> client id
+* See {@link IntrinsicFunctionResolver.resolveRefValue}.
+*/
+const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
+	"AWS::ApiGateway::Model",
+	"AWS::ApiGateway::RequestValidator",
+	"AWS::Cognito::UserPoolClient"
+]);
 /**
 * Intrinsic-function keys the resolver knows how to handle.
 *
@@ -5909,10 +5919,10 @@ var IntrinsicFunctionResolver = class {
 	* stores. But for a few types CFn's `Ref` returns a sub-component of the
 	* physical id, and returning the raw physical id breaks downstream consumers.
 	*
-	* Two API Gateway child types are provisioned via Cloud Control (no SDK
-	* provider), whose primary identifier — and thus cdkd's physical id — is the
-	* compound `<restApiId>|<ref>`, while CFn's `Ref` returns only the `<ref>`
-	* segment:
+	* The {@link REF_RETURNS_SEGMENT_AFTER_PIPE} types are provisioned via Cloud
+	* Control (no SDK provider), whose primary identifier — and thus cdkd's
+	* physical id — is the compound `<parentId>|<ref>`, while CFn's `Ref` returns
+	* only the trailing `<ref>` segment:
 	*   - `AWS::ApiGateway::Model` → Ref is the model NAME; physical id is
 	*     `<restApiId>|<modelName>`. A method wiring
 	*     `RequestModels: { "application/json": { "Ref": <Model> } }` would
@@ -5923,8 +5933,12 @@ var IntrinsicFunctionResolver = class {
 	*     `RequestValidatorId: { "Ref": <Validator> }` would otherwise get the
 	*     compound id and API Gateway rejects it with
 	*     "Invalid Request Validator identifier specified".
-	* In both cases the `Ref` value is the segment after the pipe (RestApiId is
-	* the first identifier component).
+	*   - `AWS::Cognito::UserPoolClient` → Ref is the client id; physical id is
+	*     `<userPoolId>|<clientId>`. Any consumer of the client id (a CfnOutput,
+	*     a Lambda env var, `cognito-idp` API calls) would otherwise get the
+	*     compound id, which fails the `[\w+]+` client-id validation.
+	* In every case the `Ref` value is the segment after the pipe (the parent id
+	* is the first identifier component).
 	*/
 	resolveRefValue(resource) {
 		const physicalId = resource.physicalId;
@@ -7562,7 +7576,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B_hrCxRx.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dgj3loIG.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -13481,4 +13495,4 @@ var DeployEngine = class {
 
 //#endregion
 export { findLargeInlineResources as $, shouldRetainResource as A, getDockerImageBySourceHash as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, formatDockerLoginError as F, resolveCaptureObservedState as G, getDefaultStateBucketName as H, getDockerCmd as I, resolveStateBucketWithDefaultAndSource as J, resolveSkipPrefix as K, runDockerForeground as L, stringifyValue as M, WorkGraph as N, S3StateBackend as O, buildDockerImage as P, MIGRATE_TMP_PREFIX as Q, runDockerStreaming as R, IntrinsicFunctionResolver as S, DagBuilder as T, getLegacyStateBucketName as U, Synthesizer as V, resolveApp as W, CFN_TEMPLATE_BODY_LIMIT as X, warnDeprecatedNoPrefixCliFlag as Y, CFN_TEMPLATE_URL_LIMIT as Z, IAMRoleProvider as _, withRetry as a, findActionableSilentDrops as b, computeImplicitDeleteEdges as c, bold as d, uploadCfnTemplate as et, cyan as f, yellow as g, red as h, withResourceDeadline as i, AssetPublisher as j, rebuildClientForBucketRegion as k, extractDeploymentEventError as l, green as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, clearBucketRegionCache as nt, isRetryableTransientError as o, gray as p, resolveStateBucketWithDefault as q, DeployEngine as r, resolveBucketRegion as rt, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssemblyReader as tt, formatResourceLine as u, collectInlinePolicyNamesManagedBySiblings as v, DiffCalculator as w, CloudControlProvider as x, ProviderRegistry as y, AssetManifestLoader as z };
-//# sourceMappingURL=deploy-engine-DGgI1zCL.js.map
+//# sourceMappingURL=deploy-engine-Bqy4oNkR.js.map