@go-to-k/cdkd 0.230.19 → 0.230.21

package/dist/{deploy-engine-Bdy5xKSQ.js → deploy-engine-C92fYX-D.js}

@@ -6048,6 +6048,43 @@ const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
 	"AWS::AppConfig::Deployment"
 ]);
 /**
+* SDK-provisioned types whose provider stores the resource ARN as the physical
+* id (their delete / update paths need the ARN), while CloudFormation's `Ref`
+* returns the CFn physical resource id — which for these types is NOT the ARN:
+*   - `AWS::Events::Rule` → the rule name (`arn:…:rule/<name>`), or
+*     `<busName>|<ruleName>` for a custom-bus rule
+*     (`arn:…:rule/<busName>/<ruleName>`) — the physical id CloudFormation
+*     reports for such rules. The ARN stays reachable via `Fn::GetAtt Arn`.
+*   - `AWS::CloudTrail::Trail` → the trail name (`arn:…:trail/<name>`).
+* Value: the ARN resource-type marker after which the CFn `Ref` value starts.
+*/
+const REF_RETURNS_NAME_FROM_ARN = new Map([["AWS::Events::Rule", ":rule/"], ["AWS::CloudTrail::Trail", ":trail/"]]);
+/**
+* Resolve the value CloudFormation's `Ref` returns for a resource, given its
+* type and cdkd-stored physical id. Pure function shared by the deploy-time
+* resolver ({@link IntrinsicFunctionResolver.resolveRefValue}) and the
+* `cdkd orphan` rewriter's `{Ref: <orphan>}` substitution, so both derive
+* identical CFn `Ref` semantics (after-pipe compound-id extraction and
+* name-from-ARN extraction included).
+*/
+function cfnRefValueFromPhysicalId(resourceType, physicalId) {
+	const nameMarker = REF_RETURNS_NAME_FROM_ARN.get(resourceType);
+	if (nameMarker && physicalId.startsWith("arn:")) {
+		const markerIdx = physicalId.indexOf(nameMarker);
+		if (markerIdx >= 0) {
+			const segment = physicalId.substring(markerIdx + nameMarker.length);
+			const slashIdx = segment.lastIndexOf("/");
+			if (slashIdx >= 0) return `${segment.substring(0, slashIdx)}|${segment.substring(slashIdx + 1)}`;
+			return segment;
+		}
+	}
+	if (REF_RETURNS_SEGMENT_AFTER_PIPE.has(resourceType)) {
+		const pipeIdx = physicalId.lastIndexOf("|");
+		if (pipeIdx >= 0) return physicalId.substring(pipeIdx + 1);
+	}
+	return physicalId;
+}
+/**
 * Intrinsic-function keys the resolver knows how to handle.
 *
 * A CloudFormation intrinsic is ALWAYS a single-key object — `{ "Ref": ... }`
@@ -6374,14 +6411,17 @@ var IntrinsicFunctionResolver = class {
 	*     compound id, which fails the `[\w+]+` client-id validation.
 	* In every case the `Ref` value is the segment after the pipe (the parent id
 	* is the first identifier component).
+	*
+	* The {@link REF_RETURNS_NAME_FROM_ARN} types are SDK-provisioned with the
+	* resource ARN stored as the physical id, while CFn's `Ref` returns the
+	* resource NAME (the CFn physical resource id) — e.g. `AWS::Events::Rule`
+	* (`Ref` is the rule name such as `mystack-ScheduledRule-ABC`; a consumer
+	* calling `events:*` APIs by name or composing the name into another string
+	* would otherwise get the full ARN) and `AWS::CloudTrail::Trail` (`Ref` is
+	* the trail name). The name is extracted from the stored ARN.
 	*/
 	resolveRefValue(resource) {
-		const physicalId = resource.physicalId;
-		if (REF_RETURNS_SEGMENT_AFTER_PIPE.has(resource.resourceType)) {
-			const pipeIdx = physicalId.lastIndexOf("|");
-			if (pipeIdx >= 0) return physicalId.substring(pipeIdx + 1);
-		}
-		return physicalId;
+		return cfnRefValueFromPhysicalId(resource.resourceType, resource.physicalId);
 	}
 	/**
 	* Resolve Fn::GetAtt intrinsic function
@@ -6514,6 +6554,7 @@ var IntrinsicFunctionResolver = class {
 		}
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
+				if (physicalId.startsWith("arn:")) return physicalId;
 				const busRaw = resource.properties?.["EventBusName"];
 				const bus = typeof busRaw === "string" && busRaw && busRaw !== "default" ? busRaw : "";
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
@@ -6540,7 +6581,9 @@ var IntrinsicFunctionResolver = class {
 			default: return physicalId;
 		}
 		if (resourceType === "AWS::CloudTrail::Trail") switch (attributeName) {
-			case "Arn": return `arn:${partition}:cloudtrail:${region}:${accountId}:trail/${physicalId}`;
+			case "Arn":
+				if (physicalId.startsWith("arn:")) return physicalId;
+				return `arn:${partition}:cloudtrail:${region}:${accountId}:trail/${physicalId}`;
 			default: return physicalId;
 		}
 		if (resourceType === "AWS::AppSync::GraphQLApi") switch (attributeName) {
@@ -12535,6 +12578,7 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Invalid value for the parameter Policy",
 	"required permissions for: ENHANCED_MONITORING",
 	"Caught ServiceAccessDeniedException",
+	"permissions required to assume the role",
 	"conflicting conditional operation",
 	"scheduled for deletion",
 	"Cannot access stream",
@@ -12742,32 +12786,9 @@ const DEFAULT_RESOURCE_WARN_AFTER_MS = 300 * 1e3;
 * explicitly because the Custom Resource provider's polling cap is 1h.
 */
 const DEFAULT_RESOURCE_TIMEOUT_MS = 1800 * 1e3;
-/**
-* Deploy engine orchestrates the entire deployment process
-*
-* Responsibilities:
-* 1. Acquire stack lock
-* 2. Load current state
-* 3. Calculate diff
-* 4. Validate resource types
-* 5. Execute deployment in DAG order
-* 6. Save new state
-* 7. Release lock
-*
-* Rollback mechanism:
-* - Tracks completed operations during deployment
-* - On failure, rolls back in reverse order (best-effort)
-* - Supports --no-rollback flag to skip rollback (saves partial state and fails)
-* - CREATE → delete the newly created resource
-* - UPDATE → restore previous properties
-* - DELETE → cannot rollback (log warning)
-*/
-/**
-* Error thrown when deployment is interrupted by SIGINT
-*/
 var InterruptedError = class extends Error {
-	constructor() {
-		super("Deployment interrupted by user (Ctrl+C)");
+	constructor(reason = "user") {
+		super(reason === "user" ? "Deployment interrupted by user (Ctrl+C)" : "Deployment aborted after another resource failed");
 		this.name = "InterruptedError";
 	}
 };
@@ -12836,6 +12857,13 @@ var DeployEngine = class {
 	resolver;
 	interrupted = false;
 	/**
+	* Why `interrupted` was set — first cause wins. `'user'` = SIGINT;
+	* `'sibling-failure'` = a resource failed and the remaining work is being
+	* cancelled. Drives the {@link InterruptedError} message so cancelled
+	* siblings don't misreport a Ctrl+C nobody pressed.
+	*/
+	interruptCause = null;
+	/**
 	* In-flight `provider.readCurrentState` promises kicked off after a
 	* successful CREATE / UPDATE. The deploy critical path does NOT
 	* `await` these; instead they're drained at the end of `doDeploy`
@@ -13126,11 +13154,13 @@ var DeployEngine = class {
 		const renderer = getLiveRenderer();
 		renderer.start();
 		this.interrupted = false;
+		this.interruptCause = null;
 		const sigintHandler = () => {
 			renderer.printAbove(() => {
 				process.stderr.write("\nInterrupted — saving partial state after current operations complete...\n");
 			});
 			this.interrupted = true;
+			this.interruptCause ??= "user";
 		};
 		process.on("SIGINT", sigintHandler);
 		try {
@@ -13350,6 +13380,7 @@ var DeployEngine = class {
 							await this.provisionResource(logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress);
 						} catch (provisionError) {
 							this.interrupted = true;
+							this.interruptCause ??= "sibling-failure";
 							throw provisionError;
 						}
 						completedOperations.push({
@@ -13366,7 +13397,7 @@ var DeployEngine = class {
 				} finally {
 					await saveChain;
 				}
-				if (this.interrupted && this.hasPending(createUpdateExecutor)) throw new InterruptedError();
+				if (this.interrupted && this.hasPending(createUpdateExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 			}
 			if (deleteChanges.size > 0) {
 				this.logger.info(`${red("Deleting")} ${red(deleteChanges.size)} resource(s)`);
@@ -13387,6 +13418,7 @@ var DeployEngine = class {
 							await this.provisionResource(logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress);
 						} catch (provisionError) {
 							this.interrupted = true;
+							this.interruptCause ??= "sibling-failure";
 							throw provisionError;
 						}
 						completedOperations.push({
@@ -13401,7 +13433,7 @@ var DeployEngine = class {
 				} finally {
 					await saveChain;
 				}
-				if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError();
+				if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 			}
 		} catch (error) {
 			try {
@@ -14145,7 +14177,7 @@ var DeployEngine = class {
 			...initialDelayMs !== void 0 && { initialDelayMs },
 			logger: this.logger,
 			isInterrupted: () => this.interrupted,
-			onInterrupted: () => new InterruptedError()
+			onInterrupted: () => new InterruptedError(this.interruptCause ?? "user")
 		});
 	}
 	/**
@@ -14187,5 +14219,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { warnDeprecatedNoPrefixCliFlag as $, LockManager as A, runDockerForeground as B, findActionableSilentDrops as C, DiffCalculator as D, applyRoleArnIfSet as E, stringifyValue as F, synthesisStatusMessage as G, AssetManifestLoader as H, WorkGraph as I, resolveApp as J, getDefaultStateBucketName as K, buildDockerImage as L, rebuildClientForBucketRegion as M, shouldRetainResource as N, DagBuilder as O, AssetPublisher as P, resolveStateBucketWithDefaultAndSource as Q, formatDockerLoginError as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, getDockerImageBySourceHash as U, runDockerStreaming as V, Synthesizer as W, resolveSkipPrefix as X, resolveCaptureObservedState as Y, resolveStateBucketWithDefault as Z, green as _, withRetry as a, AssemblyReader as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, isStatefulRecreateTargetSync as d, CFN_TEMPLATE_BODY_LIMIT as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, uploadCfnTemplate as it, S3StateBackend as j, TemplateParser as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, MIGRATE_TMP_PREFIX as nt, isRetryableTransientError as o, clearBucketRegionCache as ot, formatResourceLine as p, getLegacyStateBucketName as q, DeployEngine as r, findLargeInlineResources as rt, IMPLICIT_DELETE_DEPENDENCIES as s, resolveBucketRegion as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_URL_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, getDockerCmd as z };
-//# sourceMappingURL=deploy-engine-Bdy5xKSQ.js.map
+export { resolveStateBucketWithDefaultAndSource as $, TemplateParser as A, getDockerCmd as B, findActionableSilentDrops as C, applyRoleArnIfSet as D, cfnRefValueFromPhysicalId as E, AssetPublisher as F, Synthesizer as G, runDockerStreaming as H, stringifyValue as I, getLegacyStateBucketName as J, synthesisStatusMessage as K, WorkGraph as L, S3StateBackend as M, rebuildClientForBucketRegion as N, DiffCalculator as O, shouldRetainResource as P, resolveStateBucketWithDefault as Q, buildDockerImage as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, AssetManifestLoader as U, runDockerForeground as V, getDockerImageBySourceHash as W, resolveCaptureObservedState as X, resolveApp as Y, resolveSkipPrefix as Z, green as _, withRetry as a, uploadCfnTemplate as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveBucketRegion as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, findLargeInlineResources as it, LockManager as j, DagBuilder as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_URL_LIMIT as nt, isRetryableTransientError as o, AssemblyReader as ot, formatResourceLine as p, getDefaultStateBucketName as q, DeployEngine as r, MIGRATE_TMP_PREFIX as rt, IMPLICIT_DELETE_DEPENDENCIES as s, clearBucketRegionCache as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_BODY_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, formatDockerLoginError as z };
+//# sourceMappingURL=deploy-engine-C92fYX-D.js.map