@go-to-k/cdkd 0.230.30 → 0.230.31

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-ByCHAN3p.js";
+import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-DpUNxTCs.js";
 import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -1446,7 +1446,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.30";
+	return "0.230.31";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -55650,7 +55650,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.30");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.31");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());

package/dist/{deploy-engine-ByCHAN3p.js → deploy-engine-DpUNxTCs.js}

@@ -6073,12 +6073,19 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 /**
 * Resource types whose CloudFormation `Ref` returns the segment AFTER the LAST
 * pipe in cdkd's compound Cloud Control physical id (rather than the whole
-* physical id). These are Cloud-Control-provisioned types whose CC
-* primaryIdentifier is compound (`<parentId>|<ref>`, or `<a>|<b>|<ref>` for
+* physical id). These are types provisioned via Cloud Control — either because
+* they have no SDK provider, or because the #614 silent-drop routing sent an
+* SDK-backed type through CC (e.g. an ApiGateway Stage carrying
+* `MethodSettings`, which the SDK provider does not wire — issue #963). Their
+* CC primaryIdentifier is compound (`<parentId>|<ref>`, or `<a>|<b>|<ref>` for
 * triple-segment AppConfig children) while CFn's `Ref` returns only the
-* trailing `<ref>` component:
+* trailing `<ref>` component. For SDK-provisioned instances of the same types
+* the stored physical id has no pipe, so the extraction is a no-op:
 *   - AWS::ApiGateway::Model            `<restApiId>|<modelName>`     -> model name
 *   - AWS::ApiGateway::RequestValidator `<restApiId>|<validatorId>`   -> validator id
+*   - AWS::ApiGateway::Stage            `<restApiId>|<stageName>`     -> stage name
+*   - AWS::ApiGateway::Resource         `<restApiId>|<resourceId>`    -> resource id
+*   - AWS::ApiGateway::Authorizer       `<restApiId>|<authorizerId>`  -> authorizer id
 *   - AWS::Cognito::UserPoolClient           `<userPoolId>|<clientId>`       -> client id
 *   - AWS::Cognito::UserPoolResourceServer   `<userPoolId>|<identifier>`     -> resource-server identifier
 *   - AWS::Cognito::UserPoolGroup            `<userPoolId>|<groupName>`      -> group name
@@ -6108,12 +6115,26 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 *   3. EXCLUDE types whose `Ref` returns a synthetic / prefixed string rather
 *      than a bare id segment — e.g. Cognito::UserPoolRiskConfigurationAttachment
 *      / ::UserPoolUICustomizationAttachment return
-*      `<TypeName>-<UserPoolId>-<ClientId>`, NOT the after-pipe segment.
-*   4. Pin each addition with a unit test in intrinsic-functions.test.ts.
+*      `<TypeName>-<UserPoolId>-<ClientId>`, NOT the after-pipe segment;
+*      ApiGateway::Method is in this category too (its documented `Ref` is a
+*      CFn-generated synthetic id like `mysta-metho-01234b567890example`, not
+*      reconstructible from the `<apiId>|<resourceId>|<verb>` physical id).
+*      Also EXCLUDE types whose AWS-docs page documents NO `Ref` return value
+*      at all (ApiGateway::DocumentationVersion) — with no contract to honor,
+*      the raw physical id is the least-surprising value.
+*   4. Types whose primaryIdentifier puts the `Ref` component FIRST
+*      (`[<refId>, <parentId>]` — e.g. ApiGateway::Deployment /
+*      ::DocumentationPart) belong in
+*      {@link REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE} instead of this Set: the
+*      after-last-pipe extraction would return the PARENT id for them.
+*   5. Pin each addition with a unit test in intrinsic-functions.test.ts.
 */
 const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
 	"AWS::ApiGateway::Model",
 	"AWS::ApiGateway::RequestValidator",
+	"AWS::ApiGateway::Stage",
+	"AWS::ApiGateway::Resource",
+	"AWS::ApiGateway::Authorizer",
 	"AWS::Cognito::UserPoolClient",
 	"AWS::Cognito::UserPoolResourceServer",
 	"AWS::Cognito::UserPoolGroup",
@@ -6126,6 +6147,23 @@ const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
 	"AWS::AppConfig::Deployment"
 ]);
 /**
+* Sibling of {@link REF_RETURNS_SEGMENT_AFTER_PIPE} for compound-id types
+* whose CC primaryIdentifier puts the `Ref` component FIRST
+* (`[<refId>, <parentId>]` — segment order REVERSED vs the after-pipe family),
+* so CFn's `Ref` value is the segment BEFORE the FIRST pipe (issue #963
+* family audit; both confirmed against the AWS-docs "Return values / Ref"
+* section):
+*   - AWS::ApiGateway::Deployment        `<deploymentId>|<restApiId>` -> deployment id
+*   - AWS::ApiGateway::DocumentationPart `<docPartId>|<restApiId>`    -> documentation part id
+*
+* Deployment matters in practice: every CDK-generated template wires the
+* Stage's `DeploymentId` as `{ Ref: <Deployment> }`, so a CC-routed
+* Deployment would otherwise hand the Stage a compound id AWS rejects. Same
+* maintenance rules as the after-pipe Set (docs-verified Ref semantics +
+* a pinning unit test per entry).
+*/
+const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = new Set(["AWS::ApiGateway::Deployment", "AWS::ApiGateway::DocumentationPart"]);
+/**
 * SDK-provisioned types whose provider stores the resource ARN as the physical
 * id (their delete / update paths need the ARN), while CloudFormation's `Ref`
 * returns the CFn physical resource id — which for these types is NOT the ARN:
@@ -6142,8 +6180,8 @@ const REF_RETURNS_NAME_FROM_ARN = new Map([["AWS::Events::Rule", ":rule/"], ["AW
 * type and cdkd-stored physical id. Pure function shared by the deploy-time
 * resolver ({@link IntrinsicFunctionResolver.resolveRefValue}) and the
 * `cdkd orphan` rewriter's `{Ref: <orphan>}` substitution, so both derive
-* identical CFn `Ref` semantics (after-pipe compound-id extraction and
-* name-from-ARN extraction included).
+* identical CFn `Ref` semantics (after-pipe / before-first-pipe compound-id
+* extraction and name-from-ARN extraction included).
 */
 function cfnRefValueFromPhysicalId(resourceType, physicalId) {
 	const nameMarker = REF_RETURNS_NAME_FROM_ARN.get(resourceType);
@@ -6160,6 +6198,10 @@ function cfnRefValueFromPhysicalId(resourceType, physicalId) {
 		const pipeIdx = physicalId.lastIndexOf("|");
 		if (pipeIdx >= 0) return physicalId.substring(pipeIdx + 1);
 	}
+	if (REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE.has(resourceType)) {
+		const pipeIdx = physicalId.indexOf("|");
+		if (pipeIdx >= 0) return physicalId.substring(0, pipeIdx);
+	}
 	return physicalId;
 }
 /**
@@ -6470,9 +6512,10 @@ var IntrinsicFunctionResolver = class {
 	* physical id, and returning the raw physical id breaks downstream consumers.
 	*
 	* The {@link REF_RETURNS_SEGMENT_AFTER_PIPE} types are provisioned via Cloud
-	* Control (no SDK provider), whose primary identifier — and thus cdkd's
-	* physical id — is the compound `<parentId>|<ref>`, while CFn's `Ref` returns
-	* only the trailing `<ref>` segment:
+	* Control (either they have no SDK provider, or the #614 silent-drop routing
+	* sent an SDK-backed type through CC), whose primary identifier — and thus
+	* cdkd's physical id — is the compound `<parentId>|<ref>`, while CFn's `Ref`
+	* returns only the trailing `<ref>` segment:
 	*   - `AWS::ApiGateway::Model` → Ref is the model NAME; physical id is
 	*     `<restApiId>|<modelName>`. A method wiring
 	*     `RequestModels: { "application/json": { "Ref": <Model> } }` would
@@ -6490,6 +6533,11 @@ var IntrinsicFunctionResolver = class {
 	* In every case the `Ref` value is the segment after the pipe (the parent id
 	* is the first identifier component).
 	*
+	* The {@link REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE} types are the mirror
+	* image: their compound primaryIdentifier puts the `Ref` component FIRST
+	* (`<refId>|<parentId>` — e.g. `AWS::ApiGateway::Deployment`), so the value
+	* is the segment before the first pipe.
+	*
 	* The {@link REF_RETURNS_NAME_FROM_ARN} types are SDK-provisioned with the
 	* resource ARN stored as the physical id, while CFn's `Ref` returns the
 	* resource NAME (the CFn physical resource id) — e.g. `AWS::Events::Rule`
@@ -14400,4 +14448,4 @@ var DeployEngine = class {
 
 //#endregion
 export { resolveStateBucketWithDefaultAndSource as $, TemplateParser as A, getDockerCmd as B, findActionableSilentDrops as C, applyRoleArnIfSet as D, cfnRefValueFromPhysicalId as E, AssetPublisher as F, Synthesizer as G, runDockerStreaming as H, stringifyValue as I, getLegacyStateBucketName as J, synthesisStatusMessage as K, WorkGraph as L, S3StateBackend as M, rebuildClientForBucketRegion as N, DiffCalculator as O, shouldRetainResource as P, resolveStateBucketWithDefault as Q, buildDockerImage as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, AssetManifestLoader as U, runDockerForeground as V, getDockerImageBySourceHash as W, resolveCaptureObservedState as X, resolveApp as Y, resolveSkipPrefix as Z, green as _, withRetry as a, uploadCfnTemplate as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveBucketRegion as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, findLargeInlineResources as it, LockManager as j, DagBuilder as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_URL_LIMIT as nt, isRetryableTransientError as o, AssemblyReader as ot, formatResourceLine as p, getDefaultStateBucketName as q, DeployEngine as r, MIGRATE_TMP_PREFIX as rt, IMPLICIT_DELETE_DEPENDENCIES as s, clearBucketRegionCache as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_BODY_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, formatDockerLoginError as z };
-//# sourceMappingURL=deploy-engine-ByCHAN3p.js.map
+//# sourceMappingURL=deploy-engine-DpUNxTCs.js.map