@go-to-k/cdkd 0.230.30 → 0.230.32

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-ByCHAN3p.js";
+import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-EV5BfAvn.js";
 import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -1446,7 +1446,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.30";
+	return "0.230.32";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -55650,7 +55650,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.30");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.32");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());

package/dist/{deploy-engine-ByCHAN3p.js → deploy-engine-EV5BfAvn.js}

@@ -6073,12 +6073,19 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 /**
 * Resource types whose CloudFormation `Ref` returns the segment AFTER the LAST
 * pipe in cdkd's compound Cloud Control physical id (rather than the whole
-* physical id). These are Cloud-Control-provisioned types whose CC
-* primaryIdentifier is compound (`<parentId>|<ref>`, or `<a>|<b>|<ref>` for
+* physical id). These are types provisioned via Cloud Control — either because
+* they have no SDK provider, or because the #614 silent-drop routing sent an
+* SDK-backed type through CC (e.g. an ApiGateway Stage carrying
+* `MethodSettings`, which the SDK provider does not wire — issue #963). Their
+* CC primaryIdentifier is compound (`<parentId>|<ref>`, or `<a>|<b>|<ref>` for
 * triple-segment AppConfig children) while CFn's `Ref` returns only the
-* trailing `<ref>` component:
+* trailing `<ref>` component. For SDK-provisioned instances of the same types
+* the stored physical id has no pipe, so the extraction is a no-op:
 *   - AWS::ApiGateway::Model            `<restApiId>|<modelName>`     -> model name
 *   - AWS::ApiGateway::RequestValidator `<restApiId>|<validatorId>`   -> validator id
+*   - AWS::ApiGateway::Stage            `<restApiId>|<stageName>`     -> stage name
+*   - AWS::ApiGateway::Resource         `<restApiId>|<resourceId>`    -> resource id
+*   - AWS::ApiGateway::Authorizer       `<restApiId>|<authorizerId>`  -> authorizer id
 *   - AWS::Cognito::UserPoolClient           `<userPoolId>|<clientId>`       -> client id
 *   - AWS::Cognito::UserPoolResourceServer   `<userPoolId>|<identifier>`     -> resource-server identifier
 *   - AWS::Cognito::UserPoolGroup            `<userPoolId>|<groupName>`      -> group name
@@ -6108,12 +6115,26 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 *   3. EXCLUDE types whose `Ref` returns a synthetic / prefixed string rather
 *      than a bare id segment — e.g. Cognito::UserPoolRiskConfigurationAttachment
 *      / ::UserPoolUICustomizationAttachment return
-*      `<TypeName>-<UserPoolId>-<ClientId>`, NOT the after-pipe segment.
-*   4. Pin each addition with a unit test in intrinsic-functions.test.ts.
+*      `<TypeName>-<UserPoolId>-<ClientId>`, NOT the after-pipe segment;
+*      ApiGateway::Method is in this category too (its documented `Ref` is a
+*      CFn-generated synthetic id like `mysta-metho-01234b567890example`, not
+*      reconstructible from the `<apiId>|<resourceId>|<verb>` physical id).
+*      Also EXCLUDE types whose AWS-docs page documents NO `Ref` return value
+*      at all (ApiGateway::DocumentationVersion) — with no contract to honor,
+*      the raw physical id is the least-surprising value.
+*   4. Types whose primaryIdentifier puts the `Ref` component FIRST
+*      (`[<refId>, <parentId>]` — e.g. ApiGateway::Deployment /
+*      ::DocumentationPart) belong in
+*      {@link REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE} instead of this Set: the
+*      after-last-pipe extraction would return the PARENT id for them.
+*   5. Pin each addition with a unit test in intrinsic-functions.test.ts.
 */
 const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
 	"AWS::ApiGateway::Model",
 	"AWS::ApiGateway::RequestValidator",
+	"AWS::ApiGateway::Stage",
+	"AWS::ApiGateway::Resource",
+	"AWS::ApiGateway::Authorizer",
 	"AWS::Cognito::UserPoolClient",
 	"AWS::Cognito::UserPoolResourceServer",
 	"AWS::Cognito::UserPoolGroup",
@@ -6126,6 +6147,23 @@ const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
 	"AWS::AppConfig::Deployment"
 ]);
 /**
+* Sibling of {@link REF_RETURNS_SEGMENT_AFTER_PIPE} for compound-id types
+* whose CC primaryIdentifier puts the `Ref` component FIRST
+* (`[<refId>, <parentId>]` — segment order REVERSED vs the after-pipe family),
+* so CFn's `Ref` value is the segment BEFORE the FIRST pipe (issue #963
+* family audit; both confirmed against the AWS-docs "Return values / Ref"
+* section):
+*   - AWS::ApiGateway::Deployment        `<deploymentId>|<restApiId>` -> deployment id
+*   - AWS::ApiGateway::DocumentationPart `<docPartId>|<restApiId>`    -> documentation part id
+*
+* Deployment matters in practice: every CDK-generated template wires the
+* Stage's `DeploymentId` as `{ Ref: <Deployment> }`, so a CC-routed
+* Deployment would otherwise hand the Stage a compound id AWS rejects. Same
+* maintenance rules as the after-pipe Set (docs-verified Ref semantics +
+* a pinning unit test per entry).
+*/
+const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = new Set(["AWS::ApiGateway::Deployment", "AWS::ApiGateway::DocumentationPart"]);
+/**
 * SDK-provisioned types whose provider stores the resource ARN as the physical
 * id (their delete / update paths need the ARN), while CloudFormation's `Ref`
 * returns the CFn physical resource id — which for these types is NOT the ARN:
@@ -6142,8 +6180,8 @@ const REF_RETURNS_NAME_FROM_ARN = new Map([["AWS::Events::Rule", ":rule/"], ["AW
 * type and cdkd-stored physical id. Pure function shared by the deploy-time
 * resolver ({@link IntrinsicFunctionResolver.resolveRefValue}) and the
 * `cdkd orphan` rewriter's `{Ref: <orphan>}` substitution, so both derive
-* identical CFn `Ref` semantics (after-pipe compound-id extraction and
-* name-from-ARN extraction included).
+* identical CFn `Ref` semantics (after-pipe / before-first-pipe compound-id
+* extraction and name-from-ARN extraction included).
 */
 function cfnRefValueFromPhysicalId(resourceType, physicalId) {
 	const nameMarker = REF_RETURNS_NAME_FROM_ARN.get(resourceType);
@@ -6160,6 +6198,10 @@ function cfnRefValueFromPhysicalId(resourceType, physicalId) {
 		const pipeIdx = physicalId.lastIndexOf("|");
 		if (pipeIdx >= 0) return physicalId.substring(pipeIdx + 1);
 	}
+	if (REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE.has(resourceType)) {
+		const pipeIdx = physicalId.indexOf("|");
+		if (pipeIdx >= 0) return physicalId.substring(0, pipeIdx);
+	}
 	return physicalId;
 }
 /**
@@ -6470,9 +6512,10 @@ var IntrinsicFunctionResolver = class {
 	* physical id, and returning the raw physical id breaks downstream consumers.
 	*
 	* The {@link REF_RETURNS_SEGMENT_AFTER_PIPE} types are provisioned via Cloud
-	* Control (no SDK provider), whose primary identifier — and thus cdkd's
-	* physical id — is the compound `<parentId>|<ref>`, while CFn's `Ref` returns
-	* only the trailing `<ref>` segment:
+	* Control (either they have no SDK provider, or the #614 silent-drop routing
+	* sent an SDK-backed type through CC), whose primary identifier — and thus
+	* cdkd's physical id — is the compound `<parentId>|<ref>`, while CFn's `Ref`
+	* returns only the trailing `<ref>` segment:
 	*   - `AWS::ApiGateway::Model` → Ref is the model NAME; physical id is
 	*     `<restApiId>|<modelName>`. A method wiring
 	*     `RequestModels: { "application/json": { "Ref": <Model> } }` would
@@ -6490,6 +6533,11 @@ var IntrinsicFunctionResolver = class {
 	* In every case the `Ref` value is the segment after the pipe (the parent id
 	* is the first identifier component).
 	*
+	* The {@link REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE} types are the mirror
+	* image: their compound primaryIdentifier puts the `Ref` component FIRST
+	* (`<refId>|<parentId>` — e.g. `AWS::ApiGateway::Deployment`), so the value
+	* is the segment before the first pipe.
+	*
 	* The {@link REF_RETURNS_NAME_FROM_ARN} types are SDK-provisioned with the
 	* resource ARN stored as the physical id, while CFn's `Ref` returns the
 	* resource NAME (the CFn physical resource id) — e.g. `AWS::Events::Rule`
@@ -12870,7 +12918,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 	} catch (error) {
 		lastError = error;
 		const message = error instanceof Error ? error.message : String(error);
-		if (!isRetryableTransientError(error, message) || attempt >= maxRetries) throw error;
+		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
 		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
 		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
 		for (let waited = 0; waited < delay; waited += 1e3) {
@@ -14075,8 +14123,38 @@ var DeployEngine = class {
 						createResult = await this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider);
 					} else {
 						this.logger.info(`  Creating new ${logicalId}...`);
-						createResult = await this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider);
-						if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
+						let deletedOldFirst = false;
+						try {
+							createResult = await this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider);
+						} catch (createError) {
+							const createMsg = createError instanceof Error ? createError.message : String(createError);
+							if (!(/already exists/i.test(createMsg) || createMsg.includes("AlreadyExists"))) throw createError;
+							if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its user-supplied physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. Rename the resource in your CDK code — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
+							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. The resource has a user-supplied physical name, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed), or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
+							this.logger.info(`  Create-first collided with the custom-named resource and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
+							try {
+								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, { expectedRegion: this.stackRegion });
+							} catch (deleteError) {
+								throw new Error(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+							}
+							this.logger.info(`  ${green("✓")} Old resource deleted`);
+							deletedOldFirst = true;
+							this.logger.info(`  Re-creating ${logicalId}...`);
+							try {
+								createResult = await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps), logicalId, void 0, void 0, replaceProvider), logicalId, {
+									maxRetries: 5,
+									initialDelayMs: 2e3,
+									maxDelayMs: 1e4,
+									logger: this.logger,
+									isInterrupted: () => this.interrupted,
+									onInterrupted: () => new InterruptedError(this.interruptCause ?? "user"),
+									isRetryable: (message) => /already exists/i.test(message) || message.includes("AlreadyExists")
+								});
+							} catch (recreateError) {
+								throw new Error(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`);
+							}
+						}
+						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
 						else {
 							this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
 							try {
@@ -14400,4 +14478,4 @@ var DeployEngine = class {
 
 //#endregion
 export { resolveStateBucketWithDefaultAndSource as $, TemplateParser as A, getDockerCmd as B, findActionableSilentDrops as C, applyRoleArnIfSet as D, cfnRefValueFromPhysicalId as E, AssetPublisher as F, Synthesizer as G, runDockerStreaming as H, stringifyValue as I, getLegacyStateBucketName as J, synthesisStatusMessage as K, WorkGraph as L, S3StateBackend as M, rebuildClientForBucketRegion as N, DiffCalculator as O, shouldRetainResource as P, resolveStateBucketWithDefault as Q, buildDockerImage as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, AssetManifestLoader as U, runDockerForeground as V, getDockerImageBySourceHash as W, resolveCaptureObservedState as X, resolveApp as Y, resolveSkipPrefix as Z, green as _, withRetry as a, uploadCfnTemplate as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveBucketRegion as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, findLargeInlineResources as it, LockManager as j, DagBuilder as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_URL_LIMIT as nt, isRetryableTransientError as o, AssemblyReader as ot, formatResourceLine as p, getDefaultStateBucketName as q, DeployEngine as r, MIGRATE_TMP_PREFIX as rt, IMPLICIT_DELETE_DEPENDENCIES as s, clearBucketRegionCache as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_BODY_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, formatDockerLoginError as z };
-//# sourceMappingURL=deploy-engine-ByCHAN3p.js.map
+//# sourceMappingURL=deploy-engine-EV5BfAvn.js.map