@go-to-k/cdkd 0.234.0 → 0.235.0

package/dist/{deploy-engine-Dj9mXUQa.js → deploy-engine-Cbi5IzWV.js}

@@ -1790,6 +1790,23 @@ function resolveUseCdkBootstrapAssets(cliValue) {
 	return (loadCdkJson()?.context?.["cdkd"])?.["useCdkBootstrapAssets"] === true;
 }
 /**
+* Resolve the effective "auto-create cdkd asset storage on first deploy into
+* an un-opted-in region" value (issue #1007).
+*
+* Mirrors {@link resolveCaptureObservedState}'s `--no-X` shape: Commander
+* reports `--no-auto-asset-storage` as `autoAssetStorage: false`, and the
+* implicit default is `true` — so the cdk.json fallback
+* (`context.cdkd.autoAssetStorage`, boolean) only fires when the CLI value
+* is the implicit default. Priority: CLI `false` wins > cdk.json boolean >
+* default `true`.
+*/
+function resolveAutoAssetStorage(cliValue) {
+	if (cliValue === false) return false;
+	const v = (loadCdkJson()?.context?.["cdkd"])?.["autoAssetStorage"];
+	if (typeof v === "boolean") return v;
+	return true;
+}
+/**
 * Pre-parse argv walk that surfaces the deprecation warning when the
 * user explicitly passes the legacy `--no-prefix-user-supplied-names`
 * flag. Commander's auto-negation of `--prefix-user-supplied-names`
@@ -3166,25 +3183,31 @@ async function ensureAssetStorage(options) {
 * are cached per region for the process lifetime (the marker read is one
 * GetObject against a bucket every deploy already reads — design §4.1).
 *
-* In legacy mode, one `logger.info` line per invocation mentions the
-* `cdk gc` hazard and the `cdkd bootstrap` opt-in (info, not warn — existing
-* users are not doing anything wrong; design §12.2).
+* In legacy mode, one `logger.info` line per legacy region per invocation
+* mentions the `cdk gc` hazard and the exact `cdkd bootstrap --region <r>`
+* opt-in command (info, not warn — existing users are not doing anything
+* wrong; design §12.2). Per-region because opt-in is keyed by each stack's
+* deploy region: a multi-region app can be opted in for one region and
+* legacy for another, and a region-less notice reads as a false negative to
+* a user who just bootstrapped a different region.
 */
 var AssetModeResolver = class {
 	logger = getLogger().child("AssetMode");
 	cache = /* @__PURE__ */ new Map();
-	legacyNoticeShown = false;
+	legacyNoticeShownRegions = /* @__PURE__ */ new Set();
 	stateBackend;
 	accountId;
 	profile;
 	useCdkBootstrapAssets;
 	suppressLegacyNotice;
+	autoCreate;
 	constructor(stateBackend, accountId, opts = {}) {
 		this.stateBackend = stateBackend;
 		this.accountId = accountId;
 		this.profile = opts.profile;
 		this.useCdkBootstrapAssets = opts.useCdkBootstrapAssets ?? false;
 		this.suppressLegacyNotice = opts.suppressLegacyNotice ?? false;
+		this.autoCreate = opts.autoCreate;
 	}
 	/**
 	* Resolve the asset mode for a deploy region. Concurrent callers for the
@@ -3205,9 +3228,13 @@ var AssetModeResolver = class {
 		const markerKey = getBootstrapMarkerKey(region);
 		const body = await this.stateBackend.getRawObject(markerKey);
 		if (body === null) {
-			if (!this.legacyNoticeShown && !this.suppressLegacyNotice) {
-				this.legacyNoticeShown = true;
-				this.logger.info("Assets are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Run 'cdkd bootstrap' to create cdkd-owned asset storage that 'cdk gc' never touches.");
+			if (this.autoCreate) {
+				const created = await this.tryAutoCreate(region, markerKey);
+				if (created) return created;
+			}
+			if (!this.legacyNoticeShownRegions.has(region) && !this.suppressLegacyNotice) {
+				this.legacyNoticeShownRegions.add(region);
+				this.logger.info(`Assets for region '${region}' are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Run 'cdkd bootstrap --region ${region}' to create cdkd-owned asset storage that 'cdk gc' never touches.`);
 			}
 			return { mode: "legacy" };
 		}
@@ -3219,6 +3246,59 @@ var AssetModeResolver = class {
 			marker
 		};
 	}
+	/**
+	* Issue #1007 — first deploy into an un-opted-in region: confirm, then
+	* create the asset bucket + container repo + marker via the same
+	* {@link ensureAssetStorage} `cdkd bootstrap` uses (squatting defense,
+	* idempotent creation, marker-written-last all included). Returns `null`
+	* (= stay legacy) when the user declines or creation fails — the caller
+	* then shows the legacy notice, so the user still learns the exact
+	* `cdkd bootstrap --region <r>` remediation.
+	*/
+	async tryAutoCreate(region, markerKey) {
+		let confirmed;
+		try {
+			confirmed = await this.autoCreate.confirm(region);
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) return null;
+		let s3Client;
+		let ecrClient;
+		try {
+			s3Client = new S3Client({
+				region,
+				...this.profile && { profile: this.profile }
+			});
+			ecrClient = new ECRClient({
+				region,
+				...this.profile && { profile: this.profile }
+			});
+			await ensureAssetStorage({
+				s3Client,
+				ecrClient,
+				stateBackend: this.stateBackend,
+				accountId: this.accountId,
+				region,
+				force: false
+			});
+			const body = await this.stateBackend.getRawObject(markerKey);
+			if (body === null) throw new CdkdError(`bootstrap marker missing at '${markerKey}' right after creation`, "ASSET_STORAGE_MARKER_MISSING");
+			const marker = parseBootstrapMarker(body, markerKey);
+			this.logger.debug(`cdkd asset storage auto-created for region '${region}': ${marker.assetBucket} / ${marker.containerRepo}`);
+			return {
+				mode: "cdkd-assets",
+				marker
+			};
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.logger.warn(`Failed to auto-create cdkd asset storage for region '${region}': ${message} Falling back to the CDK bootstrap destinations for this run — run 'cdkd bootstrap --region ${region}' (with S3/ECR create permissions) to opt the region in.`);
+			return null;
+		} finally {
+			s3Client?.destroy();
+			ecrClient?.destroy();
+		}
+	}
 };
 
 //#endregion
@@ -7497,6 +7577,27 @@ async function getAccountInfo(overrideRegion) {
 		return cachedAccountInfo;
 	}
 }
+/**
+* Collect every name referenced (Ref / Fn::Sub placeholder / other intrinsic
+* argument) by the sections cdkd actually evaluates: Resources, Outputs, and
+* Conditions. Deliberately excludes `Rules` (assertion-only, never evaluated
+* by cdkd — CloudFormation evaluates them pre-deployment, cdkd has no
+* equivalent gate) and `Metadata`. Used to avoid resolving template
+* parameters nothing consumes.
+*/
+function collectReferencedParameterNames(template) {
+	const parser = new TemplateParser();
+	const referenced = /* @__PURE__ */ new Set();
+	for (const section of [
+		template.Resources,
+		template.Outputs,
+		template.Conditions
+	]) {
+		if (!section || typeof section !== "object") continue;
+		for (const name of parser.extractReferences(section)) referenced.add(name);
+	}
+	return referenced;
+}
 var IntrinsicFunctionResolver = class {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
@@ -7517,6 +7618,7 @@ var IntrinsicFunctionResolver = class {
 		const parameters = {};
 		const templateParameters = template.Parameters;
 		if (!templateParameters || typeof templateParameters !== "object") return parameters;
+		let referencedNames;
 		for (const [name, definition] of Object.entries(templateParameters)) {
 			const paramDef = definition;
 			if (userParameters && name in userParameters) {
@@ -7529,6 +7631,11 @@ var IntrinsicFunctionResolver = class {
 			}
 			if ("Default" in paramDef) {
 				if (paramDef.Type.startsWith("AWS::SSM::Parameter::Value")) {
+					referencedNames ??= collectReferencedParameterNames(template);
+					if (!referencedNames.has(name)) {
+						this.logger.debug(`Parameter ${name}: skipping SSM resolution (not referenced by Resources/Outputs/Conditions)`);
+						continue;
+					}
 					const ssmPath = String(paramDef.Default);
 					this.logger.debug(`Parameter ${name}: resolving SSM parameter path ${ssmPath}`);
 					const resolved = await this.resolveSSMParameter(ssmPath);
@@ -15736,5 +15843,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { AssetManifestLoader as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, buildDockerImage as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, runDockerStreaming as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, getDockerCmd as X, formatDockerLoginError as Y, runDockerForeground as Z, green as _, AssemblyReader as _t, withRetry as a, resolveApp as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveStateBucketWithDefault as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as dt, getDockerImageBySourceHash as et, renderStatefulReason as f, CFN_TEMPLATE_BODY_LIMIT as ft, gray as g, uploadCfnTemplate as gt, cyan as h, findLargeInlineResources as ht, withResourceDeadline as i, getLegacyStateBucketName as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveStateBucketWithDefaultAndSource as lt, bold as m, MIGRATE_TMP_PREFIX as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, synthesisStatusMessage as nt, isRetryableTransientError as o, resolveCaptureObservedState as ot, formatResourceLine as p, CFN_TEMPLATE_URL_LIMIT as pt, parseBootstrapMarker as q, DeployEngine as r, getDefaultStateBucketName as rt, IMPLICIT_DELETE_DEPENDENCIES as s, resolveSkipPrefix as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, Synthesizer as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveUseCdkBootstrapAssets as ut, red as v, clearBucketRegionCache as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, resolveBucketRegion as yt, WorkGraph as z };
-//# sourceMappingURL=deploy-engine-Dj9mXUQa.js.map
+export { AssetManifestLoader as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, buildDockerImage as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, runDockerStreaming as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, getDockerCmd as X, formatDockerLoginError as Y, runDockerForeground as Z, green as _, uploadCfnTemplate as _t, withRetry as a, resolveApp as at, IAMRoleProvider as b, resolveBucketRegion as bt, computeImplicitDeleteEdges as c, resolveSkipPrefix as ct, isStatefulRecreateTargetSync as d, resolveUseCdkBootstrapAssets as dt, getDockerImageBySourceHash as et, renderStatefulReason as f, warnDeprecatedNoPrefixCliFlag as ft, gray as g, findLargeInlineResources as gt, cyan as h, MIGRATE_TMP_PREFIX as ht, withResourceDeadline as i, getLegacyStateBucketName as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveStateBucketWithDefault as lt, bold as m, CFN_TEMPLATE_URL_LIMIT as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, synthesisStatusMessage as nt, isRetryableTransientError as o, resolveAutoAssetStorage as ot, formatResourceLine as p, CFN_TEMPLATE_BODY_LIMIT as pt, parseBootstrapMarker as q, DeployEngine as r, getDefaultStateBucketName as rt, IMPLICIT_DELETE_DEPENDENCIES as s, resolveCaptureObservedState as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, Synthesizer as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveStateBucketWithDefaultAndSource as ut, red as v, AssemblyReader as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, clearBucketRegionCache as yt, WorkGraph as z };
+//# sourceMappingURL=deploy-engine-Cbi5IzWV.js.map