@go-to-k/cdkd 0.238.3 → 0.238.5

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-MEo926OW.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-_tADDg2k.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -1885,7 +1885,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.238.3";
+	return "0.238.5";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -47206,17 +47206,18 @@ function collectImportableResources(template) {
 */
 function buildStackState(stackName, region, rows, templateParser, template, existingState, selectiveMode) {
 	const resources = selectiveMode && existingState ? { ...existingState.resources } : {};
+	const parameterNames = new Set(Object.keys(template.Parameters ?? {}));
 	for (const row of rows) {
 		if (row.outcome !== "imported" || !row.physicalId) continue;
 		const tmplResource = template.Resources[row.logicalId];
 		if (!tmplResource) continue;
-		const deps = templateParser.extractDependencies(tmplResource);
+		const deps = [...templateParser.extractDependencies(tmplResource)].filter((dep) => !parameterNames.has(dep));
 		resources[row.logicalId] = {
 			physicalId: row.physicalId,
 			resourceType: row.resourceType,
 			properties: tmplResource.Properties ?? {},
 			attributes: {},
-			dependencies: [...deps],
+			dependencies: deps,
 			provisionedBy: "sdk"
 		};
 	}
@@ -47704,6 +47705,72 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 	}
 }
 /**
+* Best-effort read of the region's asset-storage bootstrap marker
+* (`s3://{stateBucket}/cdkd-bootstrap/{region}.json`) to recover the
+* cdkd-owned container-asset ECR repository name (issue #1025). Since
+* `cdkd bootstrap --container-repo <name>` (issue #1011) the repo can
+* carry ANY name, so the local resolvers' conventional-prefix regex
+* cannot classify images published to a custom-named repo — the marker
+* is the only source of truth.
+*
+* This is a fast-path optimization for `cdkd local run-task
+* --from-state` (recognizing a cdk-asset image enables the local
+* `cdk.out` docker build instead of an ECR pull), so it must NEVER fail
+* the run: every miss (no bucket, no marker, malformed marker, any AWS
+* error) logs at debug and returns `undefined` — the caller falls back
+* to the conventional-prefix regex.
+*
+* Marker-key region resolution: the marker records the repo for the
+* stack's DEPLOY region, so after the explicit CLI overrides (`--region`
+* highest per the repo convention, then `--stack-region` — the state
+* disambiguator that names the region whose state is being loaded) the
+* synth-derived stack region outranks the ambient env region. This
+* deliberately differs from {@link loadStateForStack}'s bucket-resolution
+* chain (which is about WHERE the state bucket is, not WHICH region's
+* data is read).
+*/
+async function loadBootstrapContainerRepo(synthRegion, opts) {
+	const logger = getLogger();
+	const prefix = opts.logPrefix ?? "--from-state";
+	const region = opts.region ?? opts.stackRegion ?? synthRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+	let stateBucket;
+	try {
+		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
+	} catch (err) {
+		logger.debug(`${prefix}: could not resolve state bucket for the bootstrap-marker read: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
+		return;
+	}
+	const awsClients = new AwsClients({
+		...opts.region !== void 0 && { region: opts.region },
+		...opts.profile !== void 0 && { profile: opts.profile }
+	});
+	setAwsClients(awsClients);
+	try {
+		const stateConfig = {
+			bucket: stateBucket,
+			prefix: opts.statePrefix
+		};
+		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
+			...opts.region !== void 0 && { region: opts.region },
+			...opts.profile !== void 0 && { profile: opts.profile }
+		});
+		const markerKey = getBootstrapMarkerKey(region);
+		const body = await stateBackend.getRawObject(markerKey);
+		if (body === null) {
+			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}' in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
+			return;
+		}
+		const marker = parseBootstrapMarker(body, markerKey);
+		logger.debug(`${prefix}: bootstrap marker for ${region} names container repo '${marker.containerRepo}'.`);
+		return marker.containerRepo;
+	} catch (err) {
+		logger.debug(`${prefix}: bootstrap-marker read failed: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
+		return;
+	} finally {
+		resetAwsClients();
+	}
+}
+/**
 * Build a {@link CrossStackResolver} that walks cdkd's S3 state to look
 * up `Fn::ImportValue` / `Fn::GetStackOutput` references the same way
 * `cdkd deploy`'s `IntrinsicFunctionResolver` does. Returns `undefined`
@@ -48430,6 +48497,7 @@ function detectEcsImageResolutionNeeds(stack) {
 	let needsStateResources = false;
 	let needsEnvOrSecretSubstitution = false;
 	let needsCrossStackResolver = false;
+	let needsAssetRepoMarker = false;
 	for (const res of Object.values(resources)) {
 		if (res.Type !== "AWS::ECS::TaskDefinition") continue;
 		const props = res.Properties ?? {};
@@ -48441,6 +48509,8 @@ function detectEcsImageResolutionNeeds(stack) {
 			const need = inspectImageForSubstitutions(image, resources);
 			if (need.pseudo) needsPseudoParameters = true;
 			if (need.state) needsStateResources = true;
+			const flat = extractImageString(image);
+			if (flat !== void 0 && extractEcrRepoComponent(flat) !== void 0 && !CDK_ASSET_IMAGE_REPO_RE.test(flat)) needsAssetRepoMarker = true;
 			if (containerHasIntrinsicEnvOrSecret(co)) needsEnvOrSecretSubstitution = true;
 			if (containerHasCrossStackEnvOrSecret(co)) {
 				needsEnvOrSecretSubstitution = true;
@@ -48460,7 +48530,8 @@ function detectEcsImageResolutionNeeds(stack) {
 		needsPseudoParameters,
 		needsStateResources,
 		needsEnvOrSecretSubstitution,
-		needsCrossStackResolver
+		needsCrossStackResolver,
+		needsAssetRepoMarker
 	};
 }
 /**
@@ -48936,11 +49007,53 @@ function buildSubstitutionContextFromImageContext(context) {
 * `cdk.out` build, so both must classify as `kind: 'cdk-asset'`. The `cdk-`
 * qualifier is generalized to `[a-z0-9]+` so a custom-qualifier bootstrap is
 * matched too (previously only the hardcoded `hnb659fds` default was).
+*
+* Since `cdkd bootstrap --container-repo <name>` (issue #1011) the
+* cdkd-owned repo can carry ANY name — the per-region bootstrap marker is
+* the source of truth. The regex therefore cannot recognize images
+* published to a custom-named repo; `isCdkAssetImageUri` additionally
+* matches an ECR-hosted URI whose repository path component equals the
+* marker-resolved name when the caller supplies it (issue #1025). The
+* regex stays as the no-marker fallback — `cdkd local run-task` can run
+* without AWS access, where no marker read is possible.
 */
 const CDK_ASSET_IMAGE_REPO_RE = /(?:cdk-[a-z0-9]+|cdkd)-container-assets-/;
-/** True when `uri` embeds a CDK-bootstrap or cdkd-owned container-assets repo. */
-function isCdkAssetImageUri(uri) {
-	return CDK_ASSET_IMAGE_REPO_RE.test(uri);
+/**
+* Extract the repository path component of an ECR-hosted image URI.
+*
+* The host part (before the first `/`) must contain `.dkr.ecr.` — this
+* tolerates both concrete hosts (`123456789012.dkr.ecr.us-east-1.amazonaws.com`)
+* and placeholder-bearing hosts
+* (`${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}`). The repo
+* component is the substring after the first `/`, stripped of a trailing
+* `@<digest>` (first `@`) and then a trailing `:<tag>` (last `:` — ECR
+* repo names cannot contain `:` but CAN contain `/`, so the last colon is
+* the tag separator). Stripping the digest FIRST handles the combined
+* `name:tag@digest` form Docker accepts. Returns `undefined` for non-ECR
+* hosts and empty results.
+*/
+function extractEcrRepoComponent(uri) {
+	const slash = uri.indexOf("/");
+	if (slash <= 0) return void 0;
+	if (!uri.slice(0, slash).includes(".dkr.ecr.")) return void 0;
+	let repo = uri.slice(slash + 1);
+	const at = repo.indexOf("@");
+	if (at !== -1) repo = repo.slice(0, at);
+	const colon = repo.lastIndexOf(":");
+	if (colon !== -1) repo = repo.slice(0, colon);
+	return repo.length > 0 ? repo : void 0;
+}
+/**
+* True when `uri` embeds a CDK-bootstrap or cdkd-owned container-assets
+* repo — either via the conventional-name regex, or (issue #1025) via an
+* exact match between the URI's ECR repository path component and the
+* bootstrap-marker-resolved `cdkAssetContainerRepo` name, which covers
+* regions bootstrapped with `cdkd bootstrap --container-repo <name>`.
+*/
+function isCdkAssetImageUri(uri, cdkAssetContainerRepo) {
+	if (CDK_ASSET_IMAGE_REPO_RE.test(uri)) return true;
+	if (cdkAssetContainerRepo === void 0) return false;
+	return extractEcrRepoComponent(uri) === cdkAssetContainerRepo;
 }
 /**
 * Parse the `Image` field of an ECS container definition.
@@ -48975,14 +49088,14 @@ function isCdkAssetImageUri(uri) {
 */
 function parseContainerImage(raw, containerName, taskLogicalId, resources, _stack, context) {
 	const getAttImage = tryResolveImageGetAtt(raw, resources, context);
-	if (getAttImage) return classifyResolvedImage(getAttImage);
+	if (getAttImage) return classifyResolvedImage(getAttImage, context?.cdkAssetContainerRepo);
 	const joinResolved = tryResolveImageFnJoin(raw, resources, context);
-	if (joinResolved.kind === "resolved") return classifyResolvedImage(joinResolved.uri);
+	if (joinResolved.kind === "resolved") return classifyResolvedImage(joinResolved.uri, context?.cdkAssetContainerRepo);
 	if (joinResolved.kind === "needs-state") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local run-task cannot resolve the repository URI without state — pass --from-state (the stack must have been deployed via cdkd deploy), build via ContainerImage.fromAsset, or pin a public image.`);
 	if (joinResolved.kind === "unsupported-join") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unsupported Fn::Join Image shape: ${joinResolved.reason}. cdkd local run-task recognizes the canonical CDK 2.x ContainerImage.fromEcrRepository Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 	const flat = extractImageString(raw);
 	if (!flat) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unparseable Image property. cdkd local run-task v1 supports flat string images, single-key Fn::Sub bodies, and CDK-asset Image references.`);
-	if (isCdkAssetImageUri(flat)) {
+	if (isCdkAssetImageUri(flat, context?.cdkAssetContainerRepo)) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(flat);
 		const out = { kind: "cdk-asset" };
 		if (hashMatch) out.assetHash = hashMatch[1];
@@ -49028,9 +49141,11 @@ function findUnresolvedEcrRepositoryRef(substituted, resources) {
 * Classify a fully-substituted image URI (Tier 1 / Tier 2 produced a
 * concrete string) into the `ResolvedEcsImage` shape. Splits out so the
 * `Fn::GetAtt` path can share the regex-match branches.
+* `cdkAssetContainerRepo` is the optional marker-resolved custom repo
+* name (issue #1025) threaded through from the resolution context.
 */
-function classifyResolvedImage(uri) {
-	if (isCdkAssetImageUri(uri)) {
+function classifyResolvedImage(uri, cdkAssetContainerRepo) {
+	if (isCdkAssetImageUri(uri, cdkAssetContainerRepo)) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(uri);
 		const out = { kind: "cdk-asset" };
 		if (hashMatch) out.assetHash = hashMatch[1];
@@ -53487,7 +53602,7 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 	const logger = getLogger();
 	if (!candidate) return void 0;
 	const needs = detectEcsImageResolutionNeeds(candidate);
-	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution) return;
+	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution && !needs.needsAssetRepoMarker) return;
 	const ctx = {};
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
@@ -53515,6 +53630,17 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 		if (loaded) ctx.stateResources = loaded.resources;
 	} else if (!stateProvider && needs.needsStateResources) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute the deployed repository URI. Otherwise the resolver will surface its existing error.");
 	else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
+	if (needs.needsAssetRepoMarker && options.fromState) {
+		const containerRepo = await loadBootstrapContainerRepo(candidate.region, {
+			statePrefix: options.statePrefix,
+			...options.stackRegion !== void 0 && { stackRegion: options.stackRegion },
+			...options.stateBucket !== void 0 && { stateBucket: options.stateBucket },
+			...options.region !== void 0 && { region: options.region },
+			...options.profile !== void 0 && { profile: options.profile },
+			logPrefix: "--from-state"
+		});
+		if (containerRepo !== void 0) ctx.cdkAssetContainerRepo = containerRepo;
+	}
 	return ctx;
 }
 function pickCandidateStack(stackPattern, stacks) {
@@ -57057,7 +57183,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.238.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.238.5");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());