@go-to-k/cdkd 0.257.0 → 0.257.1

package/README.md

@@ -452,7 +452,9 @@ the stack is managed by `cdkd deploy`. This is the reverse direction
 of `cdkd export` (see below).
 
 ```bash
-# Adopt a whole stack previously deployed by cdk deploy (tag-based auto-lookup).
+# Adopt a whole stack: each resource is resolved from its template name property,
+# then from a same-named CloudFormation stack (#1128). Use
+# --migrate-from-cloudformation below when you also want that stack retired.
 cdkd import MyStack --yes
 
 # Adopt only specific resources (CDK CLI parity).

package/dist/cli.js

@@ -1899,7 +1899,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.257.0";
+	return "0.257.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -3945,9 +3945,11 @@ var IAMInstanceProfileProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.InstanceProfileName` → verify
 	*     via `GetInstanceProfile`.
-	*  2. `ListInstanceProfiles` paginator + match `aws:cdk:path` against the
-	*     `InstanceProfile.Tags` array returned inline (no separate
-	*     `ListInstanceProfileTags` call needed).
+	*  2. `ListInstanceProfiles` paginator + a per-candidate `GetInstanceProfile`
+	*     to read the tags, matched against `aws:cdk:path`. The list API does
+	*     NOT return tags (AWS documents this on the command) even though the
+	*     `InstanceProfile` type declares `Tags?`, so reading them off the
+	*     summary typechecks and never matches.
 	*
 	* IAM is global; this walks every instance profile in the account once.
 	*/
@@ -3963,20 +3965,32 @@ var IAMInstanceProfileProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
-			for (const profile of list.InstanceProfiles ?? []) {
-				if (!profile.InstanceProfileName) continue;
-				if (matchesCdkPath(profile.Tags, input.cdkPath)) return {
-					physicalId: profile.InstanceProfileName,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.InstanceProfiles,
+					nextMarker: list.IsTruncated ? list.Marker : void 0
 				};
-			}
-			marker = list.IsTruncated ? list.Marker : void 0;
-		} while (marker);
-		return null;
+			},
+			describe: async (profile) => {
+				if (!profile.InstanceProfileName) return void 0;
+				try {
+					return (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: profile.InstanceProfileName }))).InstanceProfile;
+				} catch (err) {
+					if (err instanceof NoSuchEntityException) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (detail) => detail?.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.InstanceProfileName,
+			attributes: {}
+		};
 	}
 };
 
@@ -10379,25 +10393,35 @@ var LambdaLayerVersionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
-			for (const layer of list.Layers ?? []) {
-				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Layers,
+					nextMarker: list.NextMarker
+				};
+			},
+			describe: async (layer) => {
+				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) return void 0;
 				try {
-					if ((await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: layer.LatestMatchingVersion.LayerVersionArn,
-						attributes: {}
-					};
+					return await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException) continue;
+					if (err instanceof ResourceNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			marker = list.NextMarker;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.LatestMatchingVersion.LayerVersionArn,
+			attributes: {}
+		};
 	}
 };
 
@@ -13940,17 +13964,24 @@ var SecretsManagerSecretProvider = class {
 			if (err instanceof ResourceNotFoundException$3) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.smClient.send(new ListSecretsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const s of list.SecretList ?? []) if (s.ARN && matchesCdkPath(s.Tags, input.cdkPath)) return {
-				physicalId: s.ARN,
-				attributes: {}
-			};
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.smClient.send(new ListSecretsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.SecretList,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (secret) => secret.ARN ? secret : void 0,
+			tagsOf: (secret) => secret.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.ARN,
+			attributes: {}
+		};
 	}
 };
 
@@ -32552,25 +32583,35 @@ var KMSProvider = class {
 			throw err;
 		}
 		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
-			for (const key of list.Keys ?? []) {
-				if (!key.KeyId) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Keys,
+					nextMarker: list.NextMarker
+				};
+			},
+			describe: async (key) => {
+				if (!key.KeyId) return void 0;
 				try {
-					const tagsResp = await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
-					for (const tag of tagsResp.Tags ?? []) if (tag.TagKey === "aws:cdk:path" && tag.TagValue === input.cdkPath) return {
-						physicalId: key.KeyId,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
 				} catch (err) {
-					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) continue;
+					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) return void 0;
 					throw err;
 				}
-			}
-			marker = list.NextMarker;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => (tagsResp.Tags ?? []).map((t) => ({
+				Key: t.TagKey,
+				Value: t.TagValue
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.KeyId,
+			attributes: {}
+		};
 	}
 };
 
@@ -39687,28 +39728,42 @@ var CodeCommitRepositoryProvider = class {
 			if (err instanceof RepositoryDoesNotExistException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListRepositoriesCommand({ ...nextToken && { nextToken } }));
-			for (const repo of list.repositories ?? []) {
-				if (!repo.repositoryName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListRepositoriesCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.repositories,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (repo) => {
+				if (!repo.repositoryName) return void 0;
 				let metadata;
 				try {
 					metadata = await this.getRepositoryMetadata(repo.repositoryName);
 				} catch (err) {
-					if (err instanceof RepositoryDoesNotExistException) continue;
+					if (err instanceof RepositoryDoesNotExistException) return void 0;
 					throw err;
 				}
-				if (!metadata?.Arn) continue;
-				if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: repo.repositoryName,
-					attributes: this.toAttributes(metadata)
+				if (!metadata?.Arn) return void 0;
+				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }));
+				return {
+					metadata,
+					tags: tagsResp.tags
 				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (detail) => Object.entries(detail.tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.repositoryName,
+			attributes: this.toAttributes(match.detail.metadata)
+		};
 	}
 	/**
 	* Seed the repository's initial commit from the CFn `Code` property.
@@ -40038,16 +40093,23 @@ var DLMLifecyclePolicyProvider = class {
 			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const list = await this.getClient().send(new GetLifecyclePoliciesCommand({}));
-		for (const policy of list.Policies ?? []) {
-			if (!policy.PolicyId) continue;
-			if (policy.Tags?.["aws:cdk:path"] === input.cdkPath) return {
-				physicalId: policy.PolicyId,
-				attributes: {}
-			};
-		}
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async () => {
+				return { items: (await this.getClient().send(new GetLifecyclePoliciesCommand({}))).Policies };
+			},
+			describe: async (policy) => policy.PolicyId ? policy : void 0,
+			tagsOf: (policy) => Object.entries(policy.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.PolicyId,
+			attributes: {}
+		};
 	}
 };
 
@@ -40285,25 +40347,35 @@ var S3VectorsProvider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let token;
-		do {
-			const list = await this.getClient().send(new ListVectorBucketsCommand({ ...token && { nextToken: token } }));
-			for (const bucket of list.vectorBuckets ?? []) {
-				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListVectorBucketsCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.vectorBuckets,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (bucket) => {
+				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) return void 0;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: bucket.vectorBucketName,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }));
 				} catch (err) {
-					if (this.isNotFoundError(err)) continue;
+					if (this.isNotFoundError(err)) return void 0;
 					throw err;
 				}
-			}
-			token = list.nextToken;
-		} while (token);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.vectorBucketName,
+			attributes: {}
+		};
 	}
 	isNotFoundError(error) {
 		if (error instanceof Error) {
@@ -44179,6 +44251,67 @@ async function confirmPrompt$6(prompt) {
 		rl.close();
 	}
 }
+/**
+* Flat `logicalId -> physicalId` map for ONE CloudFormation stack, or `null`
+* when no stack of that name exists.
+*
+* This is the non-recursive, non-throwing sibling of
+* {@link getCloudFormationResourceTree}, used by `cdkd import`'s auto mode as
+* a best-effort lookup (issue #1128). The distinction matters:
+*
+*   - the tree walk is for `--migrate-from-cloudformation`, where the stack is
+*     known to exist and nested children must be walked so each child's state
+*     can be written and the whole tree retired;
+*   - this one runs speculatively on every auto-mode import, so a missing
+*     stack is the NORMAL case (a cdkd-native stack has no CFn counterpart)
+*     and must return `null` rather than abort the import.
+*
+* NO failure is fatal. The lookup is an OPTIMIZATION: when it cannot answer,
+* the caller falls through to the per-provider lookups, which is exactly the
+* behavior that shipped before this function existed. Throwing would convert a
+* missed improvement into a hard failure — and it would do so precisely for the
+* users least likely to benefit. A cdkd-native stack has no CloudFormation
+* counterpart, so an operator whose IAM policy is scoped to cdkd's actual needs
+* (no `cloudformation:DescribeStackResources`) would see `AccessDenied` abort an
+* import that worked fine the day before.
+*
+* A missing stack is the expected case and logs at debug. Anything else logs a
+* WARN naming the cause, so a permissions gap or a throttle is visible rather
+* than silent — the user learns why the ids were not resolved, and still gets
+* the pre-existing behavior instead of an abort.
+*/
+async function tryGetCloudFormationResourceMap(stackName, cfnClient) {
+	const logger = getLogger();
+	let resp;
+	try {
+		resp = await cfnClient.send(new DescribeStackResourcesCommand({ StackName: stackName }));
+	} catch (err) {
+		if (isStackNotFoundError(err)) {
+			logger.debug(`No CloudFormation stack named '${stackName}'.`);
+			return null;
+		}
+		const reason = err instanceof Error ? err.message : String(err);
+		logger.warn(`Could not read CloudFormation stack '${stackName}' to resolve physical IDs (${reason}). Falling back to per-resource lookup; resources whose physical name CloudFormation generated may be reported as not found. Grant cloudformation:DescribeStackResources, or pass --resource <LogicalId>=<physicalId> for those resources.`);
+		return null;
+	}
+	const resources = /* @__PURE__ */ new Map();
+	for (const r of resp.StackResources ?? []) {
+		if (!r.LogicalResourceId || !r.PhysicalResourceId) continue;
+		resources.set(r.LogicalResourceId, r.PhysicalResourceId);
+	}
+	return resources;
+}
+/**
+* CloudFormation reports an unknown stack as a `ValidationError` whose message
+* carries "does not exist" — there is no dedicated exception type to catch.
+* Matching the message is therefore required, but it is kept narrow so an
+* unrelated ValidationError (a malformed stack name, say) still surfaces.
+*/
+function isStackNotFoundError(err) {
+	const name = err?.name;
+	const message = err?.message ?? "";
+	return name === "ValidationError" && /does not exist/i.test(message);
+}
 
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
@@ -51905,6 +52038,21 @@ async function importCommand(stackArg, options) {
 		}
 		const selectiveMode = overrides.size > 0 && !options.auto && !options.migrateFromCloudformation;
 		if (selectiveMode) logger.info(`Selective mode: only importing the ${overrides.size} resource(s) you listed (${[...overrides.keys()].join(", ")}). Pass --auto to also tag-import the rest.`);
+		if (!selectiveMode && !migrationCfnStackName) {
+			const cfnResources = await tryGetCloudFormationResourceMap(stackInfo.stackName, awsClients.cloudFormation);
+			if (cfnResources) {
+				let derived = 0;
+				for (const [logicalId, physicalId] of cfnResources) {
+					if (!templateLogicalIds.has(logicalId)) continue;
+					if (template.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") continue;
+					if (overrides.has(logicalId)) continue;
+					overrides.set(logicalId, physicalId);
+					derived++;
+				}
+				if (derived > 0) logger.info(`Resolved ${derived} physical ID(s) from CloudFormation stack '${stackInfo.stackName}'. To adopt AND retire that stack, use --migrate-from-cloudformation.`);
+				else logger.debug(`CloudFormation stack '${stackInfo.stackName}' contributed no new physical IDs.`);
+			} else logger.debug(`No CloudFormation stack named '${stackInfo.stackName}' — resolving physical IDs per provider.`);
+		}
 		const existingResult = await stateBackend.getState(stackInfo.stackName, targetRegion);
 		const existingState = existingResult?.state ?? null;
 		const existingEtag = existingResult?.etag;
@@ -62172,7 +62320,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());