@go-to-k/cdkd 0.280.36 → 0.280.38

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-BcorBRVN.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-B3a5MhON.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DeR16ts4.js";
+import { t as ASGProvider } from "./asg-provider-CVra7Nuk.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -37371,6 +37371,55 @@ var AppSyncProvider = class {
 //#endregion
 //#region src/provisioning/providers/glue-provider.ts
 /**
+* Read a template-borne value that is about to be forwarded to a Glue read
+* API as a string.
+*
+* `import()` runs against the RAW template, where `substituteOverrideRefs`
+* has resolved only the `Ref`s whose target is in the overrides map — a
+* pseudo parameter is never in that map, so `CatalogId: {Ref: AWS::AccountId}`
+* (what `@aws-cdk/aws-glue-alpha` renders for an environment-agnostic stack)
+* survives as an OBJECT. A bare `as string` cast then hands that object to
+* `GetTable` / `GetDatabase` as if it were an id. Dropping it instead matches
+* the API default (the caller's own account), which is what the intrinsic
+* would have resolved to anyway.
+*/
+function importableString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function resolveTableIdentity(input) {
+	const { knownPhysicalId, templateDatabaseName, templateTableName } = input;
+	let databaseName;
+	let tableName;
+	if (knownPhysicalId === void 0) {
+		databaseName = templateDatabaseName;
+		tableName = templateTableName;
+	} else if (knownPhysicalId.includes("|")) {
+		const parts = knownPhysicalId.split("|");
+		if (parts.length !== 2) return {
+			ok: false,
+			reason: "pipe-in-name"
+		};
+		databaseName = parts[0] || void 0;
+		tableName = parts[1] || void 0;
+	} else {
+		databaseName = templateDatabaseName;
+		tableName = importableString(knownPhysicalId);
+	}
+	if (databaseName === void 0 || tableName === void 0) return {
+		ok: false,
+		reason: knownPhysicalId === void 0 ? "unidentified" : "unpairable"
+	};
+	if (databaseName.includes("|") || tableName.includes("|")) return {
+		ok: false,
+		reason: "pipe-in-name"
+	};
+	return {
+		ok: true,
+		databaseName,
+		tableName
+	};
+}
+/**
 * SDK Provider for AWS Glue resources
 *
 * Supports:
@@ -38000,8 +38049,8 @@ var GlueProvider = class {
 		}
 	}
 	async importDatabase(input) {
-		const explicitName = input.knownPhysicalId ?? input.properties["DatabaseInput"]?.["Name"];
-		const catalogId = input.properties["CatalogId"];
+		const explicitName = input.knownPhysicalId ?? importableString(input.properties["DatabaseInput"]?.["Name"]);
+		const catalogId = importableString(input.properties["CatalogId"]);
 		if (explicitName) try {
 			await this.getClient().send(new GetDatabaseCommand({
 				Name: explicitName,
@@ -38018,42 +38067,42 @@ var GlueProvider = class {
 		return null;
 	}
 	async importTable(input) {
-		const databaseName = input.properties["DatabaseName"];
-		const templateTableName = input.properties["TableInput"]?.["Name"];
-		const catalogId = input.properties["CatalogId"];
-		if (input.knownPhysicalId) {
-			const [dbName, tName] = input.knownPhysicalId.split("|");
-			if (!dbName || !tName) return null;
-			try {
-				await this.getClient().send(new GetTableCommand({
-					DatabaseName: dbName,
-					Name: tName,
-					...catalogId && { CatalogId: catalogId }
-				}));
-				return {
-					physicalId: input.knownPhysicalId,
-					attributes: {}
-				};
-			} catch (err) {
-				if (err instanceof EntityNotFoundException) return null;
-				throw err;
+		const databaseName = importableString(input.properties["DatabaseName"]);
+		const tableInput = input.properties["TableInput"];
+		const templateTableName = importableString(tableInput?.["Name"]);
+		const catalogId = importableString(input.properties["CatalogId"]);
+		const identity = resolveTableIdentity({
+			knownPhysicalId: input.knownPhysicalId,
+			templateDatabaseName: databaseName,
+			templateTableName
+		});
+		if (!identity.ok) {
+			switch (identity.reason) {
+				case "pipe-in-name":
+					this.logger.warn(`AWS::Glue::Table ${input.logicalId}: cannot be imported because a name contains '|', which cdkd currently uses as the separator in this type's physical id (<databaseName>|<tableName>). Adopting it would record an id cdkd cannot decode back to the same table. CloudFormation manages such a table fine; this is a cdkd limitation tracked in https://github.com/go-to-k/cdkd/issues/1672. Until it is lifted, rename the table or database to omit '|', or manage this resource outside cdkd.`);
+					break;
+				case "unpairable":
+					this.logger.warn(`AWS::Glue::Table ${input.logicalId}: cannot resolve a database for physical id '${input.knownPhysicalId}'. ` + (input.knownPhysicalId === "" ? `The supplied physical id is empty. ` : "The template's DatabaseName is absent or is an unresolved intrinsic, so the bare table name cannot be paired. ") + `Pass the composite form instead: --resource '${input.logicalId}=<databaseName>|<tableName>' (quote it — '|' is a shell pipe).`);
+					break;
+				case "unidentified": break;
 			}
+			return null;
 		}
-		if (databaseName && templateTableName) try {
+		const { databaseName: dbName, tableName: tName } = identity;
+		try {
 			await this.getClient().send(new GetTableCommand({
-				DatabaseName: databaseName,
-				Name: templateTableName,
+				DatabaseName: dbName,
+				Name: tName,
 				...catalogId && { CatalogId: catalogId }
 			}));
 			return {
-				physicalId: `${databaseName}|${templateTableName}`,
+				physicalId: `${dbName}|${tName}`,
 				attributes: {}
 			};
 		} catch (err) {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		return null;
 	}
 };
 /**
@@ -61130,9 +61179,12 @@ async function importCommand(stackArg, options) {
 			useCdkBootstrapAssets: resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets),
 			suppressLegacyNotice: true
 		})(stackInfo.assetManifestPath, targetRegion);
+		let stateTemplate = stackInfo.template;
 		if (assetRedirect) {
+			stateTemplate = structuredClone(stackInfo.template);
 			const rewritten = rewriteTemplateAssetReferences(stackInfo.template, assetRedirect);
 			logger.debug(`Rewrote ${rewritten} asset reference(s) to cdkd asset storage in template of stack ${stackInfo.stackName}`);
+			if (rewritten > 0) logger.info(`Note: ${rewritten} asset reference(s) in stack ${stackInfo.stackName} are recorded in state at their pre-rewrite (CDK bootstrap) values, so the next 'cdkd deploy' repoints any resource that still holds them to cdkd asset storage.`);
 		}
 		const overrides = parseResourceOverrides(options.resource, options.resourceMapping, options.resourceMappingInline);
 		if (overrides.size > 0) logger.debug(`User-supplied physical IDs: ${[...overrides.keys()].join(", ")}`);
@@ -61246,8 +61298,8 @@ async function importCommand(stackArg, options) {
 					return;
 				}
 			}
-			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, template, existingState, selectiveMode);
-			await resolveImportedProperties(stackState, template, targetRegion, stateBackend, logger);
+			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
+			await resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger);
 			await captureObservedForImportedResources(stackState, providerRegistry, logger);
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
@@ -61904,7 +61956,12 @@ async function importNestedStackChildrenRecursive(args) {
 		if (!childTemplatePath) throw new Error(`cdkd import --migrate-from-cloudformation: missing nested-template path for '${childLogicalId}' under parent '${parentStackName}' — validateNestedStackShape should have rejected this; please file a bug.`);
 		logger.info(`Adopting nested stack '${childLogicalId}' as cdkd stack '${childStackName}' (${childRegion})...`);
 		const childTemplate = readNestedChildTemplate(childTemplatePath, childLogicalId);
-		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
+		let childStateTemplate = childTemplate;
+		if (assetRedirect) {
+			childStateTemplate = structuredClone(childTemplate);
+			const childRewritten = rewriteTemplateAssetReferences(childTemplate, assetRedirect);
+			if (childRewritten > 0) logger.info(`Note: ${childRewritten} asset reference(s) in nested stack ${childStackName} are recorded in state at their pre-rewrite (CDK bootstrap) values, so the next 'cdkd deploy' repoints any resource that still holds them to cdkd asset storage.`);
+		}
 		await lockManager.acquireLock(childStackName, childRegion, lockOwner, "import");
 		try {
 			const childResources = collectImportableResources(childTemplate);
@@ -61938,11 +61995,11 @@ async function importNestedStackChildrenRecursive(args) {
 				});
 				rows.push(outcome);
 			}
-			const childStackState = buildStackState(childStackName, childRegion, rows, templateParser, childTemplate, null, false);
+			const childStackState = buildStackState(childStackName, childRegion, rows, templateParser, childStateTemplate, null, false);
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
 			childStackState.parentRegion = parentRegion;
-			await resolveImportedProperties(childStackState, childTemplate, childRegion, stateBackend, logger);
+			await resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger);
 			await captureObservedForImportedResources(childStackState, providerRegistry, logger);
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
@@ -71517,7 +71574,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.36");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.38");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;