@go-to-k/cdkd 0.280.46 → 0.281.0

package/dist/{deploy-engine-E_JV4UqE.js → deploy-engine-Bebl98bx.js}

@@ -9,7 +9,7 @@ import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaC
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { CreateSnapshotCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
 import { DescribeTableCommand, DynamoDBClient } from "@aws-sdk/client-dynamodb";
-import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeTypeCommand, GetTemplateCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
+import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStacksCommand, DescribeTypeCommand, GetTemplateCommand, ListExportsCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, GetRestApiCommand } from "@aws-sdk/client-api-gateway";
 import { DescribeApiDestinationCommand, DescribeConnectionCommand, EventBridgeClient } from "@aws-sdk/client-eventbridge";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
@@ -10687,6 +10687,34 @@ var IntrinsicFunctionResolver = class {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
 	strictGetAtt;
+	cfnFallback;
+	/**
+	* Per-region CloudFormation clients for the cross-stack fallback
+	* lookups (issue #1697). Keyed by region because `Fn::GetStackOutput`
+	* may target a region different from the consumer's deploy region.
+	*/
+	cfnClients = {};
+	/**
+	* Memoized full `ListExports` listing for the `Fn::ImportValue`
+	* fallback (issue #1697 review). Without it, EVERY cdkd-miss import
+	* re-paginates the whole region's export list — a deploy consuming N
+	* values from CFn producers pays N full walks and exposes itself to
+	* ListExports throttling. Resolver instances are per-deploy (the
+	* engine constructs one per stack), so the cache lifetime matches the
+	* exports-index philosophy: stable within a deploy, fresh across
+	* deploys. FAILED fetches are not cached (the rejection handler
+	* clears the slot) so a transient throttle does not poison the rest
+	* of the deploy's lookups.
+	*/
+	cfnExportsPromise;
+	/**
+	* Memoized per-(region, stack) `DescribeStacks` outputs for the
+	* `Fn::GetStackOutput` fallback (issue #1697 review) — a stack
+	* referencing the same CFn producer N times pays one call. Successful
+	* lookups (including the definitive "stack does not exist" miss) are
+	* cached; lookup FAILURES are evicted so they are retried.
+	*/
+	cfnStackOutputsCache = /* @__PURE__ */ new Map();
 	/**
 	* Number of unknown-attribute resolutions that fell back to the physical
 	* ID (the warn path) since construction / the last
@@ -10709,6 +10737,7 @@ var IntrinsicFunctionResolver = class {
 	constructor(region, options) {
 		this.resolverRegion = region || process.env["AWS_REGION"] || "us-east-1";
 		this.strictGetAtt = options?.strictGetAtt ?? false;
+		this.cfnFallback = options?.cfnFallback ?? true;
 	}
 	/** Unknown-attribute physicalId fallbacks recorded since the last reset. */
 	getPhysicalIdFallbackCount() {
@@ -11604,7 +11633,113 @@ var IntrinsicFunctionResolver = class {
 				continue;
 			}
 		}
-		throw new Error(`Fn::ImportValue: export '${exportName}' not found in any stack. Searched ${allStacks.length} state record(s). Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
+		if (this.cfnFallback) {
+			const cfnExport = await this.lookupCfnExport(exportName);
+			if (cfnExport) {
+				this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(cfnExport.value)} (from CloudFormation exports${cfnExport.exportingStackId ? `; exporting stack: ${cfnExport.exportingStackId}` : ""}; weak reference — producer is not cdkd-managed)`);
+				return cfnExport.value;
+			}
+		}
+		throw new Error(`Fn::ImportValue: export '${exportName}' not found in any stack. Searched ${allStacks.length} cdkd state record(s)${this.cfnFallback ? " and CloudFormation exports" : ""}. Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
+	}
+	/**
+	* CloudFormation `ListExports` fallback lookup for `Fn::ImportValue`
+	* (issue #1697). Searches the consumer's deploy region (CFn exports are
+	* region-scoped, same as cdkd's `Fn::ImportValue` semantics).
+	*
+	* Returns `undefined` both when the export does not exist AND when the
+	* lookup itself failed (a warning is logged for the latter — e.g. the
+	* caller's credentials lack `cloudformation:ListExports`), so the caller
+	* surfaces its own not-found error either way. Graceful degradation is
+	* deliberate: without this fallback the deploy would have failed with
+	* the same not-found error anyway.
+	*/
+	async lookupCfnExport(exportName) {
+		let listing = this.cfnExportsPromise;
+		if (!listing) {
+			listing = this.fetchAllCfnExports();
+			this.cfnExportsPromise = listing;
+			listing.catch(() => {
+				if (this.cfnExportsPromise === listing) this.cfnExportsPromise = void 0;
+			});
+		}
+		try {
+			const exports = await listing;
+			for (const exp of exports) if (exp.Name === exportName && exp.Value !== void 0) return {
+				value: exp.Value,
+				...exp.ExportingStackId && { exportingStackId: exp.ExportingStackId }
+			};
+			return;
+		} catch (error) {
+			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${exportName}' (region ${this.resolverRegion}): ${error instanceof Error ? error.message : String(error)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			return;
+		}
+	}
+	/** Full paginated ListExports walk backing {@link lookupCfnExport}'s memo. */
+	async fetchAllCfnExports() {
+		const client = this.getCfnClient(this.resolverRegion);
+		const exports = [];
+		let nextToken;
+		do {
+			const res = await client.send(new ListExportsCommand({ NextToken: nextToken }));
+			exports.push(...res.Exports ?? []);
+			nextToken = res.NextToken;
+		} while (nextToken);
+		return exports;
+	}
+	/**
+	* CloudFormation `DescribeStacks` fallback lookup for
+	* `Fn::GetStackOutput` (issue #1697). Region-pinned because the
+	* intrinsic may target a region different from the consumer's.
+	*
+	* Returns the stack's outputs map when the CFn stack exists;
+	* `undefined` when it does not exist OR the lookup failed (a warning is
+	* logged for non-not-found failures). Same graceful-degradation
+	* contract as {@link lookupCfnExport}.
+	*/
+	async lookupCfnStackOutputs(stackName, region) {
+		const cacheKey = `${region}\0${stackName}`;
+		let fetch = this.cfnStackOutputsCache.get(cacheKey);
+		if (!fetch) {
+			fetch = this.fetchCfnStackOutputs(stackName, region);
+			this.cfnStackOutputsCache.set(cacheKey, fetch);
+			fetch.catch(() => {
+				if (this.cfnStackOutputsCache.get(cacheKey) === fetch) this.cfnStackOutputsCache.delete(cacheKey);
+			});
+		}
+		try {
+			return await fetch;
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${stackName}' (${region}): ${message}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			return;
+		}
+	}
+	/**
+	* Single DescribeStacks read backing {@link lookupCfnStackOutputs}'s memo.
+	* Resolves to the outputs map, `undefined` for the definitive
+	* does-not-exist miss, and REJECTS on any other failure.
+	*/
+	async fetchCfnStackOutputs(stackName, region) {
+		try {
+			const stack = (await this.getCfnClient(region).send(new DescribeStacksCommand({ StackName: stackName }))).Stacks?.[0];
+			if (!stack) return void 0;
+			const outputs = {};
+			for (const out of stack.Outputs ?? []) if (out.OutputKey && out.OutputValue !== void 0) outputs[out.OutputKey] = out.OutputValue;
+			return outputs;
+		} catch (error) {
+			if (error instanceof Error && error.name === "ValidationError" && /does not exist/i.test(error.message)) return;
+			throw error;
+		}
+	}
+	/** Lazily-constructed per-region CloudFormation client (issue #1697). */
+	getCfnClient(region) {
+		let client = this.cfnClients[region];
+		if (!client) {
+			client = new CloudFormationClient({ region });
+			this.cfnClients[region] = client;
+		}
+		return client;
 	}
 	/**
 	* Push a resolved `Fn::ImportValue` into the consumer's recorded-imports
@@ -11691,7 +11826,21 @@ var IntrinsicFunctionResolver = class {
 		if (!roleArn && context.stackName && context.stackName === stackName && region === this.resolverRegion) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${stackName}' in the same region '${region}'`);
 		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
 		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
-		if (!stateData) throw new Error(`Fn::GetStackOutput: stack '${stackName}' not found in region '${region}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. Make sure the producer stack has been deployed via cdkd.`);
+		if (!stateData) {
+			if (!roleArn && this.cfnFallback) {
+				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region);
+				if (cfnOutputs) {
+					if (!(outputName in cfnOutputs)) {
+						const available = Object.keys(cfnOutputs).join(", ") || "(none)";
+						throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in CloudFormation stack '${stackName}' (${region}). Available outputs: ${available}`);
+					}
+					const value = cfnOutputs[outputName];
+					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName} -> ${JSON.stringify(value)} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
+					return value;
+				}
+			}
+			throw new Error(`Fn::GetStackOutput: stack '${stackName}' not found in region '${region}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+		}
 		const outputs = stateData.state.outputs ?? {};
 		if (!(outputName in outputs)) {
 			const available = Object.keys(outputs).join(", ") || "(none)";
@@ -12915,7 +13064,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DGHuyUA8.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BSx4Vrth.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -19791,7 +19940,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.280.46";
+	return "0.281.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -20410,7 +20559,10 @@ var DeployEngine = class {
 		this.options = options;
 		this.stackRegion = stackRegion;
 		this.exportIndexStore = exportIndexStore;
-		this.resolver = new IntrinsicFunctionResolver(stackRegion, { strictGetAtt: options.strictGetAtt ?? false });
+		this.resolver = new IntrinsicFunctionResolver(stackRegion, {
+			strictGetAtt: options.strictGetAtt ?? false,
+			cfnFallback: options.cfnFallback ?? true
+		});
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
 		this.options.lockTimeout = options.lockTimeout ?? 300 * 1e3;
@@ -21957,4 +22109,4 @@ var DeployEngine = class {
 
 //#endregion
 export { requireConfigArray as $, expectedOwnerParam as $t, green as A, withErrorHandling as An, getDockerCmd as At, slowCcOperationTimeoutMs as B, resolveAutoAssetStorage as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, StackHasActiveImportsError as Cn, ensureAssetStorage as Ct, bold as D, formatError as Dn, validateContainerRepoName as Dt, formatResourceLine as E, SynthesisError as En, validateAssetBucketName as Et, clearOnUpdateRemoval as F, Synthesizer as Ft, refStateLookupFromResource as G, resolveUseCdkBootstrapAssets as Gt, isTerminationProtectionPropagationError as H, resolveSkipPrefix as Ht, ProviderRegistry as I, synthesisStatusMessage as It, resolveExplicitPhysicalId as J, CFN_TEMPLATE_BODY_LIMIT as Jt, WAFv2WebACLProvider as K, stateBucketExistenceConfirmed as Kt, findActionableSilentDrops as L, getDefaultStateBucketName as Lt, yellow as M, runDockerStreaming as Mt, IAMRoleProvider as N, AssetManifestLoader as Nt, cyan as O, isCdkdError as On, buildDockerImage as Ot, collectInlinePolicyNamesManagedBySiblings as P, getDockerImageBySourceHash as Pt, replayWarn as Q, uploadCfnTemplate as Qt, findSilentDropProperties as R, getLegacyStateBucketName as Rt, extractDeploymentEventError as S, ResourceUpdateNotSupportedError as Sn, BOOTSTRAP_MARKER_PREFIX as St, renderStatefulReason as T, StateError as Tn, parseBootstrapMarker as Tt, IntrinsicFunctionResolver as U, resolveStateBucketWithDefault as Ut, disableInstanceApiTermination as V, resolveCaptureObservedState as Vt, cfnRefValueFromPhysicalId as W, resolveStateBucketWithDefaultAndSource as Wt, configStringRefusal as X, MIGRATE_TMP_PREFIX as Xt, assertRegionMatch as Y, CFN_TEMPLATE_URL_LIMIT as Yt, readConfigString as Z, findLargeInlineResources as Zt, createPreDeleteFinalSnapshot as _, MissingCdkCliError as _n, buildAssetRedirectMap as _t, DeploymentEventsStore as a, getAwsClients as an, withRetry as at, unsupportedFinalSnapshotError as b, ProvisioningError as bn, rewriteTemplateAssetReferences as bt, replayFailedOperations as c, AssetError as cn, DagBuilder as ct, IMPLICIT_DELETE_DEPENDENCIES as d, DependencyError as dn, S3StateBackend as dt, AssemblyReader as en, requireConfigObject as et, computeImplicitDeleteEdges as f, DeployCancelledError as fn, rebuildClientForBucketRegion as ft, ccRoutedFinalSnapshotError as g, LockError as gn, WorkGraph as gt, buildFinalSnapshotIdentifier as h, LocalStartServiceError as hn, stringifyValue as ht, DeploymentEventsReader as i, AwsClients as in, describeTypeWithThrottleRetry as it, red as j, __exportAll as jn, runDockerForeground as jt, gray as k, normalizeAwsError as kn, formatDockerLoginError as kt, replayRollback as l, CdkdError as ln, TemplateParser as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalMigrateError as mn, AssetPublisher as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, clearBucketRegionCache as nn, applyRoleArnIfSet as nt, planFailedOps as o, resetAwsClients as on, isRetryableTransientError as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalInvokeBuildError as pn, shouldRetainResource as pt, normalizeAwsTagsToCfn as q, warnDeprecatedNoPrefixCliFlag as qt, DeployEngine as r, resolveBucketRegion as rn, DiffCalculator as rt, planRollback as s, setAwsClients as sn, isThrottlingError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as tn, requireConfigString as tt, withResourceDeadline as u, ConfigError as un, LockManager as ut, isFinalSnapshotError as v, NestedStackChildDirectDestroyError as vn, createAssetRedirectResolver as vt, isStatefulRecreateTargetSync as w, StackTerminationProtectionError as wn, getBootstrapMarkerKey as wt, makeCanonicalizePropertiesFn as x, ResourceTimeoutError as xn, AssetModeResolver as xt, refusesFinalSnapshot as y, PartialFailureError as yn, loadPublishableAssetManifest as yt, CloudControlProvider as z, resolveApp as zt };
-//# sourceMappingURL=deploy-engine-E_JV4UqE.js.map
+//# sourceMappingURL=deploy-engine-Bebl98bx.js.map