@go-to-k/cdkd 0.281.11 → 0.281.13

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as replayWarn, $t as uploadCfnTemplate, A as green, An as normalizeAwsError, At as formatDockerLoginError, B as slowCcOperationTimeoutMs, Bt as resolveApp, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceUpdateNotSupportedError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as getDockerImageBySourceHash, G as getAccountInfo, Gt as resolveStateBucketWithDefaultAndSource, H as isTerminationProtectionPropagationError, Ht as resolveCaptureObservedState, I as ProviderRegistry, It as Synthesizer, J as normalizeAwsTagsToCfn, Jt as warnDeprecatedNoPrefixCliFlag, K as refStateLookupFromResource, Kt as resolveUseCdkBootstrapAssets, L as findActionableSilentDrops, Lt as synthesisStatusMessage, M as yellow, Mt as runDockerForeground, N as IAMRoleProvider, Nt as runDockerStreaming, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as AssetManifestLoader, Q as readConfigString, Qt as findLargeInlineResources, R as findSilentDropProperties, Rt as getDefaultStateBucketName, S as extractDeploymentEventError, Sn as ResourceTimeoutError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackTerminationProtectionError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveSkipPrefix, V as disableInstanceApiTermination, Vt as resolveAutoAssetStorage, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefault, X as assertRegionMatch, Xt as CFN_TEMPLATE_URL_LIMIT, Y as resolveExplicitPhysicalId, Yt as CFN_TEMPLATE_BODY_LIMIT, Z as configStringRefusal, Zt as MIGRATE_TMP_PREFIX, _ as createPreDeleteFinalSnapshot, _t as WorkGraph, a as DeploymentEventsStore, an as AwsClients, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as PartialFailureError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as setAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dt as LockManager, en as expectedOwnerParam, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalStartServiceError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalMigrateError, ht as AssetPublisher, i as DeploymentEventsReader, in as resolveBucketRegion, it as DiffCalculator, j as red, jn as withErrorHandling, jt as getDockerCmd, k as gray, kt as buildDockerImage, l as replayRollback, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalInvokeBuildError$1, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as processStackMessages, nt as requireConfigString, o as planFailedOps, on as getAwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as DeployCancelledError, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as stateBucketExistenceConfirmed, r as DeployEngine, rt as applyRoleArnIfSet, s as planRollback, sn as resetAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssemblyReader, tt as requireConfigObject, u as withResourceDeadline, un as CdkdError, ut as TemplateParser, v as isFinalSnapshotError, vn as MissingCdkCliError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as StackHasActiveImportsError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as ProvisioningError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as NestedStackChildDirectDestroyError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getLegacyStateBucketName } from "./deploy-engine-BErTJjXl.js";
+import { $ as replayWarn, $t as uploadCfnTemplate, A as green, An as normalizeAwsError, At as formatDockerLoginError, B as slowCcOperationTimeoutMs, Bt as resolveApp, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceUpdateNotSupportedError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as getDockerImageBySourceHash, G as getAccountInfo, Gt as resolveStateBucketWithDefaultAndSource, H as isTerminationProtectionPropagationError, Ht as resolveCaptureObservedState, I as ProviderRegistry, It as Synthesizer, J as normalizeAwsTagsToCfn, Jt as warnDeprecatedNoPrefixCliFlag, K as refStateLookupFromResource, Kt as resolveUseCdkBootstrapAssets, L as findActionableSilentDrops, Lt as synthesisStatusMessage, M as yellow, Mt as runDockerForeground, N as IAMRoleProvider, Nt as runDockerStreaming, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as AssetManifestLoader, Q as readConfigString, Qt as findLargeInlineResources, R as findSilentDropProperties, Rt as getDefaultStateBucketName, S as extractDeploymentEventError, Sn as ResourceTimeoutError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackTerminationProtectionError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveSkipPrefix, V as disableInstanceApiTermination, Vt as resolveAutoAssetStorage, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefault, X as assertRegionMatch, Xt as CFN_TEMPLATE_URL_LIMIT, Y as resolveExplicitPhysicalId, Yt as CFN_TEMPLATE_BODY_LIMIT, Z as configStringRefusal, Zt as MIGRATE_TMP_PREFIX, _ as createPreDeleteFinalSnapshot, _t as WorkGraph, a as DeploymentEventsStore, an as AwsClients, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as PartialFailureError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as setAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dt as LockManager, en as expectedOwnerParam, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalStartServiceError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalMigrateError, ht as AssetPublisher, i as DeploymentEventsReader, in as resolveBucketRegion, it as DiffCalculator, j as red, jn as withErrorHandling, jt as getDockerCmd, k as gray, kt as buildDockerImage, l as replayRollback, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalInvokeBuildError$1, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as processStackMessages, nt as requireConfigString, o as planFailedOps, on as getAwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as DeployCancelledError, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as stateBucketExistenceConfirmed, r as DeployEngine, rt as applyRoleArnIfSet, s as planRollback, sn as resetAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssemblyReader, tt as requireConfigObject, u as withResourceDeadline, un as CdkdError, ut as TemplateParser, v as isFinalSnapshotError, vn as MissingCdkCliError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as StackHasActiveImportsError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as ProvisioningError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as NestedStackChildDirectDestroyError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getLegacyStateBucketName } from "./deploy-engine-BWM9RxAW.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-AKp6xuP0.js";
+import { t as ASGProvider } from "./asg-provider-CsY1ahKM.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12859,7 +12859,7 @@ var DynamoDBTableProvider = class {
 			let billingModeUnusable = false;
 			const requestedBillingMode = properties["BillingMode"] === void 0 ? "PROVISIONED" : requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", { onUnusable: (message) => {
 				billingModeUnusable = true;
-				this.logger.warn(`${message} The table's current billing mode (${prevBillingMode}) is kept for this update rather than flipped to the default.`);
+				this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: ${message} The mode this update compared against (${prevBillingMode}) is kept rather than flipped to the default.`);
 			} });
 			const billingMode = billingModeUnusable ? prevBillingMode : requestedBillingMode;
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
@@ -37050,8 +37050,9 @@ var AppSyncProvider = class {
 	* `CloudControlProvider` uses for its own ARN reconstruction, so this costs
 	* at most one `GetCallerIdentity` per deploy.
 	*/
-	async buildAppSyncArn(suffix) {
-		const accountInfo = await getAccountInfo(this.providerRegion ?? await this.getClient().config.region());
+	async buildAppSyncArn(suffix, regionOverride) {
+		const accountInfo = await getAccountInfo(regionOverride ?? this.providerRegion ?? await this.getClient().config.region());
+		if (accountInfo.fabricated) throw new Error(`cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so an ARN for ${suffix} would be fabricated`);
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
 		return `arn:${partition}:appsync:${accountInfo.region}:${accountInfo.accountId}:${suffix}`;
 	}
@@ -37098,25 +37099,45 @@ var AppSyncProvider = class {
 	* Returns `undefined` for an id whose arity does not match the type — a
 	* record that malformed cannot be healed by guessing, and carrying the
 	* existing attributes forward is the safe answer.
+	*
+	* `omitArnOnFailure` is for the IMPORT path only (issue #1728 review). The
+	* non-ARN keys — `Name`, `ApiKey` — are split straight out of the physical id
+	* and involve no account at all, so dropping them because the ACCOUNT could
+	* not be resolved would fail `Fn::GetAtt Name` for a reason that has nothing
+	* to do with it. Import has no prior record to preserve, so keeping what it
+	* can beats keeping nothing. `update()` must NOT pass it: there a partial map
+	* replaces the record's wholesale and would delete a good ARN.
 	*/
-	async childRefAttributes(resourceType, physicalId) {
+	async childRefAttributes(resourceType, physicalId, regionOverride, omitArnOnFailure = false) {
 		const parts = physicalId.split("|");
+		const arn = async (suffix) => {
+			try {
+				return await this.buildAppSyncArn(suffix, regionOverride);
+			} catch (error) {
+				if (!omitArnOnFailure) throw error;
+				this.logger.warn(`Imported ${resourceType} (${physicalId}) but its ARN attribute was NOT recorded: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+				return;
+			}
+		};
 		if (resourceType === "AWS::AppSync::DataSource" && parts.length === 2) {
 			const [apiId, name] = parts;
+			const dataSourceArn = await arn(`apis/${apiId}/datasources/${name}`);
 			return {
-				DataSourceArn: await this.buildAppSyncArn(`apis/${apiId}/datasources/${name}`),
+				...dataSourceArn && { DataSourceArn: dataSourceArn },
 				Name: name
 			};
 		}
 		if (resourceType === "AWS::AppSync::Resolver" && parts.length === 3) {
 			const [apiId, typeName, fieldName] = parts;
-			return { ResolverArn: await this.buildAppSyncArn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`) };
+			const resolverArn = await arn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`);
+			return { ...resolverArn && { ResolverArn: resolverArn } };
 		}
 		if (resourceType === "AWS::AppSync::ApiKey" && parts.length === 2) {
 			const [apiId, apiKeyId] = parts;
+			const apiKeyArn = await arn(`apis/${apiId}/apikey/${apiKeyId}`);
 			return {
 				ApiKey: apiKeyId,
-				Arn: await this.buildAppSyncArn(`apis/${apiId}/apikey/${apiKeyId}`)
+				...apiKeyArn && { Arn: apiKeyArn }
 			};
 		}
 	}
@@ -37124,9 +37145,21 @@ var AppSyncProvider = class {
 	* The no-replacement update result for a child type, carrying the healed
 	* attribute set (issue #1681). Reporting none is still the correct answer for
 	* an unhealable id — the engine then carries the existing attributes forward.
+	*
+	* An ARN that cannot be built takes the SAME answer, and it must (issue #1728
+	* review). An `update()` attribute map REPLACES the record's wholesale, so
+	* reporting a partial set here would DELETE the ARN a previous deploy
+	* correctly recorded; reporting none carries it forward untouched. That is
+	* why this arm differs from the import one below, which has no prior record
+	* to preserve and therefore keeps what it can.
 	*/
 	async childUpdateResult(resourceType, physicalId) {
-		const attributes = await this.childRefAttributes(resourceType, physicalId);
+		let attributes;
+		try {
+			attributes = await this.childRefAttributes(resourceType, physicalId);
+		} catch (error) {
+			this.logger.warn(`Updated ${resourceType} (${physicalId}) but could not rebuild its ARN attribute: ${error instanceof Error ? error.message : String(error)}. The previously recorded attributes are kept.`);
+		}
 		return {
 			physicalId,
 			wasReplaced: false,
@@ -37134,6 +37167,47 @@ var AppSyncProvider = class {
 		};
 	}
 	/**
+	* The child attribute set for an ADOPTED resource (issue #1728).
+	*
+	* `import()` used to record `attributes: {}` for every child type, so a child
+	* adopted via `cdkd import` had no ARN in state and the resolver's
+	* `REF_RETURNS_ARN_FROM_STATE` lookup missed — `Ref` fell back to the raw
+	* compound id, i.e. the pre-#1681 behavior, and `Fn::GetAtt DataSourceArn` /
+	* `ResolverArn` / `Arn` were equally unresolved. The record healed only on the
+	* resource's next UPDATE (#1727), so an imported-and-untouched child stayed
+	* broken indefinitely.
+	*
+	* RECONSTRUCTED rather than read back from AWS. Every segment is already in
+	* the physical id the import receives, `childRefAttributes` is the SAME
+	* mapping `create()` / `update()` use (so the three spellings cannot drift),
+	* and the reconstruction costs one process-cached STS call instead of one
+	* DescribeApi-family call per imported child. A readback would be
+	* authoritative but cannot be more correct for a well-formed id: `import`
+	* adopts a resource in the caller's own account, which is exactly the context
+	* `buildAppSyncArn` derives from.
+	*
+	* Never throws: a failure degrades to `{}` (or to the account-independent
+	* keys — see `omitArnOnFailure`), which is at worst the exact pre-#1728
+	* behavior, because adopting the resource is worth more than its bookkeeping
+	* attribute. `childRefAttributes` already answers `undefined` for a mis-arity
+	* id, which degrades the same way rather than guessing.
+	*
+	* The fabricated-account refusal that makes this honest lives in
+	* `buildAppSyncArn`, not here (issue #1728 review): the UPDATE path rebuilds
+	* the ARN on every in-place update, so an STS blip there would REPLACE a
+	* correct recorded ARN rather than merely fail to write one. Guarding only
+	* this call site would have left the worse path open. The fabrication itself
+	* is issue #1730.
+	*/
+	async childImportAttributes(resourceType, physicalId, region) {
+		try {
+			return await this.childRefAttributes(resourceType, physicalId, region, true) ?? {};
+		} catch (error) {
+			this.logger.warn(`Imported ${resourceType} (${physicalId}) but could not build its ARN attribute: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+			return {};
+		}
+	}
+	/**
 	* Lazy S3 client for the `*S3Location` properties (Resolver
 	* `CodeS3Location` / `RequestMappingTemplateS3Location` /
 	* `ResponseMappingTemplateS3Location`, GraphQLSchema
@@ -38564,13 +38638,16 @@ var AppSyncProvider = class {
 	* real resource (issue #1134); auto-mode import resolves ids from
 	* CloudFormation's `DescribeStackResources` instead. AppSync sub-resources
 	* (`GraphQLSchema`, `DataSource`, `Resolver`, `ApiKey`) are scoped under a
-	* parent `apiId` — explicit-override only.
+	* parent `apiId` — explicit-override only. The three ARN-`Ref` children
+	* additionally record the same attribute set `create()` does, so an adopted
+	* child's `Ref` / `Fn::GetAtt` resolve immediately rather than only after its
+	* first update (issue #1728) — see {@link childImportAttributes}.
 	*/
 	async import(input) {
 		if (input.resourceType !== "AWS::AppSync::GraphQLApi") {
 			if (input.knownPhysicalId) return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: await this.childImportAttributes(input.resourceType, input.knownPhysicalId, input.region)
 			};
 			return null;
 		}
@@ -73513,7 +73590,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.11");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.13");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;