@go-to-k/cdkd 0.281.11 → 0.281.13

package/dist/{deploy-engine-BErTJjXl.js → deploy-engine-BWM9RxAW.js}

@@ -10522,10 +10522,13 @@ const REF_RETURNS_SEGMENT_AT_INDEX = /* @__PURE__ */ new Map([["AWS::Route53::Re
 *
 * Value: the attribute keys to try, in order.
 *
-* Degradation is deliberate and matches the sibling recoveries — an IMPORTED
-* child records `attributes: {}` (`AppSyncProvider.import` returns the physical
-* id only), so the lookup misses and the raw compound id is returned rather
-* than a fabricated ARN.
+* Degradation is deliberate and matches the sibling recoveries: when the
+* attribute is absent the raw compound id is returned rather than a fabricated
+* ARN. Since issue #1728 an IMPORTED child records the same attribute set
+* `create()` does (`AppSyncProvider.childImportAttributes`), so the miss is no
+* longer the normal case for an adopted resource — it is now reached by a
+* record written before #1681/#1728, or by an import whose ARN build failed and
+* warned.
 */
 const REF_RETURNS_ARN_FROM_STATE = /* @__PURE__ */ new Map([
 	["AWS::AppSync::ApiKey", ["Arn"]],
@@ -10722,13 +10725,15 @@ async function getAccountInfo(overrideRegion) {
 	const logger = getLogger().child("IntrinsicFunctionResolver");
 	const stsClient = getAwsClients().sts;
 	try {
-		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account || "123456789012";
+		const response = await stsClient.send(new GetCallerIdentityCommand({}));
+		const accountId = response.Account || "123456789012";
 		const region = overrideRegion || process.env["AWS_REGION"] || "us-east-1";
 		const partition = "aws";
 		cachedAccountInfo = {
 			accountId,
 			region,
-			partition
+			partition,
+			...response.Account ? {} : { fabricated: true }
 		};
 		logger.debug(`Retrieved AWS account info: ${accountId}, ${region}, ${partition}`);
 		if (overrideRegion && overrideRegion !== region) return {
@@ -10741,7 +10746,8 @@ async function getAccountInfo(overrideRegion) {
 		cachedAccountInfo = {
 			accountId: process.env["AWS_ACCOUNT_ID"] || "123456789012",
 			region: overrideRegion || process.env["AWS_REGION"] || "us-east-1",
-			partition: "aws"
+			partition: "aws",
+			...process.env["AWS_ACCOUNT_ID"] ? {} : { fabricated: true }
 		};
 		return cachedAccountInfo;
 	}
@@ -11111,6 +11117,7 @@ var IntrinsicFunctionResolver = class {
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const flatValue = resource.attributes[attributeName];
 			if (flatValue !== void 0) {
+				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId);
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
 				return flatValue;
 			}
@@ -11133,6 +11140,40 @@ var IntrinsicFunctionResolver = class {
 		return value;
 	}
 	/**
+	* Refuse a pre-#1681 PLACEHOLDER ARN served from the cached attribute map
+	* (issue #1729) — the `Fn::GetAtt` half of the guard
+	* {@link cfnRefValueFromPhysicalId} applies to `Ref`.
+	*
+	* `Ref` and `Fn::GetAtt` read the SAME recorded attribute, and #1681 treated
+	* only the `Ref` side: for an `AWS::AppSync::*` child created by a pre-#1681
+	* binary, `{"Fn::GetAtt": ["MyDataSource", "DataSourceArn"]}` still resolved
+	* to `arn:aws:appsync:*:*:apis/.../datasources/...` — structurally valid,
+	* unusable, and indistinguishable downstream from a real ARN.
+	*
+	* Scoped to the {@link REF_RETURNS_ARN_FROM_STATE} types AND their declared
+	* ARN attribute names, the narrowest form of the fix: a wildcard-bearing ARN
+	* is only KNOWN to be a placeholder for these three attributes, and some
+	* other type could legitimately cache an ARN-shaped string carrying a `*` in
+	* a position {@link isPlaceholderArn} inspects. Every other attribute of
+	* these same types (`AWS::AppSync::ApiKey`'s `ApiKey`,
+	* `AWS::AppSync::DataSource`'s `Name`) is untouched.
+	*
+	* THROWS rather than degrading, which is where it diverges from the `Ref`
+	* half, and deliberately: `Ref`'s fallback is the raw compound id, whereas
+	* the value here is requested under an ARN-suffixed attribute name, so
+	* handing back a non-ARN would be exactly the shape mismatch
+	* {@link guardedPhysicalIdFallback} already hard-fails on (the #1103 class —
+	* a green deploy that ships a wrong value into stack Outputs / an IAM
+	* policy). A resource in this state has no correct value to serve, so the
+	* honest answer is to say so and name the remedy: the record heals on the
+	* resource's next in-place update (#1727).
+	*/
+	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId) {
+		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
+		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
+		throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: the recorded value "${value}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`);
+	}
+	/**
 	* Construct resource attribute value based on resource type
 	*
 	* Many CloudFormation attributes are not returned by Cloud Control API,
@@ -13167,7 +13208,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-AKp6xuP0.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CsY1ahKM.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -20041,7 +20082,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.281.11";
+	return "0.281.13";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22210,4 +22251,4 @@ var DeployEngine = class {
 
 //#endregion
 export { replayWarn as $, uploadCfnTemplate as $t, green as A, normalizeAwsError as An, formatDockerLoginError as At, slowCcOperationTimeoutMs as B, resolveApp as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, ResourceUpdateNotSupportedError as Cn, BOOTSTRAP_MARKER_PREFIX as Ct, bold as D, SynthesisError as Dn, validateAssetBucketName as Dt, formatResourceLine as E, StateError as En, parseBootstrapMarker as Et, clearOnUpdateRemoval as F, getDockerImageBySourceHash as Ft, getAccountInfo as G, resolveStateBucketWithDefaultAndSource as Gt, isTerminationProtectionPropagationError as H, resolveCaptureObservedState as Ht, ProviderRegistry as I, Synthesizer as It, normalizeAwsTagsToCfn as J, warnDeprecatedNoPrefixCliFlag as Jt, refStateLookupFromResource as K, resolveUseCdkBootstrapAssets as Kt, findActionableSilentDrops as L, synthesisStatusMessage as Lt, yellow as M, __exportAll as Mn, runDockerForeground as Mt, IAMRoleProvider as N, runDockerStreaming as Nt, cyan as O, formatError as On, validateContainerRepoName as Ot, collectInlinePolicyNamesManagedBySiblings as P, AssetManifestLoader as Pt, readConfigString as Q, findLargeInlineResources as Qt, findSilentDropProperties as R, getDefaultStateBucketName as Rt, extractDeploymentEventError as S, ResourceTimeoutError as Sn, AssetModeResolver as St, renderStatefulReason as T, StackTerminationProtectionError as Tn, getBootstrapMarkerKey as Tt, IntrinsicFunctionResolver as U, resolveSkipPrefix as Ut, disableInstanceApiTermination as V, resolveAutoAssetStorage as Vt, cfnRefValueFromPhysicalId as W, resolveStateBucketWithDefault as Wt, assertRegionMatch as X, CFN_TEMPLATE_URL_LIMIT as Xt, resolveExplicitPhysicalId as Y, CFN_TEMPLATE_BODY_LIMIT as Yt, configStringRefusal as Z, MIGRATE_TMP_PREFIX as Zt, createPreDeleteFinalSnapshot as _, LockError as _n, WorkGraph as _t, DeploymentEventsStore as a, AwsClients as an, describeTypeWithThrottleRetry as at, unsupportedFinalSnapshotError as b, PartialFailureError as bn, loadPublishableAssetManifest as bt, replayFailedOperations as c, setAwsClients as cn, isThrottlingError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, ConfigError as dn, LockManager as dt, expectedOwnerParam as en, requireConfigArray as et, computeImplicitDeleteEdges as f, DependencyError as fn, S3StateBackend as ft, ccRoutedFinalSnapshotError as g, LocalStartServiceError as gn, stringifyValue as gt, buildFinalSnapshotIdentifier as h, LocalMigrateError as hn, AssetPublisher as ht, DeploymentEventsReader as i, resolveBucketRegion as in, DiffCalculator as it, red as j, withErrorHandling as jn, getDockerCmd as jt, gray as k, isCdkdError as kn, buildDockerImage as kt, replayRollback as l, AssetError as ln, DagBuilder as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalInvokeBuildError as mn, shouldRetainResource as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, processStackMessages as nn, requireConfigString as nt, planFailedOps as o, getAwsClients as on, withRetry as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, DeployCancelledError as pn, rebuildClientForBucketRegion as pt, WAFv2WebACLProvider as q, stateBucketExistenceConfirmed as qt, DeployEngine as r, clearBucketRegionCache as rn, applyRoleArnIfSet as rt, planRollback as s, resetAwsClients as sn, isRetryableTransientError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssemblyReader as tn, requireConfigObject as tt, withResourceDeadline as u, CdkdError as un, TemplateParser as ut, isFinalSnapshotError as v, MissingCdkCliError as vn, buildAssetRedirectMap as vt, isStatefulRecreateTargetSync as w, StackHasActiveImportsError as wn, ensureAssetStorage as wt, makeCanonicalizePropertiesFn as x, ProvisioningError as xn, rewriteTemplateAssetReferences as xt, refusesFinalSnapshot as y, NestedStackChildDirectDestroyError as yn, createAssetRedirectResolver as yt, CloudControlProvider as z, getLegacyStateBucketName as zt };
-//# sourceMappingURL=deploy-engine-BErTJjXl.js.map
+//# sourceMappingURL=deploy-engine-BWM9RxAW.js.map