@go-to-k/cdkd 0.281.12 → 0.281.14

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as replayWarn, $t as uploadCfnTemplate, A as green, An as normalizeAwsError, At as formatDockerLoginError, B as slowCcOperationTimeoutMs, Bt as resolveApp, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceUpdateNotSupportedError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as getDockerImageBySourceHash, G as getAccountInfo, Gt as resolveStateBucketWithDefaultAndSource, H as isTerminationProtectionPropagationError, Ht as resolveCaptureObservedState, I as ProviderRegistry, It as Synthesizer, J as normalizeAwsTagsToCfn, Jt as warnDeprecatedNoPrefixCliFlag, K as refStateLookupFromResource, Kt as resolveUseCdkBootstrapAssets, L as findActionableSilentDrops, Lt as synthesisStatusMessage, M as yellow, Mt as runDockerForeground, N as IAMRoleProvider, Nt as runDockerStreaming, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as AssetManifestLoader, Q as readConfigString, Qt as findLargeInlineResources, R as findSilentDropProperties, Rt as getDefaultStateBucketName, S as extractDeploymentEventError, Sn as ResourceTimeoutError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackTerminationProtectionError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveSkipPrefix, V as disableInstanceApiTermination, Vt as resolveAutoAssetStorage, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefault, X as assertRegionMatch, Xt as CFN_TEMPLATE_URL_LIMIT, Y as resolveExplicitPhysicalId, Yt as CFN_TEMPLATE_BODY_LIMIT, Z as configStringRefusal, Zt as MIGRATE_TMP_PREFIX, _ as createPreDeleteFinalSnapshot, _t as WorkGraph, a as DeploymentEventsStore, an as AwsClients, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as PartialFailureError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as setAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dt as LockManager, en as expectedOwnerParam, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalStartServiceError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalMigrateError, ht as AssetPublisher, i as DeploymentEventsReader, in as resolveBucketRegion, it as DiffCalculator, j as red, jn as withErrorHandling, jt as getDockerCmd, k as gray, kt as buildDockerImage, l as replayRollback, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalInvokeBuildError$1, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as processStackMessages, nt as requireConfigString, o as planFailedOps, on as getAwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as DeployCancelledError, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as stateBucketExistenceConfirmed, r as DeployEngine, rt as applyRoleArnIfSet, s as planRollback, sn as resetAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssemblyReader, tt as requireConfigObject, u as withResourceDeadline, un as CdkdError, ut as TemplateParser, v as isFinalSnapshotError, vn as MissingCdkCliError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as StackHasActiveImportsError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as ProvisioningError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as NestedStackChildDirectDestroyError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getLegacyStateBucketName } from "./deploy-engine-CPDPlPQN.js";
+import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as AssetModeResolver, D as bold, Dt as parseBootstrapMarker, E as formatResourceLine, En as StackTerminationProtectionError, Et as getBootstrapMarkerKey, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateAssetBucketName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as rewriteTemplateAssetReferences, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as ensureAssetStorage, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as stringifyValue, a as DeploymentEventsStore, an as resolveBucketRegion, at as DiffCalculator, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as createAssetRedirectResolver, c as replayFailedOperations, cn as resetAwsClients, ct as isRetryableTransientError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as TemplateParser, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as LockManager, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as AssetPublisher, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as shouldRetainResource, i as DeploymentEventsReader, it as applyRoleArnIfSet, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as validateContainerRepoName, l as replayRollback, ln as setAwsClients, lt as isThrottlingError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as rebuildClientForBucketRegion, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as describeTypeWithThrottleRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as S3StateBackend, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as derivePartitionAndUrlSuffix, s as planRollback, sn as getAwsClients, st as withRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as DagBuilder, v as isFinalSnapshotError, vt as WorkGraph, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as BOOTSTRAP_MARKER_PREFIX, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as loadPublishableAssetManifest, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as buildAssetRedirectMap, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-3BZtmJqZ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-JZvPyCEp.js";
+import { t as ASGProvider } from "./asg-provider-C1WbHit9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -36867,51 +36867,6 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 };
 
-//#endregion
-//#region src/utils/aws-partition.ts
-/**
-* AWS partition / URL-suffix derivation, shared across layers.
-*
-* Lives in `src/utils/` because it has consumers in two different layers: the
-* `cdkd local *` command family (which passes a region in once to keep the STS
-* hop minimal) and the provisioning layer's `AppSyncProvider`, which rebuilds a
-* child resource's ARN when AWS did not report one.
-*
-* It was originally defined in `src/local/ecs-task-resolver.ts`, which
-* re-exports it so every existing call site is unchanged; a provisioning
-* provider importing from `src/local/**` would invert the layering.
-*
-* NOTE this is the mapping to prefer over `getAccountInfo().partition`
-* (`src/deployment/intrinsic-function-resolver.ts`), which is hardcoded to
-* `'aws'` and says so in its own comment.
-*/
-/**
-* Derive the AWS partition / URL suffix for an AWS region. Same mapping
-* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
-*/
-function derivePartitionAndUrlSuffix(region) {
-	if (region.startsWith("cn-")) return {
-		partition: "aws-cn",
-		urlSuffix: "amazonaws.com.cn"
-	};
-	if (region.startsWith("us-gov-")) return {
-		partition: "aws-us-gov",
-		urlSuffix: "amazonaws.com"
-	};
-	if (region.startsWith("us-iso-")) return {
-		partition: "aws-iso",
-		urlSuffix: "c2s.ic.gov"
-	};
-	if (region.startsWith("us-isob-")) return {
-		partition: "aws-iso-b",
-		urlSuffix: "sc2s.sgov.gov"
-	};
-	return {
-		partition: "aws",
-		urlSuffix: "amazonaws.com"
-	};
-}
-
 //#endregion
 //#region src/provisioning/providers/appsync-provider.ts
 const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
@@ -37050,8 +37005,9 @@ var AppSyncProvider = class {
 	* `CloudControlProvider` uses for its own ARN reconstruction, so this costs
 	* at most one `GetCallerIdentity` per deploy.
 	*/
-	async buildAppSyncArn(suffix) {
-		const accountInfo = await getAccountInfo(this.providerRegion ?? await this.getClient().config.region());
+	async buildAppSyncArn(suffix, regionOverride) {
+		const accountInfo = await getAccountInfo(regionOverride ?? this.providerRegion ?? await this.getClient().config.region());
+		if (accountInfo.fabricated) throw new Error(`cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so an ARN for ${suffix} would be fabricated`);
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
 		return `arn:${partition}:appsync:${accountInfo.region}:${accountInfo.accountId}:${suffix}`;
 	}
@@ -37098,25 +37054,45 @@ var AppSyncProvider = class {
 	* Returns `undefined` for an id whose arity does not match the type — a
 	* record that malformed cannot be healed by guessing, and carrying the
 	* existing attributes forward is the safe answer.
+	*
+	* `omitArnOnFailure` is for the IMPORT path only (issue #1728 review). The
+	* non-ARN keys — `Name`, `ApiKey` — are split straight out of the physical id
+	* and involve no account at all, so dropping them because the ACCOUNT could
+	* not be resolved would fail `Fn::GetAtt Name` for a reason that has nothing
+	* to do with it. Import has no prior record to preserve, so keeping what it
+	* can beats keeping nothing. `update()` must NOT pass it: there a partial map
+	* replaces the record's wholesale and would delete a good ARN.
 	*/
-	async childRefAttributes(resourceType, physicalId) {
+	async childRefAttributes(resourceType, physicalId, regionOverride, omitArnOnFailure = false) {
 		const parts = physicalId.split("|");
+		const arn = async (suffix) => {
+			try {
+				return await this.buildAppSyncArn(suffix, regionOverride);
+			} catch (error) {
+				if (!omitArnOnFailure) throw error;
+				this.logger.warn(`Imported ${resourceType} (${physicalId}) but its ARN attribute was NOT recorded: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+				return;
+			}
+		};
 		if (resourceType === "AWS::AppSync::DataSource" && parts.length === 2) {
 			const [apiId, name] = parts;
+			const dataSourceArn = await arn(`apis/${apiId}/datasources/${name}`);
 			return {
-				DataSourceArn: await this.buildAppSyncArn(`apis/${apiId}/datasources/${name}`),
+				...dataSourceArn && { DataSourceArn: dataSourceArn },
 				Name: name
 			};
 		}
 		if (resourceType === "AWS::AppSync::Resolver" && parts.length === 3) {
 			const [apiId, typeName, fieldName] = parts;
-			return { ResolverArn: await this.buildAppSyncArn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`) };
+			const resolverArn = await arn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`);
+			return { ...resolverArn && { ResolverArn: resolverArn } };
 		}
 		if (resourceType === "AWS::AppSync::ApiKey" && parts.length === 2) {
 			const [apiId, apiKeyId] = parts;
+			const apiKeyArn = await arn(`apis/${apiId}/apikey/${apiKeyId}`);
 			return {
 				ApiKey: apiKeyId,
-				Arn: await this.buildAppSyncArn(`apis/${apiId}/apikey/${apiKeyId}`)
+				...apiKeyArn && { Arn: apiKeyArn }
 			};
 		}
 	}
@@ -37124,9 +37100,21 @@ var AppSyncProvider = class {
 	* The no-replacement update result for a child type, carrying the healed
 	* attribute set (issue #1681). Reporting none is still the correct answer for
 	* an unhealable id — the engine then carries the existing attributes forward.
+	*
+	* An ARN that cannot be built takes the SAME answer, and it must (issue #1728
+	* review). An `update()` attribute map REPLACES the record's wholesale, so
+	* reporting a partial set here would DELETE the ARN a previous deploy
+	* correctly recorded; reporting none carries it forward untouched. That is
+	* why this arm differs from the import one below, which has no prior record
+	* to preserve and therefore keeps what it can.
 	*/
 	async childUpdateResult(resourceType, physicalId) {
-		const attributes = await this.childRefAttributes(resourceType, physicalId);
+		let attributes;
+		try {
+			attributes = await this.childRefAttributes(resourceType, physicalId);
+		} catch (error) {
+			this.logger.warn(`Updated ${resourceType} (${physicalId}) but could not rebuild its ARN attribute: ${error instanceof Error ? error.message : String(error)}. The previously recorded attributes are kept.`);
+		}
 		return {
 			physicalId,
 			wasReplaced: false,
@@ -37134,6 +37122,47 @@ var AppSyncProvider = class {
 		};
 	}
 	/**
+	* The child attribute set for an ADOPTED resource (issue #1728).
+	*
+	* `import()` used to record `attributes: {}` for every child type, so a child
+	* adopted via `cdkd import` had no ARN in state and the resolver's
+	* `REF_RETURNS_ARN_FROM_STATE` lookup missed — `Ref` fell back to the raw
+	* compound id, i.e. the pre-#1681 behavior, and `Fn::GetAtt DataSourceArn` /
+	* `ResolverArn` / `Arn` were equally unresolved. The record healed only on the
+	* resource's next UPDATE (#1727), so an imported-and-untouched child stayed
+	* broken indefinitely.
+	*
+	* RECONSTRUCTED rather than read back from AWS. Every segment is already in
+	* the physical id the import receives, `childRefAttributes` is the SAME
+	* mapping `create()` / `update()` use (so the three spellings cannot drift),
+	* and the reconstruction costs one process-cached STS call instead of one
+	* DescribeApi-family call per imported child. A readback would be
+	* authoritative but cannot be more correct for a well-formed id: `import`
+	* adopts a resource in the caller's own account, which is exactly the context
+	* `buildAppSyncArn` derives from.
+	*
+	* Never throws: a failure degrades to `{}` (or to the account-independent
+	* keys — see `omitArnOnFailure`), which is at worst the exact pre-#1728
+	* behavior, because adopting the resource is worth more than its bookkeeping
+	* attribute. `childRefAttributes` already answers `undefined` for a mis-arity
+	* id, which degrades the same way rather than guessing.
+	*
+	* The fabricated-account refusal that makes this honest lives in
+	* `buildAppSyncArn`, not here (issue #1728 review): the UPDATE path rebuilds
+	* the ARN on every in-place update, so an STS blip there would REPLACE a
+	* correct recorded ARN rather than merely fail to write one. Guarding only
+	* this call site would have left the worse path open. The fabrication itself
+	* is issue #1730.
+	*/
+	async childImportAttributes(resourceType, physicalId, region) {
+		try {
+			return await this.childRefAttributes(resourceType, physicalId, region, true) ?? {};
+		} catch (error) {
+			this.logger.warn(`Imported ${resourceType} (${physicalId}) but could not build its ARN attribute: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+			return {};
+		}
+	}
+	/**
 	* Lazy S3 client for the `*S3Location` properties (Resolver
 	* `CodeS3Location` / `RequestMappingTemplateS3Location` /
 	* `ResponseMappingTemplateS3Location`, GraphQLSchema
@@ -38564,13 +38593,16 @@ var AppSyncProvider = class {
 	* real resource (issue #1134); auto-mode import resolves ids from
 	* CloudFormation's `DescribeStackResources` instead. AppSync sub-resources
 	* (`GraphQLSchema`, `DataSource`, `Resolver`, `ApiKey`) are scoped under a
-	* parent `apiId` — explicit-override only.
+	* parent `apiId` — explicit-override only. The three ARN-`Ref` children
+	* additionally record the same attribute set `create()` does, so an adopted
+	* child's `Ref` / `Fn::GetAtt` resolve immediately rather than only after its
+	* first update (issue #1728) — see {@link childImportAttributes}.
 	*/
 	async import(input) {
 		if (input.resourceType !== "AWS::AppSync::GraphQLApi") {
 			if (input.knownPhysicalId) return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: await this.childImportAttributes(input.resourceType, input.knownPhysicalId, input.region)
 			};
 			return null;
 		}
@@ -73513,7 +73545,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.12");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.14");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;