@go-to-k/cdkd 0.281.2 → 0.281.3

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-drWGPyTA.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-DFZo1Twc.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-n21zWyH-.js";
+import { t as ASGProvider } from "./asg-provider-CBIIk31p.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33306,6 +33306,47 @@ function normalizeRecordName(name) {
 	return lowered.endsWith(".") ? lowered : `${lowered}.`;
 }
 /**
+* Is this value ONLY an unresolved intrinsic — `{Ref: …}` / `{Fn::If: […]}` —
+* rather than a real object with members?
+*
+* `import.ts` substitutes only single-key `{Ref}` before calling a provider,
+* so an element behind a condition reaches `import()` in this shape.
+*/
+function isIntrinsicOnly(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || (keys[0] ?? "").startsWith("Fn::"));
+}
+/**
+* Read a hosted zone's PUBLIC-vs-PRIVATE visibility off its own template
+* properties (issue #1702), for the `import()` name lookup's zone filter.
+*
+* CloudFormation has no `PrivateZone` property — visibility is implied by
+* `VPCs`: a zone associated with at least one VPC is private, one with none is
+* public. So:
+*
+* - `VPCs` ABSENT -> `false` (public). This is the CDK `PublicHostedZone`
+*   shape and by far the common one.
+* - an array carrying at least one element that is NOT purely an unresolved
+*   intrinsic -> `true` (private). Such an element proves the template
+*   attaches a VPC unconditionally, even when the `VPCId` inside it is itself
+*   a `Ref` this provider cannot resolve.
+* - anything else -> `undefined` (do not narrow), and the caller's ambiguity
+*   guard then refuses rather than adopting the wrong zone. Three shapes land
+*   here and each would otherwise be a GUESS: a non-array (an unresolved
+*   intrinsic is a truthy OBJECT); an EMPTY array (more likely a
+*   condition-collapsed value than a deliberate "public"); and — the one that
+*   is easy to miss — an array whose every element is intrinsic-only
+*   (`[{Ref: 'AWS::NoValue'}]`, the CFn spelling of a conditionally-absent
+*   element), which is non-empty yet may resolve to a PUBLIC zone.
+*/
+function templateZoneVisibility(properties) {
+	const vpcs = properties["VPCs"];
+	if (vpcs == null) return false;
+	if (!Array.isArray(vpcs)) return void 0;
+	return vpcs.some((v) => typeof v === "object" && v !== null && !Array.isArray(v) && !isIntrinsicOnly(v)) ? true : void 0;
+}
+/**
 * Canonicalize a name for the QUERY side of a Route 53 list call.
 *
 * `normalizeRecordName` above is the COMPARE-side canonicalizer, and the two
@@ -34025,12 +34066,33 @@ var Route53Provider = class {
 	* Resolve HostedZoneId from properties.
 	* If HostedZoneId is provided, use it directly.
 	* If HostedZoneName is provided, resolve it to a HostedZoneId via ListHostedZonesByName.
+	*
+	* `options.requirePrivateZone` narrows the name match to PRIVATE (`true`) or
+	* PUBLIC (`false`) zones before the ambiguity decision below; leave it
+	* undefined to match either. Split-horizon DNS is exactly a public and a
+	* private zone sharing one name, so a caller that already knows which side
+	* it wants resolves cleanly where the ambiguity guard would otherwise
+	* refuse. `importHostedZone` is the one caller today, deriving the answer
+	* from the template's own `VPCs` (declared = private, absent = public);
+	* every RecordSet caller leaves it undefined, since a record set's template
+	* says nothing about the zone's visibility.
+	*
+	* `options.subject` names what is being resolved FOR in the errors this
+	* raises, and what remedy to point at. It exists because the messages are
+	* user-facing and this helper is no longer RecordSet-only: telling someone
+	* adopting a hosted zone to "pass the '<zoneId>|<name>|<type>' composite"
+	* names a physicalId shape their resource does not have.
 	*/
 	async resolveHostedZoneId(properties, logicalId, resourceType, physicalId, options) {
+		const subject = options?.subject ?? {
+			noun: "record set",
+			remedy: "set HostedZoneId explicitly, or pass the '<zoneId>|<name>|<type>' composite via --resource"
+		};
 		const hostedZoneId = properties["HostedZoneId"];
 		if (typeof hostedZoneId === "string" && hostedZoneId) return hostedZoneId;
 		let lookupErrorMessage;
 		let lookupErrorCause;
+		const narrowing = options?.requirePrivateZone !== void 0;
 		const hostedZoneName = properties["HostedZoneName"];
 		if (typeof hostedZoneName === "string" && hostedZoneName) {
 			let matched = [];
@@ -34043,18 +34105,26 @@ var Route53Provider = class {
 				const zones = response.HostedZones ?? [];
 				const normalizedName = normalizeRecordName(hostedZoneName);
 				matched = zones.filter((z) => normalizeRecordName(z.Name ?? "") === normalizedName);
-				absenceIsSound = !hostedZoneName.includes("\\") && (zones.length > 0 || response.IsTruncated !== true);
+				if (narrowing) matched = matched.filter((z) => (z.Config?.PrivateZone ?? false) === options?.requirePrivateZone);
+				const sawLaterName = zones.some((z) => normalizeRecordName(z.Name ?? "") !== normalizedName);
+				absenceIsSound = !hostedZoneName.includes("\\") && (narrowing ? sawLaterName || response.IsTruncated !== true : zones.length > 0 || response.IsTruncated !== true);
 			} catch (error) {
 				lookupErrorMessage = error instanceof Error ? error.message : String(error);
 				lookupErrorCause = error instanceof Error ? error : void 0;
 				this.logger.warn(`Failed to resolve HostedZoneName "${hostedZoneName}" for ${logicalId}: ${lookupErrorMessage}`);
 			}
-			if (matched.length > 1 && options?.requireUnambiguousZoneName) throw new ProvisioningError(`HostedZoneName "${hostedZoneName}" matches ${matched.length} hosted zones for ${logicalId} (split-horizon public/private DNS). Refusing to guess which one this record belongs to — set HostedZoneId explicitly, or pass the '<zoneId>|<name>|<type>' composite via --resource.`, resourceType, logicalId, physicalId);
+			if (matched.length > 1 && options?.requireUnambiguousZoneName) {
+				const cause = narrowing ? "" : " (split-horizon public/private DNS)";
+				throw new ProvisioningError(`HostedZoneName "${hostedZoneName}" matches ${matched.length} hosted zones for ${logicalId}${cause}. Refusing to guess which one is meant — ${subject.remedy}.`, resourceType, logicalId, physicalId);
+			}
 			const matchedZone = matched[0];
 			if (matchedZone?.Id) return matchedZone.Id.replace("/hostedzone/", "");
-			if (absenceIsSound) throw new HostedZoneNameNotFoundError(`HostedZoneName "${hostedZoneName}" matches no hosted zone in this account/region for ${logicalId}`, resourceType, logicalId, physicalId);
+			if (absenceIsSound) {
+				const visibility = options?.requirePrivateZone === void 0 ? "" : options.requirePrivateZone ? "private " : "public ";
+				throw new HostedZoneNameNotFoundError(`HostedZoneName "${hostedZoneName}" matches no ${visibility}hosted zone in this account/region for ${logicalId}`, resourceType, logicalId, physicalId);
+			}
 		}
-		throw new ProvisioningError(lookupErrorMessage ? `Could not resolve HostedZoneName "${String(hostedZoneName)}" for record set ${logicalId}: ${lookupErrorMessage}` : `Either HostedZoneId or HostedZoneName is required for record set ${logicalId}`, resourceType, logicalId, physicalId, lookupErrorCause);
+		throw new ProvisioningError(lookupErrorMessage ? `Could not resolve HostedZoneName "${String(hostedZoneName)}" for ${subject.noun} ${logicalId}: ${lookupErrorMessage}` : typeof hostedZoneName === "string" && hostedZoneName ? `Could not determine whether HostedZoneName "${hostedZoneName}" exists for ${subject.noun} ${logicalId} — the hosted-zone listing ended before the name could be resolved either way, so cdkd will not assume it is absent. ${subject.remedy}.` : `Either HostedZoneId or HostedZoneName is required for ${subject.noun} ${logicalId}`, resourceType, logicalId, physicalId, lookupErrorCause);
 	}
 	/**
 	* Recover `(hostedZoneId, name, type)` for a record set from EITHER shape of
@@ -34232,8 +34302,10 @@ var Route53Provider = class {
 	/**
 	* Adopt an existing Route 53 resource into cdkd state.
 	*
-	* Supported types: `AWS::Route53::HostedZone` (override-only);
-	* `AWS::Route53::RecordSet` (override-only too — the supplied id is
+	* Supported types: `AWS::Route53::HostedZone` (AUTO-RESOLVED from the
+	* template's `Name` since issue #1702, with an explicit `--resource`
+	* override still taking precedence);
+	* `AWS::Route53::RecordSet` (override-only — the supplied id is
 	* CANONICALIZED rather than trusted, using the template's
 	* `HostedZoneId` / `HostedZoneName` + `Name` + `Type` and verified
 	* against AWS, but an import with no override still declines because
@@ -34315,6 +34387,29 @@ var Route53Provider = class {
 			attributes: {}
 		};
 	}
+	/**
+	* Adopt an existing hosted zone (issue #1702).
+	*
+	* An explicit `--resource` id is ground truth and is only VERIFIED. With no
+	* override, the zone is resolved from the template's `Name` via
+	* `ListHostedZonesByName` — the physical-name route docs/import.md's
+	* Auto-resolved section documents, which this method declined to take until
+	* now, so a type the table listed as auto-resolved silently reported
+	* `skipped-not-found` and (under `--migrate-from-cloudformation`) was left
+	* out of state after the CloudFormation stack had already been retired.
+	*
+	* Three properties of the lookup matter and none of them is incidental:
+	* the query name is canonicalized to AWS's ordering key
+	* (`canonicalizeQueryName`) so a bounded page cannot skip past the zone; a
+	* name matching MORE than one zone is REFUSED rather than guessed at
+	* (split-horizon DNS), except that the template's own `VPCs` first narrows
+	* the match to the public or private side (`templateZoneVisibility`), which
+	* is what makes the ordinary split-horizon pair resolve cleanly; and the
+	* two ways of failing are kept DISTINCT — a proven absence returns `null`
+	* (`skipped-not-found`, the next deploy creates the zone) while an
+	* ambiguous name or a failed lookup throws, which `importOne` records as
+	* `failed` for this row alone.
+	*/
 	async importHostedZone(input) {
 		if (input.knownPhysicalId) try {
 			await this.getClient().send(new GetHostedZoneCommand({ Id: input.knownPhysicalId }));
@@ -34326,7 +34421,24 @@ var Route53Provider = class {
 			if (err instanceof Error && err.name === "NoSuchHostedZone") return null;
 			throw err;
 		}
-		return null;
+		const zoneName = input.properties["Name"];
+		if (typeof zoneName !== "string" || !zoneName) return null;
+		try {
+			return {
+				physicalId: await this.resolveHostedZoneId({ HostedZoneName: zoneName }, input.logicalId, input.resourceType, void 0, {
+					requireUnambiguousZoneName: true,
+					requirePrivateZone: templateZoneVisibility(input.properties),
+					subject: {
+						noun: "hosted zone",
+						remedy: `pass --resource ${input.logicalId}=<hostedZoneId> to adopt it explicitly`
+					}
+				}),
+				attributes: {}
+			};
+		} catch (error) {
+			if (error instanceof HostedZoneNameNotFoundError) return null;
+			throw error;
+		}
 	}
 };
 
@@ -72620,7 +72732,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.3");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;