@go-to-k/cdkd 0.281.7 → 0.281.8

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-B8Qo1vPU.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-OafbuSbc.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Lj_P_wtb.js";
+import { t as ASGProvider } from "./asg-provider-BhomRJhR.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11746,23 +11746,28 @@ var LambdaLayerVersionProvider = class {
 * ## What this does NOT cover
 *
 * The claim is "every composite packer this change reaches", not "every `|`
-* join in the tree". Two deliberate exclusions, recorded so the scope is not
+* join in the tree". One deliberate exclusion, recorded so the scope is not
 * read as wider than it is:
 *
-* - **`route53-provider.ts`'s three packers** (`AWS::Route53::RecordSet` and
-*   its siblings) are NOT guarded — the file was owned by a parallel lane when
-*   this shipped. The exposure there is bounded rather than absent:
-*   `parseRecordSetCompositeId` requires EXACTLY three parts, so a four-part
-*   id is REJECTED rather than mis-decoded into a different record. That is
-*   the loud failure mode, not the silent-wrong-resource one this helper
-*   exists for — but the deploy still records an id nothing can decode, so the
-*   type belongs here whenever that lane lands. Tracked in issue
-*   [#1711](https://github.com/go-to-k/cdkd/issues/1711).
 * - **`intrinsic-function-resolver.ts`'s `|` joins** (the WAFv2 and
 *   `AWS::Events::Rule` arms) are out of scope by KIND, not by ownership: they
 *   build a `Ref` VALUE for the template resolver, never a physicalId cdkd
 *   records and later splits. Nothing decodes them, so an ambiguous join has
 *   no decode site to go wrong at.
+*
+* ## Guarding the PACKERS is not the whole story
+*
+* A packer that refuses ambiguity does nothing about an id an EARLIER binary
+* already recorded, or one an `import` was handed — and a type whose decoder is
+* loose will mis-decode both. Issue #1711 is where that was learned:
+* `AWS::Route53::RecordSet`'s `parseRecordSetCompositeId` accepts any three
+* NON-EMPTY segments, so a record name carrying two pipes decoded to a
+* DIFFERENT hosted zone at three sites this helper never sees — an `import`
+* early accept, an identity-resolution short-circuit, and `delete`'s own parse,
+* where `cdkd destroy` then reported success over a live record. When adopting
+* this guard for a new type, audit its DECODE sites in the same change and make
+* each one cross-check the parsed segments against something it can verify them
+* with (Route 53 uses the template's own `Name` / `Type`).
 */
 /** The character every composite physicalId in this codebase joins segments with. */
 const COMPOSITE_ID_SEPARATOR = "|";
@@ -33705,10 +33710,10 @@ var Route53Provider = class {
 		if (!this.route53Client) this.route53Client = new Route53Client(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.route53Client;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::Route53::HostedZone": return this.createHostedZone(logicalId, resourceType, properties);
-			case "AWS::Route53::RecordSet": return this.createRecordSet(logicalId, resourceType, properties);
+			case "AWS::Route53::RecordSet": return this.createRecordSet(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -33937,11 +33942,25 @@ var Route53Provider = class {
 			default: return;
 		}
 	}
-	async createRecordSet(logicalId, resourceType, properties) {
+	async createRecordSet(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Route 53 record set ${logicalId}`);
 		const hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType);
 		const recordName = properties["Name"];
 		const recordType = properties["Type"];
+		const compositeId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "hostedZoneId",
+				value: hostedZoneId
+			},
+			{
+				name: "recordName",
+				value: recordName
+			},
+			{
+				name: "recordType",
+				value: recordType
+			}
+		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const comment = properties["Comment"];
@@ -33955,7 +33974,6 @@ var Route53Provider = class {
 					}]
 				}
 			}));
-			const compositeId = `${hostedZoneId}|${recordName}|${recordType}`;
 			this.logger.debug(`Successfully created record set ${logicalId}: ${compositeId}`);
 			return {
 				physicalId: compositeId,
@@ -33972,6 +33990,20 @@ var Route53Provider = class {
 		const hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId);
 		const recordName = properties["Name"];
 		const recordType = properties["Type"];
+		const compositeId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "hostedZoneId",
+				value: hostedZoneId
+			},
+			{
+				name: "recordName",
+				value: recordName
+			},
+			{
+				name: "recordType",
+				value: recordType
+			}
+		], { onRefusal: (message) => this.logger.warn(message) });
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const comment = properties["Comment"];
@@ -33985,7 +34017,6 @@ var Route53Provider = class {
 					}]
 				}
 			}));
-			const compositeId = `${hostedZoneId}|${recordName}|${recordType}`;
 			this.logger.debug(`Successfully updated record set ${logicalId}`);
 			return {
 				physicalId: compositeId,
@@ -34000,7 +34031,8 @@ var Route53Provider = class {
 	async deleteRecordSet(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Route 53 record set ${logicalId}: ${physicalId}`);
 		if (!properties) throw new ProvisioningError(`Properties required to delete record set ${logicalId}`, resourceType, logicalId, physicalId);
-		const composite = parseRecordSetCompositeId(physicalId);
+		const parsedComposite = parseRecordSetCompositeId(physicalId);
+		const composite = parsedComposite && this.compositeAgreesWithTemplate(parsedComposite, properties) ? parsedComposite : void 0;
 		let hostedZoneId;
 		if (composite) hostedZoneId = composite.hostedZoneId;
 		else try {
@@ -34433,7 +34465,7 @@ var Route53Provider = class {
 	*/
 	async resolveRecordSetIdentity(physicalId, properties, options) {
 		const composite = parseRecordSetCompositeId(physicalId);
-		if (composite) return composite;
+		if (composite && (!properties || this.compositeAgreesWithTemplate(composite, properties))) return composite;
 		if (!properties) return void 0;
 		const name = typeof properties["Name"] === "string" ? properties["Name"] : physicalId;
 		const type = properties["Type"];
@@ -34612,6 +34644,52 @@ var Route53Provider = class {
 		}
 	}
 	/**
+	* Does a parsed composite agree with the properties recorded alongside it?
+	*
+	* Called from all THREE sites that split a stored id back apart —
+	* `importRecordSet`'s early accept, `resolveRecordSetIdentity`, and
+	* `deleteRecordSet` — because `parseRecordSetCompositeId` asks only for three
+	* NON-EMPTY segments, which a record NAME carrying two pipes satisfies
+	* (issue #1711).
+	*
+	* Each check is applied only when the template side is a usable string, so an
+	* unresolved intrinsic or an absent field leaves the pre-#1711 behavior
+	* exactly as it was. When BOTH are unusable this returns `true` and the
+	* mis-decode is still reachable — an accepted bound, since the alternative is
+	* refusing every id on a bag cdkd cannot read, and the identity resolution the
+	* fall-through leads to needs those same fields anyway.
+	*
+	* The NAME check is what catches the residual the TYPE check alone leaves: a
+	* name like `a|b|A` on a record whose `Type` really is `A` agrees on the type
+	* and still decodes to the wrong zone. The TYPE check is in turn the sole
+	* discriminator only where the NAME is unusable, which is why both are here.
+	*
+	* **A false REJECTION is what this must not do, and the argument is
+	* REACHABILITY rather than cost.** The cost differs per caller and is not
+	* uniformly small: at `deleteRecordSet` the fall-through re-resolves the zone
+	* with `requireUnambiguousZoneName`, which THROWS on a split-horizon
+	* `HostedZoneName` and would turn a working destroy into a failed one. It
+	* cannot fire, because every composite is packed from the same
+	* `properties['Name']` / `['Type']` the engine records beside it — create,
+	* update and the import canonicalization all use one bag — so a genuine
+	* composite always agrees with the bag it is stored with. `Type` being
+	* updateable does not break that: `update()` returns the RE-PACKED id, which
+	* is recorded together with the new properties. The one real divergence is
+	* cosmetic and absorbed on purpose — `canonicalizeQueryName` makes the name
+	* compare case- and trailing-dot-insensitive, so a template spelling the name
+	* without CDK's dot is not rejected.
+	*
+	* Note two of the three callers pass a STATE-borne bag rather than a template
+	* one; the reachability argument above is what covers them.
+	*/
+	compositeAgreesWithTemplate(parsed, properties) {
+		const templateType = properties["Type"];
+		if (typeof templateType === "string" && templateType && parsed.type !== templateType) return false;
+		const templateName = properties["Name"];
+		if (typeof templateName === "string" && templateName && canonicalizeQueryName(parsed.name) !== canonicalizeQueryName(templateName)) return false;
+		return true;
+	}
+	/**
 	* Adopt an existing record set (issue #1658).
 	*
 	* cdkd's physicalId is the composite `<hostedZoneId>|<Name>|<Type>` that
@@ -34654,7 +34732,8 @@ var Route53Provider = class {
 	async importRecordSet(input) {
 		const known = input.knownPhysicalId;
 		if (!known) return null;
-		if (parseRecordSetCompositeId(known)) return {
+		const parsedKnown = parseRecordSetCompositeId(known);
+		if (parsedKnown && this.compositeAgreesWithTemplate(parsedKnown, input.properties)) return {
 			physicalId: known,
 			attributes: {}
 		};
@@ -34667,7 +34746,22 @@ var Route53Provider = class {
 		};
 		const identity = await this.resolveRecordSetIdentity(known, input.properties, { requireUnambiguousZoneName: true });
 		if (!identity) return adoptVerbatim("the template does not unambiguously resolve to a hosted zone + Name + Type");
-		const compositeId = `${identity.hostedZoneId}|${identity.name}|${identity.type}`;
+		const segments = [
+			{
+				name: "hostedZoneId",
+				value: identity.hostedZoneId
+			},
+			{
+				name: "recordName",
+				value: identity.name
+			},
+			{
+				name: "recordType",
+				value: identity.type
+			}
+		];
+		if (compositeIdSeparatorRefusal(input.resourceType, input.logicalId, segments) !== void 0) return adoptVerbatim(`the resolved hosted zone + Name + Type would pack an ambiguous id — a segment contains '${"|"}', which cdkd uses as this type's physical-id separator`);
+		const compositeId = packCompositeId(input.resourceType, input.logicalId, segments);
 		let observed;
 		try {
 			observed = await this.readRecordSet(compositeId);
@@ -73207,7 +73301,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.7");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.8");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;