@go-to-k/cdkd 0.281.7 → 0.281.9

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-B8Qo1vPU.js";
+import { $ as replayWarn, $t as uploadCfnTemplate, A as green, An as normalizeAwsError, At as formatDockerLoginError, B as slowCcOperationTimeoutMs, Bt as resolveApp, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceUpdateNotSupportedError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as getDockerImageBySourceHash, G as getAccountInfo, Gt as resolveStateBucketWithDefaultAndSource, H as isTerminationProtectionPropagationError, Ht as resolveCaptureObservedState, I as ProviderRegistry, It as Synthesizer, J as normalizeAwsTagsToCfn, Jt as warnDeprecatedNoPrefixCliFlag, K as refStateLookupFromResource, Kt as resolveUseCdkBootstrapAssets, L as findActionableSilentDrops, Lt as synthesisStatusMessage, M as yellow, Mt as runDockerForeground, N as IAMRoleProvider, Nt as runDockerStreaming, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as AssetManifestLoader, Q as readConfigString, Qt as findLargeInlineResources, R as findSilentDropProperties, Rt as getDefaultStateBucketName, S as extractDeploymentEventError, Sn as ResourceTimeoutError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackTerminationProtectionError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveSkipPrefix, V as disableInstanceApiTermination, Vt as resolveAutoAssetStorage, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefault, X as assertRegionMatch, Xt as CFN_TEMPLATE_URL_LIMIT, Y as resolveExplicitPhysicalId, Yt as CFN_TEMPLATE_BODY_LIMIT, Z as configStringRefusal, Zt as MIGRATE_TMP_PREFIX, _ as createPreDeleteFinalSnapshot, _t as WorkGraph, a as DeploymentEventsStore, an as AwsClients, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as PartialFailureError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as setAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dt as LockManager, en as expectedOwnerParam, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalStartServiceError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalMigrateError, ht as AssetPublisher, i as DeploymentEventsReader, in as resolveBucketRegion, it as DiffCalculator, j as red, jn as withErrorHandling, jt as getDockerCmd, k as gray, kt as buildDockerImage, l as replayRollback, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalInvokeBuildError$1, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as processStackMessages, nt as requireConfigString, o as planFailedOps, on as getAwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as DeployCancelledError, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as stateBucketExistenceConfirmed, r as DeployEngine, rt as applyRoleArnIfSet, s as planRollback, sn as resetAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssemblyReader, tt as requireConfigObject, u as withResourceDeadline, un as CdkdError, ut as TemplateParser, v as isFinalSnapshotError, vn as MissingCdkCliError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as StackHasActiveImportsError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as ProvisioningError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as NestedStackChildDirectDestroyError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getLegacyStateBucketName } from "./deploy-engine-DQ9kW3Pu.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Lj_P_wtb.js";
+import { t as ASGProvider } from "./asg-provider-C4zMjWYv.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11746,23 +11746,28 @@ var LambdaLayerVersionProvider = class {
 * ## What this does NOT cover
 *
 * The claim is "every composite packer this change reaches", not "every `|`
-* join in the tree". Two deliberate exclusions, recorded so the scope is not
+* join in the tree". One deliberate exclusion, recorded so the scope is not
 * read as wider than it is:
 *
-* - **`route53-provider.ts`'s three packers** (`AWS::Route53::RecordSet` and
-*   its siblings) are NOT guarded — the file was owned by a parallel lane when
-*   this shipped. The exposure there is bounded rather than absent:
-*   `parseRecordSetCompositeId` requires EXACTLY three parts, so a four-part
-*   id is REJECTED rather than mis-decoded into a different record. That is
-*   the loud failure mode, not the silent-wrong-resource one this helper
-*   exists for — but the deploy still records an id nothing can decode, so the
-*   type belongs here whenever that lane lands. Tracked in issue
-*   [#1711](https://github.com/go-to-k/cdkd/issues/1711).
 * - **`intrinsic-function-resolver.ts`'s `|` joins** (the WAFv2 and
 *   `AWS::Events::Rule` arms) are out of scope by KIND, not by ownership: they
 *   build a `Ref` VALUE for the template resolver, never a physicalId cdkd
 *   records and later splits. Nothing decodes them, so an ambiguous join has
 *   no decode site to go wrong at.
+*
+* ## Guarding the PACKERS is not the whole story
+*
+* A packer that refuses ambiguity does nothing about an id an EARLIER binary
+* already recorded, or one an `import` was handed — and a type whose decoder is
+* loose will mis-decode both. Issue #1711 is where that was learned:
+* `AWS::Route53::RecordSet`'s `parseRecordSetCompositeId` accepts any three
+* NON-EMPTY segments, so a record name carrying two pipes decoded to a
+* DIFFERENT hosted zone at three sites this helper never sees — an `import`
+* early accept, an identity-resolution short-circuit, and `delete`'s own parse,
+* where `cdkd destroy` then reported success over a live record. When adopting
+* this guard for a new type, audit its DECODE sites in the same change and make
+* each one cross-check the parsed segments against something it can verify them
+* with (Route 53 uses the template's own `Name` / `Type`).
 */
 /** The character every composite physicalId in this codebase joins segments with. */
 const COMPOSITE_ID_SEPARATOR = "|";
@@ -33705,10 +33710,10 @@ var Route53Provider = class {
 		if (!this.route53Client) this.route53Client = new Route53Client(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.route53Client;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::Route53::HostedZone": return this.createHostedZone(logicalId, resourceType, properties);
-			case "AWS::Route53::RecordSet": return this.createRecordSet(logicalId, resourceType, properties);
+			case "AWS::Route53::RecordSet": return this.createRecordSet(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -33937,11 +33942,25 @@ var Route53Provider = class {
 			default: return;
 		}
 	}
-	async createRecordSet(logicalId, resourceType, properties) {
+	async createRecordSet(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Route 53 record set ${logicalId}`);
 		const hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType);
 		const recordName = properties["Name"];
 		const recordType = properties["Type"];
+		const compositeId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "hostedZoneId",
+				value: hostedZoneId
+			},
+			{
+				name: "recordName",
+				value: recordName
+			},
+			{
+				name: "recordType",
+				value: recordType
+			}
+		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const comment = properties["Comment"];
@@ -33955,7 +33974,6 @@ var Route53Provider = class {
 					}]
 				}
 			}));
-			const compositeId = `${hostedZoneId}|${recordName}|${recordType}`;
 			this.logger.debug(`Successfully created record set ${logicalId}: ${compositeId}`);
 			return {
 				physicalId: compositeId,
@@ -33972,6 +33990,20 @@ var Route53Provider = class {
 		const hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId);
 		const recordName = properties["Name"];
 		const recordType = properties["Type"];
+		const compositeId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "hostedZoneId",
+				value: hostedZoneId
+			},
+			{
+				name: "recordName",
+				value: recordName
+			},
+			{
+				name: "recordType",
+				value: recordType
+			}
+		], { onRefusal: (message) => this.logger.warn(message) });
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const comment = properties["Comment"];
@@ -33985,7 +34017,6 @@ var Route53Provider = class {
 					}]
 				}
 			}));
-			const compositeId = `${hostedZoneId}|${recordName}|${recordType}`;
 			this.logger.debug(`Successfully updated record set ${logicalId}`);
 			return {
 				physicalId: compositeId,
@@ -34000,7 +34031,8 @@ var Route53Provider = class {
 	async deleteRecordSet(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Route 53 record set ${logicalId}: ${physicalId}`);
 		if (!properties) throw new ProvisioningError(`Properties required to delete record set ${logicalId}`, resourceType, logicalId, physicalId);
-		const composite = parseRecordSetCompositeId(physicalId);
+		const parsedComposite = parseRecordSetCompositeId(physicalId);
+		const composite = parsedComposite && this.compositeAgreesWithTemplate(parsedComposite, properties) ? parsedComposite : void 0;
 		let hostedZoneId;
 		if (composite) hostedZoneId = composite.hostedZoneId;
 		else try {
@@ -34433,7 +34465,7 @@ var Route53Provider = class {
 	*/
 	async resolveRecordSetIdentity(physicalId, properties, options) {
 		const composite = parseRecordSetCompositeId(physicalId);
-		if (composite) return composite;
+		if (composite && (!properties || this.compositeAgreesWithTemplate(composite, properties))) return composite;
 		if (!properties) return void 0;
 		const name = typeof properties["Name"] === "string" ? properties["Name"] : physicalId;
 		const type = properties["Type"];
@@ -34612,6 +34644,52 @@ var Route53Provider = class {
 		}
 	}
 	/**
+	* Does a parsed composite agree with the properties recorded alongside it?
+	*
+	* Called from all THREE sites that split a stored id back apart —
+	* `importRecordSet`'s early accept, `resolveRecordSetIdentity`, and
+	* `deleteRecordSet` — because `parseRecordSetCompositeId` asks only for three
+	* NON-EMPTY segments, which a record NAME carrying two pipes satisfies
+	* (issue #1711).
+	*
+	* Each check is applied only when the template side is a usable string, so an
+	* unresolved intrinsic or an absent field leaves the pre-#1711 behavior
+	* exactly as it was. When BOTH are unusable this returns `true` and the
+	* mis-decode is still reachable — an accepted bound, since the alternative is
+	* refusing every id on a bag cdkd cannot read, and the identity resolution the
+	* fall-through leads to needs those same fields anyway.
+	*
+	* The NAME check is what catches the residual the TYPE check alone leaves: a
+	* name like `a|b|A` on a record whose `Type` really is `A` agrees on the type
+	* and still decodes to the wrong zone. The TYPE check is in turn the sole
+	* discriminator only where the NAME is unusable, which is why both are here.
+	*
+	* **A false REJECTION is what this must not do, and the argument is
+	* REACHABILITY rather than cost.** The cost differs per caller and is not
+	* uniformly small: at `deleteRecordSet` the fall-through re-resolves the zone
+	* with `requireUnambiguousZoneName`, which THROWS on a split-horizon
+	* `HostedZoneName` and would turn a working destroy into a failed one. It
+	* cannot fire, because every composite is packed from the same
+	* `properties['Name']` / `['Type']` the engine records beside it — create,
+	* update and the import canonicalization all use one bag — so a genuine
+	* composite always agrees with the bag it is stored with. `Type` being
+	* updateable does not break that: `update()` returns the RE-PACKED id, which
+	* is recorded together with the new properties. The one real divergence is
+	* cosmetic and absorbed on purpose — `canonicalizeQueryName` makes the name
+	* compare case- and trailing-dot-insensitive, so a template spelling the name
+	* without CDK's dot is not rejected.
+	*
+	* Note two of the three callers pass a STATE-borne bag rather than a template
+	* one; the reachability argument above is what covers them.
+	*/
+	compositeAgreesWithTemplate(parsed, properties) {
+		const templateType = properties["Type"];
+		if (typeof templateType === "string" && templateType && parsed.type !== templateType) return false;
+		const templateName = properties["Name"];
+		if (typeof templateName === "string" && templateName && canonicalizeQueryName(parsed.name) !== canonicalizeQueryName(templateName)) return false;
+		return true;
+	}
+	/**
 	* Adopt an existing record set (issue #1658).
 	*
 	* cdkd's physicalId is the composite `<hostedZoneId>|<Name>|<Type>` that
@@ -34654,7 +34732,8 @@ var Route53Provider = class {
 	async importRecordSet(input) {
 		const known = input.knownPhysicalId;
 		if (!known) return null;
-		if (parseRecordSetCompositeId(known)) return {
+		const parsedKnown = parseRecordSetCompositeId(known);
+		if (parsedKnown && this.compositeAgreesWithTemplate(parsedKnown, input.properties)) return {
 			physicalId: known,
 			attributes: {}
 		};
@@ -34667,7 +34746,22 @@ var Route53Provider = class {
 		};
 		const identity = await this.resolveRecordSetIdentity(known, input.properties, { requireUnambiguousZoneName: true });
 		if (!identity) return adoptVerbatim("the template does not unambiguously resolve to a hosted zone + Name + Type");
-		const compositeId = `${identity.hostedZoneId}|${identity.name}|${identity.type}`;
+		const segments = [
+			{
+				name: "hostedZoneId",
+				value: identity.hostedZoneId
+			},
+			{
+				name: "recordName",
+				value: identity.name
+			},
+			{
+				name: "recordType",
+				value: identity.type
+			}
+		];
+		if (compositeIdSeparatorRefusal(input.resourceType, input.logicalId, segments) !== void 0) return adoptVerbatim(`the resolved hosted zone + Name + Type would pack an ambiguous id — a segment contains '${"|"}', which cdkd uses as this type's physical-id separator`);
+		const compositeId = packCompositeId(input.resourceType, input.logicalId, segments);
 		let observed;
 		try {
 			observed = await this.readRecordSet(compositeId);
@@ -36671,6 +36765,51 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 };
 
+//#endregion
+//#region src/utils/aws-partition.ts
+/**
+* AWS partition / URL-suffix derivation, shared across layers.
+*
+* Lives in `src/utils/` because it has consumers in two different layers: the
+* `cdkd local *` command family (which passes a region in once to keep the STS
+* hop minimal) and the provisioning layer's `AppSyncProvider`, which rebuilds a
+* child resource's ARN when AWS did not report one.
+*
+* It was originally defined in `src/local/ecs-task-resolver.ts`, which
+* re-exports it so every existing call site is unchanged; a provisioning
+* provider importing from `src/local/**` would invert the layering.
+*
+* NOTE this is the mapping to prefer over `getAccountInfo().partition`
+* (`src/deployment/intrinsic-function-resolver.ts`), which is hardcoded to
+* `'aws'` and says so in its own comment.
+*/
+/**
+* Derive the AWS partition / URL suffix for an AWS region. Same mapping
+* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
+*/
+function derivePartitionAndUrlSuffix(region) {
+	if (region.startsWith("cn-")) return {
+		partition: "aws-cn",
+		urlSuffix: "amazonaws.com.cn"
+	};
+	if (region.startsWith("us-gov-")) return {
+		partition: "aws-us-gov",
+		urlSuffix: "amazonaws.com"
+	};
+	if (region.startsWith("us-iso-")) return {
+		partition: "aws-iso",
+		urlSuffix: "c2s.ic.gov"
+	};
+	if (region.startsWith("us-isob-")) return {
+		partition: "aws-iso-b",
+		urlSuffix: "sc2s.sgov.gov"
+	};
+	return {
+		partition: "aws",
+		urlSuffix: "amazonaws.com"
+	};
+}
+
 //#endregion
 //#region src/provisioning/providers/appsync-provider.ts
 const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
@@ -36788,6 +36927,111 @@ var AppSyncProvider = class {
 		return this.client;
 	}
 	/**
+	* Build a child-resource ARN from the deploy's REAL partition / region /
+	* account (issue #1681).
+	*
+	* The three child types record an ARN attribute because CloudFormation's
+	* `Ref` for each of them returns the resource ARN (docs-verified 2026-08-12)
+	* and `Fn::GetAtt` serves the same value from the same cached map — this
+	* provider's `getAttribute` always resolves `undefined`, so the recorded
+	* attribute is the ONLY source for both intrinsics.
+	*
+	* Until #1681 those attributes were string-built as
+	* `arn:aws:appsync:*:*:...`, i.e. with literal `*` in the region and account
+	* positions, so every consumer received an ARN AWS cannot resolve. Prefer the
+	* ARN the create response reports (`dataSourceArn` / `resolverArn`); this
+	* helper is for `AWS::AppSync::ApiKey`, whose `CreateApiKey` response carries
+	* no ARN field at all, and as the fallback for the other two when a response
+	* comes back without one.
+	*
+	* `getAccountInfo` is the same STS-backed, process-cached resolver
+	* `CloudControlProvider` uses for its own ARN reconstruction, so this costs
+	* at most one `GetCallerIdentity` per deploy.
+	*/
+	async buildAppSyncArn(suffix) {
+		const accountInfo = await getAccountInfo(this.providerRegion ?? await this.getClient().config.region());
+		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
+		return `arn:${partition}:appsync:${accountInfo.region}:${accountInfo.accountId}:${suffix}`;
+	}
+	/**
+	* {@link buildAppSyncArn} for the POST-CREATE sites, where throwing is not an
+	* option (issue #1681 PR review).
+	*
+	* Moving the ARN build outside the create `try` stops a failure being
+	* re-labelled as a creation failure — but on its own it does NOT stop the
+	* resource being orphaned: `create()` still throws, the engine still journals
+	* no physicalId for a failed CREATE, and the resource still sits in AWS
+	* untracked (the issue #1710 class). Since the ARN is bookkeeping and the
+	* resource already exists, the honest answer is to never fail the create for
+	* it: warn, omit the attribute, and let `Ref` fall back to the compound id
+	* exactly as it does for an imported child. The resource's next update heals
+	* the record via `childRefAttributes`.
+	*/
+	async buildAppSyncArnOrWarn(suffix, logicalId, physicalId) {
+		try {
+			return await this.buildAppSyncArn(suffix);
+		} catch (error) {
+			this.logger.warn(`Created ${logicalId} (${physicalId}) but could not build its ARN attribute: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id until the next update.`);
+			return;
+		}
+	}
+	/**
+	* Rebuild a child type's COMPLETE attribute set from its compound physical id
+	* (issue #1681), for the update path to return.
+	*
+	* This is what heals a record written by a pre-#1681 binary. `update()`
+	* previously returned no attributes, and the deploy engine carries the
+	* existing ones forward when a provider reports none — so without this a
+	* resource created before the fix would keep its `arn:aws:appsync:*:*:...`
+	* placeholder for the rest of its life, since only a REPLACEMENT re-runs
+	* `create()`. `Fn::GetAtt` reads the same cached map, so the placeholder was
+	* breaking that intrinsic too, independently of the `Ref` defect #1681 is
+	* about.
+	*
+	* It must return EVERY key the create path records, not just the ARN: an
+	* `attributes` map returned from `update()` REPLACES the record's map
+	* wholesale rather than merging into it (`deploy-engine.ts`), so a partial
+	* answer would silently drop `Name` / `ApiKey`.
+	*
+	* Returns `undefined` for an id whose arity does not match the type — a
+	* record that malformed cannot be healed by guessing, and carrying the
+	* existing attributes forward is the safe answer.
+	*/
+	async childRefAttributes(resourceType, physicalId) {
+		const parts = physicalId.split("|");
+		if (resourceType === "AWS::AppSync::DataSource" && parts.length === 2) {
+			const [apiId, name] = parts;
+			return {
+				DataSourceArn: await this.buildAppSyncArn(`apis/${apiId}/datasources/${name}`),
+				Name: name
+			};
+		}
+		if (resourceType === "AWS::AppSync::Resolver" && parts.length === 3) {
+			const [apiId, typeName, fieldName] = parts;
+			return { ResolverArn: await this.buildAppSyncArn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`) };
+		}
+		if (resourceType === "AWS::AppSync::ApiKey" && parts.length === 2) {
+			const [apiId, apiKeyId] = parts;
+			return {
+				ApiKey: apiKeyId,
+				Arn: await this.buildAppSyncArn(`apis/${apiId}/apikey/${apiKeyId}`)
+			};
+		}
+	}
+	/**
+	* The no-replacement update result for a child type, carrying the healed
+	* attribute set (issue #1681). Reporting none is still the correct answer for
+	* an unhealable id — the engine then carries the existing attributes forward.
+	*/
+	async childUpdateResult(resourceType, physicalId) {
+		const attributes = await this.childRefAttributes(resourceType, physicalId);
+		return {
+			physicalId,
+			wasReplaced: false,
+			...attributes && { attributes }
+		};
+	}
+	/**
 	* Lazy S3 client for the `*S3Location` properties (Resolver
 	* `CodeS3Location` / `RequestMappingTemplateS3Location` /
 	* `ResponseMappingTemplateS3Location`, GraphQLSchema
@@ -36977,10 +37221,7 @@ var AppSyncProvider = class {
 			"EventBridgeConfig",
 			"RelationalDatabaseConfig",
 			"MetricsConfig"
-		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return {
-			physicalId,
-			wasReplaced: false
-		};
+		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return this.childUpdateResult(resourceType, physicalId);
 		const input = {
 			apiId,
 			name,
@@ -36992,10 +37233,7 @@ var AppSyncProvider = class {
 		} catch (error) {
 			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "DataSource");
 		}
-		return {
-			physicalId,
-			wasReplaced: false
-		};
+		return this.childUpdateResult(resourceType, physicalId);
 	}
 	async updateResolver(logicalId, physicalId, resourceType, properties, previousProperties) {
 		for (const field of [
@@ -37025,10 +37263,7 @@ var AppSyncProvider = class {
 			"CodeS3Location",
 			"RequestMappingTemplateS3Location",
 			"ResponseMappingTemplateS3Location"
-		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return {
-			physicalId,
-			wasReplaced: false
-		};
+		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return this.childUpdateResult(resourceType, physicalId);
 		const input = {
 			apiId,
 			typeName,
@@ -37040,10 +37275,7 @@ var AppSyncProvider = class {
 		} catch (error) {
 			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "Resolver");
 		}
-		return {
-			physicalId,
-			wasReplaced: false
-		};
+		return this.childUpdateResult(resourceType, physicalId);
 	}
 	async updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties) {
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync ApiKey.ApiId is immutable — destroy + redeploy to change");
@@ -37053,10 +37285,7 @@ var AppSyncProvider = class {
 		const oldDesc = previousProperties["Description"];
 		const newExp = properties["Expires"];
 		const oldExp = previousProperties["Expires"];
-		if (newDesc === oldDesc && newExp === oldExp) return {
-			physicalId,
-			wasReplaced: false
-		};
+		if (newDesc === oldDesc && newExp === oldExp) return this.childUpdateResult(resourceType, physicalId);
 		const input = {
 			apiId,
 			id: apiKeyId
@@ -37068,10 +37297,7 @@ var AppSyncProvider = class {
 		} catch (error) {
 			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "ApiKey");
 		}
-		return {
-			physicalId,
-			wasReplaced: false
-		};
+		return this.childUpdateResult(resourceType, physicalId);
 	}
 	/**
 	* Apply a Tags diff to a GraphqlApi via TagResource / UntagResource.
@@ -37733,6 +37959,7 @@ var AppSyncProvider = class {
 			name: "name",
 			value: name
 		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		let reportedArn;
 		try {
 			const input = {
 				apiId,
@@ -37740,19 +37967,20 @@ var AppSyncProvider = class {
 				type
 			};
 			this.applyDataSourceConfig(input, resourceType, logicalId, properties);
-			await this.getClient().send(new CreateDataSourceCommand(input));
+			reportedArn = (await this.getClient().send(new CreateDataSourceCommand(input))).dataSource?.dataSourceArn;
 			this.logger.debug(`Successfully created DataSource ${logicalId}: ${physicalId}`);
-			return {
-				physicalId,
-				attributes: {
-					DataSourceArn: `arn:aws:appsync:*:*:apis/${apiId}/datasources/${name}`,
-					Name: name
-				}
-			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create DataSource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
+		const dataSourceArn = reportedArn ?? await this.buildAppSyncArnOrWarn(`apis/${apiId}/datasources/${name}`, logicalId, physicalId);
+		return {
+			physicalId,
+			attributes: {
+				...dataSourceArn !== void 0 && { DataSourceArn: dataSourceArn },
+				Name: name
+			}
+		};
 	}
 	async deleteDataSource(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting DataSource ${logicalId}: ${physicalId}`);
@@ -37797,6 +38025,7 @@ var AppSyncProvider = class {
 				value: fieldName
 			}
 		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		let reportedArn;
 		try {
 			const input = {
 				apiId,
@@ -37804,16 +38033,17 @@ var AppSyncProvider = class {
 				fieldName
 			};
 			await this.applyResolverConfig(input, resourceType, logicalId, properties);
-			await this.getClient().send(new CreateResolverCommand(input));
+			reportedArn = (await this.getClient().send(new CreateResolverCommand(input))).resolver?.resolverArn;
 			this.logger.debug(`Successfully created Resolver ${logicalId}: ${physicalId}`);
-			return {
-				physicalId,
-				attributes: { ResolverArn: `arn:aws:appsync:*:*:apis/${apiId}/types/${typeName}/resolvers/${fieldName}` }
-			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create Resolver ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
+		const resolverArn = reportedArn ?? await this.buildAppSyncArnOrWarn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`, logicalId, physicalId);
+		return {
+			physicalId,
+			attributes: { ...resolverArn !== void 0 && { ResolverArn: resolverArn } }
+		};
 	}
 	async deleteResolver(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Resolver ${logicalId}: ${physicalId}`);
@@ -37855,17 +38085,19 @@ var AppSyncProvider = class {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create ApiKey ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
+		const physicalId = packCompositeId(resourceType, logicalId, [{
+			name: "apiId",
+			value: apiId
+		}, {
+			name: "apiKeyId",
+			value: apiKeyId
+		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		const apiKeyArn = await this.buildAppSyncArnOrWarn(`apis/${apiId}/apikey/${apiKeyId}`, logicalId, physicalId);
 		return {
-			physicalId: packCompositeId(resourceType, logicalId, [{
-				name: "apiId",
-				value: apiId
-			}, {
-				name: "apiKeyId",
-				value: apiKeyId
-			}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0),
+			physicalId,
 			attributes: {
 				ApiKey: apiKeyId,
-				Arn: `arn:aws:appsync:*:*:apis/${apiId}/apikeys/${apiKeyId}`
+				...apiKeyArn !== void 0 && { Arn: apiKeyArn }
 			}
 		};
 	}
@@ -64534,34 +64766,6 @@ function notFoundError$1(target, stack, resources) {
 
 //#endregion
 //#region src/local/ecs-task-resolver.ts
-/**
-* Derive the AWS partition / URL suffix for an AWS region. Same mapping
-* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
-* Exported so the CLI can keep the STS hop minimal — caller passes the
-* region in once, this returns the matching partition + suffix.
-*/
-function derivePartitionAndUrlSuffix(region) {
-	if (region.startsWith("cn-")) return {
-		partition: "aws-cn",
-		urlSuffix: "amazonaws.com.cn"
-	};
-	if (region.startsWith("us-gov-")) return {
-		partition: "aws-us-gov",
-		urlSuffix: "amazonaws.com"
-	};
-	if (region.startsWith("us-iso-")) return {
-		partition: "aws-iso",
-		urlSuffix: "c2s.ic.gov"
-	};
-	if (region.startsWith("us-isob-")) return {
-		partition: "aws-iso-b",
-		urlSuffix: "sc2s.sgov.gov"
-	};
-	return {
-		partition: "aws",
-		urlSuffix: "amazonaws.com"
-	};
-}
 function detectEcsImageResolutionNeeds(stack) {
 	const resources = stack.template.Resources ?? {};
 	let needsPseudoParameters = false;
@@ -73207,7 +73411,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.7");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.9");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;