@go-to-k/cdkd 0.281.7 → 0.281.9

package/dist/{deploy-engine-B8Qo1vPU.js → deploy-engine-DQ9kW3Pu.js}

@@ -10393,12 +10393,15 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 *   - already correct, no change needed: EC2::EIP (before-first-pipe),
 *     S3Tables::Namespace / ::Table (added by the 2026-07-03 close-out audit),
 *     ECS::Service (before-first-pipe; stores the bare ARN on the SDK path);
-*   - KNOWN WRONG and NOT fixable by a Set entry, tracked in issue #1681:
+*   - was KNOWN WRONG and not fixable by a Set entry; FIXED by issue #1681,
+*     each with a mechanism of its own rather than an entry here:
 *     AppSync::ApiKey / ::DataSource / ::Resolver (`Ref` returns the resource
-*     ARN, so the value must be RECONSTRUCTED like the WAFv2::WebACL case
-*     below, not extracted) and Route53::RecordSet (`Ref` returns "the name of
-*     the record" — the MIDDLE segment of `<hostedZoneId>|<name>|<type>`, which
-*     neither after-LAST-pipe nor before-FIRST-pipe yields).
+*     ARN, which is no segment of the compound id — recovered from the
+*     provider-recorded ARN attribute via {@link REF_RETURNS_ARN_FROM_STATE})
+*     and Route53::RecordSet (`Ref` returns "the name of the record" — the
+*     MIDDLE segment of `<hostedZoneId>|<name>|<type>`, which neither
+*     after-LAST-pipe nor before-FIRST-pipe yields, so it takes
+*     {@link REF_RETURNS_SEGMENT_AT_INDEX}).
 */
 const REF_RETURNS_SEGMENT_AFTER_PIPE = /* @__PURE__ */ new Set([
 	"AWS::ApiGateway::Model",
@@ -10475,6 +10478,61 @@ const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = /* @__PURE__ */ new Set([
 */
 const REF_RETURNS_NAME_FROM_ARN = /* @__PURE__ */ new Map([["AWS::Events::Rule", ":rule/"], ["AWS::CloudTrail::Trail", ":trail/"]]);
 /**
+* Third sibling of the two `REF_RETURNS_SEGMENT_*_PIPE` Sets, for a compound id
+* whose `Ref` segment is neither the first nor the last (issue #1681).
+*
+* `AWS::Route53::RecordSet` is the only entry: `Route53Provider` stores
+* `<hostedZoneId>|<name>|<type>` while CloudFormation's `Ref` returns "the name
+* of the record" (docs-verified 2026-08-12) — the MIDDLE segment. Neither
+* existing Set can express that (after-LAST-pipe yields the record TYPE `A`,
+* before-FIRST-pipe yields the hosted zone id), which is why the type was filed
+* rather than added to one of them.
+*
+* Value: `arity` is the EXACT segment count the extraction is valid for and
+* `index` the 0-based segment to return. Requiring the exact arity rather than
+* a minimum is what keeps this safe on a mis-arity'd id: cdkd's own
+* `parseRecordSetCompositeId` also demands exactly three parts, so a record
+* whose name contained a `|` is already rejected everywhere else, and returning
+* a confidently-wrong middle segment here would be worse than passing the raw
+* id through. Anything that does not match falls through to the raw physical id,
+* the same graceful degradation the `stateLookup` recoveries use.
+*
+* Same maintenance rules as the two Sets: docs-verified `Ref` semantics per
+* type, a whole-service-family audit before adding one, and a pinning unit test
+* asserting the RESOLVED value (not merely map membership).
+*/
+const REF_RETURNS_SEGMENT_AT_INDEX = /* @__PURE__ */ new Map([["AWS::Route53::RecordSet", {
+	arity: 3,
+	index: 1
+}]]);
+/**
+* Compound-id types whose CFn `Ref` is the resource ARN, recovered from an ARN
+* ATTRIBUTE the provider recorded at create time (issue #1681).
+*
+* The three `AWS::AppSync::*` child types pack a compound physical id
+* (`<apiId>|<name>`, `<apiId>|<typeName>|<fieldName>`, `<apiId>|<apiKeyId>`)
+* while CloudFormation's `Ref` returns the resource ARN (all three
+* docs-verified 2026-08-12). The ARN is not a SEGMENT of the id, so no
+* `REF_RETURNS_SEGMENT_*` mechanism can produce it — it has to be recovered,
+* and the same `stateLookup` seam the S3Tables / Backup / CodeCommit cases use
+* is preferred over string-building an ARN here: `AppSyncProvider` records the
+* real ARN (from the create response where AWS reports one, else reconstructed
+* from the deploy's own partition / region / account), so the resolver does not
+* have to re-derive account context it may not share with the provider.
+*
+* Value: the attribute keys to try, in order.
+*
+* Degradation is deliberate and matches the sibling recoveries — an IMPORTED
+* child records `attributes: {}` (`AppSyncProvider.import` returns the physical
+* id only), so the lookup misses and the raw compound id is returned rather
+* than a fabricated ARN.
+*/
+const REF_RETURNS_ARN_FROM_STATE = /* @__PURE__ */ new Map([
+	["AWS::AppSync::ApiKey", ["Arn"]],
+	["AWS::AppSync::DataSource", ["DataSourceArn"]],
+	["AWS::AppSync::Resolver", ["ResolverArn"]]
+]);
+/**
 * Build a {@link RefStateLookup} from a resource's stored state maps, checking
 * `properties` first (the template value CFn `Ref` mirrors) then `attributes`.
 * Only non-empty string values qualify — an intrinsic-shaped or empty value is
@@ -10503,7 +10561,9 @@ function refStateLookupFromResource(resource) {
 * `stateLookup` (optional) recovers a `Ref` value that the physical id cannot
 * yield — the `AWS::S3Tables::Table` CC-routed case, whose bare TableARN ends
 * in a UUID (not the table name CFn `Ref` returns), so the name is read from
-* the stored `TableName` property/attribute instead (issue #974).
+* the stored `TableName` property/attribute instead (issue #974) — and, since
+* issue #1681, the {@link REF_RETURNS_ARN_FROM_STATE} types, whose `Ref` is an
+* ARN that is no segment of their compound id.
 */
 function cfnRefValueFromPhysicalId(resourceType, physicalId, stateLookup) {
 	if (resourceType === "AWS::S3Tables::Table" && !physicalId.includes("|") && stateLookup) {
@@ -10541,9 +10601,33 @@ function cfnRefValueFromPhysicalId(resourceType, physicalId, stateLookup) {
 		const pipeIdx = physicalId.indexOf("|");
 		if (pipeIdx >= 0) return physicalId.substring(0, pipeIdx);
 	}
+	const segmentSpec = REF_RETURNS_SEGMENT_AT_INDEX.get(resourceType);
+	if (segmentSpec) {
+		const parts = physicalId.split("|");
+		if (parts.length === segmentSpec.arity) {
+			const segment = parts[segmentSpec.index];
+			if (segment) return segment;
+		}
+	}
+	const arnAttributeKeys = REF_RETURNS_ARN_FROM_STATE.get(resourceType);
+	if (arnAttributeKeys && stateLookup) {
+		const arn = stateLookup(arnAttributeKeys);
+		if (arn && !isPlaceholderArn(arn)) return arn;
+	}
 	return physicalId;
 }
 /**
+* True for an ARN carrying a wildcard in its region or account position — the
+* shape cdkd's AppSync provider recorded before issue #1681. Matched
+* positionally (fields 3 and 4 of `arn:<partition>:<service>:<region>:<account>`)
+* rather than by substring, so a legitimate ARN whose RESOURCE segment contains
+* `*` (an IAM policy resource pattern, an S3 key prefix) is never rejected.
+*/
+function isPlaceholderArn(arn) {
+	const fields = arn.split(":");
+	return fields.length >= 5 && (fields[3] === "*" || fields[4] === "*");
+}
+/**
 * Intrinsic-function keys the resolver knows how to handle.
 *
 * A CloudFormation intrinsic is ALWAYS a single-key object — `{ "Ref": ... }`
@@ -10994,6 +11078,13 @@ var IntrinsicFunctionResolver = class {
 	* not the name), so the resolver passes the resource's stored `properties` /
 	* `attributes` as a `stateLookup` and `cfnRefValueFromPhysicalId` recovers
 	* the name from the `TableName` property (issue #974).
+	*
+	* Two further mechanisms cover compounds neither Set can express (issue
+	* #1681): {@link REF_RETURNS_SEGMENT_AT_INDEX} for an INTERIOR segment
+	* (`AWS::Route53::RecordSet`'s `<hostedZoneId>|<name>|<type>` -> the record
+	* name), and {@link REF_RETURNS_ARN_FROM_STATE} for the `AWS::AppSync::*`
+	* children, whose `Ref` is an ARN recovered from the provider-recorded ARN
+	* attribute through the same `stateLookup` seam.
 	*/
 	resolveRefValue(resource) {
 		return cfnRefValueFromPhysicalId(resource.resourceType, resource.physicalId, refStateLookupFromResource(resource));
@@ -13076,7 +13167,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Lj_P_wtb.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C4zMjWYv.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -19950,7 +20041,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.281.7";
+	return "0.281.9";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22118,5 +22209,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { requireConfigArray as $, expectedOwnerParam as $t, green as A, withErrorHandling as An, getDockerCmd as At, slowCcOperationTimeoutMs as B, resolveAutoAssetStorage as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, StackHasActiveImportsError as Cn, ensureAssetStorage as Ct, bold as D, formatError as Dn, validateContainerRepoName as Dt, formatResourceLine as E, SynthesisError as En, validateAssetBucketName as Et, clearOnUpdateRemoval as F, Synthesizer as Ft, refStateLookupFromResource as G, resolveUseCdkBootstrapAssets as Gt, isTerminationProtectionPropagationError as H, resolveSkipPrefix as Ht, ProviderRegistry as I, synthesisStatusMessage as It, resolveExplicitPhysicalId as J, CFN_TEMPLATE_BODY_LIMIT as Jt, WAFv2WebACLProvider as K, stateBucketExistenceConfirmed as Kt, findActionableSilentDrops as L, getDefaultStateBucketName as Lt, yellow as M, runDockerStreaming as Mt, IAMRoleProvider as N, AssetManifestLoader as Nt, cyan as O, isCdkdError as On, buildDockerImage as Ot, collectInlinePolicyNamesManagedBySiblings as P, getDockerImageBySourceHash as Pt, replayWarn as Q, uploadCfnTemplate as Qt, findSilentDropProperties as R, getLegacyStateBucketName as Rt, extractDeploymentEventError as S, ResourceUpdateNotSupportedError as Sn, BOOTSTRAP_MARKER_PREFIX as St, renderStatefulReason as T, StateError as Tn, parseBootstrapMarker as Tt, IntrinsicFunctionResolver as U, resolveStateBucketWithDefault as Ut, disableInstanceApiTermination as V, resolveCaptureObservedState as Vt, cfnRefValueFromPhysicalId as W, resolveStateBucketWithDefaultAndSource as Wt, configStringRefusal as X, MIGRATE_TMP_PREFIX as Xt, assertRegionMatch as Y, CFN_TEMPLATE_URL_LIMIT as Yt, readConfigString as Z, findLargeInlineResources as Zt, createPreDeleteFinalSnapshot as _, MissingCdkCliError as _n, buildAssetRedirectMap as _t, DeploymentEventsStore as a, getAwsClients as an, withRetry as at, unsupportedFinalSnapshotError as b, ProvisioningError as bn, rewriteTemplateAssetReferences as bt, replayFailedOperations as c, AssetError as cn, DagBuilder as ct, IMPLICIT_DELETE_DEPENDENCIES as d, DependencyError as dn, S3StateBackend as dt, AssemblyReader as en, requireConfigObject as et, computeImplicitDeleteEdges as f, DeployCancelledError as fn, rebuildClientForBucketRegion as ft, ccRoutedFinalSnapshotError as g, LockError as gn, WorkGraph as gt, buildFinalSnapshotIdentifier as h, LocalStartServiceError as hn, stringifyValue as ht, DeploymentEventsReader as i, AwsClients as in, describeTypeWithThrottleRetry as it, red as j, __exportAll as jn, runDockerForeground as jt, gray as k, normalizeAwsError as kn, formatDockerLoginError as kt, replayRollback as l, CdkdError as ln, TemplateParser as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalMigrateError as mn, AssetPublisher as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, clearBucketRegionCache as nn, applyRoleArnIfSet as nt, planFailedOps as o, resetAwsClients as on, isRetryableTransientError as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalInvokeBuildError as pn, shouldRetainResource as pt, normalizeAwsTagsToCfn as q, warnDeprecatedNoPrefixCliFlag as qt, DeployEngine as r, resolveBucketRegion as rn, DiffCalculator as rt, planRollback as s, setAwsClients as sn, isThrottlingError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, processStackMessages as tn, requireConfigString as tt, withResourceDeadline as u, ConfigError as un, LockManager as ut, isFinalSnapshotError as v, NestedStackChildDirectDestroyError as vn, createAssetRedirectResolver as vt, isStatefulRecreateTargetSync as w, StackTerminationProtectionError as wn, getBootstrapMarkerKey as wt, makeCanonicalizePropertiesFn as x, ResourceTimeoutError as xn, AssetModeResolver as xt, refusesFinalSnapshot as y, PartialFailureError as yn, loadPublishableAssetManifest as yt, CloudControlProvider as z, resolveApp as zt };
-//# sourceMappingURL=deploy-engine-B8Qo1vPU.js.map
+export { replayWarn as $, uploadCfnTemplate as $t, green as A, normalizeAwsError as An, formatDockerLoginError as At, slowCcOperationTimeoutMs as B, resolveApp as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, ResourceUpdateNotSupportedError as Cn, BOOTSTRAP_MARKER_PREFIX as Ct, bold as D, SynthesisError as Dn, validateAssetBucketName as Dt, formatResourceLine as E, StateError as En, parseBootstrapMarker as Et, clearOnUpdateRemoval as F, getDockerImageBySourceHash as Ft, getAccountInfo as G, resolveStateBucketWithDefaultAndSource as Gt, isTerminationProtectionPropagationError as H, resolveCaptureObservedState as Ht, ProviderRegistry as I, Synthesizer as It, normalizeAwsTagsToCfn as J, warnDeprecatedNoPrefixCliFlag as Jt, refStateLookupFromResource as K, resolveUseCdkBootstrapAssets as Kt, findActionableSilentDrops as L, synthesisStatusMessage as Lt, yellow as M, __exportAll as Mn, runDockerForeground as Mt, IAMRoleProvider as N, runDockerStreaming as Nt, cyan as O, formatError as On, validateContainerRepoName as Ot, collectInlinePolicyNamesManagedBySiblings as P, AssetManifestLoader as Pt, readConfigString as Q, findLargeInlineResources as Qt, findSilentDropProperties as R, getDefaultStateBucketName as Rt, extractDeploymentEventError as S, ResourceTimeoutError as Sn, AssetModeResolver as St, renderStatefulReason as T, StackTerminationProtectionError as Tn, getBootstrapMarkerKey as Tt, IntrinsicFunctionResolver as U, resolveSkipPrefix as Ut, disableInstanceApiTermination as V, resolveAutoAssetStorage as Vt, cfnRefValueFromPhysicalId as W, resolveStateBucketWithDefault as Wt, assertRegionMatch as X, CFN_TEMPLATE_URL_LIMIT as Xt, resolveExplicitPhysicalId as Y, CFN_TEMPLATE_BODY_LIMIT as Yt, configStringRefusal as Z, MIGRATE_TMP_PREFIX as Zt, createPreDeleteFinalSnapshot as _, LockError as _n, WorkGraph as _t, DeploymentEventsStore as a, AwsClients as an, describeTypeWithThrottleRetry as at, unsupportedFinalSnapshotError as b, PartialFailureError as bn, loadPublishableAssetManifest as bt, replayFailedOperations as c, setAwsClients as cn, isThrottlingError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, ConfigError as dn, LockManager as dt, expectedOwnerParam as en, requireConfigArray as et, computeImplicitDeleteEdges as f, DependencyError as fn, S3StateBackend as ft, ccRoutedFinalSnapshotError as g, LocalStartServiceError as gn, stringifyValue as gt, buildFinalSnapshotIdentifier as h, LocalMigrateError as hn, AssetPublisher as ht, DeploymentEventsReader as i, resolveBucketRegion as in, DiffCalculator as it, red as j, withErrorHandling as jn, getDockerCmd as jt, gray as k, isCdkdError as kn, buildDockerImage as kt, replayRollback as l, AssetError as ln, DagBuilder as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalInvokeBuildError as mn, shouldRetainResource as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, processStackMessages as nn, requireConfigString as nt, planFailedOps as o, getAwsClients as on, withRetry as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, DeployCancelledError as pn, rebuildClientForBucketRegion as pt, WAFv2WebACLProvider as q, stateBucketExistenceConfirmed as qt, DeployEngine as r, clearBucketRegionCache as rn, applyRoleArnIfSet as rt, planRollback as s, resetAwsClients as sn, isRetryableTransientError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssemblyReader as tn, requireConfigObject as tt, withResourceDeadline as u, CdkdError as un, TemplateParser as ut, isFinalSnapshotError as v, MissingCdkCliError as vn, buildAssetRedirectMap as vt, isStatefulRecreateTargetSync as w, StackHasActiveImportsError as wn, ensureAssetStorage as wt, makeCanonicalizePropertiesFn as x, ProvisioningError as xn, rewriteTemplateAssetReferences as xt, refusesFinalSnapshot as y, NestedStackChildDirectDestroyError as yn, createAssetRedirectResolver as yt, CloudControlProvider as z, getLegacyStateBucketName as zt };
+//# sourceMappingURL=deploy-engine-DQ9kW3Pu.js.map