@go-to-k/cdkd 0.283.17 → 0.283.19

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-Muh32cTG.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-UVLw029j.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DLVW2wf1.js";
+import { t as ASGProvider } from "./asg-provider-B260vt0k.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11777,21 +11777,23 @@ var LambdaFunctionProvider = class {
 			} catch (pcErr) {
 				if (!(pcErr instanceof ResourceNotFoundException)) this.logger.debug(`GetFunctionConcurrency failed for ${physicalId}: ${pcErr instanceof Error ? pcErr.message : String(pcErr)}`);
 			}
-			try {
-				const rmResp = await this.lambdaClient.send(new GetRuntimeManagementConfigCommand({ FunctionName: physicalId }));
-				if (rmResp.UpdateRuntimeOn !== void 0) {
-					const rm = { UpdateRuntimeOn: rmResp.UpdateRuntimeOn };
-					if (rmResp.RuntimeVersionArn !== void 0) rm["RuntimeVersionArn"] = rmResp.RuntimeVersionArn;
-					result["RuntimeManagementConfig"] = rm;
+			if (cfg.PackageType !== "Image") {
+				try {
+					const rmResp = await this.lambdaClient.send(new GetRuntimeManagementConfigCommand({ FunctionName: physicalId }));
+					if (rmResp.UpdateRuntimeOn !== void 0) {
+						const rm = { UpdateRuntimeOn: rmResp.UpdateRuntimeOn };
+						if (rmResp.RuntimeVersionArn !== void 0) rm["RuntimeVersionArn"] = rmResp.RuntimeVersionArn;
+						result["RuntimeManagementConfig"] = rm;
+					}
+				} catch (rmErr) {
+					if (!(rmErr instanceof ResourceNotFoundException)) this.logger.warn(`GetRuntimeManagementConfig failed for ${physicalId} — RuntimeManagementConfig omitted from the drift snapshot (may surface as a false removal): ${rmErr instanceof Error ? rmErr.message : String(rmErr)}`);
+				}
+				try {
+					const csResp = await this.lambdaClient.send(new GetFunctionCodeSigningConfigCommand({ FunctionName: physicalId }));
+					if (csResp.CodeSigningConfigArn !== void 0) result["CodeSigningConfigArn"] = csResp.CodeSigningConfigArn;
+				} catch (csErr) {
+					if (!(csErr instanceof ResourceNotFoundException)) this.logger.warn(`GetFunctionCodeSigningConfig failed for ${physicalId} — CodeSigningConfigArn omitted from the drift snapshot (may surface as a false removal): ${csErr instanceof Error ? csErr.message : String(csErr)}`);
 				}
-			} catch (rmErr) {
-				if (!(rmErr instanceof ResourceNotFoundException)) this.logger.warn(`GetRuntimeManagementConfig failed for ${physicalId} — RuntimeManagementConfig omitted from the drift snapshot (may surface as a false removal): ${rmErr instanceof Error ? rmErr.message : String(rmErr)}`);
-			}
-			try {
-				const csResp = await this.lambdaClient.send(new GetFunctionCodeSigningConfigCommand({ FunctionName: physicalId }));
-				if (csResp.CodeSigningConfigArn !== void 0) result["CodeSigningConfigArn"] = csResp.CodeSigningConfigArn;
-			} catch (csErr) {
-				if (!(csErr instanceof ResourceNotFoundException)) this.logger.warn(`GetFunctionCodeSigningConfig failed for ${physicalId} — CodeSigningConfigArn omitted from the drift snapshot (may surface as a false removal): ${csErr instanceof Error ? csErr.message : String(csErr)}`);
 			}
 			return result;
 		} catch (err) {
@@ -38109,6 +38111,58 @@ var Route53Provider = class {
 		};
 	}
 	/**
+	* The attribute set for a hosted zone adopted through the NAME-lookup
+	* branch (issue #1875). `null` means DECLINE the row.
+	*
+	* Unlike the `knownPhysicalId` branch — whose verification call already
+	* carries the delegation set — this branch resolves the zone through
+	* `ListHostedZonesByName`, which does NOT return one, so the attributes
+	* cost one extra `GetHostedZone`.
+	*
+	* **A vanished zone DECLINES, it does not degrade.** `NoSuchHostedZone`
+	* between the list and this read is exactly the condition the
+	* `knownPhysicalId` branch answers with `null` / `skipped-not-found`, and
+	* adopting a zone that demonstrably no longer exists is worse than
+	* declining it — the next deploy would compare against a record for
+	* something AWS does not have. The two branches must agree; everything
+	* else degrades.
+	*
+	* **The degraded answer is the EMPTY map, and that is load-bearing rather
+	* than tidy.** `import.ts`'s attribute carry-over is gated on the returned
+	* map being NON-empty (`row.attributes && Object.keys(...).length > 0 ?
+	* row.attributes : undefined`, then `?? priorAttributes ?? {}`) — a gate
+	* that exists precisely because almost every provider spells
+	* `attributes: {}` explicitly. So a partial `{ Id }` is NON-empty, takes
+	* the row branch, and OVERWRITES a previously-recorded good map: a zone
+	* imported successfully once and re-imported while `route53:GetHostedZone`
+	* is denied would LOSE its stored `NameServers`, leaving state strictly
+	* worse than before this fix. `{}` falls through and preserves it. Do NOT
+	* "improve" this into keeping what it can — that is the one change that
+	* makes the failure path destructive.
+	*
+	* NEVER throws otherwise, matching the convention the neighbouring
+	* adoption paths already use (`AppSyncProvider.childImportAttributes`,
+	* issue #1728, and `importRecordSet`'s canonicalization, which adopts
+	* VERBATIM rather than declining): an import must not hard-fail because
+	* one optional attribute could not be read. `import.ts` only aborts when
+	* ZERO resources import, so under `--migrate-from-cloudformation` a throw
+	* here would cost the row at exactly the moment the CloudFormation stack
+	* is being retired — the resource would end up in NEITHER CloudFormation
+	* nor cdkd state.
+	*/
+	async hostedZoneImportAttributes(zoneId, logicalId) {
+		try {
+			return {
+				Id: zoneId,
+				NameServers: (await this.getClient().send(new GetHostedZoneCommand({ Id: zoneId }))).DelegationSet?.NameServers ?? []
+			};
+		} catch (error) {
+			if (error instanceof Error && error.name === "NoSuchHostedZone") return null;
+			this.logger.warn(`Imported hosted zone ${zoneId} but could not read its NameServers: ${error instanceof Error ? error.message : String(error)}. The zone is adopted without them (any attributes already in state for this zone are kept). Re-run \`cdkd import --resource ${logicalId}=${zoneId} --force\` once the permission is granted, or make a template change that forces an UPDATE — a plain \`cdkd deploy\` does NOT heal the record, because an unchanged zone is NO_CHANGE and never calls update().`);
+			return {};
+		}
+	}
+	/**
 	* Adopt an existing hosted zone (issue #1702).
 	*
 	* An explicit `--resource` id is ground truth and is only VERIFIED. With no
@@ -38130,13 +38184,44 @@ var Route53Provider = class {
 	* (`skipped-not-found`, the next deploy creates the zone) while an
 	* ambiguous name or a failed lookup throws, which `importOne` records as
 	* `failed` for this row alone.
+	*
+	* BOTH branches record the same `{ Id, NameServers }` attribute set a
+	* `cdkd deploy` CREATE records (issue #1875). Recording `attributes: {}`
+	* left an adopted zone with no `NameServers` in state, and nothing else
+	* rescues it: `IntrinsicFunctionResolver.resolveGetAtt`'s flat-attribute
+	* branch misses (so PR #1868's legacy comma-string normalization, which
+	* lives in that branch, never runs either), `constructAttribute` has no
+	* `AWS::Route53::HostedZone` case, and resolution falls through to
+	* `guardedPhysicalIdFallback`, which hands back the zone id STRING — so a
+	* downstream `Fn::Join` threw `second argument must be a list` and the
+	* Output was silently dropped. `provider.getAttribute` does return the list
+	* but is only reached from the orphan-rewriter path, never from ordinary
+	* template resolution.
+	*
+	* The delegation set is normalized `?? []` — a LIST, never a comma string —
+	* exactly as `createHostedZone` / `updateHostedZone` / `getHostedZoneAttribute`
+	* do, so an imported zone and a deployed one resolve IDENTICALLY. A
+	* divergence here would be a phantom-drift hazard as well as a resolution
+	* one.
+	*
+	* **A plain `cdkd deploy` does NOT rewrite these attributes**, so do not
+	* offer one as the remedy when a read fails. `deploy-engine.ts` `continue`s
+	* on `NO_CHANGE`, so an unchanged zone never reaches `update()` and its
+	* `attributes` are never rewritten; `kickOffAutoRefreshObservedProperties`
+	* refreshes `observedProperties`, a different field. What DOES rewrite the
+	* record is re-running the import for that row
+	* (`cdkd import --resource <logicalId>=<zoneId> --force`, which re-enters
+	* this method) or a template change that forces a real UPDATE.
 	*/
 	async importHostedZone(input) {
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new GetHostedZoneCommand({ Id: input.knownPhysicalId }));
+			const response = await this.getClient().send(new GetHostedZoneCommand({ Id: input.knownPhysicalId }));
 			return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: {
+					Id: input.knownPhysicalId.replace("/hostedzone/", ""),
+					NameServers: response.DelegationSet?.NameServers ?? []
+				}
 			};
 		} catch (err) {
 			if (err instanceof Error && err.name === "NoSuchHostedZone") return null;
@@ -38145,16 +38230,19 @@ var Route53Provider = class {
 		const zoneName = input.properties["Name"];
 		if (typeof zoneName !== "string" || !zoneName) return null;
 		try {
+			const zoneId = await this.resolveHostedZoneId({ HostedZoneName: zoneName }, input.logicalId, input.resourceType, void 0, {
+				requireUnambiguousZoneName: true,
+				requirePrivateZone: templateZoneVisibility(input.properties),
+				subject: {
+					noun: "hosted zone",
+					remedy: `pass --resource ${input.logicalId}=<hostedZoneId> to adopt it explicitly`
+				}
+			});
+			const attributes = await this.hostedZoneImportAttributes(zoneId, input.logicalId);
+			if (attributes === null) return null;
 			return {
-				physicalId: await this.resolveHostedZoneId({ HostedZoneName: zoneName }, input.logicalId, input.resourceType, void 0, {
-					requireUnambiguousZoneName: true,
-					requirePrivateZone: templateZoneVisibility(input.properties),
-					subject: {
-						noun: "hosted zone",
-						remedy: `pass --resource ${input.logicalId}=<hostedZoneId> to adopt it explicitly`
-					}
-				}),
-				attributes: {}
+				physicalId: zoneId,
+				attributes
 			};
 		} catch (error) {
 			if (error instanceof HostedZoneNameNotFoundError) return null;
@@ -78726,7 +78814,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.17");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.19");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;