@go-to-k/cdkd 0.31.2 → 0.32.0

package/dist/index.js

@@ -3934,6 +3934,58 @@ function collectRefIds(value, out) {
   }
 }
 
+// src/analyzer/cdk-defensive-deps.ts
+var DEFENSIVE_DEPENDS_ON_TYPE_PAIRS = [
+  // VPC Lambda's execution Role (and its inline Policy) get DependsOn'd onto
+  // the route only because CDK assumes the Lambda will run before the route
+  // is up. The Role/Policy create call itself is VPC-agnostic.
+  { fromType: "AWS::IAM::Role", toType: "AWS::EC2::Route" },
+  { fromType: "AWS::IAM::Role", toType: "AWS::EC2::SubnetRouteTableAssociation" },
+  { fromType: "AWS::IAM::Policy", toType: "AWS::EC2::Route" },
+  { fromType: "AWS::IAM::Policy", toType: "AWS::EC2::SubnetRouteTableAssociation" },
+  // VPC Lambda itself: CreateFunction returns synchronously while the
+  // function is still in Pending; the route only matters once the function
+  // is invoked at runtime.
+  { fromType: "AWS::Lambda::Function", toType: "AWS::EC2::Route" },
+  { fromType: "AWS::Lambda::Function", toType: "AWS::EC2::SubnetRouteTableAssociation" },
+  // Lambda::Url is just a deterministic URL derivation off the function; it
+  // doesn't need the function's runtime egress to exist.
+  { fromType: "AWS::Lambda::Url", toType: "AWS::EC2::Route" },
+  { fromType: "AWS::Lambda::Url", toType: "AWS::EC2::SubnetRouteTableAssociation" },
+  // EventSourceMapping just registers the wire-up; AWS handles delivery
+  // async and will retry once the function reaches Active.
+  { fromType: "AWS::Lambda::EventSourceMapping", toType: "AWS::EC2::Route" },
+  {
+    fromType: "AWS::Lambda::EventSourceMapping",
+    toType: "AWS::EC2::SubnetRouteTableAssociation"
+  }
+];
+function defensiveDependsOnToSkip(resource, template) {
+  const skip = /* @__PURE__ */ new Set();
+  if (!resource.DependsOn) {
+    return skip;
+  }
+  const dependsOn = Array.isArray(resource.DependsOn) ? resource.DependsOn : [resource.DependsOn];
+  for (const dep of dependsOn) {
+    if (typeof dep !== "string")
+      continue;
+    const target = template.Resources[dep];
+    if (!target)
+      continue;
+    const fromType = resource.Type;
+    const toType = target.Type;
+    if (!fromType || !toType)
+      continue;
+    const matched = DEFENSIVE_DEPENDS_ON_TYPE_PAIRS.some(
+      (pair) => pair.fromType === fromType && pair.toType === toType
+    );
+    if (matched) {
+      skip.add(dep);
+    }
+  }
+  return skip;
+}
+
 // src/analyzer/dag-builder.ts
 var { Graph, alg } = graphlib;
 var IAM_ROLE_POLICY_TYPES = /* @__PURE__ */ new Set([
@@ -3944,6 +3996,10 @@ var IAM_ROLE_POLICY_TYPES = /* @__PURE__ */ new Set([
 var DagBuilder = class {
   logger = getLogger().child("DagBuilder");
   parser = new TemplateParser();
+  options;
+  constructor(options = {}) {
+    this.options = options;
+  }
   /**
    * Build dependency graph from CloudFormation template
    *
@@ -3962,13 +4018,22 @@ var DagBuilder = class {
     });
     this.logger.debug(`Total nodes: ${resourceIds.length}`);
     let edgeCount = 0;
+    let relaxedEdgeCount = 0;
     for (const logicalId of resourceIds) {
       const resource = this.parser.getResource(template, logicalId);
       if (!resource) {
         continue;
       }
       const dependencies = this.parser.extractDependencies(resource);
+      const skip = this.options.relaxCdkVpcDefensiveDeps ? defensiveDependsOnToSkip(resource, template) : null;
       for (const depId of dependencies) {
+        if (skip?.has(depId)) {
+          relaxedEdgeCount++;
+          this.logger.debug(
+            `Skipped CDK-defensive DependsOn edge: ${depId} -> ${logicalId} (--aggressive-vpc-parallel)`
+          );
+          continue;
+        }
         if (graph.hasNode(depId)) {
           graph.setEdge(depId, logicalId);
           edgeCount++;
@@ -3980,6 +4045,11 @@ var DagBuilder = class {
         }
       }
     }
+    if (relaxedEdgeCount > 0) {
+      this.logger.info(
+        `[DagBuilder] Relaxed ${relaxedEdgeCount} CDK-defensive DependsOn edge(s) (--aggressive-vpc-parallel)`
+      );
+    }
     this.logger.debug(`Dependency graph built: ${resourceIds.length} nodes, ${edgeCount} edges`);
     edgeCount += this.addCustomResourcePolicyEdges(graph, template);
     edgeCount += this.addLambdaVpcEdges(graph, template);