@go-to-k/cdkd 0.93.0 → 0.94.1

package/README.md

@@ -455,44 +455,82 @@ Both `cdkd destroy` (synth-driven) and `cdkd state destroy`
 
 ## Stack-name prefix on physical names
 
-cdkd prepends the **stack name** to physical names you declare in CDK
-code: `new iam.Role(this, 'CRRole', { roleName: 'my-role' })` in stack
-`MyStack` is created in AWS as `MyStack-my-role`. The prefix protects
-cross-stack uniqueness (two stacks declaring `roleName: 'my-role'`
-otherwise collide on a single AWS account). Pre-PR this behavior was
-**inconsistent**: only IAM Role / User / Group / InstanceProfile and
-ELBv2 LoadBalancer / TargetGroup actually got the prefix; Lambda, S3,
-SNS, SQS, DynamoDB, etc. used the user's declared name as-is.
-
-`cdkd deploy --no-prefix-user-supplied-names` opts in to skipping
-the prefix on user-declared physical names, making cdkd consistent
-across all resource types. Off by default for backward compatibility.
-
-| | Default (no flag) | `--no-prefix-user-supplied-names` |
+By default cdkd creates AWS resources with the **exact name you
+declared** in CDK code: `new iam.Role(this, 'CRRole', { roleName:
+'my-role' })` in stack `MyStack` produces an AWS resource named
+`my-role`. Consistent across every resource type. This is the
+default since **v0.94.0** (closes [#299](https://github.com/go-to-k/cdkd/issues/299)).
+
+Pre-v0.94.0 cdkd prepended the stack name to user-declared physical
+names on a subset of types only (Pattern B providers: IAM Role /
+User / Group / InstanceProfile / ELBv2 LoadBalancer / TargetGroup),
+while Pattern A providers (Lambda, S3, SNS, SQS, DynamoDB, etc.) used
+the user's name as-is. The inconsistency was opaque to users and
+surfaced as failures in `cdkd export` (CFn IMPORT identifier
+mismatch). Flipping the default brings every resource type into line
+out of the box.
+
+`cdkd deploy --prefix-user-supplied-names` opts BACK in to the
+legacy prefixing on Pattern B providers (matching pre-v0.94.0 cdkd).
+Useful when migrating an existing stack that was originally deployed
+under the legacy default and you don't want to take a one-time
+replacement on every Pattern B resource.
+
+| | Default (no flag) | `--prefix-user-supplied-names` |
 | --- | --- | --- |
-| `new iam.Role({ roleName: 'my-role' })` | `MyStack-my-role` | `my-role` |
-| `new s3.Bucket({ bucketName: 'my-bucket' })` | `my-bucket` (already no prefix — Pattern A) | `my-bucket` (unchanged) |
-| `new iam.Role(...)` (no `roleName`) | `MyStack-CRRole-<hash>` (auto-generated, prefix kept for uniqueness) | `MyStack-CRRole-<hash>` (unchanged) |
-
-Resolution chain (highest wins): `--no-prefix-user-supplied-names`
-CLI flag → `CDKD_NO_PREFIX_USER_SUPPLIED_NAMES=true` env var →
-`cdk.json` `context.cdkd.noPrefixUserSuppliedNames: true` → default
-`false`.
-
-Affects `cdkd deploy` only. Already-deployed stacks deployed under
-the legacy prefixed-name scheme keep working — the flag only controls
-what AWS resource cdkd creates on **future** deploys. Switching the
-flag mid-flight on an existing stack would propose REPLACEMENT on
-every Pattern B resource (the existing AWS resource has the prefixed
-name; the new template intent has the un-prefixed name).
-
-Surfaced by [PR #285 `cdkd export`](https://github.com/go-to-k/cdkd/pull/285)
-where the CFn IMPORT changeset's identifier check would fail on a
-synth `RoleName: 'my-role'` vs the AWS-deployed `MyStack-my-role`;
-the export command currently overlays `ResourceIdentifier` onto
-`Properties` to bridge the gap. A future major-version PR will flip
-the default of `--no-prefix-user-supplied-names` to `true`, after
-which the overlay can be dropped.
+| `new iam.Role({ roleName: 'my-role' })` | `my-role` | `MyStack-my-role` (legacy) |
+| `new s3.Bucket({ bucketName: 'my-bucket' })` | `my-bucket` (always — Pattern A) | `my-bucket` (unchanged) |
+| `new iam.Role(...)` (no `roleName`) | `MyStack-CRRole-<hash>` (auto-generated; prefix kept for uniqueness) | `MyStack-CRRole-<hash>` (unchanged) |
+
+Resolution chain (highest wins): `--prefix-user-supplied-names`
+CLI flag → `CDKD_PREFIX_USER_SUPPLIED_NAMES=true` env var →
+`cdk.json` `context.cdkd.prefixUserSuppliedNames: true` → default
+`false` (skip prefix).
+
+The deprecated `--no-prefix-user-supplied-names` flag (plus the
+`CDKD_NO_PREFIX_USER_SUPPLIED_NAMES` env var and `cdk.json
+context.cdkd.noPrefixUserSuppliedNames`) is still accepted but now
+matches the default; setting it emits a deprecation warning and is a
+no-op. Remove it from your CLI invocations and config.
+
+### Migration from pre-v0.94.0
+
+This is a **breaking change**: upgrading from a pre-v0.94.0 cdkd to
+v0.94.0+ flips the AWS-resource name cdkd produces on Pattern B
+providers (IAM Role / User / Group / InstanceProfile / ELBv2 LB / TG)
+with user-supplied physical names. The next `cdkd deploy` against an
+existing stack will propose REPLACEMENT on every such resource —
+the AWS resource has the prefixed name; the new template intent has
+the un-prefixed name.
+
+Pick one of:
+
+1. **Accept the one-time replacement** (simplest; only safe when the
+   types involved tolerate replacement — IAM Roles get fresh ARNs,
+   ELBv2 LBs get fresh DNS names).
+2. **Pin legacy prefixing**: pass `--prefix-user-supplied-names`,
+   set `CDKD_PREFIX_USER_SUPPLIED_NAMES=true`, or add
+   `"prefixUserSuppliedNames": true` under `cdk.json` `context.cdkd`.
+3. **Drop the explicit physical name** in CDK code where you don't
+   actually need a stable name — `new iam.Role(...)` without
+   `roleName` always uses the auto-generated `MyStack-CRRole-<hash>`
+   form regardless of this flag.
+
+A migration helper (`cdkd state rename-strip-prefix <stack>`) that
+would let an existing stack adopt the new default without replacement
+is tracked separately in [#300](https://github.com/go-to-k/cdkd/issues/300).
+
+### Effect on `cdkd export`
+
+[PR #285 `cdkd export`](https://github.com/go-to-k/cdkd/pull/285)
+surfaced the pre-v0.94.0 inconsistency: the CFn IMPORT changeset's
+identifier check would fail on a synth `RoleName: 'my-role'` vs the
+AWS-deployed `MyStack-my-role`, so the export command overlays
+`ResourceIdentifier` onto `Properties` to bridge the gap. The
+overlay is still needed for stacks deployed under the legacy default
+(or with `--prefix-user-supplied-names`); a fresh stack deployed
+under the v0.94.0 default has matching names and the overlay is a
+no-op for it.
 
 ## `--remove-protection`: one-shot bypass for protected resources
 

package/dist/cli.js

@@ -23396,9 +23396,20 @@ var deployOptions = [
     "Skip capturing AWS-current properties after each create/update (adds a fire-and-forget readCurrentState per resource so cdkd drift can compare against the real deploy-time AWS snapshot instead of the template). On by default. Disable when deploy speed matters more than rich drift detection \u2014 falls back to comparing against template properties (the pre-v3 behavior)."
   ),
   new Option(
-    "--no-prefix-user-supplied-names",
-    'Do NOT prepend the stack name to physical names the user explicitly supplied in their CDK code (e.g. `new iam.Role(this, "X", { roleName: "my-role" })` \u2192 AWS resource named `my-role` instead of `MyStack-my-role`). Auto-generated-name resources (where the user did not declare a physical name) keep the prefix unchanged. Off by default for backward compatibility; enable via this flag, CDKD_NO_PREFIX_USER_SUPPLIED_NAMES=true, or cdk.json context.cdkd.noPrefixUserSuppliedNames=true. Applies to `cdkd deploy` only.'
-  ),
+    "--prefix-user-supplied-names",
+    'Opt in to LEGACY behavior: prepend the stack name to physical names the user explicitly supplied in their CDK code (e.g. `new iam.Role(this, "X", { roleName: "my-role" })` \u2192 AWS resource named `MyStack-my-role` instead of `my-role`). Since v0.94.0 the default is to NOT prefix user-supplied names \u2014 this flag restores the pre-v0.94.0 behavior on Pattern B providers (IAM Role / User / Group / InstanceProfile / ELBv2 LoadBalancer / TargetGroup). Enable via this flag, CDKD_PREFIX_USER_SUPPLIED_NAMES=true, or cdk.json context.cdkd.prefixUserSuppliedNames=true. Applies to `cdkd deploy` only.'
+  ).default(false),
+  // Note: the deprecated `--no-prefix-user-supplied-names` flag is NOT
+  // declared as a separate Option. Commander's automatic `--no-X`
+  // negation lets users still pass it without error — it negates the
+  // new `--prefix-user-supplied-names` flag, leaving its default
+  // `false` (= skip prefix) unchanged, which matches the v0.94.0
+  // default. Detection of the literal `--no-prefix-user-supplied-names`
+  // flag for the deprecation warning happens via the pre-parse argv
+  // walk in `warnDeprecatedNoPrefixCliFlag` (src/cli/config-loader.ts) —
+  // declaring both Options together would have collapsed both onto a
+  // single Commander key, making `noPrefixUserSuppliedNames` permanently
+  // `undefined` and silencing the warning.
   noWaitOption,
   aggressiveVpcParallelOption,
   new Option(
@@ -23543,18 +23554,44 @@ function resolveCaptureObservedState(cliValue) {
     return v;
   return true;
 }
-function resolveSkipPrefix(cliValue) {
-  if (cliValue === false)
-    return true;
-  const envValue = process.env["CDKD_NO_PREFIX_USER_SUPPLIED_NAMES"];
-  if (envValue === "true")
-    return true;
+function warnDeprecatedNoPrefixCliFlag(argv = process.argv) {
+  const seen = argv.some(
+    (a) => a === "--no-prefix-user-supplied-names" || a.startsWith("--no-prefix-user-supplied-names=")
+  );
+  if (seen) {
+    getLogger().warn(
+      "--no-prefix-user-supplied-names is deprecated since v0.94.0 \u2014 skipping the prefix is now the default. Remove the flag."
+    );
+  }
+}
+function resolveSkipPrefix(opts = {}) {
+  const logger = getLogger();
+  if (opts.prefixUserSuppliedNames === true) {
+    return false;
+  }
+  const envPrefix = process.env["CDKD_PREFIX_USER_SUPPLIED_NAMES"];
+  if (envPrefix === "true") {
+    return false;
+  }
   const cdkJson = loadCdkJson();
   const cdkdContext = cdkJson?.context?.["cdkd"];
-  const v = cdkdContext?.["noPrefixUserSuppliedNames"];
-  if (typeof v === "boolean" && v === true)
-    return true;
-  return false;
+  const v = cdkdContext?.["prefixUserSuppliedNames"];
+  if (typeof v === "boolean" && v === true) {
+    return false;
+  }
+  const deprecatedEnv = process.env["CDKD_NO_PREFIX_USER_SUPPLIED_NAMES"];
+  if (deprecatedEnv === "true") {
+    logger.warn(
+      "CDKD_NO_PREFIX_USER_SUPPLIED_NAMES is deprecated since v0.94.0 \u2014 skipping the prefix is now the default. Unset the env var."
+    );
+  }
+  const deprecatedCdkJson = cdkdContext?.["noPrefixUserSuppliedNames"];
+  if (typeof deprecatedCdkJson === "boolean" && deprecatedCdkJson === true) {
+    logger.warn(
+      "cdk.json context.cdkd.noPrefixUserSuppliedNames is deprecated since v0.94.0 \u2014 skipping the prefix is now the default. Remove the entry."
+    );
+  }
+  return true;
 }
 function resolveStateBucketWithSource(cliBucket) {
   if (cliBucket)
@@ -65557,10 +65594,17 @@ async function deployCommand(stacks, options) {
   if (!options.wait) {
     process.env["CDKD_NO_WAIT"] = "true";
   }
-  const skipPrefix = resolveSkipPrefix(options.prefixUserSuppliedNames);
+  warnDeprecatedNoPrefixCliFlag();
+  const skipPrefix = resolveSkipPrefix({
+    prefixUserSuppliedNames: options.prefixUserSuppliedNames
+  });
   if (skipPrefix) {
     logger.debug(
-      "Skipping stack-name prefix on user-supplied physical names (--no-prefix-user-supplied-names / CDKD_NO_PREFIX_USER_SUPPLIED_NAMES / cdk.json context.cdkd.noPrefixUserSuppliedNames)"
+      "Skipping stack-name prefix on user-supplied physical names (default since v0.94.0)"
+    );
+  } else {
+    logger.debug(
+      "Keeping legacy stack-name prefix on user-supplied physical names (--prefix-user-supplied-names / CDKD_PREFIX_USER_SUPPLIED_NAMES / cdk.json context.cdkd.prefixUserSuppliedNames)"
     );
   }
   const app = resolveApp(options.app);
@@ -79985,7 +80029,8 @@ var PRIMARY_IDENTIFIER_FALLBACK = {
 };
 var COMPOSITE_ID_SPLITTERS = {
   // cdkd stores `restApiId|resourceId|httpMethod` (apigateway-provider.ts);
-  // CFn primary identifier is [RestApiId, ResourceId, HttpMethod] — same order.
+  // CFn primary identifier is [RestApiId, ResourceId, HttpMethod] — same
+  // order, and all three are writable Properties of AWS::ApiGateway::Method.
   "AWS::ApiGateway::Method": (id) => {
     const parts = id.split("|");
     if (parts.length !== 3) {
@@ -79993,28 +80038,98 @@ var COMPOSITE_ID_SPLITTERS = {
         `expected 3 parts (restApiId|resourceId|httpMethod), got ${parts.length}: '${id}'`
       );
     }
-    return { RestApiId: parts[0], ResourceId: parts[1], HttpMethod: parts[2] };
+    const map = { RestApiId: parts[0], ResourceId: parts[1], HttpMethod: parts[2] };
+    return { resourceIdentifier: map };
   },
   // cdkd stores `restApiId|resourceId` (apigateway-provider.ts);
-  // CFn primary identifier is [RestApiId, ResourceId].
+  // CFn primary identifier is [RestApiId, ResourceId] — both are writable
+  // Properties of AWS::ApiGateway::Resource.
   "AWS::ApiGateway::Resource": (id) => {
     const parts = id.split("|");
     if (parts.length !== 2) {
       throw new Error(`expected 2 parts (restApiId|resourceId), got ${parts.length}: '${id}'`);
     }
-    return { RestApiId: parts[0], ResourceId: parts[1] };
+    const map = { RestApiId: parts[0], ResourceId: parts[1] };
+    return { resourceIdentifier: map };
   },
   // cdkd stores `IGW|VpcId` (ec2-provider.ts);
   // CFn primary identifier is [VpcId, InternetGatewayId] — DIFFERENT order
-  // from cdkd. Splitter reorders explicitly.
+  // from cdkd. Splitter reorders explicitly. Both are writable Properties.
   "AWS::EC2::VPCGatewayAttachment": (id) => {
     const parts = id.split("|");
     if (parts.length !== 2) {
       throw new Error(`expected 2 parts (IGW|VpcId), got ${parts.length}: '${id}'`);
     }
-    return { VpcId: parts[1], InternetGatewayId: parts[0] };
+    const map = { VpcId: parts[1], InternetGatewayId: parts[0] };
+    return { resourceIdentifier: map };
+  },
+  // cdkd stores just `IntegrationId` (apigatewayv2-provider.ts); the parent
+  // `ApiId` lives in cdkd state's properties (`properties.ApiId`). CFn primary
+  // identifier is [ApiId, IntegrationId]. ApiId IS a writable Property
+  // (already in synth template via Ref); IntegrationId is tagged
+  // `readOnlyProperties: ['/properties/IntegrationId']` in the CFn schema —
+  // exclude it from propertiesOverlay so CFn doesn't reject writing a
+  // read-only property at changeset-create.
+  "AWS::ApiGatewayV2::Integration": (physicalId, properties) => {
+    const apiId = readStringProperty(properties, "ApiId", "AWS::ApiGatewayV2::Integration");
+    return {
+      resourceIdentifier: { ApiId: apiId, IntegrationId: physicalId },
+      propertiesOverlay: { ApiId: apiId }
+    };
+  },
+  // cdkd stores just `RouteId` (apigatewayv2-provider.ts); parent `ApiId`
+  // comes from properties. CFn primary identifier is [ApiId, RouteId]. Same
+  // overlay narrowing as Integration above.
+  "AWS::ApiGatewayV2::Route": (physicalId, properties) => {
+    const apiId = readStringProperty(properties, "ApiId", "AWS::ApiGatewayV2::Route");
+    return {
+      resourceIdentifier: { ApiId: apiId, RouteId: physicalId },
+      propertiesOverlay: { ApiId: apiId }
+    };
+  },
+  // NOTE: `AWS::ApiGatewayV2::Stage` is intentionally NOT in this map.
+  // (1) AWS reports its primaryIdentifier as `['/properties/Id']` (single-key),
+  //     so cdkd's single-key resolution path handles it without a splitter.
+  // (2) But AWS CloudFormation does NOT support `AWS::ApiGatewayV2::Stage` in
+  //     IMPORT changesets (CreateChangeSet rejects with "ResourceTypes
+  //     [AWS::ApiGatewayV2::Stage] are not supported for Import"). This means
+  //     `cdkd export` cannot complete on any stack that includes an HttpApi
+  //     (CDK auto-creates a `$default` Stage). Tracked in a follow-up issue
+  //     (link in PR description); the workaround design is open
+  //     (pre-delete + phase-2-CREATE vs hard-block-with-clear-error).
+  // cdkd stores `StatementId` (lambda-permission-provider.ts:124); for state
+  // entries written by the older CC-API path (pre-SDK-provider), physicalId
+  // may instead be the legacy `<functionArn>|<statementId>` shape — the
+  // provider's own delete / update / getAttribute paths normalize via
+  // `physicalId.split('|').pop()` (see lambda-permission-provider.ts:160 /
+  // 222 / 290). Mirror that here so legacy state still produces the
+  // correct CFn Id field; otherwise CFn IMPORT's identifier-match would
+  // compare `Id: '<arn>|<sid>'` against the AWS-current Sid and reject.
+  //
+  // CFn primary identifier is [FunctionName, Id] (note: CFn schema calls
+  // the field `Id`, not `StatementId`). FunctionName IS a writable
+  // Property; `Id` is tagged `readOnlyProperties: ['/properties/Id']` in
+  // the CFn schema (it's set at create time by AWS, not by the user).
+  // Narrow overlay to FunctionName so CFn doesn't reject writing read-only
+  // `Id` at changeset-create.
+  "AWS::Lambda::Permission": (physicalId, properties) => {
+    const functionName = readStringProperty(properties, "FunctionName", "AWS::Lambda::Permission");
+    const statementId = physicalId.includes("|") ? physicalId.split("|").pop() : physicalId;
+    return {
+      resourceIdentifier: { FunctionName: functionName, Id: statementId },
+      propertiesOverlay: { FunctionName: functionName }
+    };
   }
 };
+function readStringProperty(properties, key, resourceType) {
+  const v = properties[key];
+  if (typeof v !== "string" || !v) {
+    throw new Error(
+      `cdkd state's properties for ${resourceType} is missing '${key}' (the parent identifier required to build the CFn ResourceIdentifier map). State entry may be corrupt or written by an older cdkd binary; re-deploy the resource to refresh state.`
+    );
+  }
+  return v;
+}
 async function exportCommand(stackArg, options) {
   const logger = getLogger();
   if (options.verbose) {
@@ -80392,11 +80507,12 @@ async function buildImportPlan(state, template, cfnClient) {
       });
       continue;
     }
-    let resourceIdentifier;
+    let resolved;
     try {
-      resourceIdentifier = await resolveResourceIdentifier(
+      resolved = await resolveResourceIdentifier(
         resourceType,
         stateEntry.physicalId,
+        stateEntry.properties ?? {},
         cfnClient,
         identifierCache
       );
@@ -80412,19 +80528,21 @@ async function buildImportPlan(state, template, cfnClient) {
       logicalId,
       resourceType,
       physicalId: stateEntry.physicalId,
-      resourceIdentifier
+      resourceIdentifier: resolved.resourceIdentifier,
+      propertiesOverlay: resolved.propertiesOverlay ?? resolved.resourceIdentifier
     });
   }
   return { phase1Imports, phase2Creates, blocked };
 }
-async function resolveResourceIdentifier(resourceType, physicalId, cfnClient, cache2) {
+async function resolveResourceIdentifier(resourceType, physicalId, properties, cfnClient, cache2) {
   let entry = cache2.get(resourceType);
   if (entry === void 0) {
     entry = await fetchPrimaryIdentifier(resourceType, cfnClient);
     cache2.set(resourceType, entry);
   }
   if (entry.fields.length === 1) {
-    return { [entry.fields[0]]: physicalId };
+    const map = { [entry.fields[0]]: physicalId };
+    return { resourceIdentifier: map };
   }
   const splitter = COMPOSITE_ID_SPLITTERS[resourceType];
   if (!splitter) {
@@ -80432,22 +80550,22 @@ async function resolveResourceIdentifier(resourceType, physicalId, cfnClient, ca
       `resource type uses a composite primary identifier (${entry.fields.length} fields: ${entry.fields.join(", ")}); add an entry to COMPOSITE_ID_SPLITTERS in src/cli/commands/export.ts that parses cdkd's physicalId for this type, or destroy the resource first and let CFn create it fresh`
     );
   }
-  let split;
+  let result;
   try {
-    split = splitter(physicalId);
+    result = splitter(physicalId, properties);
   } catch (err) {
     throw new Error(
       `composite-id splitter for ${resourceType} failed: ` + (err instanceof Error ? err.message : String(err))
     );
   }
   for (const f of entry.fields) {
-    if (!(f in split)) {
+    if (!(f in result.resourceIdentifier)) {
       throw new Error(
-        `composite-id splitter for ${resourceType} did not produce field '${f}' (produced: ${Object.keys(split).join(", ")})`
+        `composite-id splitter for ${resourceType} did not produce field '${f}' (produced: ${Object.keys(result.resourceIdentifier).join(", ")})`
       );
     }
   }
-  return split;
+  return result;
 }
 async function fetchPrimaryIdentifier(resourceType, cfnClient) {
   try {
@@ -80570,7 +80688,8 @@ function overlayResourceIdentifierOnProperties(resource, entry) {
   const r = resource;
   const existingProperties = r["Properties"];
   const properties = existingProperties && typeof existingProperties === "object" && !Array.isArray(existingProperties) ? { ...existingProperties } : {};
-  for (const [field, value] of Object.entries(entry.resourceIdentifier)) {
+  const overlay = entry.propertiesOverlay ?? entry.resourceIdentifier;
+  for (const [field, value] of Object.entries(overlay)) {
     properties[field] = value;
   }
   return { ...r, Properties: properties };
@@ -80938,7 +81057,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command18();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.93.0");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.94.1");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());