@go-to-k/cdkd 0.94.0 → 0.94.2

package/dist/cli.js

@@ -80029,7 +80029,8 @@ var PRIMARY_IDENTIFIER_FALLBACK = {
 };
 var COMPOSITE_ID_SPLITTERS = {
   // cdkd stores `restApiId|resourceId|httpMethod` (apigateway-provider.ts);
-  // CFn primary identifier is [RestApiId, ResourceId, HttpMethod] — same order.
+  // CFn primary identifier is [RestApiId, ResourceId, HttpMethod] — same
+  // order, and all three are writable Properties of AWS::ApiGateway::Method.
   "AWS::ApiGateway::Method": (id) => {
     const parts = id.split("|");
     if (parts.length !== 3) {
@@ -80037,26 +80038,119 @@ var COMPOSITE_ID_SPLITTERS = {
         `expected 3 parts (restApiId|resourceId|httpMethod), got ${parts.length}: '${id}'`
       );
     }
-    return { RestApiId: parts[0], ResourceId: parts[1], HttpMethod: parts[2] };
+    const map = { RestApiId: parts[0], ResourceId: parts[1], HttpMethod: parts[2] };
+    return { resourceIdentifier: map };
   },
   // cdkd stores `restApiId|resourceId` (apigateway-provider.ts);
-  // CFn primary identifier is [RestApiId, ResourceId].
+  // CFn primary identifier is [RestApiId, ResourceId] — both are writable
+  // Properties of AWS::ApiGateway::Resource.
   "AWS::ApiGateway::Resource": (id) => {
     const parts = id.split("|");
     if (parts.length !== 2) {
       throw new Error(`expected 2 parts (restApiId|resourceId), got ${parts.length}: '${id}'`);
     }
-    return { RestApiId: parts[0], ResourceId: parts[1] };
+    const map = { RestApiId: parts[0], ResourceId: parts[1] };
+    return { resourceIdentifier: map };
   },
   // cdkd stores `IGW|VpcId` (ec2-provider.ts);
   // CFn primary identifier is [VpcId, InternetGatewayId] — DIFFERENT order
-  // from cdkd. Splitter reorders explicitly.
+  // from cdkd. Splitter reorders explicitly. Both are writable Properties.
   "AWS::EC2::VPCGatewayAttachment": (id) => {
     const parts = id.split("|");
     if (parts.length !== 2) {
       throw new Error(`expected 2 parts (IGW|VpcId), got ${parts.length}: '${id}'`);
     }
-    return { VpcId: parts[1], InternetGatewayId: parts[0] };
+    const map = { VpcId: parts[1], InternetGatewayId: parts[0] };
+    return { resourceIdentifier: map };
+  },
+  // cdkd stores just `IntegrationId` (apigatewayv2-provider.ts); the parent
+  // `ApiId` lives in cdkd state's properties (`properties.ApiId`). CFn primary
+  // identifier is [ApiId, IntegrationId]. ApiId IS a writable Property
+  // (already in synth template via Ref); IntegrationId is tagged
+  // `readOnlyProperties: ['/properties/IntegrationId']` in the CFn schema —
+  // exclude it from propertiesOverlay so CFn doesn't reject writing a
+  // read-only property at changeset-create.
+  "AWS::ApiGatewayV2::Integration": (physicalId, properties) => {
+    const apiId = readStringProperty(properties, "ApiId", "AWS::ApiGatewayV2::Integration");
+    return {
+      resourceIdentifier: { ApiId: apiId, IntegrationId: physicalId },
+      propertiesOverlay: { ApiId: apiId }
+    };
+  },
+  // cdkd stores just `RouteId` (apigatewayv2-provider.ts); parent `ApiId`
+  // comes from properties. CFn primary identifier is [ApiId, RouteId]. Same
+  // overlay narrowing as Integration above.
+  "AWS::ApiGatewayV2::Route": (physicalId, properties) => {
+    const apiId = readStringProperty(properties, "ApiId", "AWS::ApiGatewayV2::Route");
+    return {
+      resourceIdentifier: { ApiId: apiId, RouteId: physicalId },
+      propertiesOverlay: { ApiId: apiId }
+    };
+  },
+  // NOTE: `AWS::ApiGatewayV2::Stage` is intentionally NOT in this map.
+  // (1) AWS reports its primaryIdentifier as `['/properties/Id']` (single-key),
+  //     so cdkd's single-key resolution path handles it without a splitter.
+  // (2) But AWS CloudFormation does NOT support `AWS::ApiGatewayV2::Stage` in
+  //     IMPORT changesets (CreateChangeSet rejects with "ResourceTypes
+  //     [AWS::ApiGatewayV2::Stage] are not supported for Import"). This means
+  //     `cdkd export` cannot complete on any stack that includes an HttpApi
+  //     (CDK auto-creates a `$default` Stage). Tracked in a follow-up issue
+  //     (link in PR description); the workaround design is open
+  //     (pre-delete + phase-2-CREATE vs hard-block-with-clear-error).
+  // cdkd stores `StatementId` (lambda-permission-provider.ts:124); for state
+  // entries written by the older CC-API path (pre-SDK-provider), physicalId
+  // may instead be the legacy `<functionArn>|<statementId>` shape — the
+  // provider's own delete / update / getAttribute paths normalize via
+  // `physicalId.split('|').pop()` (see lambda-permission-provider.ts:160 /
+  // 222 / 290). Mirror that here so legacy state still produces the
+  // correct CFn Id field; otherwise CFn IMPORT's identifier-match would
+  // compare `Id: '<arn>|<sid>'` against the AWS-current Sid and reject.
+  //
+  // CFn primary identifier is [FunctionName, Id] (note: CFn schema calls
+  // the field `Id`, not `StatementId`). FunctionName IS a writable
+  // Property; `Id` is tagged `readOnlyProperties: ['/properties/Id']` in
+  // the CFn schema (it's set at create time by AWS, not by the user).
+  // Narrow overlay to FunctionName so CFn doesn't reject writing read-only
+  // `Id` at changeset-create.
+  "AWS::Lambda::Permission": (physicalId, properties) => {
+    const functionName = readStringProperty(properties, "FunctionName", "AWS::Lambda::Permission");
+    const statementId = physicalId.includes("|") ? physicalId.split("|").pop() : physicalId;
+    return {
+      resourceIdentifier: { FunctionName: functionName, Id: statementId },
+      propertiesOverlay: { FunctionName: functionName }
+    };
+  }
+};
+function readStringProperty(properties, key, resourceType) {
+  const v = properties[key];
+  if (typeof v !== "string" || !v) {
+    throw new Error(
+      `cdkd state's properties for ${resourceType} is missing '${key}' (the parent identifier required to build the CFn ResourceIdentifier map). State entry may be corrupt or written by an older cdkd binary; re-deploy the resource to refresh state.`
+    );
+  }
+  return v;
+}
+var IMPORT_UNSUPPORTED_RECREATABLE_TYPES = /* @__PURE__ */ new Set([
+  "AWS::ApiGatewayV2::Stage"
+]);
+var PRE_DELETE_HANDLERS = {
+  "AWS::ApiGatewayV2::Stage": async (entry) => {
+    const { ApiGatewayV2Client: ApiGatewayV2Client2, DeleteStageCommand: DeleteStageCommand3, NotFoundException: NotFoundException7 } = await import("@aws-sdk/client-apigatewayv2");
+    const apiId = entry.properties["ApiId"];
+    if (typeof apiId !== "string" || !apiId) {
+      throw new Error(
+        `cdkd state's properties for ${entry.logicalId} (${entry.resourceType}) is missing 'ApiId'`
+      );
+    }
+    const client = new ApiGatewayV2Client2({});
+    try {
+      await client.send(new DeleteStageCommand3({ ApiId: apiId, StageName: entry.physicalId }));
+    } catch (err) {
+      if (err instanceof NotFoundException7) {
+        return;
+      }
+      throw err;
+    }
   }
 };
 async function exportCommand(stackArg, options) {
@@ -80172,10 +80266,13 @@ async function exportCommand(stackArg, options) {
       }
     }
     try {
-      const { phase1Imports, phase2Creates, blocked } = await buildImportPlan(
+      const { phase1Imports, phase2Creates, recreateBeforePhase2, blocked } = await buildImportPlan(
         state,
         template,
-        awsClients.cloudFormation
+        awsClients.cloudFormation,
+        {
+          recreateImportUnsupported: options.recreateImportUnsupported
+        }
       );
       if (blocked.length > 0) {
         logger.error("The following resources block migration:");
@@ -80195,7 +80292,7 @@ async function exportCommand(stackArg, options) {
           `${phase2Creates.length} non-importable resource(s) detected (Custom::*). Pass --include-non-importable to run a 2-phase migration: phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones (re-invoking each Custom Resource's backing Lambda onCreate handler \u2014 make sure those are idempotent). Or destroy these resources first.`
         );
       }
-      if (phase1Imports.length === 0 && phase2Creates.length === 0) {
+      if (phase1Imports.length === 0 && phase2Creates.length === 0 && recreateBeforePhase2.length === 0) {
         logger.warn("No resources to migrate \u2014 cdkd state is empty.");
         return;
       }
@@ -80212,14 +80309,28 @@ async function exportCommand(stackArg, options) {
         }
         logger.info("");
       }
+      if (recreateBeforePhase2.length > 0) {
+        logger.info(
+          `Phase 2 will also re-CREATE ${recreateBeforePhase2.length} IMPORT-unsupported resource(s) after cdkd deletes the AWS-side resource:`
+        );
+        for (const r of recreateBeforePhase2) {
+          logger.info(`  ${r.logicalId} (${r.resourceType}) \u2014 physicalId: ${r.physicalId}`);
+        }
+        logger.info(
+          "  Brief unavailability window (~10s for Stage; HttpApi endpoint URL is unchanged because it embeds ApiId, not StageName). Pass --no-recreate-import-unsupported to block instead."
+        );
+        logger.info("");
+      }
       if (options.dryRun) {
         logger.info("--dry-run: no CloudFormation changeset will be created.");
         return;
       }
       if (!options.yes) {
         const phase2Note = phase2Creates.length > 0 ? ` Phase 2 will then CREATE ${phase2Creates.length} non-importable resource(s) (invoking each Custom Resource's onCreate handler).` : "";
+        const recreateNote = recreateBeforePhase2.length > 0 ? ` cdkd will also DELETE ${recreateBeforePhase2.length} AWS resource(s) between phases so CFn can re-CREATE them in phase 2 (brief unavailability window \u2014 see plan above for the affected resources).` : "";
+        const unchangedClaim = recreateBeforePhase2.length > 0 ? ` All other AWS resources are unchanged on import.` : ` AWS resources are unchanged on import.`;
         const ok = await confirmPrompt6(
-          `Create CloudFormation stack '${cfnStackName}' by importing ${phase1Imports.length} resource(s) from cdkd state '${resolvedStackName}' (${targetRegion})?` + phase2Note + ` AWS resources are unchanged on import. cdkd state for '${resolvedStackName}' will be deleted on success.`
+          `Create CloudFormation stack '${cfnStackName}' by importing ${phase1Imports.length} resource(s) from cdkd state '${resolvedStackName}' (${targetRegion})?` + phase2Note + recreateNote + unchangedClaim + ` cdkd state for '${resolvedStackName}' will be deleted on success.`
         );
         if (!ok) {
           logger.info("Migration cancelled. cdkd state and CloudFormation are unchanged.");
@@ -80273,7 +80384,42 @@ async function exportCommand(stackArg, options) {
       logger.info(
         `\u2713 Phase 1: CloudFormation stack '${cfnStackName}' created via IMPORT. ${phase1Imports.length} resource(s) imported.`
       );
-      if (phase2Creates.length > 0) {
+      if (recreateBeforePhase2.length > 0) {
+        for (const entry of recreateBeforePhase2) {
+          const handler = PRE_DELETE_HANDLERS[entry.resourceType];
+          if (!handler) {
+            throw new Error(
+              `No pre-delete handler registered for ${entry.resourceType} (${entry.logicalId}). This is a cdkd bug \u2014 the resource is in IMPORT_UNSUPPORTED_RECREATABLE_TYPES but lacks a PRE_DELETE_HANDLERS entry. Phase 1 IMPORT already succeeded; cdkd state is intact. To recover, delete the AWS resource manually and run the phase 2 UPDATE.`
+            );
+          }
+          logger.info(
+            `Pre-deleting AWS resource for ${entry.logicalId} (${entry.resourceType}) so CFn can re-CREATE in phase 2...`
+          );
+          try {
+            await handler(entry);
+            logger.info(`  \u2713 deleted ${entry.physicalId}`);
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new Error(
+              `Phase 1 (IMPORT) succeeded; pre-delete of ${entry.logicalId} (${entry.resourceType}, physicalId: ${entry.physicalId}) failed: ${msg}
+
+The CloudFormation stack '${cfnStackName}' contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work \u2014 the existing-stack check rejects it. To recover manually:
+  1. Fix the failure cause (typically IAM permissions for the underlying      AWS API \u2014 e.g. apigatewayv2:DeleteStage for AWS::ApiGatewayV2::Stage).
+  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:
+       aws apigatewayv2 delete-stage --api-id <ApiId> --stage-name <StageName>
+     (one per entry in the pre-delete list logged above).
+  3. Run the phase-2 UPDATE manually with the full synth template:
+       aws cloudformation create-change-set --stack-name ${cfnStackName} \\
+         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\
+         --template-body file://<full-template.json>
+  4. Once phase 2 succeeds, run: cdkd state orphan ${resolvedStackName}
+     to clean up cdkd's stale state record.`
+            );
+          }
+        }
+      }
+      const phase2Count = phase2Creates.length + recreateBeforePhase2.length;
+      if (phase2Count > 0) {
         try {
           await executeUpdateChangeSet(
             awsClients.cloudFormation,
@@ -80281,14 +80427,23 @@ async function exportCommand(stackArg, options) {
             template,
             cfnParameters
           );
-          logger.info(`\u2713 Phase 2: ${phase2Creates.length} non-importable resource(s) CREATEd.`);
+          const parts = [];
+          if (phase2Creates.length > 0) {
+            parts.push(`${phase2Creates.length} non-importable resource(s) CREATEd`);
+          }
+          if (recreateBeforePhase2.length > 0) {
+            parts.push(`${recreateBeforePhase2.length} IMPORT-unsupported resource(s) re-CREATEd`);
+          }
+          logger.info(`\u2713 Phase 2: ${parts.join("; ")}.`);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
+          const recreateNote = recreateBeforePhase2.length > 0 ? `  - cdkd deleted ${recreateBeforePhase2.length} AWS resource(s) before phase 2 (Stage etc.). They are gone in AWS but absent from the CFn stack. Running phase 2 UPDATE manually will CFn-CREATE them fresh.
+` : "";
           throw new Error(
             `Phase 1 (IMPORT) succeeded; phase 2 (UPDATE) failed: ${msg}
 
-The CloudFormation stack '${cfnStackName}' now contains the imported resources but is missing the ${phase2Creates.length} non-importable resource(s). cdkd state is UNCHANGED so you can inspect what's in it, but DO NOT run \`cdkd deploy\` against this stack (the imported resources are now CFn-managed). To recover:
-  1. Fix the failure cause (typically an onCreate Lambda error).
+The CloudFormation stack '${cfnStackName}' now contains the imported resources but is missing ${phase2Count} resource(s) (${phase2Creates.length} Custom Resource(s) + ${recreateBeforePhase2.length} IMPORT-unsupported). cdkd state is UNCHANGED so you can inspect what's in it, but DO NOT run \`cdkd deploy\` against this stack (the imported resources are now CFn-managed). To recover:
+` + recreateNote + `  1. Fix the failure cause (typically an onCreate Lambda error).
   2. Re-run the phase 2 UPDATE manually with the full synth template:
        aws cloudformation create-change-set --stack-name ${cfnStackName} \\
          --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\
@@ -80396,13 +80551,14 @@ async function assertCfnStackAbsent(cfnClient, stackName) {
 function isPhase2CreatableType(resourceType) {
   return isCustomResourceType(resourceType);
 }
-async function buildImportPlan(state, template, cfnClient) {
+async function buildImportPlan(state, template, cfnClient, options = { recreateImportUnsupported: true }) {
   const templateResources = template["Resources"];
   if (!templateResources || typeof templateResources !== "object" || Array.isArray(templateResources)) {
     throw new Error("Template has no Resources section.");
   }
   const phase1Imports = [];
   const phase2Creates = [];
+  const recreateBeforePhase2 = [];
   const blocked = [];
   const identifierCache = /* @__PURE__ */ new Map();
   for (const [logicalId, raw] of Object.entries(templateResources)) {
@@ -80436,11 +80592,29 @@ async function buildImportPlan(state, template, cfnClient) {
       });
       continue;
     }
-    let resourceIdentifier;
+    if (IMPORT_UNSUPPORTED_RECREATABLE_TYPES.has(resourceType)) {
+      if (options.recreateImportUnsupported) {
+        recreateBeforePhase2.push({
+          logicalId,
+          resourceType,
+          physicalId: stateEntry.physicalId,
+          properties: stateEntry.properties ?? {}
+        });
+      } else {
+        blocked.push({
+          logicalId,
+          resourceType,
+          reason: `AWS CloudFormation does not support ${resourceType} in IMPORT changesets (${resourceType} has no IMPORT handler). Re-run without --no-recreate-import-unsupported to let cdkd delete the AWS-side resource before phase 2 (CFn will then CREATE it fresh; brief unavailability window).`
+        });
+      }
+      continue;
+    }
+    let resolved;
     try {
-      resourceIdentifier = await resolveResourceIdentifier(
+      resolved = await resolveResourceIdentifier(
         resourceType,
         stateEntry.physicalId,
+        stateEntry.properties ?? {},
         cfnClient,
         identifierCache
       );
@@ -80456,19 +80630,21 @@ async function buildImportPlan(state, template, cfnClient) {
       logicalId,
       resourceType,
       physicalId: stateEntry.physicalId,
-      resourceIdentifier
+      resourceIdentifier: resolved.resourceIdentifier,
+      propertiesOverlay: resolved.propertiesOverlay ?? resolved.resourceIdentifier
     });
   }
-  return { phase1Imports, phase2Creates, blocked };
+  return { phase1Imports, phase2Creates, recreateBeforePhase2, blocked };
 }
-async function resolveResourceIdentifier(resourceType, physicalId, cfnClient, cache2) {
+async function resolveResourceIdentifier(resourceType, physicalId, properties, cfnClient, cache2) {
   let entry = cache2.get(resourceType);
   if (entry === void 0) {
     entry = await fetchPrimaryIdentifier(resourceType, cfnClient);
     cache2.set(resourceType, entry);
   }
   if (entry.fields.length === 1) {
-    return { [entry.fields[0]]: physicalId };
+    const map = { [entry.fields[0]]: physicalId };
+    return { resourceIdentifier: map };
   }
   const splitter = COMPOSITE_ID_SPLITTERS[resourceType];
   if (!splitter) {
@@ -80476,22 +80652,22 @@ async function resolveResourceIdentifier(resourceType, physicalId, cfnClient, ca
       `resource type uses a composite primary identifier (${entry.fields.length} fields: ${entry.fields.join(", ")}); add an entry to COMPOSITE_ID_SPLITTERS in src/cli/commands/export.ts that parses cdkd's physicalId for this type, or destroy the resource first and let CFn create it fresh`
     );
   }
-  let split;
+  let result;
   try {
-    split = splitter(physicalId);
+    result = splitter(physicalId, properties);
   } catch (err) {
     throw new Error(
       `composite-id splitter for ${resourceType} failed: ` + (err instanceof Error ? err.message : String(err))
     );
   }
   for (const f of entry.fields) {
-    if (!(f in split)) {
+    if (!(f in result.resourceIdentifier)) {
       throw new Error(
-        `composite-id splitter for ${resourceType} did not produce field '${f}' (produced: ${Object.keys(split).join(", ")})`
+        `composite-id splitter for ${resourceType} did not produce field '${f}' (produced: ${Object.keys(result.resourceIdentifier).join(", ")})`
       );
     }
   }
-  return split;
+  return result;
 }
 async function fetchPrimaryIdentifier(resourceType, cfnClient) {
   try {
@@ -80614,7 +80790,8 @@ function overlayResourceIdentifierOnProperties(resource, entry) {
   const r = resource;
   const existingProperties = r["Properties"];
   const properties = existingProperties && typeof existingProperties === "object" && !Array.isArray(existingProperties) ? { ...existingProperties } : {};
-  for (const [field, value] of Object.entries(entry.resourceIdentifier)) {
+  const overlay = entry.propertiesOverlay ?? entry.resourceIdentifier;
+  for (const [field, value] of Object.entries(overlay)) {
     properties[field] = value;
   }
   return { ...r, Properties: properties };
@@ -80944,6 +81121,9 @@ function createExportCommand() {
     "--strict-cross-stack",
     "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns but proceeds \u2014 the user is expected to migrate the consumer stacks in a follow-up.",
     false
+  ).option(
+    "--no-recreate-import-unsupported",
+    "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead."
   ).action(withErrorHandling(exportCommand));
   [...commonOptions, ...appOptions, ...stateOptions, ...contextOptions].forEach(
     (opt) => cmd.addOption(opt)
@@ -80982,7 +81162,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command18();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.94.0");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.94.2");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());