@go-to-k/cdkd 0.97.0 → 0.98.1

package/dist/{deploy-engine-Cl7v7Ml5.js → deploy-engine-D44ADMVs.js}

@@ -1074,6 +1074,44 @@ var StackTerminationProtectionError = class StackTerminationProtectionError exte
 	}
 };
 /**
+* `cdkd destroy <producer>` refused because at least one consumer stack
+* still records an `Fn::ImportValue` reference to one of the producer's
+* outputs. This matches CloudFormation's strong-reference semantics —
+* CFn rejects `DeleteStack` for an exporter while an importer exists.
+*
+* cdkd has no `--force` escape hatch for this (intentionally, mirroring
+* CFn). The error message lists every offending consumer and points the
+* user at the two valid resolution paths:
+*
+*  1. Destroy the consumer first: `cdkd destroy <consumer>`
+*  2. Remove the `Fn::ImportValue` from the consumer's template and
+*     redeploy, then retry the producer destroy.
+*
+* Weak-reference consumers (`Fn::GetStackOutput`, cdkd-specific) never
+* trigger this error by design — the producer stays deletable
+* independently of consumers when the user intentionally chose a weak
+* reference at template-authoring time.
+*
+* Exit code 2 (same as `PartialFailureError`) so multi-stack `cdkd
+* destroy --all` runs that partially succeed still surface as
+* non-zero without being indistinguishable from a fatal cdkd error.
+*/
+var StackHasActiveImportsError = class StackHasActiveImportsError extends CdkdError {
+	exitCode = 2;
+	producerStack;
+	producerRegion;
+	consumers;
+	constructor(producerStack, producerRegion, consumers, cause) {
+		const lines = consumers.map((c) => `  - ${c.consumerStack} (${c.consumerRegion}): imports export '${c.exportName}'`);
+		super(`Cannot destroy stack '${producerStack}' (${producerRegion}): the following stacks still import its outputs via Fn::ImportValue:\n${lines.join("\n")}\n\nThis matches CloudFormation's strong-reference semantics — exports are\nprotected as long as a consumer references them.\n\nTo proceed:\n  1. Destroy the consumer first: cdkd destroy <consumer-stack>\n  2. Or remove the Fn::ImportValue from the consumer's template\n     (e.g. inline the value, or refactor) and re-deploy the consumer,\n     then retry this destroy.\n\nNote: cdkd's Fn::GetStackOutput intrinsic is a weak alternative that\ndoes NOT protect the producer — use it when you intentionally want\nthe producer to be deletable independently of consumers.`, "STACK_HAS_ACTIVE_IMPORTS", cause);
+		this.producerStack = producerStack;
+		this.producerRegion = producerRegion;
+		this.consumers = consumers;
+		this.name = "StackHasActiveImportsError";
+		Object.setPrototypeOf(this, StackHasActiveImportsError.prototype);
+	}
+};
+/**
 * Signals that `cdkd local start-api`'s route discovery hit an unsupported
 * shape — non-AWS_PROXY integration, ApiGwV2 service integration
 * (`IntegrationSubtype` set), WebSocket protocol, Lambda::Url with
@@ -3272,7 +3310,8 @@ var AssetPublisher = class {
 const STATE_SCHEMA_VERSIONS_READABLE = [
 	1,
 	2,
-	3
+	3,
+	4
 ];
 
 //#endregion
@@ -3489,7 +3528,7 @@ var S3StateBackend = class {
 		const { expectedEtag, migrateLegacy } = options;
 		const body = {
 			...state,
-			version: 3,
+			version: 4,
 			stackName,
 			region
 		};
@@ -5607,6 +5646,16 @@ var IntrinsicFunctionResolver = class {
 		if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
 		if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
 		this.logger.debug(`Resolving Fn::ImportValue: ${exportName}`);
+		if (context.exportIndex) try {
+			const entry = await context.exportIndex.lookup(exportName);
+			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
+				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
+				this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(entry.value)} (from index: ${entry.producerStack} / ${entry.producerRegion})`);
+				return entry.value;
+			}
+		} catch (err) {
+			this.logger.warn(`Exports index lookup failed for '${exportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
+		}
 		const allStacks = await context.stateBackend.listStacks();
 		this.logger.debug(`Found ${allStacks.length} state record(s) to search for export: ${exportName}`);
 		for (const ref of allStacks) {
@@ -5630,6 +5679,14 @@ var IntrinsicFunctionResolver = class {
 				if (state.outputs && exportName in state.outputs) {
 					const value = state.outputs[exportName];
 					this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(value)} (from stack: ${refStack} / ${lookupRegion})`);
+					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
+						value,
+						producerStack: refStack,
+						producerRegion: lookupRegion
+					}).catch((err) => {
+						this.logger.debug(`Failed to patch exports index for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
+					});
+					this.recordImport(context, exportName, refStack, lookupRegion);
 					return value;
 				}
 			} catch (error) {
@@ -5640,6 +5697,39 @@ var IntrinsicFunctionResolver = class {
 		throw new Error(`Fn::ImportValue: export '${exportName}' not found in any stack. Searched ${allStacks.length} state record(s). Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
 	}
 	/**
+	* Push a resolved `Fn::ImportValue` into the consumer's recorded-imports
+	* bag (when supplied by the caller). Skips duplicates within the
+	* SAME bag — multiple references to the same `(exportName,
+	* sourceStack, sourceRegion)` triple emit one entry.
+	*
+	* Concurrency: the check + push pair is purely synchronous (no
+	* `await` between `some()` and `push()`), so the JS event loop
+	* cannot interleave a competing `recordImport` call between the
+	* dedup check and the append. The bag's lifetime is per-deploy
+	* (DeployEngine resets `this.recordedImports = []` at the top of
+	* each `deploy()` call), so the bag identity already serves as
+	* the dedup scope.
+	*
+	* Cross-context dedup: when callers share the same bag instance
+	* across multiple ResolverContext objects (the typical pattern —
+	* DeployEngine passes `this.recordedImports` into every resolver
+	* context it constructs), the dedup naturally extends across
+	* contexts because the `some()` reads the shared bag. Stashing
+	* the dedup Set on `context.recordedImports` directly via a
+	* property would break under `verbatimModuleSyntax`-style strict
+	* typing; the array scan stays O(N) where N is the per-deploy
+	* import count (typically < 20), which is fine.
+	*/
+	recordImport(context, exportName, producerStack, producerRegion) {
+		if (!context.recordedImports) return;
+		if (context.recordedImports.some((e) => e.exportName === exportName && e.sourceStack === producerStack && e.sourceRegion === producerRegion)) return;
+		context.recordedImports.push({
+			exportName,
+			sourceStack: producerStack,
+			sourceRegion: producerRegion
+		});
+	}
+	/**
 	* Resolve Fn::GetStackOutput (cross-stack / cross-region output reference)
 	*
 	* Shape: { "Fn::GetStackOutput": { "StackName": "...", "OutputName": "...",
@@ -8276,12 +8366,28 @@ var DeployEngine = class {
 	providerRegistry;
 	options;
 	/**
+	* Optional persistent exports index store. When supplied, all
+	* `Fn::ImportValue` resolutions in this deploy session prefer the
+	* O(1) index lookup over the per-stack state.json scan, and the
+	* consumer's `state.imports` field is populated for destroy-time
+	* strong-reference checks. Shared across DeployEngine instances in
+	* a single `cdkd deploy --all` invocation so the in-memory cache
+	* survives across stacks.
+	*/
+	exportIndexStore;
+	/**
+	* Per-deploy-session bag the resolver pushes resolved
+	* `Fn::ImportValue` entries into. Reset at the start of each
+	* `deploy()` call and persisted to `newState.imports` at the end.
+	*/
+	recordedImports = [];
+	/**
 	* Target region for this stack. Required — load-bearing for the
 	* region-prefixed S3 state key and recorded in state.json for
 	* cross-region destroy.
 	*/
 	stackRegion;
-	constructor(stateBackend, lockManager, dagBuilder, diffCalculator, providerRegistry, options = {}, stackRegion) {
+	constructor(stateBackend, lockManager, dagBuilder, diffCalculator, providerRegistry, options = {}, stackRegion, exportIndexStore) {
 		this.stateBackend = stateBackend;
 		this.lockManager = lockManager;
 		this.dagBuilder = dagBuilder;
@@ -8289,6 +8395,7 @@ var DeployEngine = class {
 		this.providerRegistry = providerRegistry;
 		this.options = options;
 		this.stackRegion = stackRegion;
+		this.exportIndexStore = exportIndexStore;
 		this.resolver = new IntrinsicFunctionResolver(stackRegion);
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
@@ -8302,9 +8409,28 @@ var DeployEngine = class {
 	* Deploy a CloudFormation template
 	*/
 	async deploy(stackName, template) {
+		this.recordedImports = [];
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
 	/**
+	* Resolver context with the imports-recording and exports-index
+	* fields wired in. Keeps the four+ inline context construction
+	* sites consistent — pass through callable as
+	* `this.buildResolverContext({...}, stackName)`.
+	*/
+	buildResolverContext(base, stackName) {
+		return {
+			template: base.template,
+			resources: base.resources,
+			...base.parameters && Object.keys(base.parameters).length > 0 && { parameters: base.parameters },
+			...base.conditions && Object.keys(base.conditions).length > 0 && { conditions: base.conditions },
+			stateBackend: this.stateBackend,
+			stackName,
+			...this.exportIndexStore && { exportIndex: this.exportIndexStore },
+			recordedImports: this.recordedImports
+		};
+	}
+	/**
 	* Kick off `provider.readCurrentState` for a freshly-created/updated
 	* resource without blocking the deploy critical path. The promise
 	* lands in `observedCaptureTasks` keyed by `logicalId`; the deploy's
@@ -8422,7 +8548,7 @@ var DeployEngine = class {
 		try {
 			const currentStateData = await this.stateBackend.getState(stackName, this.stackRegion);
 			const currentState = currentStateData?.state ?? {
-				version: 3,
+				version: 4,
 				region: this.stackRegion,
 				stackName,
 				resources: {},
@@ -8436,13 +8562,11 @@ var DeployEngine = class {
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
 			const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters);
 			this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
-			const context = {
+			const context = this.buildResolverContext({
 				template,
 				resources: currentState.resources,
-				...Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-				stateBackend: this.stateBackend,
-				stackName
-			};
+				parameters: parameterValues
+			}, stackName);
 			const conditions = await this.resolver.evaluateConditions(context);
 			this.logger.debug(`Evaluated ${Object.keys(conditions).length} conditions: ${Object.keys(conditions).join(", ")}`);
 			const resourceTypes = new Set(Object.values(template.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
@@ -8451,14 +8575,12 @@ var DeployEngine = class {
 			const dag = this.dagBuilder.buildGraph(template);
 			const executionLevels = this.dagBuilder.getExecutionLevels(dag);
 			this.logger.debug(`Dependency graph: ${executionLevels.length} execution levels`);
-			const diffResolverContext = {
+			const diffResolverContext = this.buildResolverContext({
 				template,
 				resources: currentState.resources,
-				...Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-				...Object.keys(conditions).length > 0 && { conditions },
-				stateBackend: this.stateBackend,
-				stackName
-			};
+				parameters: parameterValues,
+				conditions
+			}, stackName);
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
 			const changes = await this.diffCalculator.calculateDiff(currentState, template, diffResolveFn);
 			if (!this.diffCalculator.hasChanges(changes)) {
@@ -8467,11 +8589,12 @@ var DeployEngine = class {
 					await this.drainObservedCaptures(currentState.resources);
 					try {
 						const refreshedState = {
-							version: 3,
+							version: 4,
 							region: this.stackRegion,
 							stackName: currentState.stackName,
 							resources: currentState.resources,
 							outputs: currentState.outputs,
+							...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
 							lastModified: Date.now()
 						};
 						const saveOptions = {};
@@ -8515,6 +8638,7 @@ var DeployEngine = class {
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, newState);
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
+			if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, newState.outputs ?? {});
 			const durationMs = Date.now() - startTime;
 			const unchangedCount = this.diffCalculator.filterByType(changes, "NO_CHANGE").length + actualCounts.skipped;
 			return {
@@ -8563,11 +8687,12 @@ var DeployEngine = class {
 			saveChain = saveChain.then(async () => {
 				try {
 					const partialState = {
-						version: 3,
+						version: 4,
 						region: this.stackRegion,
 						stackName: currentState.stackName,
 						resources: newResources,
 						outputs: currentState.outputs,
+						...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
 						lastModified: Date.now()
 					};
 					const migrate = pendingMigration;
@@ -8668,11 +8793,12 @@ var DeployEngine = class {
 		} catch (error) {
 			try {
 				const preRollbackState = {
-					version: 3,
+					version: 4,
 					region: this.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
 					outputs: currentState.outputs,
+					...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
 					lastModified: Date.now()
 				};
 				const migrate = pendingMigration;
@@ -8696,11 +8822,12 @@ var DeployEngine = class {
 			} else await this.performRollback(completedOperations, newResources, stackName);
 			try {
 				const postRollbackState = {
-					version: 3,
+					version: 4,
 					region: this.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
 					outputs: currentState.outputs,
+					...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
 					lastModified: Date.now()
 				};
 				await this.stateBackend.saveState(stackName, this.stackRegion, postRollbackState, { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
@@ -8710,11 +8837,12 @@ var DeployEngine = class {
 				try {
 					const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
 					const postRollbackState = {
-						version: 3,
+						version: 4,
 						region: this.stackRegion,
 						stackName: currentState.stackName,
 						resources: newResources,
 						outputs: currentState.outputs,
+						...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
 						lastModified: Date.now()
 					};
 					await this.stateBackend.saveState(stackName, this.stackRegion, postRollbackState, { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
@@ -8728,11 +8856,12 @@ var DeployEngine = class {
 		const outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
 		return {
 			state: {
-				version: 3,
+				version: 4,
 				region: this.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
 				outputs,
+				...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
 				lastModified: Date.now()
 			},
 			actualCounts
@@ -8915,14 +9044,12 @@ var DeployEngine = class {
 		switch (change.changeType) {
 			case "CREATE": {
 				const desiredProps = change.desiredProperties || {};
-				const context = {
+				const context = this.buildResolverContext({
 					template,
 					resources: stateResources,
-					...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-					...conditions && Object.keys(conditions).length > 0 && { conditions },
-					stateBackend: this.stateBackend,
-					stackName
-				};
+					...parameterValues && { parameters: parameterValues },
+					...conditions && { conditions }
+				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				const { provider: createProvider, properties: createProps } = this.selectProviderWithSafetyNet(provider, resourceType, resolvedProps, logicalId);
 				const result = await this.withRetry(() => createProvider.create(logicalId, resourceType, createProps), logicalId, void 0, void 0, provider);
@@ -8947,14 +9074,12 @@ var DeployEngine = class {
 				if (!currentResource) throw new Error(`Cannot update ${logicalId}: resource not found in state`);
 				const desiredProps = change.desiredProperties || {};
 				const currentProps = change.currentProperties || {};
-				const context = {
+				const context = this.buildResolverContext({
 					template,
 					resources: stateResources,
-					...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-					...conditions && Object.keys(conditions).length > 0 && { conditions },
-					stateBackend: this.stateBackend,
-					stackName
-				};
+					...parameterValues && { parameters: parameterValues },
+					...conditions && { conditions }
+				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
 					this.logger.debug(`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
@@ -9215,14 +9340,12 @@ var DeployEngine = class {
 	async resolveOutputs(template, resources, stackName, parameterValues, conditions) {
 		if (!template.Outputs) return {};
 		const outputs = {};
-		const context = {
+		const context = this.buildResolverContext({
 			template,
 			resources,
-			...parameterValues && Object.keys(parameterValues).length > 0 && { parameters: parameterValues },
-			...conditions && Object.keys(conditions).length > 0 && { conditions },
-			stateBackend: this.stateBackend,
-			stackName
-		};
+			...parameterValues && { parameters: parameterValues },
+			...conditions && { conditions }
+		}, stackName);
 		for (const [outputKey, output] of Object.entries(template.Outputs)) try {
 			const value = await this.resolver.resolve(output.Value, context);
 			outputs[outputKey] = value;
@@ -9239,5 +9362,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { isCdkdError as $, resolveCaptureObservedState as A, ConfigError as B, stringifyValue as C, getDefaultStateBucketName as D, Synthesizer as E, AssemblyReader as F, ProvisioningError as G, LocalInvokeBuildError as H, clearBucketRegionCache as I, RouteDiscoveryError as J, ResourceTimeoutError as K, resolveBucketRegion as L, resolveStateBucketWithDefault as M, resolveStateBucketWithDefaultAndSource as N, getLegacyStateBucketName as O, warnDeprecatedNoPrefixCliFlag as P, formatError as Q, AssetError as R, AssetPublisher as S, buildDockerImage as T, LockError as U, DependencyError as V, PartialFailureError as W, StateError as X, StackTerminationProtectionError as Y, SynthesisError as Z, DiffCalculator as _, withRetry as a, runStackBuffered as at, LockManager as b, collectInlinePolicyNamesManagedBySiblings as c, PATTERN_B_RESOURCE_TYPES as ct, normalizeAwsTagsToCfn as d, withSkipPrefix as dt, normalizeAwsError as et, resolveExplicitPhysicalId as f, withStackName as ft, IntrinsicFunctionResolver as g, assertRegionMatch as h, withResourceDeadline as i, setLogger as it, resolveSkipPrefix as j, resolveApp as k, CDK_PATH_TAG as l, generateResourceName as lt, CloudControlProvider as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ConsoleLogger as nt, IMPLICIT_DELETE_DEPENDENCIES as o, getLiveRenderer as ot, ProviderRegistry as p, ResourceUpdateNotSupportedError as q, DeployEngine as r, getLogger as rt, IAMRoleProvider as s, PATTERN_B_NAME_PROPERTIES as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, withErrorHandling as tt, matchesCdkPath as u, generateResourceNameWithFallback as ut, DagBuilder as v, WorkGraph as w, S3StateBackend as x, TemplateParser as y, CdkdError as z };
-//# sourceMappingURL=deploy-engine-Cl7v7Ml5.js.map
+export { formatError as $, resolveCaptureObservedState as A, ConfigError as B, stringifyValue as C, getDefaultStateBucketName as D, Synthesizer as E, AssemblyReader as F, ProvisioningError as G, LocalInvokeBuildError as H, clearBucketRegionCache as I, RouteDiscoveryError as J, ResourceTimeoutError as K, resolveBucketRegion as L, resolveStateBucketWithDefault as M, resolveStateBucketWithDefaultAndSource as N, getLegacyStateBucketName as O, warnDeprecatedNoPrefixCliFlag as P, SynthesisError as Q, AssetError as R, AssetPublisher as S, buildDockerImage as T, LockError as U, DependencyError as V, PartialFailureError as W, StackTerminationProtectionError as X, StackHasActiveImportsError as Y, StateError as Z, DiffCalculator as _, withRetry as a, setLogger as at, LockManager as b, collectInlinePolicyNamesManagedBySiblings as c, PATTERN_B_NAME_PROPERTIES as ct, normalizeAwsTagsToCfn as d, generateResourceNameWithFallback as dt, isCdkdError as et, resolveExplicitPhysicalId as f, withSkipPrefix as ft, IntrinsicFunctionResolver as g, assertRegionMatch as h, withResourceDeadline as i, getLogger as it, resolveSkipPrefix as j, resolveApp as k, CDK_PATH_TAG as l, PATTERN_B_RESOURCE_TYPES as lt, CloudControlProvider as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, withErrorHandling as nt, IMPLICIT_DELETE_DEPENDENCIES as o, runStackBuffered as ot, ProviderRegistry as p, withStackName as pt, ResourceUpdateNotSupportedError as q, DeployEngine as r, ConsoleLogger as rt, IAMRoleProvider as s, getLiveRenderer as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, normalizeAwsError as tt, matchesCdkPath as u, generateResourceName as ut, DagBuilder as v, WorkGraph as w, S3StateBackend as x, TemplateParser as y, CdkdError as z };
+//# sourceMappingURL=deploy-engine-D44ADMVs.js.map