@go-to-k/cdkd 0.159.0 → 0.159.2

package/dist/cli.js

@@ -41666,7 +41666,10 @@ var CfnLocalStateProvider = class {
 	}
 	getClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
-		if (!this.client) this.client = new CloudFormationClient({ region: this.region });
+		if (!this.client) this.client = new CloudFormationClient({
+			region: this.region,
+			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
+		});
 		return this.client;
 	}
 	/**
@@ -53022,6 +53025,11 @@ function buildOverlay(authorizer, result, routeApiVersion) {
 }
 /**
 * Map the authorizer rejection to an HTTP status code and body.
+*   - REST v1 with AWS_IAM (issue #625) → 403 for both deny kinds (the
+*     deployed REST v1 SigV4 layer rejects unsigned requests with 403
+*     `{"message":"Missing Authentication Token"}` and signature/policy
+*     failures with 403 `{"message":"Forbidden"}` — lowercase `message`
+*     distinguishes the REST v1 shape from the Function URL shape below).
 *   - REST v1, missing identity → 401 `{"message":"Unauthorized"}`
 *     (matches deployed behavior; the route reaches the Method but no
 *     identity source is present so the authorizer never runs).
@@ -53031,9 +53039,19 @@ function buildOverlay(authorizer, result, routeApiVersion) {
 *     collapses both into the same response).
 *   - Function URL with AWS_IAM (issue #621) → 403 `{"Message":"Forbidden"}`
 *     for both deny kinds (matches Lambda's deployed Function URL IAM
-*     behavior — the AWS SigV4 layer rejects with 403, not 401).
+*     behavior — the AWS SigV4 layer rejects with 403, not 401). Note the
+*     capital `Message` — distinct from REST v1 AWS_IAM's lowercase
+*     `message`.
 */
 function writeAuthRejection(res, apiVersion, denyKind, authorizerKind) {
+	if (apiVersion === "v1" && authorizerKind === "iam") {
+		if (denyKind === "missing-identity") {
+			writeError(res, 403, "{\"message\":\"Missing Authentication Token\"}");
+			return;
+		}
+		writeError(res, 403, "{\"message\":\"Forbidden\"}");
+		return;
+	}
 	if (apiVersion === "v2" && authorizerKind === "iam") {
 		writeError(res, 403, "{\"Message\":\"Forbidden\"}");
 		return;
@@ -59473,7 +59491,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.159.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.159.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());