@go-to-k/cdkd 0.233.0 → 0.234.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-uvVnteGl.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as AssemblyReader, a as withRetry, at as resolveApp, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveStateBucketWithDefault, d as isStatefulRecreateTargetSync, dt as warnDeprecatedNoPrefixCliFlag, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as CFN_TEMPLATE_BODY_LIMIT, g as gray, gt as uploadCfnTemplate, h as cyan, ht as findLargeInlineResources, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefaultAndSource, m as bold, mt as MIGRATE_TMP_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveCaptureObservedState, p as formatResourceLine, pt as CFN_TEMPLATE_URL_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveSkipPrefix, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveUseCdkBootstrapAssets, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, yt as resolveBucketRegion, z as WorkGraph } from "./deploy-engine-Dj9mXUQa.js";
+import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as AssemblyReader, a as withRetry, at as resolveApp, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveStateBucketWithDefault, d as isStatefulRecreateTargetSync, dt as warnDeprecatedNoPrefixCliFlag, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as CFN_TEMPLATE_BODY_LIMIT, g as gray, gt as uploadCfnTemplate, h as cyan, ht as findLargeInlineResources, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefaultAndSource, m as bold, mt as MIGRATE_TMP_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveCaptureObservedState, p as formatResourceLine, pt as CFN_TEMPLATE_URL_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveSkipPrefix, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveUseCdkBootstrapAssets, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, yt as resolveBucketRegion, z as WorkGraph } from "./deploy-engine-CdAkyW9k.js";
 import { t as ASGProvider } from "./asg-provider-Dd9Xze-T.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -645,10 +645,12 @@ async function bootstrapCommand(options) {
 		bucketName = getDefaultStateBucketName(accountId);
 		logger.info(`Using default state bucket: ${bucketName}`);
 	}
+	const rebuiltStateBucketClient = await rebuildClientForBucketRegion(s3Client, bucketName, { ...options.profile && { profile: options.profile } });
+	const stateBucketS3 = rebuiltStateBucketClient ?? s3Client;
 	try {
 		let bucketExists = false;
 		try {
-			await s3Client.send(new HeadBucketCommand({ Bucket: bucketName }));
+			await stateBucketS3.send(new HeadBucketCommand({ Bucket: bucketName }));
 			bucketExists = true;
 			logger.info(`Bucket ${bucketName} already exists`);
 		} catch (error) {
@@ -672,18 +674,18 @@ async function bootstrapCommand(options) {
 			logger.info(`Creating S3 bucket: ${bucketName} in region ${region}`);
 			const createBucketParams = { Bucket: bucketName };
 			if (region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: region };
-			await s3Client.send(new CreateBucketCommand(createBucketParams));
+			await stateBucketS3.send(new CreateBucketCommand(createBucketParams));
 			logger.info(`✓ Created S3 bucket: ${bucketName}`);
 		}
 		if (!skipStateBucketConfig) {
 			logger.debug("Enabling bucket versioning...");
-			await s3Client.send(new PutBucketVersioningCommand({
+			await stateBucketS3.send(new PutBucketVersioningCommand({
 				Bucket: bucketName,
 				VersioningConfiguration: { Status: "Enabled" }
 			}));
 			logger.info("✓ Enabled bucket versioning");
 			logger.debug("Enabling bucket encryption...");
-			await s3Client.send(new PutBucketEncryptionCommand({
+			await stateBucketS3.send(new PutBucketEncryptionCommand({
 				Bucket: bucketName,
 				ServerSideEncryptionConfiguration: { Rules: [{
 					ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
@@ -703,7 +705,7 @@ async function bootstrapCommand(options) {
 					Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
 				}]
 			};
-			await s3Client.send(new PutBucketPolicyCommand({
+			await stateBucketS3.send(new PutBucketPolicyCommand({
 				Bucket: bucketName,
 				Policy: JSON.stringify(bucketPolicy)
 			}));
@@ -753,6 +755,7 @@ async function bootstrapCommand(options) {
 		logger.info(`  --state-bucket ${bucketName}`);
 		logger.info(`  --region ${region}`);
 	} finally {
+		rebuiltStateBucketClient?.destroy();
 		awsClients.destroy();
 	}
 }
@@ -1500,7 +1503,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.233.0";
+	return "0.234.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -47876,6 +47879,28 @@ function buildSubstitutionContextFromImageContext(context) {
 	return subContext;
 }
 /**
+* A container-image URI that points at a CDK-bootstrap OR cdkd-owned assets
+* ECR repository:
+*
+*   - `cdk-<qualifier>-container-assets-<acct>-<region>` — the CDK bootstrap
+*     repo (default qualifier `hnb659fds`, or a custom `cdk bootstrap
+*     --qualifier` value);
+*   - `cdkd-container-assets-<acct>-<region>` — the repo `cdkd bootstrap`
+*     creates and `cdkd deploy` publishes into once a bootstrap marker exists
+*     (issue #1002; a migrated stack's template / `--from-state` state carries
+*     this shape).
+*
+* Either is a CDK asset image the ECS runner resolves back to the on-disk
+* `cdk.out` build, so both must classify as `kind: 'cdk-asset'`. The `cdk-`
+* qualifier is generalized to `[a-z0-9]+` so a custom-qualifier bootstrap is
+* matched too (previously only the hardcoded `hnb659fds` default was).
+*/
+const CDK_ASSET_IMAGE_REPO_RE = /(?:cdk-[a-z0-9]+|cdkd)-container-assets-/;
+/** True when `uri` embeds a CDK-bootstrap or cdkd-owned container-assets repo. */
+function isCdkAssetImageUri(uri) {
+	return CDK_ASSET_IMAGE_REPO_RE.test(uri);
+}
+/**
 * Parse the `Image` field of an ECS container definition.
 *
 * Three shapes:
@@ -47915,7 +47940,7 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 	if (joinResolved.kind === "unsupported-join") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unsupported Fn::Join Image shape: ${joinResolved.reason}. cdkd local run-task recognizes the canonical CDK 2.x ContainerImage.fromEcrRepository Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 	const flat = extractImageString(raw);
 	if (!flat) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unparseable Image property. cdkd local run-task v1 supports flat string images, single-key Fn::Sub bodies, and CDK-asset Image references.`);
-	if (flat.includes("cdk-hnb659fds-container-assets-")) {
+	if (isCdkAssetImageUri(flat)) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(flat);
 		const out = { kind: "cdk-asset" };
 		if (hashMatch) out.assetHash = hashMatch[1];
@@ -47963,7 +47988,7 @@ function findUnresolvedEcrRepositoryRef(substituted, resources) {
 * `Fn::GetAtt` path can share the regex-match branches.
 */
 function classifyResolvedImage(uri) {
-	if (uri.includes("cdk-hnb659fds-container-assets-")) {
+	if (isCdkAssetImageUri(uri)) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(uri);
 		const out = { kind: "cdk-asset" };
 		if (hashMatch) out.assetHash = hashMatch[1];
@@ -55989,7 +56014,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.233.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.234.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());