@go-to-k/cdkd 0.234.1 → 0.235.1

package/dist/cli.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-uvVnteGl.js";
-import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as AssemblyReader, a as withRetry, at as resolveApp, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveStateBucketWithDefault, d as isStatefulRecreateTargetSync, dt as warnDeprecatedNoPrefixCliFlag, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as CFN_TEMPLATE_BODY_LIMIT, g as gray, gt as uploadCfnTemplate, h as cyan, ht as findLargeInlineResources, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefaultAndSource, m as bold, mt as MIGRATE_TMP_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveCaptureObservedState, p as formatResourceLine, pt as CFN_TEMPLATE_URL_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveSkipPrefix, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveUseCdkBootstrapAssets, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, yt as resolveBucketRegion, z as WorkGraph } from "./deploy-engine-CdAkyW9k.js";
-import { t as ASGProvider } from "./asg-provider-Dd9Xze-T.js";
+import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
+import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
+import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
+import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as uploadCfnTemplate, a as withRetry, at as resolveApp, b as IAMRoleProvider, bt as resolveBucketRegion, c as computeImplicitDeleteEdges, ct as resolveSkipPrefix, d as isStatefulRecreateTargetSync, dt as resolveUseCdkBootstrapAssets, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as warnDeprecatedNoPrefixCliFlag, g as gray, gt as findLargeInlineResources, h as cyan, ht as MIGRATE_TMP_PREFIX, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefault, m as bold, mt as CFN_TEMPLATE_URL_LIMIT, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveAutoAssetStorage, p as formatResourceLine, pt as CFN_TEMPLATE_BODY_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveCaptureObservedState, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveStateBucketWithDefaultAndSource, v as red, vt as AssemblyReader, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as WorkGraph } from "./deploy-engine-iahWC4C1.js";
+import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
+import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -508,6 +510,7 @@ const deployOptions = [
 	new Option("--dry-run", "Show changes without applying").default(false),
 	new Option("--skip-assets", "Skip asset publishing").default(false),
 	new Option("--no-rollback", "Skip rollback on deployment failure"),
+	new Option("--no-auto-asset-storage", "Do not auto-create cdkd-owned asset storage (asset bucket + container-asset ECR repo + marker) on the first deploy into a region not yet opted in via 'cdkd bootstrap'. Deploys into such regions stay in legacy mode (CDK bootstrap destinations). Per-app opt-out: cdk.json context.cdkd.autoAssetStorage: false."),
 	new Option("--no-capture-observed-state", "Skip capturing AWS-current properties after each create/update (adds a fire-and-forget readCurrentState per resource so cdkd drift can compare against the real deploy-time AWS snapshot instead of the template). On by default. Disable when deploy speed matters more than rich drift detection — falls back to comparing against template properties (the pre-v3 behavior)."),
 	new Option("--prefix-user-supplied-names", "Opt in to LEGACY behavior: prepend the stack name to physical names the user explicitly supplied in their CDK code (e.g. `new iam.Role(this, \"X\", { roleName: \"my-role\" })` → AWS resource named `MyStack-my-role` instead of `my-role`). Since v0.94.0 the default is to NOT prefix user-supplied names — this flag restores the pre-v0.94.0 behavior on Pattern B providers (IAM Role / User / Group / InstanceProfile / ELBv2 LoadBalancer / TargetGroup). Enable via this flag, CDKD_PREFIX_USER_SUPPLIED_NAMES=true, or cdk.json context.cdkd.prefixUserSuppliedNames=true. Applies to `cdkd deploy` only.").default(false),
 	noWaitOption,
@@ -650,7 +653,10 @@ async function bootstrapCommand(options) {
 	try {
 		let bucketExists = false;
 		try {
-			await stateBucketS3.send(new HeadBucketCommand({ Bucket: bucketName }));
+			await stateBucketS3.send(new HeadBucketCommand({
+				Bucket: bucketName,
+				ExpectedBucketOwner: accountId
+			}));
 			bucketExists = true;
 			logger.info(`Bucket ${bucketName} already exists`);
 		} catch (error) {
@@ -681,12 +687,14 @@ async function bootstrapCommand(options) {
 			logger.debug("Enabling bucket versioning...");
 			await stateBucketS3.send(new PutBucketVersioningCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				VersioningConfiguration: { Status: "Enabled" }
 			}));
 			logger.info("✓ Enabled bucket versioning");
 			logger.debug("Enabling bucket encryption...");
 			await stateBucketS3.send(new PutBucketEncryptionCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				ServerSideEncryptionConfiguration: { Rules: [{
 					ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
 					BucketKeyEnabled: true
@@ -707,6 +715,7 @@ async function bootstrapCommand(options) {
 			};
 			await stateBucketS3.send(new PutBucketPolicyCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				Policy: JSON.stringify(bucketPolicy)
 			}));
 			logger.info("✓ Set bucket policy (deny external access)");
@@ -1463,6 +1472,28 @@ async function promptRecreateConfirm(input) {
 	}
 }
 
+//#endregion
+//#region src/cli/commands/confirm-prompt.ts
+/**
+* Default-YES confirmation prompt (`[Y/n]`, empty input = yes). Used by the
+* issue #1007 asset-storage auto-create on interactive TTY deploys without
+* `--yes`. Kept in its own module (mirrors `recreate-confirm-prompt.ts`) so
+* the accept/decline parsing is unit-testable without importing the whole
+* deploy command.
+*/
+async function promptYesNo(prompt) {
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const ans = await rl.question(`${prompt} [Y/n] `);
+		return /^(y(es)?)?$/i.test(ans.trim());
+	} finally {
+		rl.close();
+	}
+}
+
 //#endregion
 //#region src/state/deployment-events-store.ts
 /**
@@ -1503,7 +1534,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.234.1";
+	return "0.235.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -2134,6 +2165,14 @@ var ExportIndexStore = class {
 	* `config.region()` shape (e.g. a hand-rolled test double) the resolution
 	* is skipped and the original client is used unchanged.
 	*/
+	/**
+	* `ExpectedBucketOwner` spread for every state-bucket S3 call (squatting
+	* hardening — see src/utils/expected-bucket-owner.ts). Best-effort:
+	* resolves to an empty object for non-standard clients (test doubles).
+	*/
+	async ownerParam() {
+		return expectedOwnerParam(this.s3Client);
+	}
 	async ensureClientForBucket() {
 		if (this.clientResolved) return;
 		if (this.resolveInFlight) return this.resolveInFlight;
@@ -2279,6 +2318,7 @@ var ExportIndexStore = class {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.bucket,
+				...await this.ownerParam(),
 				Key: this.indexKey()
 			}));
 			return {
@@ -2295,6 +2335,7 @@ var ExportIndexStore = class {
 		const body = JSON.stringify(next, null, 2);
 		return (await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.bucket,
+			...await this.ownerParam(),
 			Key: this.indexKey(),
 			Body: body,
 			ContentLength: Buffer.byteLength(body),
@@ -37709,9 +37750,18 @@ async function deployCommand(stacks, options) {
 		stsClient.destroy();
 		const assetPublisher = new AssetPublisher();
 		const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
+		const autoAssetStorage = resolveAutoAssetStorage(options.autoAssetStorage);
+		const confirmAutoAssetStorage = async (assetRegion) => {
+			if (options.yes || !process.stdin.isTTY) {
+				logger.info(`Creating cdkd asset storage for region '${assetRegion}' (first deploy into this region; opt out with --no-auto-asset-storage).`);
+				return true;
+			}
+			return promptYesNo(`Region '${assetRegion}' has no cdkd asset storage yet. Create it now (S3 bucket cdkd-assets-${accountId}-${assetRegion} + container-asset ECR repo, out of 'cdk gc' reach)?`);
+		};
 		const assetModeResolver = new AssetModeResolver(preflightStateBackend, accountId, {
 			...options.profile && { profile: options.profile },
-			...useCdkBootstrapAssets && { useCdkBootstrapAssets: true }
+			...useCdkBootstrapAssets && { useCdkBootstrapAssets: true },
+			...autoAssetStorage && !options.dryRun && !options.skipAssets && { autoCreate: { confirm: confirmAutoAssetStorage } }
 		});
 		const stateConfig = {
 			bucket: stateBucket,
@@ -41906,6 +41956,8 @@ async function stateMigrateCommand(options) {
 					await newS3.send(new CopyObjectCommand({
 						Bucket: newBucket,
 						Key: obj.Key,
+						...await expectedOwnerParam(newS3),
+						ExpectedSourceBucketOwner: accountId,
 						CopySource: encodeURIComponent(`${legacyBucket}/${obj.Key}`)
 					}));
 					copied++;
@@ -41919,7 +41971,10 @@ async function stateMigrateCommand(options) {
 					logger.info(`Emptying source bucket ${legacyBucket} (all versions + delete markers)...`);
 					await emptyBucketAllVersions(legacyS3, legacyBucket);
 					logger.info(`Deleting source bucket ${legacyBucket}...`);
-					await legacyS3.send(new DeleteBucketCommand({ Bucket: legacyBucket }));
+					await legacyS3.send(new DeleteBucketCommand({
+						Bucket: legacyBucket,
+						...await expectedOwnerParam(legacyS3)
+					}));
 					logger.info(`✓ Deleted source bucket: ${legacyBucket}`);
 				} else logger.info(`Source bucket ${legacyBucket} kept. Pass --remove-legacy on a future run to delete it.`);
 				logger.info(`✓ Migration complete: ${legacyBucket} -> ${newBucket}`);
@@ -41935,7 +41990,10 @@ async function stateMigrateCommand(options) {
 }
 async function bucketExists(s3, bucketName) {
 	try {
-		await s3.send(new HeadBucketCommand({ Bucket: bucketName }));
+		await s3.send(new HeadBucketCommand({
+			Bucket: bucketName,
+			...await expectedOwnerParam(s3)
+		}));
 		return true;
 	} catch (error) {
 		const err = error;
@@ -41951,6 +42009,7 @@ async function listAllObjects(s3, bucket) {
 	do {
 		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
+			...await expectedOwnerParam(s3),
 			...continuationToken && { ContinuationToken: continuationToken }
 		}));
 		if (resp.Contents) all.push(...resp.Contents);
@@ -41993,10 +42052,12 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	logger.info(`✓ Created destination bucket: ${bucketName}`);
 	await s3.send(new PutBucketVersioningCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		VersioningConfiguration: { Status: "Enabled" }
 	}));
 	await s3.send(new PutBucketEncryptionCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		ServerSideEncryptionConfiguration: { Rules: [{
 			ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
 			BucketKeyEnabled: true
@@ -42004,6 +42065,7 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	}));
 	await s3.send(new PutBucketPolicyCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		Policy: JSON.stringify({
 			Version: "2012-10-17",
 			Statement: [{
@@ -42030,6 +42092,7 @@ async function emptyBucketAllVersions(s3, bucket) {
 	do {
 		const resp = await s3.send(new ListObjectVersionsCommand({
 			Bucket: bucket,
+			...await expectedOwnerParam(s3),
 			...keyMarker && { KeyMarker: keyMarker },
 			...versionIdMarker && { VersionIdMarker: versionIdMarker }
 		}));
@@ -42046,6 +42109,7 @@ async function emptyBucketAllVersions(s3, bucket) {
 			const batch = ids.slice(i, i + 1e3);
 			await s3.send(new DeleteObjectsCommand({
 				Bucket: bucket,
+				...await expectedOwnerParam(s3),
 				Delete: {
 					Objects: batch,
 					Quiet: true
@@ -45282,7 +45346,10 @@ function formatBucketSource(source) {
 */
 async function detectBucketRegion(awsClients, bucket) {
 	try {
-		const constraint = (await awsClients.s3.send(new GetBucketLocationCommand({ Bucket: bucket }))).LocationConstraint;
+		const constraint = (await awsClients.s3.send(new GetBucketLocationCommand({
+			Bucket: bucket,
+			...await expectedOwnerParam(awsClients.s3)
+		}))).LocationConstraint;
 		if (!constraint) return "us-east-1";
 		if (constraint === "EU") return "eu-west-1";
 		return constraint;
@@ -45330,7 +45397,8 @@ async function readSchemaVersion(awsClients, bucket, keys) {
 	try {
 		const resp = await awsClients.s3.send(new GetObjectCommand({
 			Bucket: bucket,
-			Key: keys[0]
+			Key: keys[0],
+			...await expectedOwnerParam(awsClients.s3)
 		}));
 		if (!resp.Body) return "unknown";
 		const body = await resp.Body.transformToString();
@@ -45365,7 +45433,8 @@ async function listAssetStorageMarkers(awsClients, bucket) {
 		try {
 			const marker = parseBootstrapMarker(await (await awsClients.s3.send(new GetObjectCommand({
 				Bucket: bucket,
-				Key: key
+				Key: key,
+				...await expectedOwnerParam(awsClients.s3)
 			}))).Body?.transformToString() ?? "", key);
 			entries.push({
 				region,
@@ -56014,7 +56083,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.234.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.235.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());