@go-to-k/cdkd 0.235.0 → 0.235.1

package/dist/cli.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-uvVnteGl.js";
-import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as uploadCfnTemplate, a as withRetry, at as resolveApp, b as IAMRoleProvider, bt as resolveBucketRegion, c as computeImplicitDeleteEdges, ct as resolveSkipPrefix, d as isStatefulRecreateTargetSync, dt as resolveUseCdkBootstrapAssets, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as warnDeprecatedNoPrefixCliFlag, g as gray, gt as findLargeInlineResources, h as cyan, ht as MIGRATE_TMP_PREFIX, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefault, m as bold, mt as CFN_TEMPLATE_URL_LIMIT, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveAutoAssetStorage, p as formatResourceLine, pt as CFN_TEMPLATE_BODY_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveCaptureObservedState, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveStateBucketWithDefaultAndSource, v as red, vt as AssemblyReader, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as WorkGraph } from "./deploy-engine-Cbi5IzWV.js";
-import { t as ASGProvider } from "./asg-provider-Dd9Xze-T.js";
+import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
+import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
+import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
+import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as uploadCfnTemplate, a as withRetry, at as resolveApp, b as IAMRoleProvider, bt as resolveBucketRegion, c as computeImplicitDeleteEdges, ct as resolveSkipPrefix, d as isStatefulRecreateTargetSync, dt as resolveUseCdkBootstrapAssets, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as warnDeprecatedNoPrefixCliFlag, g as gray, gt as findLargeInlineResources, h as cyan, ht as MIGRATE_TMP_PREFIX, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefault, m as bold, mt as CFN_TEMPLATE_URL_LIMIT, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveAutoAssetStorage, p as formatResourceLine, pt as CFN_TEMPLATE_BODY_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveCaptureObservedState, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveStateBucketWithDefaultAndSource, v as red, vt as AssemblyReader, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as WorkGraph } from "./deploy-engine-iahWC4C1.js";
+import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
+import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -651,7 +653,10 @@ async function bootstrapCommand(options) {
 	try {
 		let bucketExists = false;
 		try {
-			await stateBucketS3.send(new HeadBucketCommand({ Bucket: bucketName }));
+			await stateBucketS3.send(new HeadBucketCommand({
+				Bucket: bucketName,
+				ExpectedBucketOwner: accountId
+			}));
 			bucketExists = true;
 			logger.info(`Bucket ${bucketName} already exists`);
 		} catch (error) {
@@ -682,12 +687,14 @@ async function bootstrapCommand(options) {
 			logger.debug("Enabling bucket versioning...");
 			await stateBucketS3.send(new PutBucketVersioningCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				VersioningConfiguration: { Status: "Enabled" }
 			}));
 			logger.info("✓ Enabled bucket versioning");
 			logger.debug("Enabling bucket encryption...");
 			await stateBucketS3.send(new PutBucketEncryptionCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				ServerSideEncryptionConfiguration: { Rules: [{
 					ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
 					BucketKeyEnabled: true
@@ -708,6 +715,7 @@ async function bootstrapCommand(options) {
 			};
 			await stateBucketS3.send(new PutBucketPolicyCommand({
 				Bucket: bucketName,
+				ExpectedBucketOwner: accountId,
 				Policy: JSON.stringify(bucketPolicy)
 			}));
 			logger.info("✓ Set bucket policy (deny external access)");
@@ -1526,7 +1534,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.235.0";
+	return "0.235.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -2157,6 +2165,14 @@ var ExportIndexStore = class {
 	* `config.region()` shape (e.g. a hand-rolled test double) the resolution
 	* is skipped and the original client is used unchanged.
 	*/
+	/**
+	* `ExpectedBucketOwner` spread for every state-bucket S3 call (squatting
+	* hardening — see src/utils/expected-bucket-owner.ts). Best-effort:
+	* resolves to an empty object for non-standard clients (test doubles).
+	*/
+	async ownerParam() {
+		return expectedOwnerParam(this.s3Client);
+	}
 	async ensureClientForBucket() {
 		if (this.clientResolved) return;
 		if (this.resolveInFlight) return this.resolveInFlight;
@@ -2302,6 +2318,7 @@ var ExportIndexStore = class {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.bucket,
+				...await this.ownerParam(),
 				Key: this.indexKey()
 			}));
 			return {
@@ -2318,6 +2335,7 @@ var ExportIndexStore = class {
 		const body = JSON.stringify(next, null, 2);
 		return (await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.bucket,
+			...await this.ownerParam(),
 			Key: this.indexKey(),
 			Body: body,
 			ContentLength: Buffer.byteLength(body),
@@ -41938,6 +41956,8 @@ async function stateMigrateCommand(options) {
 					await newS3.send(new CopyObjectCommand({
 						Bucket: newBucket,
 						Key: obj.Key,
+						...await expectedOwnerParam(newS3),
+						ExpectedSourceBucketOwner: accountId,
 						CopySource: encodeURIComponent(`${legacyBucket}/${obj.Key}`)
 					}));
 					copied++;
@@ -41951,7 +41971,10 @@ async function stateMigrateCommand(options) {
 					logger.info(`Emptying source bucket ${legacyBucket} (all versions + delete markers)...`);
 					await emptyBucketAllVersions(legacyS3, legacyBucket);
 					logger.info(`Deleting source bucket ${legacyBucket}...`);
-					await legacyS3.send(new DeleteBucketCommand({ Bucket: legacyBucket }));
+					await legacyS3.send(new DeleteBucketCommand({
+						Bucket: legacyBucket,
+						...await expectedOwnerParam(legacyS3)
+					}));
 					logger.info(`✓ Deleted source bucket: ${legacyBucket}`);
 				} else logger.info(`Source bucket ${legacyBucket} kept. Pass --remove-legacy on a future run to delete it.`);
 				logger.info(`✓ Migration complete: ${legacyBucket} -> ${newBucket}`);
@@ -41967,7 +41990,10 @@ async function stateMigrateCommand(options) {
 }
 async function bucketExists(s3, bucketName) {
 	try {
-		await s3.send(new HeadBucketCommand({ Bucket: bucketName }));
+		await s3.send(new HeadBucketCommand({
+			Bucket: bucketName,
+			...await expectedOwnerParam(s3)
+		}));
 		return true;
 	} catch (error) {
 		const err = error;
@@ -41983,6 +42009,7 @@ async function listAllObjects(s3, bucket) {
 	do {
 		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
+			...await expectedOwnerParam(s3),
 			...continuationToken && { ContinuationToken: continuationToken }
 		}));
 		if (resp.Contents) all.push(...resp.Contents);
@@ -42025,10 +42052,12 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	logger.info(`✓ Created destination bucket: ${bucketName}`);
 	await s3.send(new PutBucketVersioningCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		VersioningConfiguration: { Status: "Enabled" }
 	}));
 	await s3.send(new PutBucketEncryptionCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		ServerSideEncryptionConfiguration: { Rules: [{
 			ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
 			BucketKeyEnabled: true
@@ -42036,6 +42065,7 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	}));
 	await s3.send(new PutBucketPolicyCommand({
 		Bucket: bucketName,
+		...await expectedOwnerParam(s3),
 		Policy: JSON.stringify({
 			Version: "2012-10-17",
 			Statement: [{
@@ -42062,6 +42092,7 @@ async function emptyBucketAllVersions(s3, bucket) {
 	do {
 		const resp = await s3.send(new ListObjectVersionsCommand({
 			Bucket: bucket,
+			...await expectedOwnerParam(s3),
 			...keyMarker && { KeyMarker: keyMarker },
 			...versionIdMarker && { VersionIdMarker: versionIdMarker }
 		}));
@@ -42078,6 +42109,7 @@ async function emptyBucketAllVersions(s3, bucket) {
 			const batch = ids.slice(i, i + 1e3);
 			await s3.send(new DeleteObjectsCommand({
 				Bucket: bucket,
+				...await expectedOwnerParam(s3),
 				Delete: {
 					Objects: batch,
 					Quiet: true
@@ -45314,7 +45346,10 @@ function formatBucketSource(source) {
 */
 async function detectBucketRegion(awsClients, bucket) {
 	try {
-		const constraint = (await awsClients.s3.send(new GetBucketLocationCommand({ Bucket: bucket }))).LocationConstraint;
+		const constraint = (await awsClients.s3.send(new GetBucketLocationCommand({
+			Bucket: bucket,
+			...await expectedOwnerParam(awsClients.s3)
+		}))).LocationConstraint;
 		if (!constraint) return "us-east-1";
 		if (constraint === "EU") return "eu-west-1";
 		return constraint;
@@ -45362,7 +45397,8 @@ async function readSchemaVersion(awsClients, bucket, keys) {
 	try {
 		const resp = await awsClients.s3.send(new GetObjectCommand({
 			Bucket: bucket,
-			Key: keys[0]
+			Key: keys[0],
+			...await expectedOwnerParam(awsClients.s3)
 		}));
 		if (!resp.Body) return "unknown";
 		const body = await resp.Body.transformToString();
@@ -45397,7 +45433,8 @@ async function listAssetStorageMarkers(awsClients, bucket) {
 		try {
 			const marker = parseBootstrapMarker(await (await awsClients.s3.send(new GetObjectCommand({
 				Bucket: bucket,
-				Key: key
+				Key: key,
+				...await expectedOwnerParam(awsClients.s3)
 			}))).Body?.transformToString() ?? "", key);
 			entries.push({
 				region,
@@ -56046,7 +56083,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.235.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.235.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());