@go-to-k/cdkd 0.263.0 → 0.263.2

package/dist/{deploy-engine-BbNhlr7X.js → deploy-engine-j-e2Q0XH.js}

@@ -11240,7 +11240,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DF1bV_pu.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CkNAViXd.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -11902,6 +11902,25 @@ var CustomResourceProvider = class CustomResourceProvider {
 	responseBucket;
 	responsePrefix;
 	/**
+	* Memoization for the lazy response-bucket region correction
+	* (`ensureResponseClient`). Mirrors the `clientResolved` /
+	* `resolveInFlight` pattern of the three other state-bucket S3
+	* consumers (S3StateBackend / LockManager / ExportIndexStore), plus a
+	* generation counter: `setResponseBucket` bumps it so a probe that was
+	* still in flight when the bucket was re-set cannot commit its stale
+	* client / resolved flag against the new bucket.
+	*/
+	responseClientResolved = false;
+	responseClientResolveInFlight = null;
+	responseClientGeneration = 0;
+	/**
+	* Whether `this.s3Client` is a provider-OWNED client (built from the
+	* `setResponseBucket` region hint or by a region-correction rebuild)
+	* vs the shared `AwsClients.s3` instance from the constructor. Owned
+	* clients are `destroy()`ed when replaced; the shared one never is.
+	*/
+	ownsS3Client = false;
+	/**
 	* Opt out of the deploy engine's outer transient-error retry loop.
 	*
 	* The loop re-invokes `provider.create()` from the top on a transient
@@ -11981,7 +12000,67 @@ var CustomResourceProvider = class CustomResourceProvider {
 	*/
 	setResponseBucket(bucket, bucketRegion) {
 		this.responseBucket = bucket;
-		if (bucketRegion) this.s3Client = new S3Client(bucketRegion ? { region: bucketRegion } : {});
+		if (bucketRegion) this.replaceS3Client(new S3Client({ region: bucketRegion }));
+		this.responseClientGeneration++;
+		this.responseClientResolved = false;
+		this.responseClientResolveInFlight = null;
+	}
+	/**
+	* Swap `this.s3Client`, destroying the previous client when the
+	* provider owned it (never the shared `AwsClients.s3` instance).
+	* The optional call tolerates test doubles without a `destroy`.
+	*/
+	replaceS3Client(replacement) {
+		if (this.ownsS3Client) this.s3Client.destroy?.();
+		this.s3Client = replacement;
+		this.ownsS3Client = true;
+	}
+	/**
+	* Resolve the response bucket's actual region and, if it differs from the
+	* current S3 client's configured region, swap in a region-corrected client
+	* before any response-bucket S3 operation (placeholder `PutObject`,
+	* pre-signed `ResponseURL` signing, response polling, cleanup).
+	*
+	* The response bucket is cdkd's state bucket, which can live in a
+	* different region from the deploy region (`cdkd deploy --region` /
+	* `AWS_REGION` against the account-scoped region-free default bucket).
+	* A pre-signed URL's host is region-specific, so signing with the deploy
+	* region against a foreign-region bucket makes S3 return a
+	* 301 PermanentRedirect (issue #1195). Mirrors the lazy
+	* `ensureClientForBucket()` correction the state backend (#60), the
+	* LockManager (#803), and the ExportIndexStore (#819) already do via the
+	* shared `rebuildClientForBucketRegion` helper (#827).
+	*
+	* `tolerateNonStandardClient` keeps test doubles (a bare `{ send }`
+	* object from a mocked `getAwsClients`) on the no-rebuild path, and
+	* `resolveBucketRegion` never throws (probe failures degrade to
+	* "no rebuild"), so this can only improve the client's region.
+	*/
+	async ensureResponseClient() {
+		if (this.responseClientResolved || !this.responseBucket) return;
+		if (this.responseClientResolveInFlight) return this.responseClientResolveInFlight;
+		const bucket = this.responseBucket;
+		const generation = this.responseClientGeneration;
+		this.responseClientResolveInFlight = (async () => {
+			try {
+				const replacement = await rebuildClientForBucketRegion(this.s3Client, bucket, {
+					reuseClientCredentials: true,
+					tolerateNonStandardClient: true,
+					onRebuild: ({ bucketRegion, currentRegion }) => {
+						this.logger.debug(`Custom resource response bucket '${bucket}' is in '${bucketRegion}' (client was '${String(currentRegion)}'); building a region-corrected S3 client for response operations.`);
+					}
+				});
+				if (generation !== this.responseClientGeneration) {
+					replacement?.destroy?.();
+					return;
+				}
+				if (replacement) this.replaceS3Client(replacement);
+				this.responseClientResolved = true;
+			} finally {
+				if (generation === this.responseClientGeneration) this.responseClientResolveInFlight = null;
+			}
+		})();
+		return this.responseClientResolveInFlight;
 	}
 	/**
 	* Create a custom resource by invoking its Lambda handler
@@ -12354,6 +12433,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	*/
 	async generateResponseURL(responseKey) {
 		if (!this.responseBucket) return "https://localhost/cfn-response-not-configured";
+		await this.ensureResponseClient();
 		await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.responseBucket,
 			Key: responseKey,
@@ -16559,6 +16639,14 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					delete stateResources[op.logicalId];
 					logger.info(`  Rollback: Orphaning created resource ${op.logicalId} (--orphan)`);
 					await afterOp?.(op.logicalId);
+					ctx.recordEvent?.({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "CREATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
 				} else logger.info(`  Rollback: Leaving ${op.logicalId} at its new state (--orphan)`);
 				return;
 			case "orphan-retain":
@@ -16738,7 +16826,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.263.0";
+	return "0.263.2";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -18646,4 +18734,4 @@ var DeployEngine = class {
 
 //#endregion
 export { rewriteTemplateAssetReferences as $, StackHasActiveImportsError as $t, disableInstanceApiTermination as A, uploadCfnTemplate as At, DiffCalculator as B, CdkdError as Bt, yellow as C, resolveStateBucketWithDefaultAndSource as Ct, findActionableSilentDrops as D, CFN_TEMPLATE_URL_LIMIT as Dt, ProviderRegistry as E, CFN_TEMPLATE_BODY_LIMIT as Et, WAFv2WebACLProvider as F, AwsClients as Ft, rebuildClientForBucketRegion as G, LocalStartServiceError as Gt, TemplateParser as H, DependencyError as Ht, normalizeAwsTagsToCfn as I, getAwsClients as It, stringifyValue as J, NestedStackChildDirectDestroyError as Jt, shouldRetainResource as K, LockError as Kt, resolveExplicitPhysicalId as L, resetAwsClients as Lt, IntrinsicFunctionResolver as M, AssemblyReader as Mt, cfnRefValueFromPhysicalId as N, clearBucketRegionCache as Nt, CloudControlProvider as O, MIGRATE_TMP_PREFIX as Ot, refStateLookupFromResource as P, resolveBucketRegion as Pt, loadPublishableAssetManifest as Q, ResourceUpdateNotSupportedError as Qt, assertRegionMatch as R, setAwsClients as Rt, red as S, resolveStateBucketWithDefault as St, collectInlinePolicyNamesManagedBySiblings as T, warnDeprecatedNoPrefixCliFlag as Tt, LockManager as U, LocalInvokeBuildError as Ut, DagBuilder as V, ConfigError as Vt, S3StateBackend as W, LocalMigrateError as Wt, buildAssetRedirectMap as X, ProvisioningError as Xt, WorkGraph as Y, PartialFailureError as Yt, createAssetRedirectResolver as Z, ResourceTimeoutError as Zt, formatResourceLine as _, getLegacyStateBucketName as _t, DeploymentEventsStore as a, normalizeAwsError as an, validateAssetBucketName as at, gray as b, resolveCaptureObservedState as bt, withResourceDeadline as c, formatDockerLoginError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, runDockerStreaming as dt, StackTerminationProtectionError as en, AssetModeResolver as et, computeImplicitDeleteEdges as f, AssetManifestLoader as ft, renderStatefulReason as g, getDefaultStateBucketName as gt, isStatefulRecreateTargetSync as h, synthesisStatusMessage as ht, DeploymentEventsReader as i, isCdkdError as in, parseBootstrapMarker as it, isTerminationProtectionPropagationError as j, expectedOwnerParam as jt, slowCcOperationTimeoutMs as k, findLargeInlineResources as kt, withRetry as l, getDockerCmd as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, Synthesizer as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, SynthesisError as nn, ensureAssetStorage as nt, planRollback as o, withErrorHandling as on, validateContainerRepoName as ot, extractDeploymentEventError as p, getDockerImageBySourceHash as pt, AssetPublisher as q, MissingCdkCliError as qt, DeployEngine as r, formatError as rn, getBootstrapMarkerKey as rt, replayRollback as s, __exportAll as sn, buildDockerImage as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StateError as tn, BOOTSTRAP_MARKER_PREFIX as tt, isRetryableTransientError as u, runDockerForeground as ut, bold as v, resolveApp as vt, IAMRoleProvider as w, resolveUseCdkBootstrapAssets as wt, green as x, resolveSkipPrefix as xt, cyan as y, resolveAutoAssetStorage as yt, applyRoleArnIfSet as z, AssetError as zt };
-//# sourceMappingURL=deploy-engine-BbNhlr7X.js.map
+//# sourceMappingURL=deploy-engine-j-e2Q0XH.js.map