@go-to-k/cdkd 0.281.12 → 0.281.14

package/dist/{deploy-engine-CPDPlPQN.js → deploy-engine-3BZtmJqZ.js}

@@ -216,6 +216,33 @@ function formatDuration(ms) {
 	return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
 }
 /**
+* A DELIBERATE refusal to resolve an intrinsic function, as opposed to a
+* "the referenced thing does not exist" miss (issue
+* [#1740](https://github.com/go-to-k/cdkd/issues/1740)).
+*
+* The distinction exists for exactly one consumer: `Fn::Sub`'s variable
+* resolution, which speculatively tries `Ref` and then `Fn::GetAtt` and keeps
+* the raw `${...}` placeholder when neither resolves. That warn-and-keep is the
+* long-standing, deliberate behavior for a genuinely unknown variable — but a
+* bare `catch` around it also swallowed every REFUSAL the resolver raises on
+* purpose (`guardedPhysicalIdFallback`'s ARN / URL shape hard-fail, the
+* `--strict-getatt` rejection, `rejectPlaceholderArnAttribute`), so a template
+* that hard-fails when the reference sits in a resource property silently
+* degraded to shipping a literal `${Resource.Attribute}` to AWS when the
+* IDENTICAL reference was written inside an `Fn::Sub`.
+*
+* Throwing this class rather than a bare `Error` is what lets that catch
+* re-raise a refusal (carrying its own message and remedy) while leaving the
+* not-found path on warn-and-keep. Nothing else branches on it.
+*/
+var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "INTRINSIC_RESOLUTION_REFUSAL", cause);
+		this.name = "IntrinsicResolutionRefusalError";
+		Object.setPrototypeOf(this, IntrinsicResolutionRefusalError.prototype);
+	}
+};
+/**
 * Dependency resolution errors
 */
 var DependencyError = class DependencyError extends CdkdError {
@@ -9205,6 +9232,53 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
+//#endregion
+//#region src/utils/aws-partition.ts
+/**
+* AWS partition / URL-suffix derivation, shared across layers.
+*
+* Lives in `src/utils/` because it has consumers in two different layers: the
+* `cdkd local *` command family (which passes a region in once to keep the STS
+* hop minimal) and the provisioning layer's `AppSyncProvider`, which rebuilds a
+* child resource's ARN when AWS did not report one.
+*
+* It was originally defined in `src/local/ecs-task-resolver.ts`, which
+* re-exports it so every existing call site is unchanged; a provisioning
+* provider importing from `src/local/**` would invert the layering.
+*
+* NOTE `getAccountInfo().partition`
+* (`src/deployment/intrinsic-function-resolver.ts`) was hardcoded to `'aws'`
+* until issue #1730, which made it derive through THIS helper — so the two now
+* agree and either spelling is correct. Prefer this one where a region is
+* already in hand, since it needs no STS round trip.
+*/
+/**
+* Derive the AWS partition / URL suffix for an AWS region. Same mapping
+* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
+*/
+function derivePartitionAndUrlSuffix(region) {
+	if (region.startsWith("cn-")) return {
+		partition: "aws-cn",
+		urlSuffix: "amazonaws.com.cn"
+	};
+	if (region.startsWith("us-gov-")) return {
+		partition: "aws-us-gov",
+		urlSuffix: "amazonaws.com"
+	};
+	if (region.startsWith("us-iso-")) return {
+		partition: "aws-iso",
+		urlSuffix: "c2s.ic.gov"
+	};
+	if (region.startsWith("us-isob-")) return {
+		partition: "aws-iso-b",
+		urlSuffix: "sc2s.sgov.gov"
+	};
+	return {
+		partition: "aws",
+		urlSuffix: "amazonaws.com"
+	};
+}
+
 //#endregion
 //#region src/provisioning/config-shape.ts
 /**
@@ -10522,10 +10596,13 @@ const REF_RETURNS_SEGMENT_AT_INDEX = /* @__PURE__ */ new Map([["AWS::Route53::Re
 *
 * Value: the attribute keys to try, in order.
 *
-* Degradation is deliberate and matches the sibling recoveries — an IMPORTED
-* child records `attributes: {}` (`AppSyncProvider.import` returns the physical
-* id only), so the lookup misses and the raw compound id is returned rather
-* than a fabricated ARN.
+* Degradation is deliberate and matches the sibling recoveries: when the
+* attribute is absent the raw compound id is returned rather than a fabricated
+* ARN. Since issue #1728 an IMPORTED child records the same attribute set
+* `create()` does (`AppSyncProvider.childImportAttributes`), so the miss is no
+* longer the normal case for an adopted resource — it is now reached by a
+* record written before #1681/#1728, or by an import whose ARN build failed and
+* warned.
 */
 const REF_RETURNS_ARN_FROM_STATE = /* @__PURE__ */ new Map([
 	["AWS::AppSync::ApiKey", ["Arn"]],
@@ -10709,41 +10786,103 @@ const cachedDynamicReferences = {};
 */
 const cachedEc2InstanceAttributes = {};
 /**
+* Re-derive the partition for a region the caller overrode (issue #1730).
+*
+* `partition` is a FUNCTION of `region`, so handing back a cached entry with a
+* different region than the one its partition was derived from would produce
+* `arn:aws:...:cn-north-1:...` for a `cn-` override. Every return path that
+* swaps the region goes through here.
+*/
+function withOverrideRegion(info, region) {
+	return {
+		...info,
+		region,
+		partition: derivePartitionAndUrlSuffix(region).partition
+	};
+}
+/**
+* How long a FABRICATED answer is reused before STS is retried (issue #1730,
+* PR review). Deliberately not the success path's forever-cache — the whole
+* point is that a transient blip must not poison the run — but not zero either:
+* `getAccountInfo` is on the path of EVERY `Fn::GetAtt` and every
+* `AWS::AccountId` / `AWS::Partition` / `AWS::StackId` pseudo-parameter, so an
+* uncached failure re-issues `GetCallerIdentity` (with the SDK's own 3-attempt
+* retry + backoff) dozens of times per stack and prints one warning each. This
+* window collapses a burst into one call while still letting a later phase of
+* the same deploy heal.
+*/
+const FABRICATED_ACCOUNT_INFO_TTL_MS = 1e4;
+/** Test seam for {@link FABRICATED_ACCOUNT_INFO_TTL_MS} expiry. */
+const accountInfoClock = { now: () => Date.now() };
+let fabricatedAccountInfo = null;
+/**
+* The single in-flight lookup, so N concurrent callers share ONE round trip.
+*
+* The TTL above collapses SEQUENTIAL callers; this collapses PARALLEL ones
+* (PR review). `cdkd deploy --concurrency 10` resolves ten resources' intrinsics
+* at once, so without it an STS outage costs ten `GetCallerIdentity` calls —
+* each with the SDK's own 3-attempt retry — and ten identical warnings per
+* window. Cleared in a `finally` so a failure cannot wedge it.
+*/
+let accountInfoInFlight = null;
+/**
 * Get AWS account information from STS
 */
 async function getAccountInfo(overrideRegion) {
-	if (cachedAccountInfo) {
-		if (overrideRegion && overrideRegion !== cachedAccountInfo.region) return {
-			...cachedAccountInfo,
-			region: overrideRegion
-		};
-		return cachedAccountInfo;
+	const forRegion = (info) => overrideRegion && overrideRegion !== info.region ? withOverrideRegion(info, overrideRegion) : info;
+	if (cachedAccountInfo) return forRegion(cachedAccountInfo);
+	if (fabricatedAccountInfo && accountInfoClock.now() < fabricatedAccountInfo.expiresAt) return forRegion(fabricatedAccountInfo.info);
+	if (accountInfoInFlight) return forRegion(await accountInfoInFlight);
+	accountInfoInFlight = resolveAccountInfo(overrideRegion);
+	try {
+		return forRegion(await accountInfoInFlight);
+	} finally {
+		accountInfoInFlight = null;
 	}
+}
+async function resolveAccountInfo(overrideRegion) {
 	const logger = getLogger().child("IntrinsicFunctionResolver");
 	const stsClient = getAwsClients().sts;
 	try {
-		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account || "123456789012";
+		const response = await stsClient.send(new GetCallerIdentityCommand({}));
+		const accountId = response.Account || "123456789012";
 		const region = overrideRegion || process.env["AWS_REGION"] || "us-east-1";
-		const partition = "aws";
-		cachedAccountInfo = {
+		const partition = derivePartitionAndUrlSuffix(region).partition;
+		const resolved = {
 			accountId,
 			region,
-			partition
+			partition,
+			...response.Account ? {} : { fabricated: true }
 		};
-		logger.debug(`Retrieved AWS account info: ${accountId}, ${region}, ${partition}`);
-		if (overrideRegion && overrideRegion !== region) return {
-			...cachedAccountInfo,
-			region: overrideRegion
+		if (resolved.fabricated) fabricatedAccountInfo = {
+			info: resolved,
+			expiresAt: accountInfoClock.now() + FABRICATED_ACCOUNT_INFO_TTL_MS
 		};
-		return cachedAccountInfo;
+		else {
+			cachedAccountInfo = resolved;
+			fabricatedAccountInfo = null;
+		}
+		logger.debug(`Retrieved AWS account info: ${accountId}, ${region}, ${partition}`);
+		return resolved;
 	} catch (error) {
 		logger.warn(`Failed to get AWS account info from STS: ${error instanceof Error ? error.message : String(error)}, using defaults`);
-		cachedAccountInfo = {
+		const region = overrideRegion || process.env["AWS_REGION"] || "us-east-1";
+		const fallback = {
 			accountId: process.env["AWS_ACCOUNT_ID"] || "123456789012",
-			region: overrideRegion || process.env["AWS_REGION"] || "us-east-1",
-			partition: "aws"
+			region,
+			partition: derivePartitionAndUrlSuffix(region).partition,
+			...process.env["AWS_ACCOUNT_ID"] ? {} : { fabricated: true }
 		};
-		return cachedAccountInfo;
+		if (fallback.fabricated) {
+			if (!cachedAccountInfo) fabricatedAccountInfo = {
+				info: fallback,
+				expiresAt: accountInfoClock.now() + FABRICATED_ACCOUNT_INFO_TTL_MS
+			};
+		} else {
+			cachedAccountInfo = fallback;
+			fabricatedAccountInfo = null;
+		}
+		return fallback;
 	}
 }
 /**
@@ -11111,6 +11250,7 @@ var IntrinsicFunctionResolver = class {
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const flatValue = resource.attributes[attributeName];
 			if (flatValue !== void 0) {
+				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId);
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
 				return flatValue;
 			}
@@ -11128,19 +11268,103 @@ var IntrinsicFunctionResolver = class {
 				}
 			}
 		}
-		const value = await this.constructAttribute(resource, attributeName, context, logicalId);
+		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
 		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, value)}`);
 		return value;
 	}
 	/**
-	* Construct resource attribute value based on resource type
+	* Refuse a pre-#1681 PLACEHOLDER ARN served from the cached attribute map
+	* (issue #1729) — the `Fn::GetAtt` half of the guard
+	* {@link cfnRefValueFromPhysicalId} applies to `Ref`.
+	*
+	* `Ref` and `Fn::GetAtt` read the SAME recorded attribute, and #1681 treated
+	* only the `Ref` side: for an `AWS::AppSync::*` child created by a pre-#1681
+	* binary, `{"Fn::GetAtt": ["MyDataSource", "DataSourceArn"]}` still resolved
+	* to `arn:aws:appsync:*:*:apis/.../datasources/...` — structurally valid,
+	* unusable, and indistinguishable downstream from a real ARN.
+	*
+	* Scoped to the {@link REF_RETURNS_ARN_FROM_STATE} types AND their declared
+	* ARN attribute names, the narrowest form of the fix: a wildcard-bearing ARN
+	* is only KNOWN to be a placeholder for these three attributes, and some
+	* other type could legitimately cache an ARN-shaped string carrying a `*` in
+	* a position {@link isPlaceholderArn} inspects. Every other attribute of
+	* these same types (`AWS::AppSync::ApiKey`'s `ApiKey`,
+	* `AWS::AppSync::DataSource`'s `Name`) is untouched.
+	*
+	* THROWS rather than degrading, which is where it diverges from the `Ref`
+	* half, and deliberately: `Ref`'s fallback is the raw compound id, whereas
+	* the value here is requested under an ARN-suffixed attribute name, so
+	* handing back a non-ARN would be exactly the shape mismatch
+	* {@link guardedPhysicalIdFallback} already hard-fails on (the #1103 class —
+	* a green deploy that ships a wrong value into stack Outputs / an IAM
+	* policy). A resource in this state has no correct value to serve, so the
+	* honest answer is to say so and name the remedy: the record heals on the
+	* resource's next in-place update (#1727).
+	*/
+	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId) {
+		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
+		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
+		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: the recorded value "${value}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`);
+	}
+	/**
+	* Construct resource attribute value based on resource type, refusing to
+	* SERVE one built from a fabricated account id (issue #1730).
+	*
+	* Thin wrapper over {@link constructAttribute}. ~30 branches there
+	* build `arn:<partition>:<svc>:<region>:<accountId>:...`, and when the account
+	* id is the hardcoded `123456789012` fallback the result is an ARN naming
+	* SOMEONE ELSE'S account with no wildcard in it — so `isPlaceholderArn` cannot
+	* catch it and every consumer downstream, the state record included, receives
+	* a confidently wrong value. Refusing matches how
+	* {@link guardedPhysicalIdFallback} already treats a knowably-wrong `*Arn`
+	* (the #1103 class): a resource in this state has no correct value to serve.
+	*
+	* The test is on the CONSTRUCTED VALUE, not on the attribute NAME, and that
+	* precision is the whole point: `AWS::S3::Bucket`'s `Arn` is
+	* `arn:aws:s3:::<bucket>` with no account field, so a name-based `*Arn` guard
+	* would refuse a value the fabricated id cannot corrupt. Everything the
+	* account id does not appear in — `DomainName`, `Endpoint`, `WebsiteURL` —
+	* keeps resolving unchanged.
+	*
+	* The match is a BARE substring rather than the colon-delimited `:<id>:` an
+	* ARN uses, because not every account embedding is an ARN field: PR review
+	* caught `AWS::ECR::Repository`'s `RepositoryUri`
+	* (`<accountId>.dkr.ecr.<region>.amazonaws.com/<repo>`), the one such site in
+	* this method, where a colon-delimited test served the fabricated URI and
+	* silently nullified the `CloudControlProvider` omission of the SAME
+	* attribute. The direction is deliberately fail-SAFE: refusing is the honest
+	* answer whenever cdkd cannot confirm the account, so a value that merely
+	* CONTAINS the placeholder digits (a physicalId recorded against the AWS
+	* documentation account) is refused rather than served — and only while STS
+	* is failing, when the deploy has bigger problems.
+	*
+	* NOTE the naming: the per-type construction below KEEPS the name
+	* `constructAttribute` and this guard takes a new one, rather than the other
+	* way round. `scripts/gen-sdk-attr-coverage.ts` collects the set of resource
+	* types `constructAttribute` references to decide which `*Arn` attributes the
+	* resolver can already answer, so renaming that method emptied its walk and
+	* the critic reported fresh `gap`s for CloudTrail Trail / RDS DBCluster /
+	* DBInstance (measured — the first cut of this change did exactly that).
+	*/
+	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
+		const accountInfo = await getAccountInfo(this.resolverRegion);
+		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
+		if (accountInfo.fabricated && typeof value === "string" && value.includes(accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		return value;
+	}
+	/**
+	* The per-resource-type attribute construction itself.
 	*
 	* Many CloudFormation attributes are not returned by Cloud Control API,
 	* so we need to construct them manually.
+	*
+	* Reached only through {@link constructGuardedAttribute}, which vets the
+	* result. Keep this method's NAME — `scripts/gen-sdk-attr-coverage.ts` reads
+	* the resource types it references.
 	*/
-	async constructAttribute(resource, attributeName, _context, logicalId) {
+	async constructAttribute(resource, attributeName, _context, logicalId, accountInfo) {
 		const { resourceType, physicalId } = resource;
-		const { region, accountId, partition } = await getAccountInfo(this.resolverRegion);
+		const { region, accountId, partition } = accountInfo;
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
 			case "StreamArn": return;
@@ -11325,7 +11549,7 @@ var IntrinsicFunctionResolver = class {
 		}
 		if (resourceType === "AWS::ECR::Repository") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecr:${region}:${accountId}:repository/${physicalId}`;
-			case "RepositoryUri": return `${accountId}.dkr.ecr.${region}.amazonaws.com/${physicalId}`;
+			case "RepositoryUri": return `${accountId}.dkr.ecr.${region}.${derivePartitionAndUrlSuffix(region).urlSuffix}/${physicalId}`;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECS::Cluster") switch (attributeName) {
@@ -11453,8 +11677,8 @@ var IntrinsicFunctionResolver = class {
 	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId) {
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
-		if (expectsArnShape || expectsUrlShape) throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
-		if (this.strictGetAtt) throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		if (expectsArnShape || expectsUrlShape) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		if (this.strictGetAtt) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
 		this.physicalIdFallbackCount++;
 		this.logger.warn(`Unknown attribute ${attributeName} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
@@ -11478,6 +11702,17 @@ var IntrinsicFunctionResolver = class {
 		return result;
 	}
 	/**
+	* The warning emitted when `Fn::Sub` keeps a `${...}` placeholder verbatim.
+	*
+	* It carries the underlying reason (issue #1740 item 2): the old text
+	* asserted `not found` for EVERY failure, which was the wrong cause whenever
+	* the variable WAS found and its resolution failed for some other reason.
+	* Deliberate refusals no longer reach this path at all — they re-throw.
+	*/
+	subPlaceholderWarning(varName, error) {
+		return `Fn::Sub variable ${varName} could not be resolved (${error instanceof Error ? error.message : String(error)}), keeping placeholder`;
+	}
+	/**
 	* Resolve Fn::Sub intrinsic function
 	*
 	* Fn::Sub supports two forms:
@@ -11522,16 +11757,18 @@ var IntrinsicFunctionResolver = class {
 				else try {
 					const value = await this.resolveRef(varNameStr, context);
 					replacement = String(value);
-				} catch {
+				} catch (refError) {
 					if (varNameStr.includes(".")) try {
 						const value = await this.resolveGetAtt(varNameStr, context);
 						replacement = String(value);
-					} catch {
-						this.logger.warn(`Fn::Sub variable ${varNameStr} not found, keeping placeholder`);
+					} catch (getAttError) {
+						if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
+						this.logger.warn(this.subPlaceholderWarning(varNameStr, getAttError));
 						replacement = match[0];
 					}
 					else {
-						this.logger.warn(`Fn::Sub variable ${varNameStr} not found, keeping placeholder`);
+						if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
+						this.logger.warn(this.subPlaceholderWarning(varNameStr, refError));
 						replacement = match[0];
 					}
 				}
@@ -12137,9 +12374,9 @@ var IntrinsicFunctionResolver = class {
 			case "AWS::StackName": return context?.stackName ?? "UnknownStack";
 			case "AWS::StackId": {
 				const info = await getAccountInfo(this.resolverRegion);
-				return `arn:aws:cloudformation:${info.region}:${info.accountId}:stack/${context?.stackName ?? "UnknownStack"}/cdkd`;
+				return `arn:${info.partition}:cloudformation:${info.region}:${info.accountId}:stack/${context?.stackName ?? "UnknownStack"}/cdkd`;
 			}
-			case "AWS::URLSuffix": return "amazonaws.com";
+			case "AWS::URLSuffix": return derivePartitionAndUrlSuffix(this.resolverRegion).urlSuffix;
 			case "AWS::NotificationARNs": return "";
 			case "AWS::NoValue": return AWS_NO_VALUE;
 			default: return;
@@ -13167,7 +13404,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-JZvPyCEp.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C1WbHit9.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -13300,6 +13537,31 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
+	* Account info for an ARN / URI this provider SYNTHESIZES and records, or
+	* `undefined` when it must not be built (issue
+	* [#1730](https://github.com/go-to-k/cdkd/issues/1730)).
+	*
+	* `getAccountInfo` falls back to a hardcoded `123456789012` when STS cannot
+	* answer, and an ARN built from it is structurally valid with no wildcard in
+	* any field — so `isPlaceholderArn` (issue #1681) cannot catch it and every
+	* downstream consumer receives a confidently wrong value that is then
+	* RECORDED into state as the resource's `Fn::GetAtt` answer.
+	*
+	* Omitting the attribute is the honest answer and mirrors
+	* `AppSyncProvider.childImportAttributes`: the resolver's own
+	* `guardedPhysicalIdFallback` then hard-fails an `*Arn` read with a message
+	* naming the cause, instead of a green deploy shipping an ARN for someone
+	* else's account, and the record heals on the resource's next update.
+	*/
+	async accountInfoForSynthesizedArn(resourceType, attributeName, physicalId) {
+		const accountInfo = await getAccountInfo();
+		if (accountInfo.fabricated) {
+			this.logger.warn(`Not enriching ${resourceType} ${attributeName} for ${physicalId}: STS did not report this deploy's account id, so the value would be built from a placeholder account and would be indistinguishable from a real one. Fix the credentials (or set AWS_ACCOUNT_ID) and deploy again — the record heals on the next update.`);
+			return;
+		}
+		return accountInfo;
+	}
+	/**
 	* Enrich resource attributes with computed values
 	*
 	* CC API GetResource returns property names that match CloudFormation
@@ -13378,9 +13640,11 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::KMS::Key":
 				if (!enriched["Arn"]) try {
-					const kmsAccountInfo = await getAccountInfo();
-					enriched["Arn"] = `arn:${kmsAccountInfo.partition}:kms:${kmsAccountInfo.region}:${kmsAccountInfo.accountId}:key/${physicalId}`;
-					this.logger.debug(`Enriched KMS Key Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+					const kmsAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					if (kmsAccountInfo) {
+						enriched["Arn"] = `arn:${kmsAccountInfo.partition}:kms:${kmsAccountInfo.region}:${kmsAccountInfo.accountId}:key/${physicalId}`;
+						this.logger.debug(`Enriched KMS Key Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+					}
 				} catch (error) {
 					this.logger.debug(`Failed to construct KMS Key Arn for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				}
@@ -13394,15 +13658,20 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::ECR::Repository":
 				if (!enriched["Arn"]) try {
-					const ecrAccountInfo = await getAccountInfo();
-					enriched["Arn"] = `arn:${ecrAccountInfo.partition}:ecr:${ecrAccountInfo.region}:${ecrAccountInfo.accountId}:repository/${physicalId}`;
-					this.logger.debug(`Enriched ECR Repository Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					if (ecrAccountInfo) {
+						enriched["Arn"] = `arn:${ecrAccountInfo.partition}:ecr:${ecrAccountInfo.region}:${ecrAccountInfo.accountId}:repository/${physicalId}`;
+						this.logger.debug(`Enriched ECR Repository Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+					}
 				} catch (error) {
 					this.logger.debug(`Failed to construct ECR Repository Arn: ${error instanceof Error ? error.message : String(error)}`);
 				}
 				if (!enriched["RepositoryUri"]) try {
-					const ecrAccountInfo = await getAccountInfo();
-					enriched["RepositoryUri"] = `${ecrAccountInfo.accountId}.dkr.ecr.${ecrAccountInfo.region}.amazonaws.com/${physicalId}`;
+					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "RepositoryUri", physicalId);
+					if (ecrAccountInfo) {
+						const { urlSuffix } = derivePartitionAndUrlSuffix(ecrAccountInfo.region);
+						enriched["RepositoryUri"] = `${ecrAccountInfo.accountId}.dkr.ecr.${ecrAccountInfo.region}.${urlSuffix}/${physicalId}`;
+					}
 				} catch {}
 				break;
 			case "AWS::EC2::EIP":
@@ -13423,9 +13692,11 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::Kinesis::Stream":
 				if (!enriched["Arn"]) try {
-					const kinesisAccountInfo = await getAccountInfo();
-					enriched["Arn"] = `arn:${kinesisAccountInfo.partition}:kinesis:${kinesisAccountInfo.region}:${kinesisAccountInfo.accountId}:stream/${physicalId}`;
-					this.logger.debug(`Enriched Kinesis Stream Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+					const kinesisAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					if (kinesisAccountInfo) {
+						enriched["Arn"] = `arn:${kinesisAccountInfo.partition}:kinesis:${kinesisAccountInfo.region}:${kinesisAccountInfo.accountId}:stream/${physicalId}`;
+						this.logger.debug(`Enriched Kinesis Stream Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+					}
 				} catch (error) {
 					this.logger.debug(`Failed to construct Kinesis Stream Arn for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				}
@@ -20041,7 +20312,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.281.12";
+	return "0.281.14";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22209,5 +22480,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { replayWarn as $, uploadCfnTemplate as $t, green as A, normalizeAwsError as An, formatDockerLoginError as At, slowCcOperationTimeoutMs as B, resolveApp as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, ResourceUpdateNotSupportedError as Cn, BOOTSTRAP_MARKER_PREFIX as Ct, bold as D, SynthesisError as Dn, validateAssetBucketName as Dt, formatResourceLine as E, StateError as En, parseBootstrapMarker as Et, clearOnUpdateRemoval as F, getDockerImageBySourceHash as Ft, getAccountInfo as G, resolveStateBucketWithDefaultAndSource as Gt, isTerminationProtectionPropagationError as H, resolveCaptureObservedState as Ht, ProviderRegistry as I, Synthesizer as It, normalizeAwsTagsToCfn as J, warnDeprecatedNoPrefixCliFlag as Jt, refStateLookupFromResource as K, resolveUseCdkBootstrapAssets as Kt, findActionableSilentDrops as L, synthesisStatusMessage as Lt, yellow as M, __exportAll as Mn, runDockerForeground as Mt, IAMRoleProvider as N, runDockerStreaming as Nt, cyan as O, formatError as On, validateContainerRepoName as Ot, collectInlinePolicyNamesManagedBySiblings as P, AssetManifestLoader as Pt, readConfigString as Q, findLargeInlineResources as Qt, findSilentDropProperties as R, getDefaultStateBucketName as Rt, extractDeploymentEventError as S, ResourceTimeoutError as Sn, AssetModeResolver as St, renderStatefulReason as T, StackTerminationProtectionError as Tn, getBootstrapMarkerKey as Tt, IntrinsicFunctionResolver as U, resolveSkipPrefix as Ut, disableInstanceApiTermination as V, resolveAutoAssetStorage as Vt, cfnRefValueFromPhysicalId as W, resolveStateBucketWithDefault as Wt, assertRegionMatch as X, CFN_TEMPLATE_URL_LIMIT as Xt, resolveExplicitPhysicalId as Y, CFN_TEMPLATE_BODY_LIMIT as Yt, configStringRefusal as Z, MIGRATE_TMP_PREFIX as Zt, createPreDeleteFinalSnapshot as _, LockError as _n, WorkGraph as _t, DeploymentEventsStore as a, AwsClients as an, describeTypeWithThrottleRetry as at, unsupportedFinalSnapshotError as b, PartialFailureError as bn, loadPublishableAssetManifest as bt, replayFailedOperations as c, setAwsClients as cn, isThrottlingError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, ConfigError as dn, LockManager as dt, expectedOwnerParam as en, requireConfigArray as et, computeImplicitDeleteEdges as f, DependencyError as fn, S3StateBackend as ft, ccRoutedFinalSnapshotError as g, LocalStartServiceError as gn, stringifyValue as gt, buildFinalSnapshotIdentifier as h, LocalMigrateError as hn, AssetPublisher as ht, DeploymentEventsReader as i, resolveBucketRegion as in, DiffCalculator as it, red as j, withErrorHandling as jn, getDockerCmd as jt, gray as k, isCdkdError as kn, buildDockerImage as kt, replayRollback as l, AssetError as ln, DagBuilder as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalInvokeBuildError as mn, shouldRetainResource as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, processStackMessages as nn, requireConfigString as nt, planFailedOps as o, getAwsClients as on, withRetry as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, DeployCancelledError as pn, rebuildClientForBucketRegion as pt, WAFv2WebACLProvider as q, stateBucketExistenceConfirmed as qt, DeployEngine as r, clearBucketRegionCache as rn, applyRoleArnIfSet as rt, planRollback as s, resetAwsClients as sn, isRetryableTransientError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssemblyReader as tn, requireConfigObject as tt, withResourceDeadline as u, CdkdError as un, TemplateParser as ut, isFinalSnapshotError as v, MissingCdkCliError as vn, buildAssetRedirectMap as vt, isStatefulRecreateTargetSync as w, StackHasActiveImportsError as wn, ensureAssetStorage as wt, makeCanonicalizePropertiesFn as x, ProvisioningError as xn, rewriteTemplateAssetReferences as xt, refusesFinalSnapshot as y, NestedStackChildDirectDestroyError as yn, createAssetRedirectResolver as yt, CloudControlProvider as z, getLegacyStateBucketName as zt };
-//# sourceMappingURL=deploy-engine-CPDPlPQN.js.map
+export { replayWarn as $, findLargeInlineResources as $t, green as A, isCdkdError as An, buildDockerImage as At, slowCcOperationTimeoutMs as B, getLegacyStateBucketName as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, ResourceTimeoutError as Cn, AssetModeResolver as Ct, bold as D, StateError as Dn, parseBootstrapMarker as Dt, formatResourceLine as E, StackTerminationProtectionError as En, getBootstrapMarkerKey as Et, clearOnUpdateRemoval as F, AssetManifestLoader as Ft, getAccountInfo as G, resolveStateBucketWithDefault as Gt, isTerminationProtectionPropagationError as H, resolveAutoAssetStorage as Ht, ProviderRegistry as I, getDockerImageBySourceHash as It, normalizeAwsTagsToCfn as J, stateBucketExistenceConfirmed as Jt, refStateLookupFromResource as K, resolveStateBucketWithDefaultAndSource as Kt, findActionableSilentDrops as L, Synthesizer as Lt, yellow as M, withErrorHandling as Mn, getDockerCmd as Mt, IAMRoleProvider as N, __exportAll as Nn, runDockerForeground as Nt, cyan as O, SynthesisError as On, validateAssetBucketName as Ot, collectInlinePolicyNamesManagedBySiblings as P, runDockerStreaming as Pt, readConfigString as Q, MIGRATE_TMP_PREFIX as Qt, findSilentDropProperties as R, synthesisStatusMessage as Rt, extractDeploymentEventError as S, ProvisioningError as Sn, rewriteTemplateAssetReferences as St, renderStatefulReason as T, StackHasActiveImportsError as Tn, ensureAssetStorage as Tt, IntrinsicFunctionResolver as U, resolveCaptureObservedState as Ut, disableInstanceApiTermination as V, resolveApp as Vt, cfnRefValueFromPhysicalId as W, resolveSkipPrefix as Wt, assertRegionMatch as X, CFN_TEMPLATE_BODY_LIMIT as Xt, resolveExplicitPhysicalId as Y, warnDeprecatedNoPrefixCliFlag as Yt, configStringRefusal as Z, CFN_TEMPLATE_URL_LIMIT as Zt, createPreDeleteFinalSnapshot as _, LocalStartServiceError as _n, stringifyValue as _t, DeploymentEventsStore as a, resolveBucketRegion as an, DiffCalculator as at, unsupportedFinalSnapshotError as b, NestedStackChildDirectDestroyError as bn, createAssetRedirectResolver as bt, replayFailedOperations as c, resetAwsClients as cn, isRetryableTransientError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, CdkdError as dn, TemplateParser as dt, uploadCfnTemplate as en, requireConfigArray as et, computeImplicitDeleteEdges as f, ConfigError as fn, LockManager as ft, ccRoutedFinalSnapshotError as g, LocalMigrateError as gn, AssetPublisher as gt, buildFinalSnapshotIdentifier as h, LocalInvokeBuildError as hn, shouldRetainResource as ht, DeploymentEventsReader as i, clearBucketRegionCache as in, applyRoleArnIfSet as it, red as j, normalizeAwsError as jn, formatDockerLoginError as jt, gray as k, formatError as kn, validateContainerRepoName as kt, replayRollback as l, setAwsClients as ln, isThrottlingError as lt, PRE_DELETE_SNAPSHOT_TYPES as m, DeployCancelledError as mn, rebuildClientForBucketRegion as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssemblyReader as nn, requireConfigString as nt, planFailedOps as o, AwsClients as on, describeTypeWithThrottleRetry as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, DependencyError as pn, S3StateBackend as pt, WAFv2WebACLProvider as q, resolveUseCdkBootstrapAssets as qt, DeployEngine as r, processStackMessages as rn, derivePartitionAndUrlSuffix as rt, planRollback as s, getAwsClients as sn, withRetry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, expectedOwnerParam as tn, requireConfigObject as tt, withResourceDeadline as u, AssetError as un, DagBuilder as ut, isFinalSnapshotError as v, LockError as vn, WorkGraph as vt, isStatefulRecreateTargetSync as w, ResourceUpdateNotSupportedError as wn, BOOTSTRAP_MARKER_PREFIX as wt, makeCanonicalizePropertiesFn as x, PartialFailureError as xn, loadPublishableAssetManifest as xt, refusesFinalSnapshot as y, MissingCdkCliError as yn, buildAssetRedirectMap as yt, CloudControlProvider as z, getDefaultStateBucketName as zt };
+//# sourceMappingURL=deploy-engine-3BZtmJqZ.js.map