@go-to-k/cdkd 0.281.17 → 0.281.19

package/dist/{deploy-engine-B6DcyQpS.js → deploy-engine-DPnxkjWi.js}

@@ -4176,11 +4176,70 @@ function cacheOptionToFlag(option) {
 	return flag;
 }
 
+//#endregion
+//#region src/utils/aws-partition.ts
+/**
+* AWS partition / URL-suffix derivation, shared across layers.
+*
+* Lives in `src/utils/` because it has consumers in two different layers: the
+* `cdkd local *` command family (which passes a region in once to keep the STS
+* hop minimal) and the provisioning layer's `AppSyncProvider`, which rebuilds a
+* child resource's ARN when AWS did not report one.
+*
+* It was originally defined in `src/local/ecs-task-resolver.ts`, which
+* re-exports it so every existing call site is unchanged; a provisioning
+* provider importing from `src/local/**` would invert the layering.
+*
+* NOTE `getAccountInfo().partition`
+* (`src/deployment/intrinsic-function-resolver.ts`) was hardcoded to `'aws'`
+* until issue #1730, which made it derive through THIS helper — so the two now
+* agree and either spelling is correct. Prefer this one where a region is
+* already in hand, since it needs no STS round trip.
+*/
+/**
+* Derive the AWS partition / URL suffix for an AWS region. Same mapping
+* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
+*/
+function derivePartitionAndUrlSuffix(region) {
+	if (region.startsWith("cn-")) return {
+		partition: "aws-cn",
+		urlSuffix: "amazonaws.com.cn"
+	};
+	if (region.startsWith("us-gov-")) return {
+		partition: "aws-us-gov",
+		urlSuffix: "amazonaws.com"
+	};
+	if (region.startsWith("us-iso-")) return {
+		partition: "aws-iso",
+		urlSuffix: "c2s.ic.gov"
+	};
+	if (region.startsWith("us-isob-")) return {
+		partition: "aws-iso-b",
+		urlSuffix: "sc2s.sgov.gov"
+	};
+	return {
+		partition: "aws",
+		urlSuffix: "amazonaws.com"
+	};
+}
+
 //#endregion
 //#region src/assets/docker-asset-publisher.ts
 /**
+* The ECR registry host suffix for a region (issue #1745).
+*
+* Every registry URI here was hardcoded to `amazonaws.com`, so outside the
+* commercial partition cdkd built a hostname that does not resolve —
+* `aws-cn` registries live under `amazonaws.com.cn`, and `us-iso*` under
+* `c2s.ic.gov` / `sc2s.sgov.gov`. Commercial output is byte-identical, which is
+* what makes the change safe to ship without a non-commercial account.
+*/
+function ecrUrlSuffix(region) {
+	return derivePartitionAndUrlSuffix(region).urlSuffix;
+}
+/**
 * Registries this process has already logged in to, keyed by registry host
-* (`<accountId>.dkr.ecr.<region>.amazonaws.com`, which uniquely encodes the
+* (`<accountId>.dkr.ecr.<region>.<urlSuffix>`, which uniquely encodes the
 * account + region credential context). ECR authorization tokens are valid
 * for ~12h and a deploy process is short-lived, so a successful login is
 * reused for the process lifetime — mirroring `cdk-assets`, which skips
@@ -4221,7 +4280,7 @@ var DockerAssetPublisher = class {
 			const repositoryName = this.resolvePlaceholders(dest.repositoryName, accountId, region);
 			const imageTag = this.resolvePlaceholders(dest.imageTag, accountId, region);
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
-			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
+			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
 			this.logger.debug(`Publishing Docker image ${asset.displayName || assetHash} → ${ecrUri}`);
 			const client = new ECRClient({ region: destRegion });
 			try {
@@ -4231,8 +4290,7 @@ var DockerAssetPublisher = class {
 				}
 				const localTag = `cdkd-asset-${assetHash}`;
 				await this.buildImage(asset, cdkOutputDir, localTag);
-				const fullUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
-				await this.tagAndPushWithLazyLogin(client, localTag, fullUri, accountId, destRegion);
+				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, accountId, destRegion);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
 				client.destroy();
@@ -4259,15 +4317,14 @@ var DockerAssetPublisher = class {
 			const repositoryName = this.resolvePlaceholders(dest.repositoryName, accountId, region);
 			const imageTag = this.resolvePlaceholders(dest.imageTag, accountId, region);
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
-			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
+			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
 			const client = new ECRClient({ region: destRegion });
 			try {
 				if (await this.imageExists(client, repositoryName, imageTag)) {
 					this.logger.debug(`Image already exists, skipping: ${ecrUri}`);
 					continue;
 				}
-				const fullUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
-				await this.tagAndPushWithLazyLogin(client, localTag, fullUri, accountId, destRegion);
+				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, accountId, destRegion);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
 				client.destroy();
@@ -4354,7 +4411,7 @@ var DockerAssetPublisher = class {
 	/**
 	* Authenticate with ECR via `docker login --password-stdin`.
 	*
-	* The login is cached per registry (`<accountId>.dkr.ecr.<region>`) for the
+	* The login is cached per registry (`<accountId>.dkr.ecr.<region>.<urlSuffix>`) for the
 	* process lifetime: a repeat publish to the same registry returns early
 	* without the `GetAuthorizationToken` call or the `docker login` subprocess
 	* (mirrors `cdk-assets`). ECR tokens are valid ~12h and a deploy process is
@@ -4366,7 +4423,7 @@ var DockerAssetPublisher = class {
 	* token that AWS has already expired.
 	*/
 	async ecrLogin(client, accountId, region, options = {}) {
-		const registryKey = `${accountId}.dkr.ecr.${region}.amazonaws.com`;
+		const registryKey = `${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
 		if (!options.force && loggedInRegistries.has(registryKey)) {
 			this.logger.debug(`Reusing cached ECR login for ${registryKey}`);
 			return;
@@ -4375,7 +4432,7 @@ var DockerAssetPublisher = class {
 		if (!authData?.authorizationToken) throw new AssetError("Failed to get ECR authorization token");
 		const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 		if (!username || password === void 0) throw new AssetError("ECR authorization token has unexpected shape (missing username/password)");
-		const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
+		const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
 		try {
 			await runDockerStreaming([
 				"login",
@@ -4995,8 +5052,8 @@ function evaluatePseudoParam(name, map) {
 	switch (name) {
 		case "AWS::AccountId": return map.accountId;
 		case "AWS::Region": return map.region;
-		case "AWS::Partition": return map.partition;
-		case "AWS::URLSuffix": return "amazonaws.com";
+		case "AWS::Partition": return derivePartitionAndUrlSuffix(map.region).partition;
+		case "AWS::URLSuffix": return derivePartitionAndUrlSuffix(map.region).urlSuffix;
 		default: throw new Error(`Not a foldable pseudo parameter: ${name}`);
 	}
 }
@@ -9232,53 +9289,6 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
-//#endregion
-//#region src/utils/aws-partition.ts
-/**
-* AWS partition / URL-suffix derivation, shared across layers.
-*
-* Lives in `src/utils/` because it has consumers in two different layers: the
-* `cdkd local *` command family (which passes a region in once to keep the STS
-* hop minimal) and the provisioning layer's `AppSyncProvider`, which rebuilds a
-* child resource's ARN when AWS did not report one.
-*
-* It was originally defined in `src/local/ecs-task-resolver.ts`, which
-* re-exports it so every existing call site is unchanged; a provisioning
-* provider importing from `src/local/**` would invert the layering.
-*
-* NOTE `getAccountInfo().partition`
-* (`src/deployment/intrinsic-function-resolver.ts`) was hardcoded to `'aws'`
-* until issue #1730, which made it derive through THIS helper — so the two now
-* agree and either spelling is correct. Prefer this one where a region is
-* already in hand, since it needs no STS round trip.
-*/
-/**
-* Derive the AWS partition / URL suffix for an AWS region. Same mapping
-* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
-*/
-function derivePartitionAndUrlSuffix(region) {
-	if (region.startsWith("cn-")) return {
-		partition: "aws-cn",
-		urlSuffix: "amazonaws.com.cn"
-	};
-	if (region.startsWith("us-gov-")) return {
-		partition: "aws-us-gov",
-		urlSuffix: "amazonaws.com"
-	};
-	if (region.startsWith("us-iso-")) return {
-		partition: "aws-iso",
-		urlSuffix: "c2s.ic.gov"
-	};
-	if (region.startsWith("us-isob-")) return {
-		partition: "aws-iso-b",
-		urlSuffix: "sc2s.sgov.gov"
-	};
-	return {
-		partition: "aws",
-		urlSuffix: "amazonaws.com"
-	};
-}
-
 //#endregion
 //#region src/provisioning/config-shape.ts
 /**
@@ -9561,6 +9571,63 @@ function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (!isPlainObject$1(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
+/**
+* Coerce a CFn boolean, which may arrive as the string `"true"` / `"false"`.
+*
+* CloudFormation is stringly typed and cdkd is not, so a hand-written or
+* imported template legitimately spells a boolean as a string. Case-insensitive
+* on purpose: CDK renders lowercase, but this also feeds
+* `AWS::S3::Bucket NotificationConfiguration.EventBridgeConfiguration` (issue
+* #1430), where "not false" means "enable" — so a `'False'` that fell through to
+* `undefined` would silently ENABLE EventBridge delivery, the exact inversion
+* #1430 fixed.
+*
+* Lives here rather than in the one provider that used to own it because
+* {@link configBooleanRefusal} must run the SAME primitive the wire read runs;
+* a second hand-written test would disagree with it on exactly the interesting
+* values, which is the guard-mismatch shape this module exists to stop.
+*
+* @returns the boolean, or `undefined` when the value is not one.
+*/
+function coerceCfnBoolean(value) {
+	if (typeof value === "boolean") return value;
+	if (typeof value === "string") {
+		const lowered = value.toLowerCase();
+		if (lowered === "true") return true;
+		if (lowered === "false") return false;
+	}
+}
+/**
+* The BOOLEAN twin of {@link configStringRefusal} — the refusal SENTENCE for a
+* config member that is read as a boolean, with no action clause attached.
+*
+* Same two halves in the same order (CONTAINER, then FIELD) and the same
+* shared detail clause, so a boolean guard and a string guard on sibling
+* members of one block cannot word the same fault differently. The FIELD half
+* is `coerceCfnBoolean`, i.e. literally the function the wire read calls, per
+* this module's "share the predicate, never restate it" rule.
+*
+* It exists because a boolean member read as `x ?? <default>` is the one shape
+* neither string guard can see: `??` treats a DECLARED `null` as absent and
+* substitutes the default, which for `AWS::S3::Bucket
+* InventoryConfigurations[].Enabled` meant a declared `Enabled: null` went on
+* the wire as `true` — a report the template may have been disabling, ENABLED
+* with no warning anywhere (issue #1751). Its string siblings on the same item
+* are SKIP-guarded (#1595) or warn-and-substitute (#1670); this was the one
+* member that silently coerced.
+*
+* @returns The refusal sentence (`<path> must be …`), or `undefined` when the
+*   value is usable — including the ABSENT container / ABSENT key cases, which
+*   legitimately take the caller's default.
+*/
+function configBooleanRefusal(container, key, containerPath) {
+	if (container === void 0 || container === null) return void 0;
+	if (!isPlainObject$1(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	const value = container[key];
+	if (value === void 0) return void 0;
+	if (coerceCfnBoolean(value) !== void 0) return void 0;
+	return `${containerPath}.${key} must be a boolean ${malformedShapeDetail(value)}`;
+}
 /** The FIELD half of {@link configStringRefusal}, shared with {@link requireConfigString}. */
 function configValueRefusal(value, fallback, path, options) {
 	if (value === void 0) return void 0;
@@ -10767,7 +10834,7 @@ function buildUnknownIntrinsicError(key) {
 	const issueUrl = `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(title)}&labels=intrinsic-support`;
 	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function "${key}": cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
 }
-let cachedAccountInfo = null;
+let cachedAccountIdentity = null;
 /**
 * Cache for availability zones per region
 */
@@ -10786,18 +10853,30 @@ const cachedDynamicReferences = {};
 */
 const cachedEc2InstanceAttributes = {};
 /**
-* Re-derive the partition for a region the caller overrode (issue #1730).
+* The region this call answers for: the caller's override, else the ambient one.
+*
+* Kept as one helper so the cached and the freshly-resolved paths cannot pick
+* different defaults (issue #1746).
+*/
+function effectiveAccountInfoRegion(overrideRegion) {
+	return overrideRegion || process.env["AWS_REGION"] || "us-east-1";
+}
+/**
+* Build the caller's full answer from the cached account identity (issue #1746).
 *
-* `partition` is a FUNCTION of `region`, so handing back a cached entry with a
-* different region than the one its partition was derived from would produce
-* `arn:aws:...:cn-north-1:...` for a `cn-` override. Every return path that
-* swaps the region goes through here.
+* `partition` is a FUNCTION of `region`, so it is derived HERE — per call —
+* rather than carried alongside the account. This is what makes the cache safe
+* to share between callers with different regions: an `arn:aws:...:cn-north-1`
+* (or the inverse `arn:aws-cn:...:us-east-1`) is structurally valid, so nothing
+* downstream could catch it.
 */
-function withOverrideRegion(info, region) {
+function accountInfoFor(identity, overrideRegion) {
+	const region = effectiveAccountInfoRegion(overrideRegion);
 	return {
-		...info,
+		accountId: identity.accountId,
 		region,
-		partition: derivePartitionAndUrlSuffix(region).partition
+		partition: derivePartitionAndUrlSuffix(region).partition,
+		...identity.fabricated ? { fabricated: true } : {}
 	};
 }
 /**
@@ -10814,7 +10893,7 @@ function withOverrideRegion(info, region) {
 const FABRICATED_ACCOUNT_INFO_TTL_MS = 1e4;
 /** Test seam for {@link FABRICATED_ACCOUNT_INFO_TTL_MS} expiry. */
 const accountInfoClock = { now: () => Date.now() };
-let fabricatedAccountInfo = null;
+let fabricatedAccountIdentity = null;
 /**
 * The single in-flight lookup, so N concurrent callers share ONE round trip.
 *
@@ -10826,66 +10905,95 @@ let fabricatedAccountInfo = null;
 */
 let accountInfoInFlight = null;
 /**
+* Bumped by {@link resetAccountInfoCache}, so a lookup that was already in
+* flight cannot write the cache it was asked to forget.
+*
+* Without it the reset only cleared the SETTLED caches: an in-flight resolve
+* would land afterwards and re-populate `cachedAccountIdentity`, so the next
+* caller read the pre-reset account. That is the `*Once`-leak shape one layer
+* down — a later test silently inheriting an earlier one's answer — and the
+* reset's own comment already claimed to forget it.
+*/
+let accountInfoGeneration = 0;
+/**
 * Get AWS account information from STS
 */
 async function getAccountInfo(overrideRegion) {
-	const forRegion = (info) => overrideRegion && overrideRegion !== info.region ? withOverrideRegion(info, overrideRegion) : info;
-	if (cachedAccountInfo) return forRegion(cachedAccountInfo);
-	if (fabricatedAccountInfo && accountInfoClock.now() < fabricatedAccountInfo.expiresAt) return forRegion(fabricatedAccountInfo.info);
-	if (accountInfoInFlight) return forRegion(await accountInfoInFlight);
-	accountInfoInFlight = resolveAccountInfo(overrideRegion);
+	if (cachedAccountIdentity) return accountInfoFor(cachedAccountIdentity, overrideRegion);
+	if (fabricatedAccountIdentity && accountInfoClock.now() < fabricatedAccountIdentity.expiresAt) return accountInfoFor(fabricatedAccountIdentity.identity, overrideRegion);
+	if (accountInfoInFlight) return accountInfoFor(await accountInfoInFlight, overrideRegion);
+	const inFlight = resolveAccountIdentity();
+	accountInfoInFlight = inFlight;
 	try {
-		return forRegion(await accountInfoInFlight);
+		return accountInfoFor(await inFlight, overrideRegion);
 	} finally {
-		accountInfoInFlight = null;
+		if (accountInfoInFlight === inFlight) accountInfoInFlight = null;
 	}
 }
-async function resolveAccountInfo(overrideRegion) {
+async function resolveAccountIdentity() {
+	const generation = accountInfoGeneration;
+	const stillCurrent = () => generation === accountInfoGeneration;
 	const logger = getLogger().child("IntrinsicFunctionResolver");
 	const stsClient = getAwsClients().sts;
 	try {
 		const response = await stsClient.send(new GetCallerIdentityCommand({}));
 		const accountId = response.Account || "123456789012";
-		const region = overrideRegion || process.env["AWS_REGION"] || "us-east-1";
-		const partition = derivePartitionAndUrlSuffix(region).partition;
 		const resolved = {
 			accountId,
-			region,
-			partition,
 			...response.Account ? {} : { fabricated: true }
 		};
-		if (resolved.fabricated) fabricatedAccountInfo = {
-			info: resolved,
+		if (!stillCurrent()) {} else if (resolved.fabricated) fabricatedAccountIdentity = {
+			identity: resolved,
 			expiresAt: accountInfoClock.now() + FABRICATED_ACCOUNT_INFO_TTL_MS
 		};
 		else {
-			cachedAccountInfo = resolved;
-			fabricatedAccountInfo = null;
+			cachedAccountIdentity = resolved;
+			fabricatedAccountIdentity = null;
 		}
-		logger.debug(`Retrieved AWS account info: ${accountId}, ${region}, ${partition}`);
+		logger.debug(`Retrieved AWS account info: ${accountId}`);
 		return resolved;
 	} catch (error) {
 		logger.warn(`Failed to get AWS account info from STS: ${error instanceof Error ? error.message : String(error)}, using defaults`);
-		const region = overrideRegion || process.env["AWS_REGION"] || "us-east-1";
 		const fallback = {
 			accountId: process.env["AWS_ACCOUNT_ID"] || "123456789012",
-			region,
-			partition: derivePartitionAndUrlSuffix(region).partition,
 			...process.env["AWS_ACCOUNT_ID"] ? {} : { fabricated: true }
 		};
+		if (!stillCurrent()) return fallback;
 		if (fallback.fabricated) {
-			if (!cachedAccountInfo) fabricatedAccountInfo = {
-				info: fallback,
+			if (!cachedAccountIdentity) fabricatedAccountIdentity = {
+				identity: fallback,
 				expiresAt: accountInfoClock.now() + FABRICATED_ACCOUNT_INFO_TTL_MS
 			};
 		} else {
-			cachedAccountInfo = fallback;
-			fabricatedAccountInfo = null;
+			cachedAccountIdentity = fallback;
+			fabricatedAccountIdentity = null;
 		}
 		return fallback;
 	}
 }
 /**
+* Does a constructed `Fn::GetAtt` answer embed the placeholder account id?
+*
+* The guard in `constructGuardedAttribute` used to test
+* `typeof value === 'string'` directly (issue #1746). Every account-bearing
+* branch of `constructAttribute` returns a string today — the only non-string
+* returns are the EC2 IPv6 CIDR LISTS, which carry no account — so that was
+* complete as written, but a future list-valued attribute embedding an account
+* would have slipped past silently with no test failing. Walking string arrays
+* (one level, which is the shape `constructAttribute` actually produces) closes
+* it now rather than at the moment someone adds one. A non-string, non-array
+* value is not account-bearing by construction and is left alone.
+*
+* EXPORTED for its own test: no `constructAttribute` branch returns an
+* account-bearing array today, so the array arm is unreachable through the
+* public resolver API and would ship unexercised otherwise.
+*/
+function embedsAccountId(value, accountId) {
+	if (typeof value === "string") return value.includes(accountId);
+	if (Array.isArray(value)) return value.some((entry) => typeof entry === "string" && entry.includes(accountId));
+	return false;
+}
+/**
 * Collect every name referenced (Ref / Fn::Sub placeholder / other intrinsic
 * argument) by the sections cdkd actually evaluates: Resources, Outputs, and
 * Conditions. Deliberately excludes `Rules` (assertion-only, never evaluated
@@ -11349,7 +11457,7 @@ var IntrinsicFunctionResolver = class {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && typeof value === "string" && value.includes(accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -13404,7 +13512,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-MpqWnvQI.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CE-lwlgZ.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -13554,7 +13662,7 @@ var CloudControlProvider = class {
 	* else's account, and the record heals on the resource's next update.
 	*/
 	async accountInfoForSynthesizedArn(resourceType, attributeName, physicalId) {
-		const accountInfo = await getAccountInfo();
+		const accountInfo = await getAccountInfo(await this.cloudControlClient.config.region());
 		if (accountInfo.fabricated) {
 			this.logger.warn(`Not enriching ${resourceType} ${attributeName} for ${physicalId}: STS did not report this deploy's account id, so the value would be built from a placeholder account and would be indistinguishable from a real one. Fix the credentials (or set AWS_ACCOUNT_ID) and deploy again — the record heals on the next update.`);
 			return;
@@ -20312,7 +20420,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.281.17";
+	return "0.281.19";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22480,5 +22588,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { replayWarn as $, findLargeInlineResources as $t, green as A, isCdkdError as An, buildDockerImage as At, slowCcOperationTimeoutMs as B, getLegacyStateBucketName as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, ResourceTimeoutError as Cn, AssetModeResolver as Ct, bold as D, StateError as Dn, parseBootstrapMarker as Dt, formatResourceLine as E, StackTerminationProtectionError as En, getBootstrapMarkerKey as Et, clearOnUpdateRemoval as F, AssetManifestLoader as Ft, getAccountInfo as G, resolveStateBucketWithDefault as Gt, isTerminationProtectionPropagationError as H, resolveAutoAssetStorage as Ht, ProviderRegistry as I, getDockerImageBySourceHash as It, normalizeAwsTagsToCfn as J, stateBucketExistenceConfirmed as Jt, refStateLookupFromResource as K, resolveStateBucketWithDefaultAndSource as Kt, findActionableSilentDrops as L, Synthesizer as Lt, yellow as M, withErrorHandling as Mn, getDockerCmd as Mt, IAMRoleProvider as N, __exportAll as Nn, runDockerForeground as Nt, cyan as O, SynthesisError as On, validateAssetBucketName as Ot, collectInlinePolicyNamesManagedBySiblings as P, runDockerStreaming as Pt, readConfigString as Q, MIGRATE_TMP_PREFIX as Qt, findSilentDropProperties as R, synthesisStatusMessage as Rt, extractDeploymentEventError as S, ProvisioningError as Sn, rewriteTemplateAssetReferences as St, renderStatefulReason as T, StackHasActiveImportsError as Tn, ensureAssetStorage as Tt, IntrinsicFunctionResolver as U, resolveCaptureObservedState as Ut, disableInstanceApiTermination as V, resolveApp as Vt, cfnRefValueFromPhysicalId as W, resolveSkipPrefix as Wt, assertRegionMatch as X, CFN_TEMPLATE_BODY_LIMIT as Xt, resolveExplicitPhysicalId as Y, warnDeprecatedNoPrefixCliFlag as Yt, configStringRefusal as Z, CFN_TEMPLATE_URL_LIMIT as Zt, createPreDeleteFinalSnapshot as _, LocalStartServiceError as _n, stringifyValue as _t, DeploymentEventsStore as a, resolveBucketRegion as an, DiffCalculator as at, unsupportedFinalSnapshotError as b, NestedStackChildDirectDestroyError as bn, createAssetRedirectResolver as bt, replayFailedOperations as c, resetAwsClients as cn, isRetryableTransientError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, CdkdError as dn, TemplateParser as dt, uploadCfnTemplate as en, requireConfigArray as et, computeImplicitDeleteEdges as f, ConfigError as fn, LockManager as ft, ccRoutedFinalSnapshotError as g, LocalMigrateError as gn, AssetPublisher as gt, buildFinalSnapshotIdentifier as h, LocalInvokeBuildError as hn, shouldRetainResource as ht, DeploymentEventsReader as i, clearBucketRegionCache as in, applyRoleArnIfSet as it, red as j, normalizeAwsError as jn, formatDockerLoginError as jt, gray as k, formatError as kn, validateContainerRepoName as kt, replayRollback as l, setAwsClients as ln, isThrottlingError as lt, PRE_DELETE_SNAPSHOT_TYPES as m, DeployCancelledError as mn, rebuildClientForBucketRegion as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssemblyReader as nn, requireConfigString as nt, planFailedOps as o, AwsClients as on, describeTypeWithThrottleRetry as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, DependencyError as pn, S3StateBackend as pt, WAFv2WebACLProvider as q, resolveUseCdkBootstrapAssets as qt, DeployEngine as r, processStackMessages as rn, derivePartitionAndUrlSuffix as rt, planRollback as s, getAwsClients as sn, withRetry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, expectedOwnerParam as tn, requireConfigObject as tt, withResourceDeadline as u, AssetError as un, DagBuilder as ut, isFinalSnapshotError as v, LockError as vn, WorkGraph as vt, isStatefulRecreateTargetSync as w, ResourceUpdateNotSupportedError as wn, BOOTSTRAP_MARKER_PREFIX as wt, makeCanonicalizePropertiesFn as x, PartialFailureError as xn, loadPublishableAssetManifest as xt, refusesFinalSnapshot as y, MissingCdkCliError as yn, buildAssetRedirectMap as yt, CloudControlProvider as z, getDefaultStateBucketName as zt };
-//# sourceMappingURL=deploy-engine-B6DcyQpS.js.map
+export { configStringRefusal as $, CFN_TEMPLATE_URL_LIMIT as $t, green as A, SynthesisError as An, validateContainerRepoName as At, slowCcOperationTimeoutMs as B, synthesisStatusMessage as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, PartialFailureError as Cn, rewriteTemplateAssetReferences as Ct, bold as D, StackHasActiveImportsError as Dn, getBootstrapMarkerKey as Dt, formatResourceLine as E, ResourceUpdateNotSupportedError as En, ensureAssetStorage as Et, clearOnUpdateRemoval as F, __exportAll as Fn, runDockerForeground as Ft, getAccountInfo as G, resolveCaptureObservedState as Gt, isTerminationProtectionPropagationError as H, getLegacyStateBucketName as Ht, ProviderRegistry as I, runDockerStreaming as It, normalizeAwsTagsToCfn as J, resolveStateBucketWithDefaultAndSource as Jt, refStateLookupFromResource as K, resolveSkipPrefix as Kt, findActionableSilentDrops as L, AssetManifestLoader as Lt, yellow as M, isCdkdError as Mn, buildDockerImage as Mt, IAMRoleProvider as N, normalizeAwsError as Nn, formatDockerLoginError as Nt, cyan as O, StackTerminationProtectionError as On, parseBootstrapMarker as Ot, collectInlinePolicyNamesManagedBySiblings as P, withErrorHandling as Pn, getDockerCmd as Pt, configBooleanRefusal as Q, CFN_TEMPLATE_BODY_LIMIT as Qt, findSilentDropProperties as R, getDockerImageBySourceHash as Rt, extractDeploymentEventError as S, NestedStackChildDirectDestroyError as Sn, loadPublishableAssetManifest as St, renderStatefulReason as T, ResourceTimeoutError as Tn, BOOTSTRAP_MARKER_PREFIX as Tt, IntrinsicFunctionResolver as U, resolveApp as Ut, disableInstanceApiTermination as V, getDefaultStateBucketName as Vt, cfnRefValueFromPhysicalId as W, resolveAutoAssetStorage as Wt, assertRegionMatch as X, stateBucketExistenceConfirmed as Xt, resolveExplicitPhysicalId as Y, resolveUseCdkBootstrapAssets as Yt, coerceCfnBoolean as Z, warnDeprecatedNoPrefixCliFlag as Zt, createPreDeleteFinalSnapshot as _, LocalInvokeBuildError as _n, AssetPublisher as _t, DeploymentEventsStore as a, processStackMessages as an, applyRoleArnIfSet as at, unsupportedFinalSnapshotError as b, LockError as bn, buildAssetRedirectMap as bt, replayFailedOperations as c, AwsClients as cn, withRetry as ct, IMPLICIT_DELETE_DEPENDENCIES as d, setAwsClients as dn, DagBuilder as dt, MIGRATE_TMP_PREFIX as en, readConfigString as et, computeImplicitDeleteEdges as f, AssetError as fn, TemplateParser as ft, ccRoutedFinalSnapshotError as g, DeployCancelledError as gn, shouldRetainResource as gt, buildFinalSnapshotIdentifier as h, DependencyError as hn, rebuildClientForBucketRegion as ht, DeploymentEventsReader as i, AssemblyReader as in, requireConfigString as it, red as j, formatError as jn, derivePartitionAndUrlSuffix as jt, gray as k, StateError as kn, validateAssetBucketName as kt, replayRollback as l, getAwsClients as ln, isRetryableTransientError as lt, PRE_DELETE_SNAPSHOT_TYPES as m, ConfigError as mn, S3StateBackend as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, uploadCfnTemplate as nn, requireConfigArray as nt, planFailedOps as o, clearBucketRegionCache as on, DiffCalculator as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, CdkdError as pn, LockManager as pt, WAFv2WebACLProvider as q, resolveStateBucketWithDefault as qt, DeployEngine as r, expectedOwnerParam as rn, requireConfigObject as rt, planRollback as s, resolveBucketRegion as sn, describeTypeWithThrottleRetry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, findLargeInlineResources as tn, replayWarn as tt, withResourceDeadline as u, resetAwsClients as un, isThrottlingError as ut, isFinalSnapshotError as v, LocalMigrateError as vn, stringifyValue as vt, isStatefulRecreateTargetSync as w, ProvisioningError as wn, AssetModeResolver as wt, makeCanonicalizePropertiesFn as x, MissingCdkCliError as xn, createAssetRedirectResolver as xt, refusesFinalSnapshot as y, LocalStartServiceError as yn, WorkGraph as yt, CloudControlProvider as z, Synthesizer as zt };
+//# sourceMappingURL=deploy-engine-DPnxkjWi.js.map