@go-to-k/cdkd 0.281.26 → 0.281.27

package/dist/{deploy-engine-XC8HOR51.js → deploy-engine-CP5fB_0I.js}

@@ -2441,25 +2441,99 @@ function collectFnTransformNames(value, seen, out) {
 * already in hand, since it needs no STS round trip.
 */
 /**
-* Derive the AWS partition / URL suffix for an AWS region. Same mapping
-* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
-*/
-function derivePartitionAndUrlSuffix(region) {
-	if (region.startsWith("cn-")) return {
+* Region prefix -> `{partition, urlSuffix}`, in match order.
+*
+* Exported so a caller needing the WHOLE mapping — rather than one region's
+* answer — can read it here instead of hand-maintaining a parallel list that
+* silently goes stale when a partition is added (issue #1785 couples `cdkd
+* gc`'s suffix list to this table for exactly that reason).
+*
+* Every row is VERIFIED against AWS-authored partition data rather than taken
+* from documentation prose (issue #1764 shipped the last three, and the issue
+* explicitly asked for confirmation rather than trust). Three independent
+* AWS-authored sources agree on every row, prefix AND suffix:
+*
+* 1. `@aws-sdk/util-endpoints`'s vendored `lib/aws/partitions.json` (the copy
+*    in this repo's own `node_modules`) — each row's `regionRegex` +
+*    `outputs.dnsSuffix`.
+* 2. botocore's `endpoints.json`, as shipped inside the official AWS CLI v2 —
+*    each row's `regionRegex` + `dnsSuffix`.
+* 3. `aws-cdk-lib`'s `region-info` `PARTITION_MAP` — each row's prefix +
+*    `domainSuffix`.
+*
+* Two things the sources settle that are easy to get wrong:
+*
+* - `aws-us-gov`'s suffix really IS the commercial `amazonaws.com`; GovCloud
+*   is the one non-commercial partition that does not have its own DNS suffix.
+* - Each partition is named by exactly ONE region prefix upstream, so this
+*   table needs no per-partition prefix list.
+*
+* Match ORDER is only load-bearing to the extent that no prefix here is a
+* prefix of another — `us-iso-` cannot swallow `us-isob-` / `us-isof-` because
+* of its trailing hyphen. A row whose prefix nests inside an earlier one would
+* be unreachable, so keep that invariant (it is pinned by a unit test).
+*
+* The one deliberate divergence from upstream is `eusc-`: the SDK / botocore
+* regex is `^eusc\-(de)\-\w+\-\d+$` and CDK pins the prefix `eusc-de-`, i.e.
+* both are scoped to today's single European Sovereign Cloud country. cdkd
+* matches on the broader `eusc-` because the failure directions are not
+* symmetric — a future `eusc-<cc>-…` region falling through to commercial is
+* the exact bug this table was widened to fix, while a false match is
+* impossible: no other partition's regions begin with `eusc-`.
+*/
+const PARTITION_TABLE = [
+	{
+		prefix: "cn-",
 		partition: "aws-cn",
 		urlSuffix: "amazonaws.com.cn"
-	};
-	if (region.startsWith("us-gov-")) return {
+	},
+	{
+		prefix: "us-gov-",
 		partition: "aws-us-gov",
 		urlSuffix: "amazonaws.com"
-	};
-	if (region.startsWith("us-iso-")) return {
+	},
+	{
+		prefix: "us-iso-",
 		partition: "aws-iso",
 		urlSuffix: "c2s.ic.gov"
-	};
-	if (region.startsWith("us-isob-")) return {
+	},
+	{
+		prefix: "us-isob-",
 		partition: "aws-iso-b",
 		urlSuffix: "sc2s.sgov.gov"
+	},
+	{
+		prefix: "us-isof-",
+		partition: "aws-iso-f",
+		urlSuffix: "csp.hci.ic.gov"
+	},
+	{
+		prefix: "eu-isoe-",
+		partition: "aws-iso-e",
+		urlSuffix: "cloud.adc-e.uk"
+	},
+	{
+		prefix: "eusc-",
+		partition: "aws-eusc",
+		urlSuffix: "amazonaws.eu"
+	}
+];
+/**
+* Derive the AWS partition / URL suffix for an AWS region. Same mapping
+* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
+*
+* An unrecognized region resolves to the commercial partition. That fallback
+* is deliberate (a brand-new commercial region must keep working before this
+* table hears about it), but it is also what made the pre-#1764 gap quiet: a
+* genuine registry host in a partition missing from the table came back with
+* the COMMERCIAL suffix, so `parseEcrRegistryHost` (`src/utils/ecr-uri.ts`)
+* rejected it under the strict host check issue #1758 added and the image was
+* classified `public` — anonymous pull, no `docker login`, opaque failure.
+*/
+function derivePartitionAndUrlSuffix(region) {
+	for (const { prefix, partition, urlSuffix } of PARTITION_TABLE) if (region.startsWith(prefix)) return {
+		partition,
+		urlSuffix
 	};
 	return {
 		partition: "aws",
@@ -13513,7 +13587,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-II3TmZ4t.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CwcEOJx0.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -20430,7 +20504,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.281.26";
+	return "0.281.27";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22599,4 +22673,4 @@ var DeployEngine = class {
 
 //#endregion
 export { configStringRefusal as $, MIGRATE_TMP_PREFIX as $t, green as A, SynthesisError as An, validateContainerRepoName as At, slowCcOperationTimeoutMs as B, getDefaultStateBucketName as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, PartialFailureError as Cn, rewriteTemplateAssetReferences as Ct, bold as D, StackHasActiveImportsError as Dn, getBootstrapMarkerKey as Dt, formatResourceLine as E, ResourceUpdateNotSupportedError as En, ensureAssetStorage as Et, clearOnUpdateRemoval as F, __exportAll as Fn, runDockerStreaming as Ft, getAccountInfo as G, resolveSkipPrefix as Gt, isTerminationProtectionPropagationError as H, resolveApp as Ht, ProviderRegistry as I, AssetManifestLoader as It, normalizeAwsTagsToCfn as J, resolveUseCdkBootstrapAssets as Jt, refStateLookupFromResource as K, resolveStateBucketWithDefault as Kt, findActionableSilentDrops as L, getDockerImageBySourceHash as Lt, yellow as M, isCdkdError as Mn, formatDockerLoginError as Mt, IAMRoleProvider as N, normalizeAwsError as Nn, getDockerCmd as Nt, cyan as O, StackTerminationProtectionError as On, parseBootstrapMarker as Ot, collectInlinePolicyNamesManagedBySiblings as P, withErrorHandling as Pn, runDockerForeground as Pt, configBooleanRefusal as Q, CFN_TEMPLATE_URL_LIMIT as Qt, findSilentDropProperties as R, Synthesizer as Rt, extractDeploymentEventError as S, NestedStackChildDirectDestroyError as Sn, loadPublishableAssetManifest as St, renderStatefulReason as T, ResourceTimeoutError as Tn, BOOTSTRAP_MARKER_PREFIX as Tt, IntrinsicFunctionResolver as U, resolveAutoAssetStorage as Ut, disableInstanceApiTermination as V, getLegacyStateBucketName as Vt, cfnRefValueFromPhysicalId as W, resolveCaptureObservedState as Wt, assertRegionMatch as X, warnDeprecatedNoPrefixCliFlag as Xt, resolveExplicitPhysicalId as Y, stateBucketExistenceConfirmed as Yt, coerceCfnBoolean as Z, CFN_TEMPLATE_BODY_LIMIT as Zt, createPreDeleteFinalSnapshot as _, LocalInvokeBuildError as _n, AssetPublisher as _t, DeploymentEventsStore as a, processStackMessages as an, applyRoleArnIfSet as at, unsupportedFinalSnapshotError as b, LockError as bn, buildAssetRedirectMap as bt, replayFailedOperations as c, AwsClients as cn, withRetry as ct, IMPLICIT_DELETE_DEPENDENCIES as d, setAwsClients as dn, DagBuilder as dt, findLargeInlineResources as en, readConfigString as et, computeImplicitDeleteEdges as f, AssetError as fn, TemplateParser as ft, ccRoutedFinalSnapshotError as g, DeployCancelledError as gn, shouldRetainResource as gt, buildFinalSnapshotIdentifier as h, DependencyError as hn, rebuildClientForBucketRegion as ht, DeploymentEventsReader as i, AssemblyReader as in, requireConfigString as it, red as j, formatError as jn, buildDockerImage as jt, gray as k, StateError as kn, validateAssetBucketName as kt, replayRollback as l, getAwsClients as ln, isRetryableTransientError as lt, PRE_DELETE_SNAPSHOT_TYPES as m, ConfigError as mn, S3StateBackend as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, expectedOwnerParam as nn, requireConfigArray as nt, planFailedOps as o, clearBucketRegionCache as on, DiffCalculator as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, CdkdError as pn, LockManager as pt, WAFv2WebACLProvider as q, resolveStateBucketWithDefaultAndSource as qt, DeployEngine as r, derivePartitionAndUrlSuffix as rn, requireConfigObject as rt, planRollback as s, resolveBucketRegion as sn, describeTypeWithThrottleRetry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, uploadCfnTemplate as tn, replayWarn as tt, withResourceDeadline as u, resetAwsClients as un, isThrottlingError as ut, isFinalSnapshotError as v, LocalMigrateError as vn, stringifyValue as vt, isStatefulRecreateTargetSync as w, ProvisioningError as wn, AssetModeResolver as wt, makeCanonicalizePropertiesFn as x, MissingCdkCliError as xn, createAssetRedirectResolver as xt, refusesFinalSnapshot as y, LocalStartServiceError as yn, WorkGraph as yt, CloudControlProvider as z, synthesisStatusMessage as zt };
-//# sourceMappingURL=deploy-engine-XC8HOR51.js.map
+//# sourceMappingURL=deploy-engine-CP5fB_0I.js.map