@go-to-k/cdkd 0.281.26 → 0.281.28

package/dist/{deploy-engine-XC8HOR51.js → deploy-engine-DnvhlIW5.js}

@@ -1054,6 +1054,25 @@ function resetAwsClients() {
 */
 const cache = /* @__PURE__ */ new Map();
 /**
+* Read an S3 client's resolved region without issuing a network call.
+*
+* Used to discover what the AWS SDK's own region chain (env vars, shared
+* config profile) picked for a client that was constructed WITHOUT an
+* explicit region. Never throws — an unresolvable chain (and a hand-rolled
+* test double with no `config`) both degrade to `undefined` so the caller
+* falls through to its own default.
+*/
+async function readClientRegion(client) {
+	try {
+		const config = client.config;
+		if (!config || typeof config.region !== "function") return void 0;
+		const region = await config.region();
+		return typeof region === "string" && region.length > 0 ? region : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * Resolve the AWS region of an S3 bucket via `GetBucketLocation`.
 *
 * Why `GetBucketLocation` rather than `HeadBucket`:
@@ -1064,27 +1083,59 @@ const cache = /* @__PURE__ */ new Map();
 *   `GetBucketLocation` is a GET with an XML body and is not subject to the
 *   same SDK glitch.
 *
-* Why a region-agnostic client (us-east-1):
-*   `GetBucketLocation` works against the global S3 endpoint regardless of
-*   the bucket's actual region, so we don't need to know the answer to ask
-*   the question.
-*
-* The result is cached per bucket name for the process lifetime — bucket
-* regions never move, so the cache never needs invalidation.
+* Why the probe is NOT pinned to us-east-1 (issue
+* [#1763](https://github.com/go-to-k/cdkd/issues/1763)):
+*   `GetBucketLocation` is answered by ANY regional S3 endpoint for any
+*   bucket in the SAME PARTITION — measured 2026-08-13 against a real
+*   eu-west-1 bucket, which resolved identically from us-east-1 / us-west-2 /
+*   ap-northeast-1 / eu-west-1 clients — so the probe never needs to know the
+*   answer to ask the question. But it DOES have to reach the right
+*   partition: a hardcoded `us-east-1` endpoint is unreachable from `aws-cn`
+*   / `us-iso*`, so outside the commercial partition the probe could not run
+*   at all, every call fell through to the commercial default, and every
+*   consumer (the state backend, the lock manager, the exports index, the
+*   custom-resource response path, `upload-cfn-template`) proceeded against
+*   the wrong region. The probe endpoint is therefore taken from, in order:
+*   `opts.region`, `opts.fallbackRegion`, the AWS SDK's own region chain
+*   (env / shared config profile — the chain every other cdkd client
+*   consults), and only then `us-east-1`. Commercial behavior is unchanged:
+*   the resolved value is identical from any commercial endpoint, and a
+*   caller with no region configured anywhere still probes `us-east-1`.
+*
+* A SUCCESSFUL result is cached per bucket name for the process lifetime —
+* bucket regions never move, so the cache never needs invalidation. A FAILED
+* probe is deliberately NOT cached (mirroring `write-only-properties.ts`):
+* the failure answer is a guess, and caching it let one transient error pin
+* every later caller in the process to the wrong region with no way to heal.
 *
 * @returns The bucket's region (e.g. `us-west-2`). An empty `LocationConstraint`
-*   in the response means `us-east-1` (S3 quirk). On any error, returns
-*   `opts.fallbackRegion` if provided, else `us-east-1`.
+*   in the response means `us-east-1` (S3 quirk — non-commercial partitions
+*   always report their region explicitly). On any error, returns
+*   `opts.fallbackRegion` if provided, else the region the probe was aimed at.
 */
 async function resolveBucketRegion(bucketName, opts = {}) {
 	const cached = cache.get(bucketName);
 	if (cached) return cached;
+	let probeFailed = false;
 	const promise = (async () => {
-		const client = new S3Client({
-			region: "us-east-1",
+		const auth = {
 			...opts.profile && { profile: opts.profile },
 			...opts.credentials && { credentials: opts.credentials }
+		};
+		const explicitRegion = opts.region ?? opts.fallbackRegion;
+		let client = new S3Client({
+			...explicitRegion && { region: explicitRegion },
+			...auth
 		});
+		let probeRegion = explicitRegion ?? await readClientRegion(client);
+		if (!probeRegion) {
+			client.destroy();
+			probeRegion = "us-east-1";
+			client = new S3Client({
+				region: probeRegion,
+				...auth
+			});
+		}
 		try {
 			const { expectedOwnerParam } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 			return (await client.send(new GetBucketLocationCommand({
@@ -1092,13 +1143,16 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 				...await expectedOwnerParam(client)
 			}))).LocationConstraint || "us-east-1";
 		} catch {
-			return opts.fallbackRegion ?? "us-east-1";
+			probeFailed = true;
+			return opts.fallbackRegion ?? probeRegion;
 		} finally {
 			client.destroy();
 		}
 	})();
 	cache.set(bucketName, promise);
-	return promise;
+	const region = await promise;
+	if (probeFailed && cache.get(bucketName) === promise) cache.delete(bucketName);
+	return region;
 }
 /**
 * Clear the per-bucket region cache. Used by tests to reset state between
@@ -2441,25 +2495,99 @@ function collectFnTransformNames(value, seen, out) {
 * already in hand, since it needs no STS round trip.
 */
 /**
-* Derive the AWS partition / URL suffix for an AWS region. Same mapping
-* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
+* Region prefix -> `{partition, urlSuffix}`, in match order.
+*
+* Exported so a caller needing the WHOLE mapping — rather than one region's
+* answer — can read it here instead of hand-maintaining a parallel list that
+* silently goes stale when a partition is added (issue #1785 couples `cdkd
+* gc`'s suffix list to this table for exactly that reason).
+*
+* Every row is VERIFIED against AWS-authored partition data rather than taken
+* from documentation prose (issue #1764 shipped the last three, and the issue
+* explicitly asked for confirmation rather than trust). Three independent
+* AWS-authored sources agree on every row, prefix AND suffix:
+*
+* 1. `@aws-sdk/util-endpoints`'s vendored `lib/aws/partitions.json` (the copy
+*    in this repo's own `node_modules`) — each row's `regionRegex` +
+*    `outputs.dnsSuffix`.
+* 2. botocore's `endpoints.json`, as shipped inside the official AWS CLI v2 —
+*    each row's `regionRegex` + `dnsSuffix`.
+* 3. `aws-cdk-lib`'s `region-info` `PARTITION_MAP` — each row's prefix +
+*    `domainSuffix`.
+*
+* Two things the sources settle that are easy to get wrong:
+*
+* - `aws-us-gov`'s suffix really IS the commercial `amazonaws.com`; GovCloud
+*   is the one non-commercial partition that does not have its own DNS suffix.
+* - Each partition is named by exactly ONE region prefix upstream, so this
+*   table needs no per-partition prefix list.
+*
+* Match ORDER is only load-bearing to the extent that no prefix here is a
+* prefix of another — `us-iso-` cannot swallow `us-isob-` / `us-isof-` because
+* of its trailing hyphen. A row whose prefix nests inside an earlier one would
+* be unreachable, so keep that invariant (it is pinned by a unit test).
+*
+* The one deliberate divergence from upstream is `eusc-`: the SDK / botocore
+* regex is `^eusc\-(de)\-\w+\-\d+$` and CDK pins the prefix `eusc-de-`, i.e.
+* both are scoped to today's single European Sovereign Cloud country. cdkd
+* matches on the broader `eusc-` because the failure directions are not
+* symmetric — a future `eusc-<cc>-…` region falling through to commercial is
+* the exact bug this table was widened to fix, while a false match is
+* impossible: no other partition's regions begin with `eusc-`.
 */
-function derivePartitionAndUrlSuffix(region) {
-	if (region.startsWith("cn-")) return {
+const PARTITION_TABLE = [
+	{
+		prefix: "cn-",
 		partition: "aws-cn",
 		urlSuffix: "amazonaws.com.cn"
-	};
-	if (region.startsWith("us-gov-")) return {
+	},
+	{
+		prefix: "us-gov-",
 		partition: "aws-us-gov",
 		urlSuffix: "amazonaws.com"
-	};
-	if (region.startsWith("us-iso-")) return {
+	},
+	{
+		prefix: "us-iso-",
 		partition: "aws-iso",
 		urlSuffix: "c2s.ic.gov"
-	};
-	if (region.startsWith("us-isob-")) return {
+	},
+	{
+		prefix: "us-isob-",
 		partition: "aws-iso-b",
 		urlSuffix: "sc2s.sgov.gov"
+	},
+	{
+		prefix: "us-isof-",
+		partition: "aws-iso-f",
+		urlSuffix: "csp.hci.ic.gov"
+	},
+	{
+		prefix: "eu-isoe-",
+		partition: "aws-iso-e",
+		urlSuffix: "cloud.adc-e.uk"
+	},
+	{
+		prefix: "eusc-",
+		partition: "aws-eusc",
+		urlSuffix: "amazonaws.eu"
+	}
+];
+/**
+* Derive the AWS partition / URL suffix for an AWS region. Same mapping
+* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
+*
+* An unrecognized region resolves to the commercial partition. That fallback
+* is deliberate (a brand-new commercial region must keep working before this
+* table hears about it), but it is also what made the pre-#1764 gap quiet: a
+* genuine registry host in a partition missing from the table came back with
+* the COMMERCIAL suffix, so `parseEcrRegistryHost` (`src/utils/ecr-uri.ts`)
+* rejected it under the strict host check issue #1758 added and the image was
+* classified `public` — anonymous pull, no `docker login`, opaque failure.
+*/
+function derivePartitionAndUrlSuffix(region) {
+	for (const { prefix, partition, urlSuffix } of PARTITION_TABLE) if (region.startsWith(prefix)) return {
+		partition,
+		urlSuffix
 	};
 	return {
 		partition: "aws",
@@ -13513,7 +13641,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-II3TmZ4t.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CPA-dc1x.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -20430,7 +20558,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.281.26";
+	return "0.281.28";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22599,4 +22727,4 @@ var DeployEngine = class {
 
 //#endregion
 export { configStringRefusal as $, MIGRATE_TMP_PREFIX as $t, green as A, SynthesisError as An, validateContainerRepoName as At, slowCcOperationTimeoutMs as B, getDefaultStateBucketName as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, PartialFailureError as Cn, rewriteTemplateAssetReferences as Ct, bold as D, StackHasActiveImportsError as Dn, getBootstrapMarkerKey as Dt, formatResourceLine as E, ResourceUpdateNotSupportedError as En, ensureAssetStorage as Et, clearOnUpdateRemoval as F, __exportAll as Fn, runDockerStreaming as Ft, getAccountInfo as G, resolveSkipPrefix as Gt, isTerminationProtectionPropagationError as H, resolveApp as Ht, ProviderRegistry as I, AssetManifestLoader as It, normalizeAwsTagsToCfn as J, resolveUseCdkBootstrapAssets as Jt, refStateLookupFromResource as K, resolveStateBucketWithDefault as Kt, findActionableSilentDrops as L, getDockerImageBySourceHash as Lt, yellow as M, isCdkdError as Mn, formatDockerLoginError as Mt, IAMRoleProvider as N, normalizeAwsError as Nn, getDockerCmd as Nt, cyan as O, StackTerminationProtectionError as On, parseBootstrapMarker as Ot, collectInlinePolicyNamesManagedBySiblings as P, withErrorHandling as Pn, runDockerForeground as Pt, configBooleanRefusal as Q, CFN_TEMPLATE_URL_LIMIT as Qt, findSilentDropProperties as R, Synthesizer as Rt, extractDeploymentEventError as S, NestedStackChildDirectDestroyError as Sn, loadPublishableAssetManifest as St, renderStatefulReason as T, ResourceTimeoutError as Tn, BOOTSTRAP_MARKER_PREFIX as Tt, IntrinsicFunctionResolver as U, resolveAutoAssetStorage as Ut, disableInstanceApiTermination as V, getLegacyStateBucketName as Vt, cfnRefValueFromPhysicalId as W, resolveCaptureObservedState as Wt, assertRegionMatch as X, warnDeprecatedNoPrefixCliFlag as Xt, resolveExplicitPhysicalId as Y, stateBucketExistenceConfirmed as Yt, coerceCfnBoolean as Z, CFN_TEMPLATE_BODY_LIMIT as Zt, createPreDeleteFinalSnapshot as _, LocalInvokeBuildError as _n, AssetPublisher as _t, DeploymentEventsStore as a, processStackMessages as an, applyRoleArnIfSet as at, unsupportedFinalSnapshotError as b, LockError as bn, buildAssetRedirectMap as bt, replayFailedOperations as c, AwsClients as cn, withRetry as ct, IMPLICIT_DELETE_DEPENDENCIES as d, setAwsClients as dn, DagBuilder as dt, findLargeInlineResources as en, readConfigString as et, computeImplicitDeleteEdges as f, AssetError as fn, TemplateParser as ft, ccRoutedFinalSnapshotError as g, DeployCancelledError as gn, shouldRetainResource as gt, buildFinalSnapshotIdentifier as h, DependencyError as hn, rebuildClientForBucketRegion as ht, DeploymentEventsReader as i, AssemblyReader as in, requireConfigString as it, red as j, formatError as jn, buildDockerImage as jt, gray as k, StateError as kn, validateAssetBucketName as kt, replayRollback as l, getAwsClients as ln, isRetryableTransientError as lt, PRE_DELETE_SNAPSHOT_TYPES as m, ConfigError as mn, S3StateBackend as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, expectedOwnerParam as nn, requireConfigArray as nt, planFailedOps as o, clearBucketRegionCache as on, DiffCalculator as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, CdkdError as pn, LockManager as pt, WAFv2WebACLProvider as q, resolveStateBucketWithDefaultAndSource as qt, DeployEngine as r, derivePartitionAndUrlSuffix as rn, requireConfigObject as rt, planRollback as s, resolveBucketRegion as sn, describeTypeWithThrottleRetry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, uploadCfnTemplate as tn, replayWarn as tt, withResourceDeadline as u, resetAwsClients as un, isThrottlingError as ut, isFinalSnapshotError as v, LocalMigrateError as vn, stringifyValue as vt, isStatefulRecreateTargetSync as w, ProvisioningError as wn, AssetModeResolver as wt, makeCanonicalizePropertiesFn as x, MissingCdkCliError as xn, createAssetRedirectResolver as xt, refusesFinalSnapshot as y, LocalStartServiceError as yn, WorkGraph as yt, CloudControlProvider as z, synthesisStatusMessage as zt };
-//# sourceMappingURL=deploy-engine-XC8HOR51.js.map
+//# sourceMappingURL=deploy-engine-DnvhlIW5.js.map