@go-to-k/cdkd 0.282.2 → 0.282.4

package/dist/{deploy-engine-6sSRIhrN.js → deploy-engine-CnxJLy3Y.js}

@@ -9418,6 +9418,118 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
+//#endregion
+//#region src/utils/s3-endpoints.ts
+/**
+* `AWS::S3::Bucket` `Fn::GetAtt` endpoint construction, shared across layers.
+*
+* cdkd answers the four host-shaped bucket attributes (`DomainName`,
+* `RegionalDomainName`, `DualStackDomainName`, `WebsiteURL`) WITHOUT an AWS
+* call, from the bucket name plus the region — and it does so in TWO places:
+* `S3BucketProvider.buildAttributes` (what lands in state) and
+* `IntrinsicFunctionResolver.constructAttribute` (what a cross-resource
+* `Fn::GetAtt` resolves to when the attribute is not cached). Those two used to
+* carry independent copies of the templates, which is the phantom-drift shape
+* `.claude/rules/providers.md` warns about: fix one and the resolver's answer
+* disagrees with what `readCurrentState` reports. They now both call THIS
+* module, so the two sides cannot diverge (issue
+* [#1745](https://github.com/go-to-k/cdkd/issues/1745)).
+*
+* Both copies also hardcoded the commercial `amazonaws.com` suffix, so outside
+* the commercial partition every one of the four emitted a hostname that does
+* not resolve — structurally valid, so nothing downstream could catch it. The
+* suffix now derives from the region through
+* {@link derivePartitionAndUrlSuffix}, the same closed table `${AWS::URLSuffix}`
+* resolves through.
+*
+* The shapes are taken from `aws-cdk-lib`'s own `Bucket.fromBucketAttributes`
+* (`aws-s3/lib/bucket.ts`), which constructs the identical four values for an
+* imported bucket, rather than from documentation prose:
+*
+* - `bucketDomainName`            -> `<bucket>.s3.<urlSuffix>`
+* - `bucketRegionalDomainName`    -> `<bucket>.s3.<region>.<urlSuffix>`
+* - `bucketDualStackDomainName`   -> `<bucket>.s3.dualstack.<region>.<urlSuffix>`
+* - `bucketWebsiteUrl`            -> `http://<bucket>.<staticWebsiteEndpoint>`
+*/
+/**
+* The regions whose S3 static-website endpoint uses the LEGACY hyphen form
+* `s3-website-<region>` rather than the current dot form `s3-website.<region>`.
+*
+* This is NOT a mechanical suffix swap, which is why the issue asked for it to
+* be verified rather than spliced. The set is CLOSED and was read out of
+* `aws-cdk-lib`'s `region-info` fact table (`S3_STATIC_WEBSITE_ENDPOINT`, the
+* same data CDK itself resolves a bucket's website endpoint from), enumerated
+* at aws-cdk-lib 2.244.0: exactly these nine regions report the hyphen form and
+* every other region — commercial and non-commercial alike — reports the dot
+* form. `us-gov-west-1` is in the hyphen set while its `us-gov-east-1` sibling
+* is not, so the split is per REGION and cannot be derived from the partition.
+*
+* An UNKNOWN region resolves to the dot form, matching what CDK falls back to
+* when `region-info` has no fact for the region: the hyphen form is the legacy
+* spelling and no new region has been added to it.
+*
+* NOTE this corrects the answer for every non-legacy COMMERCIAL region too, not
+* only for other partitions — the previous hardcoded template emitted the
+* hyphen form everywhere, so e.g. an `eu-central-1` bucket's `WebsiteURL`
+* resolved to a host AWS does not serve.
+*/
+const S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS = /* @__PURE__ */ new Set([
+	"ap-northeast-1",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"eu-west-1",
+	"sa-east-1",
+	"us-east-1",
+	"us-gov-west-1",
+	"us-west-1",
+	"us-west-2"
+]);
+/** `arn:<partition>:s3:::<bucket>` — the bucket ARN (no region / account field). */
+function s3BucketArn(bucketName, region) {
+	return `arn:${derivePartitionAndUrlSuffix(region).partition}:s3:::${bucketName}`;
+}
+/**
+* `<bucket>.s3.<urlSuffix>` — the partition-global (non-regional) domain name.
+*
+* **This host does not RESOLVE outside the commercial partition, and that is
+* not something this module can fix.** S3's partition-global endpoint exists
+* only in `aws`: `s3.amazonaws.com.cn` is NXDOMAIN (probed 2026-08-13), and in
+* GovCloud the commercial `<bucket>.s3.amazonaws.com` resolves to COMMERCIAL S3,
+* which answers `NoSuchBucket`. Only the regional / dual-stack / website forms
+* have a real non-commercial spelling.
+*
+* The suffix is still derived rather than hardcoded, because the alternative —
+* inventing the REGIONAL form here — would make cdkd's `Fn::GetAtt DomainName`
+* disagree with what CloudFormation returns, which is the compatibility cdkd
+* exists to keep. This spelling matches `aws-cdk-lib`'s own
+* `Bucket.fromBucketAttributes` (`bucketDomainName: <bucket>.s3.<urlSuffix>`),
+* the only AWS-authored answer available without a non-commercial account.
+* Settling it against real CloudFormation is issue
+* [#1809](https://github.com/go-to-k/cdkd/issues/1809).
+*/
+function s3BucketDomainName(bucketName, region) {
+	return `${bucketName}.s3.${derivePartitionAndUrlSuffix(region).urlSuffix}`;
+}
+/** `<bucket>.s3.<region>.<urlSuffix>` — the regional domain name. */
+function s3BucketRegionalDomainName(bucketName, region) {
+	return `${bucketName}.s3.${region}.${derivePartitionAndUrlSuffix(region).urlSuffix}`;
+}
+/** `<bucket>.s3.dualstack.<region>.<urlSuffix>` — the IPv6 dual-stack domain name. */
+function s3BucketDualStackDomainName(bucketName, region) {
+	return `${bucketName}.s3.dualstack.${region}.${derivePartitionAndUrlSuffix(region).urlSuffix}`;
+}
+/**
+* `http://<bucket>.s3-website[-.]<region>.<urlSuffix>` — the static-website URL.
+*
+* The separator is picked per region from
+* {@link S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS}; see that constant for why it
+* cannot be derived from the partition.
+*/
+function s3BucketWebsiteUrl(bucketName, region) {
+	const { urlSuffix } = derivePartitionAndUrlSuffix(region);
+	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(region) ? "-" : "."}${region}.${urlSuffix}`;
+}
+
 //#endregion
 //#region src/provisioning/config-shape.ts
 /**
@@ -11608,10 +11720,11 @@ var IntrinsicFunctionResolver = class {
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::S3::Bucket") switch (attributeName) {
-			case "Arn": return `arn:${partition}:s3:::${physicalId}`;
-			case "DomainName": return `${physicalId}.s3.amazonaws.com`;
-			case "RegionalDomainName": return `${physicalId}.s3.${region}.amazonaws.com`;
-			case "WebsiteURL": return `http://${physicalId}.s3-website-${region}.amazonaws.com`;
+			case "Arn": return s3BucketArn(physicalId, region);
+			case "DomainName": return s3BucketDomainName(physicalId, region);
+			case "RegionalDomainName": return s3BucketRegionalDomainName(physicalId, region);
+			case "DualStackDomainName": return s3BucketDualStackDomainName(physicalId, region);
+			case "WebsiteURL": return s3BucketWebsiteUrl(physicalId, region);
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Role") switch (attributeName) {
@@ -13641,7 +13754,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B5EgvcoP.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D9VJTwn3.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -20558,7 +20671,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.282.2";
+	return "0.282.4";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22726,5 +22839,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { configStringRefusal as $, MIGRATE_TMP_PREFIX as $t, green as A, StateError as An, validateContainerRepoName as At, slowCcOperationTimeoutMs as B, getDefaultStateBucketName as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, NestedStackChildDirectDestroyError as Cn, rewriteTemplateAssetReferences as Ct, bold as D, ResourceUpdateNotSupportedError as Dn, getBootstrapMarkerKey as Dt, formatResourceLine as E, ResourceTimeoutError as En, ensureAssetStorage as Et, clearOnUpdateRemoval as F, withErrorHandling as Fn, runDockerStreaming as Ft, getAccountInfo as G, resolveSkipPrefix as Gt, isTerminationProtectionPropagationError as H, resolveApp as Ht, ProviderRegistry as I, __exportAll as In, AssetManifestLoader as It, normalizeAwsTagsToCfn as J, resolveUseCdkBootstrapAssets as Jt, refStateLookupFromResource as K, resolveStateBucketWithDefault as Kt, findActionableSilentDrops as L, getDockerImageBySourceHash as Lt, yellow as M, formatError as Mn, formatDockerLoginError as Mt, IAMRoleProvider as N, isCdkdError as Nn, getDockerCmd as Nt, cyan as O, StackHasActiveImportsError as On, parseBootstrapMarker as Ot, collectInlinePolicyNamesManagedBySiblings as P, normalizeAwsError as Pn, runDockerForeground as Pt, configBooleanRefusal as Q, CFN_TEMPLATE_URL_LIMIT as Qt, findSilentDropProperties as R, Synthesizer as Rt, extractDeploymentEventError as S, MissingCdkCliError as Sn, loadPublishableAssetManifest as St, renderStatefulReason as T, ProvisioningError as Tn, BOOTSTRAP_MARKER_PREFIX as Tt, IntrinsicFunctionResolver as U, resolveAutoAssetStorage as Ut, disableInstanceApiTermination as V, getLegacyStateBucketName as Vt, cfnRefValueFromPhysicalId as W, resolveCaptureObservedState as Wt, assertRegionMatch as X, warnDeprecatedNoPrefixCliFlag as Xt, resolveExplicitPhysicalId as Y, stateBucketExistenceConfirmed as Yt, coerceCfnBoolean as Z, CFN_TEMPLATE_BODY_LIMIT as Zt, createPreDeleteFinalSnapshot as _, DeployCancelledError as _n, AssetPublisher as _t, DeploymentEventsStore as a, AssemblyReader as an, applyRoleArnIfSet as at, unsupportedFinalSnapshotError as b, LocalStartServiceError as bn, buildAssetRedirectMap as bt, replayFailedOperations as c, resolveBucketRegion as cn, withRetry as ct, IMPLICIT_DELETE_DEPENDENCIES as d, resetAwsClients as dn, DagBuilder as dt, findLargeInlineResources as en, readConfigString as et, computeImplicitDeleteEdges as f, setAwsClients as fn, TemplateParser as ft, ccRoutedFinalSnapshotError as g, DependencyError as gn, shouldRetainResource as gt, buildFinalSnapshotIdentifier as h, ConfigError as hn, rebuildClientForBucketRegion as ht, DeploymentEventsReader as i, derivePartitionAndUrlSuffix as in, requireConfigString as it, red as j, SynthesisError as jn, buildDockerImage as jt, gray as k, StackTerminationProtectionError as kn, validateAssetBucketName as kt, replayRollback as l, AwsClients as ln, isRetryableTransientError as lt, PRE_DELETE_SNAPSHOT_TYPES as m, CdkdError as mn, S3StateBackend as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, expectedOwnerParam as nn, requireConfigArray as nt, planFailedOps as o, processStackMessages as on, DiffCalculator as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, AssetError as pn, LockManager as pt, WAFv2WebACLProvider as q, resolveStateBucketWithDefaultAndSource as qt, DeployEngine as r, PARTITION_TABLE as rn, requireConfigObject as rt, planRollback as s, clearBucketRegionCache as sn, describeTypeWithThrottleRetry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, uploadCfnTemplate as tn, replayWarn as tt, withResourceDeadline as u, getAwsClients as un, isThrottlingError as ut, isFinalSnapshotError as v, LocalInvokeBuildError as vn, stringifyValue as vt, isStatefulRecreateTargetSync as w, PartialFailureError as wn, AssetModeResolver as wt, makeCanonicalizePropertiesFn as x, LockError as xn, createAssetRedirectResolver as xt, refusesFinalSnapshot as y, LocalMigrateError as yn, WorkGraph as yt, CloudControlProvider as z, synthesisStatusMessage as zt };
-//# sourceMappingURL=deploy-engine-6sSRIhrN.js.map
+export { configStringRefusal as $, resolveUseCdkBootstrapAssets as $t, green as A, ProvisioningError as An, BOOTSTRAP_MARKER_PREFIX as At, slowCcOperationTimeoutMs as B, withErrorHandling as Bn, runDockerStreaming as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, LocalInvokeBuildError as Cn, stringifyValue as Ct, bold as D, MissingCdkCliError as Dn, loadPublishableAssetManifest as Dt, formatResourceLine as E, LockError as En, createAssetRedirectResolver as Et, clearOnUpdateRemoval as F, StateError as Fn, validateContainerRepoName as Ft, getAccountInfo as G, getDefaultStateBucketName as Gt, isTerminationProtectionPropagationError as H, getDockerImageBySourceHash as Ht, ProviderRegistry as I, SynthesisError as In, buildDockerImage as It, normalizeAwsTagsToCfn as J, resolveAutoAssetStorage as Jt, refStateLookupFromResource as K, getLegacyStateBucketName as Kt, findActionableSilentDrops as L, formatError as Ln, formatDockerLoginError as Lt, yellow as M, ResourceUpdateNotSupportedError as Mn, getBootstrapMarkerKey as Mt, IAMRoleProvider as N, StackHasActiveImportsError as Nn, parseBootstrapMarker as Nt, cyan as O, NestedStackChildDirectDestroyError as On, rewriteTemplateAssetReferences as Ot, collectInlinePolicyNamesManagedBySiblings as P, StackTerminationProtectionError as Pn, validateAssetBucketName as Pt, configBooleanRefusal as Q, resolveStateBucketWithDefaultAndSource as Qt, findSilentDropProperties as R, isCdkdError as Rn, getDockerCmd as Rt, extractDeploymentEventError as S, DeployCancelledError as Sn, AssetPublisher as St, renderStatefulReason as T, LocalStartServiceError as Tn, buildAssetRedirectMap as Tt, IntrinsicFunctionResolver as U, Synthesizer as Ut, disableInstanceApiTermination as V, __exportAll as Vn, AssetManifestLoader as Vt, cfnRefValueFromPhysicalId as W, synthesisStatusMessage as Wt, assertRegionMatch as X, resolveSkipPrefix as Xt, resolveExplicitPhysicalId as Y, resolveCaptureObservedState as Yt, coerceCfnBoolean as Z, resolveStateBucketWithDefault as Zt, createPreDeleteFinalSnapshot as _, setAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, findLargeInlineResources as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, ConfigError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, PARTITION_TABLE as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, processStackMessages as dn, DiffCalculator as dt, stateBucketExistenceConfirmed as en, readConfigString as et, computeImplicitDeleteEdges as f, clearBucketRegionCache as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, resetAwsClients as gn, DagBuilder as gt, buildFinalSnapshotIdentifier as h, getAwsClients as hn, isThrottlingError as ht, DeploymentEventsReader as i, MIGRATE_TMP_PREFIX as in, requireConfigString as it, red as j, ResourceTimeoutError as jn, ensureAssetStorage as jt, gray as k, PartialFailureError as kn, AssetModeResolver as kt, replayRollback as l, derivePartitionAndUrlSuffix as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, AwsClients as mn, isRetryableTransientError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_BODY_LIMIT as nn, requireConfigArray as nt, planFailedOps as o, uploadCfnTemplate as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, resolveBucketRegion as pn, withRetry as pt, WAFv2WebACLProvider as q, resolveApp as qt, DeployEngine as r, CFN_TEMPLATE_URL_LIMIT as rn, requireConfigObject as rt, planRollback as s, expectedOwnerParam as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, warnDeprecatedNoPrefixCliFlag as tn, replayWarn as tt, withResourceDeadline as u, AssemblyReader as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, AssetError as vn, LockManager as vt, isStatefulRecreateTargetSync as w, LocalMigrateError as wn, WorkGraph as wt, makeCanonicalizePropertiesFn as x, DependencyError as xn, shouldRetainResource as xt, refusesFinalSnapshot as y, CdkdError as yn, S3StateBackend as yt, CloudControlProvider as z, normalizeAwsError as zn, runDockerForeground as zt };
+//# sourceMappingURL=deploy-engine-CnxJLy3Y.js.map