@go-to-k/cdkd 0.282.4 → 0.282.5

package/dist/{deploy-engine-CnxJLy3Y.js → deploy-engine-Cg_wFdJP.js}

@@ -2573,6 +2573,39 @@ const PARTITION_TABLE = [
 	}
 ];
 /**
+* Fold an AWS region name to its canonical lower-case spelling.
+*
+* AWS region ids ARE lower case — `${AWS::Region}` always returns that form —
+* but nothing between a `--region` flag and an SDK client enforces it, and
+* essentially everything downstream is case-SENSITIVE (issue
+* [#1795](https://github.com/go-to-k/cdkd/issues/1795)):
+*
+* - This module's own `PARTITION_TABLE` walk is a `startsWith` prefix test, so
+*   `--region CN-NORTH-1` fell through to the commercial partition and the
+*   `cdkd local *` commands synthesized
+*   `<acct>.dkr.ecr.CN-NORTH-1.amazonaws.com/...` — a `cn-` region carrying the
+*   commercial suffix, a host that does not exist.
+* - The AWS SDK's endpoint resolution is case-sensitive in the SAME direction.
+*   Measured against this repo's vendored `@aws-sdk/util-endpoints` partition
+*   data: `cn-north-1` resolves `aws-cn` / `amazonaws.com.cn` while
+*   `CN-NORTH-1` resolves `aws` / `amazonaws.com` (both the exact-match table
+*   and the `regionRegex` fallback are case-sensitive). So EVERY SDK client
+*   built from a raw region — `STSClient` for `${AWS::AccountId}`, the ECR /
+*   SecretsManager / SSM clients further down the `cdkd local` path — talks to
+*   the wrong partition's endpoint and fails.
+* - `${AWS::Region}` substituted from a raw value spells the region wrongly
+*   inside every ARN the resolver builds from it.
+*
+* Applied BOTH in `derivePartitionAndUrlSuffix` (so any caller of the mapping
+* inherits it) AND at the `cdkd local *` region-resolution points (so the
+* region VALUE those commands hand to SDK clients and to `${AWS::Region}` is
+* canonical too). Double-folding is a no-op, which is what makes having it in
+* both places safe rather than redundant.
+*/
+function canonicalizeRegion(region) {
+	return typeof region === "string" ? region.toLowerCase() : region;
+}
+/**
 * Derive the AWS partition / URL suffix for an AWS region. Same mapping
 * CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
 *
@@ -2583,9 +2616,24 @@ const PARTITION_TABLE = [
 * the COMMERCIAL suffix, so `parseEcrRegistryHost` (`src/utils/ecr-uri.ts`)
 * rejected it under the strict host check issue #1758 added and the image was
 * classified `public` — anonymous pull, no `docker login`, opaque failure.
+*
+* The region is CANONICALIZED through {@link canonicalizeRegion} before the
+* prefix tests (issue [#1795](https://github.com/go-to-k/cdkd/issues/1795)),
+* so every present and future caller inherits ONE normalization point and the
+* three `cdkd local *` call sites cannot drift apart again.
+*
+* This is only HALF the answer at those call sites, and the half it is NOT is
+* worth stating: canonicalizing here fixes the derived SUFFIX, but each caller
+* also passes the raw region VALUE to its SDK clients and stores it as
+* `${AWS::Region}`. The AWS SDK's own endpoint resolution is case-sensitive in
+* exactly the same way (measured against this repo's vendored
+* `@aws-sdk/util-endpoints` partition data: `CN-NORTH-1` resolves to the
+* COMMERCIAL `amazonaws.com`), so the callers canonicalize the value too — see
+* `canonicalizeRegion`'s own note.
 */
 function derivePartitionAndUrlSuffix(region) {
-	for (const { prefix, partition, urlSuffix } of PARTITION_TABLE) if (region.startsWith(prefix)) return {
+	const canonical = canonicalizeRegion(region);
+	for (const { prefix, partition, urlSuffix } of PARTITION_TABLE) if (canonical.startsWith(prefix)) return {
 		partition,
 		urlSuffix
 	};
@@ -13754,7 +13802,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D9VJTwn3.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dl8-YYQR.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -20671,7 +20719,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.282.4";
+	return "0.282.5";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22839,5 +22887,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { configStringRefusal as $, resolveUseCdkBootstrapAssets as $t, green as A, ProvisioningError as An, BOOTSTRAP_MARKER_PREFIX as At, slowCcOperationTimeoutMs as B, withErrorHandling as Bn, runDockerStreaming as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, LocalInvokeBuildError as Cn, stringifyValue as Ct, bold as D, MissingCdkCliError as Dn, loadPublishableAssetManifest as Dt, formatResourceLine as E, LockError as En, createAssetRedirectResolver as Et, clearOnUpdateRemoval as F, StateError as Fn, validateContainerRepoName as Ft, getAccountInfo as G, getDefaultStateBucketName as Gt, isTerminationProtectionPropagationError as H, getDockerImageBySourceHash as Ht, ProviderRegistry as I, SynthesisError as In, buildDockerImage as It, normalizeAwsTagsToCfn as J, resolveAutoAssetStorage as Jt, refStateLookupFromResource as K, getLegacyStateBucketName as Kt, findActionableSilentDrops as L, formatError as Ln, formatDockerLoginError as Lt, yellow as M, ResourceUpdateNotSupportedError as Mn, getBootstrapMarkerKey as Mt, IAMRoleProvider as N, StackHasActiveImportsError as Nn, parseBootstrapMarker as Nt, cyan as O, NestedStackChildDirectDestroyError as On, rewriteTemplateAssetReferences as Ot, collectInlinePolicyNamesManagedBySiblings as P, StackTerminationProtectionError as Pn, validateAssetBucketName as Pt, configBooleanRefusal as Q, resolveStateBucketWithDefaultAndSource as Qt, findSilentDropProperties as R, isCdkdError as Rn, getDockerCmd as Rt, extractDeploymentEventError as S, DeployCancelledError as Sn, AssetPublisher as St, renderStatefulReason as T, LocalStartServiceError as Tn, buildAssetRedirectMap as Tt, IntrinsicFunctionResolver as U, Synthesizer as Ut, disableInstanceApiTermination as V, __exportAll as Vn, AssetManifestLoader as Vt, cfnRefValueFromPhysicalId as W, synthesisStatusMessage as Wt, assertRegionMatch as X, resolveSkipPrefix as Xt, resolveExplicitPhysicalId as Y, resolveCaptureObservedState as Yt, coerceCfnBoolean as Z, resolveStateBucketWithDefault as Zt, createPreDeleteFinalSnapshot as _, setAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, findLargeInlineResources as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, ConfigError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, PARTITION_TABLE as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, processStackMessages as dn, DiffCalculator as dt, stateBucketExistenceConfirmed as en, readConfigString as et, computeImplicitDeleteEdges as f, clearBucketRegionCache as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, resetAwsClients as gn, DagBuilder as gt, buildFinalSnapshotIdentifier as h, getAwsClients as hn, isThrottlingError as ht, DeploymentEventsReader as i, MIGRATE_TMP_PREFIX as in, requireConfigString as it, red as j, ResourceTimeoutError as jn, ensureAssetStorage as jt, gray as k, PartialFailureError as kn, AssetModeResolver as kt, replayRollback as l, derivePartitionAndUrlSuffix as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, AwsClients as mn, isRetryableTransientError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_BODY_LIMIT as nn, requireConfigArray as nt, planFailedOps as o, uploadCfnTemplate as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, resolveBucketRegion as pn, withRetry as pt, WAFv2WebACLProvider as q, resolveApp as qt, DeployEngine as r, CFN_TEMPLATE_URL_LIMIT as rn, requireConfigObject as rt, planRollback as s, expectedOwnerParam as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, warnDeprecatedNoPrefixCliFlag as tn, replayWarn as tt, withResourceDeadline as u, AssemblyReader as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, AssetError as vn, LockManager as vt, isStatefulRecreateTargetSync as w, LocalMigrateError as wn, WorkGraph as wt, makeCanonicalizePropertiesFn as x, DependencyError as xn, shouldRetainResource as xt, refusesFinalSnapshot as y, CdkdError as yn, S3StateBackend as yt, CloudControlProvider as z, normalizeAwsError as zn, runDockerForeground as zt };
-//# sourceMappingURL=deploy-engine-CnxJLy3Y.js.map
+export { configStringRefusal as $, resolveUseCdkBootstrapAssets as $t, green as A, PartialFailureError as An, BOOTSTRAP_MARKER_PREFIX as At, slowCcOperationTimeoutMs as B, normalizeAwsError as Bn, runDockerStreaming as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, DeployCancelledError as Cn, stringifyValue as Ct, bold as D, LockError as Dn, loadPublishableAssetManifest as Dt, formatResourceLine as E, LocalStartServiceError as En, createAssetRedirectResolver as Et, clearOnUpdateRemoval as F, StackTerminationProtectionError as Fn, validateContainerRepoName as Ft, getAccountInfo as G, getDefaultStateBucketName as Gt, isTerminationProtectionPropagationError as H, __exportAll as Hn, getDockerImageBySourceHash as Ht, ProviderRegistry as I, StateError as In, buildDockerImage as It, normalizeAwsTagsToCfn as J, resolveAutoAssetStorage as Jt, refStateLookupFromResource as K, getLegacyStateBucketName as Kt, findActionableSilentDrops as L, SynthesisError as Ln, formatDockerLoginError as Lt, yellow as M, ResourceTimeoutError as Mn, getBootstrapMarkerKey as Mt, IAMRoleProvider as N, ResourceUpdateNotSupportedError as Nn, parseBootstrapMarker as Nt, cyan as O, MissingCdkCliError as On, rewriteTemplateAssetReferences as Ot, collectInlinePolicyNamesManagedBySiblings as P, StackHasActiveImportsError as Pn, validateAssetBucketName as Pt, configBooleanRefusal as Q, resolveStateBucketWithDefaultAndSource as Qt, findSilentDropProperties as R, formatError as Rn, getDockerCmd as Rt, extractDeploymentEventError as S, DependencyError as Sn, AssetPublisher as St, renderStatefulReason as T, LocalMigrateError as Tn, buildAssetRedirectMap as Tt, IntrinsicFunctionResolver as U, Synthesizer as Ut, disableInstanceApiTermination as V, withErrorHandling as Vn, AssetManifestLoader as Vt, cfnRefValueFromPhysicalId as W, synthesisStatusMessage as Wt, assertRegionMatch as X, resolveSkipPrefix as Xt, resolveExplicitPhysicalId as Y, resolveCaptureObservedState as Yt, coerceCfnBoolean as Z, resolveStateBucketWithDefault as Zt, createPreDeleteFinalSnapshot as _, resetAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, findLargeInlineResources as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, CdkdError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, PARTITION_TABLE as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, AssemblyReader as dn, DiffCalculator as dt, stateBucketExistenceConfirmed as en, readConfigString as et, computeImplicitDeleteEdges as f, processStackMessages as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, getAwsClients as gn, DagBuilder as gt, buildFinalSnapshotIdentifier as h, AwsClients as hn, isThrottlingError as ht, DeploymentEventsReader as i, MIGRATE_TMP_PREFIX as in, requireConfigString as it, red as j, ProvisioningError as jn, ensureAssetStorage as jt, gray as k, NestedStackChildDirectDestroyError as kn, AssetModeResolver as kt, replayRollback as l, canonicalizeRegion as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, resolveBucketRegion as mn, isRetryableTransientError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_BODY_LIMIT as nn, requireConfigArray as nt, planFailedOps as o, uploadCfnTemplate as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, clearBucketRegionCache as pn, withRetry as pt, WAFv2WebACLProvider as q, resolveApp as qt, DeployEngine as r, CFN_TEMPLATE_URL_LIMIT as rn, requireConfigObject as rt, planRollback as s, expectedOwnerParam as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, warnDeprecatedNoPrefixCliFlag as tn, replayWarn as tt, withResourceDeadline as u, derivePartitionAndUrlSuffix as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, setAwsClients as vn, LockManager as vt, isStatefulRecreateTargetSync as w, LocalInvokeBuildError as wn, WorkGraph as wt, makeCanonicalizePropertiesFn as x, ConfigError as xn, shouldRetainResource as xt, refusesFinalSnapshot as y, AssetError as yn, S3StateBackend as yt, CloudControlProvider as z, isCdkdError as zn, runDockerForeground as zt };
+//# sourceMappingURL=deploy-engine-Cg_wFdJP.js.map