@go-to-k/cdkd 0.282.5 → 0.282.7

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveUseCdkBootstrapAssets, A as green, An as PartialFailureError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bn as normalizeAwsError, Bt as runDockerStreaming, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as DeployCancelledError, Ct as stringifyValue, D as bold, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalStartServiceError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackTerminationProtectionError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as getDefaultStateBucketName, H as isTerminationProtectionPropagationError, Ht as getDockerImageBySourceHash, I as ProviderRegistry, It as buildDockerImage, J as normalizeAwsTagsToCfn, Jt as resolveAutoAssetStorage, K as refStateLookupFromResource, Kt as getLegacyStateBucketName, L as findActionableSilentDrops, Lt as formatDockerLoginError, M as yellow, Mn as ResourceTimeoutError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceUpdateNotSupportedError, Nt as parseBootstrapMarker, O as cyan, On as MissingCdkCliError, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as StackHasActiveImportsError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefaultAndSource, R as findSilentDropProperties, Rt as getDockerCmd, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalMigrateError, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as Synthesizer, V as disableInstanceApiTermination, Vn as withErrorHandling, Vt as AssetManifestLoader, W as cfnRefValueFromPhysicalId, Wt as synthesisStatusMessage, X as assertRegionMatch, Xt as resolveSkipPrefix, Y as resolveExplicitPhysicalId, Yt as resolveCaptureObservedState, Z as coerceCfnBoolean, Zt as resolveStateBucketWithDefault, _ as createPreDeleteFinalSnapshot, _n as resetAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as findLargeInlineResources, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as CdkdError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as PARTITION_TABLE, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as AssemblyReader, dt as DiffCalculator, en as stateBucketExistenceConfirmed, et as readConfigString, f as computeImplicitDeleteEdges, fn as processStackMessages, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as getAwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as AwsClients, ht as isThrottlingError, i as DeploymentEventsReader, in as MIGRATE_TMP_PREFIX, it as requireConfigString, j as red, jn as ProvisioningError, jt as ensureAssetStorage, k as gray, kn as NestedStackChildDirectDestroyError, kt as AssetModeResolver, l as replayRollback, ln as canonicalizeRegion, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as resolveBucketRegion, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as CFN_TEMPLATE_BODY_LIMIT, nt as requireConfigArray, o as planFailedOps, on as uploadCfnTemplate, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as withRetry, q as WAFv2WebACLProvider, qt as resolveApp, r as DeployEngine, rn as CFN_TEMPLATE_URL_LIMIT, rt as requireConfigObject, s as planRollback, sn as expectedOwnerParam, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as warnDeprecatedNoPrefixCliFlag, tt as replayWarn, u as withResourceDeadline, un as derivePartitionAndUrlSuffix, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as setAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as LocalInvokeBuildError$1, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xt as shouldRetainResource, y as refusesFinalSnapshot, yt as S3StateBackend, z as CloudControlProvider, zt as runDockerForeground } from "./deploy-engine-Cg_wFdJP.js";
+import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-NA36xDvk.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Dl8-YYQR.js";
+import { t as ASGProvider } from "./asg-provider-DulIbRCK.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1164,17 +1164,7 @@ async function bootstrapCommand(options) {
 			}));
 			logger.info("✓ Enabled bucket encryption (AES-256)");
 			logger.debug("Setting bucket policy...");
-			const bucketPolicy = {
-				Version: "2012-10-17",
-				Statement: [{
-					Sid: "DenyExternalAccess",
-					Effect: "Deny",
-					Principal: "*",
-					Action: "s3:*",
-					Resource: [`arn:aws:s3:::${bucketName}`, `arn:aws:s3:::${bucketName}/*`],
-					Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
-				}]
-			};
+			const bucketPolicy = buildDenyExternalAccessPolicy(bucketName, accountId, await stateBucketS3.config.region());
 			await stateBucketS3.send(new PutBucketPolicyCommand({
 				Bucket: bucketName,
 				ExpectedBucketOwner: accountId,
@@ -58779,17 +58769,7 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	await s3.send(new PutBucketPolicyCommand({
 		Bucket: bucketName,
 		...await expectedOwnerParam(s3),
-		Policy: JSON.stringify({
-			Version: "2012-10-17",
-			Statement: [{
-				Sid: "DenyExternalAccess",
-				Effect: "Deny",
-				Principal: "*",
-				Action: "s3:*",
-				Resource: [`arn:aws:s3:::${bucketName}`, `arn:aws:s3:::${bucketName}/*`],
-				Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
-			}]
-		})
+		Policy: JSON.stringify(buildDenyExternalAccessPolicy(bucketName, accountId, await s3.config.region()))
 	}));
 	logger.info("✓ Applied versioning, encryption, and account-only access policy");
 	return s3;
@@ -67096,9 +67076,127 @@ function notFoundError$1(target, stack, resources) {
 * registry (`c2s.ic.gov` / `sc2s.sgov.gov`) never matched and the caller
 * silently classified a real ECR image as a user-managed one — skipping the
 * `docker login` it needs.
+*
+* KNOWN BOUND (issue #1792): the `dkr.ecr` LABELS are still matched
+* case-sensitively, so `<acct>.DKR.ECR.<region>.<suffix>/` does not match at
+* all. Audited deliberately while fixing issue #1786 rather than missed — that
+* issue's normalization covers the captured region + suffix, i.e. the strict
+* CHECK, whereas widening the shape MATCHER makes cdkd `docker login` to a
+* host shape it previously skipped, which is a behavior expansion wanting its
+* own decision. The failure direction here is the safe one: NO credentials are
+* sent on any of the four call sites. Traced — `local run-task` and
+* `local invoke-agentcore` fall through to an anonymous `docker pull` that
+* fails, while `local invoke` and `local start-api` REFUSE before any pull.
 */
 const ECR_URI_HOST_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.([^/]+)\//;
 /**
+* A region segment cdkd is willing to treat as a region id.
+*
+* Case is not the only way the `startsWith` partition classification can be
+* side-stepped: any leading junk defeats it the same way, and the captured
+* segment does not stay inert — it becomes an `ECRClient({region})` and is
+* interpolated into the fallback `docker login` endpoint. Measured before this
+* guard: `…dkr.ecr. us-iso-east-1.amazonaws.com/…` (leading space) and a
+* combining-mark form both parsed, yielding regions `" us-iso-east-1"` and
+* `"us-i̇so-east-1"`. Neither leaks credentials — an ACCEPTED suffix is always
+* an AWS-owned domain — but a region id is ASCII alphanumeric plus `-`, so
+* anything else is a malformed host and refusing it keeps the classification
+* honest.
+*
+* TESTED AGAINST THE RAW SEGMENT, BEFORE `toLowerCase()`, and that order is the
+* whole point: `String.prototype.toLowerCase` performs full Unicode case
+* folding, so the Kelvin sign U+212A folds to a plain ASCII `k`. Checking the
+* FOLDED segment therefore accepts `us-eKst-1` and yields the region
+* `us-ekst-1` — a region the host does not name — which is precisely the
+* class of substitution this guard exists to refuse. Matching `[A-Za-z0-9-]`
+* on the raw capture keeps case-insensitivity (the point of issue #1786) while
+* admitting only characters that fold to themselves.
+*
+* ONE DELIBERATE SIDE EFFECT, called out because it is a withdrawal rather than
+* an addition: a malformed-region host is now classified as an ordinary public
+* image with NO cdkd-side signal at all — neither the ECR verdict nor the #1764
+* foreign-suffix diagnostic. Both arms change, not just the foreign one:
+* `<acct>.dkr.ecr.us_east_1.example.com/…` used to log the partition-gap
+* warning and now logs nothing, and `<acct>.dkr.ecr.us_east_1.amazonaws.com/…`
+* used to be ACCEPTED as ECR and is now refused. That is the correct verdict
+* rather than a regression — the diagnostic's whole subject is "this suffix does
+* not belong to its region's PARTITION", and a segment that is not a region id
+* has no partition to belong to, so reporting it would send the reader hunting
+* for a table entry that could never exist — but it does mean a typo'd region
+* gets no cdkd-side hint, only docker's own pull failure. Both arms are pinned
+* by tests so a future widening of the guard cannot flip them silently.
+*/
+const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+/**
+* A URL suffix cdkd is willing to compare against the partition table.
+*
+* The SAME raw-capture rule as the region, and for the same reason one layer
+* over: the suffix is folded before the comparison, so a code point folding
+* into ASCII can impersonate a partition's suffix. This became reachable the
+* moment issue #1764 landed `aws-isoe`'s `cloud.adc-e.uk` — that suffix
+* contains a `k`, so `…dkr.ecr.eu-isoe-west-1.cloud.adc-e.uK/…` (Kelvin
+* sign) folded onto it and was ACCEPTED. Not a credential leak, since UTS-46
+* maps U+212A to `k` too and the host resolves to the real AWS domain, but it
+* falsifies the invariant the region guard's comment above states, so both
+* captures are held to the same rule rather than only the one that was
+* measured first.
+*
+* Dots are admitted because a suffix is a dotted DNS name; every other
+* character is refused, so the accepted set stays exactly the partition
+* table's own literals.
+*/
+const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+/**
+* The ONE case-normalization boundary of this module (issue #1786).
+*
+* DNS is case-INSENSITIVE, so `US-ISO-EAST-1.amazonaws.com` and
+* `us-iso-east-1.amazonaws.com` name the same host — but both halves of the
+* #1758 suffix check were case-SENSITIVE, in OPPOSITE directions:
+*
+* - an upper-cased REGION fails every `startsWith` prefix test in
+*   `derivePartitionAndUrlSuffix`, so it falls through to the commercial
+*   partition whose suffix is `amazonaws.com` — which is exactly what an ISO
+*   look-alike host carries, so the strict check ACCEPTED it (the bypass);
+* - an upper-cased region or SUFFIX on a GENUINE host stopped matching its own
+*   partition's suffix, so a real ECR registry was REJECTED and the caller
+*   silently classified it as a user-managed image — the #1758 regression, one
+*   layer up.
+*
+* The normalization lives HERE rather than inside `derivePartitionAndUrlSuffix`
+* because this is the boundary where an untrusted, DNS-shaped string enters
+* cdkd, and keeping it in ONE function means both exported entry points below —
+* and the suffix COMPARISON itself — cannot drift apart.
+*
+* This does NOT duplicate `canonicalizeRegion`, which issue #1795 added inside
+* `derivePartitionAndUrlSuffix` so the mapping folds its own input. The two
+* answer different questions and both are needed: that one makes the partition
+* LOOKUP case-insensitive for every caller, while these guards decide whether
+* the captured segments are a region id and a URL suffix AT ALL. Folding alone
+* cannot do that — folding is precisely what turns `us-eKst-1` into the
+* plausible `us-ekst-1` (see the guards' own comments), so a fold-only helper
+* makes the substitution easier to reach, not harder. Double-folding is a
+* no-op, which is why the redundant `toLowerCase()` calls below are left in
+* rather than removed: they keep this function the single answer for the
+* comparison even if the helper's behaviour changes again.
+*
+* The derived suffix is lower-cased too. Every entry in the partition table is
+* a lower-case literal today, so that is a no-op; it is there so this function
+* stays the single answer even if that table ever gains a mixed-case entry.
+*/
+function matchEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	if (!CANONICAL_REGION_SEGMENT.test(m[2])) return void 0;
+	if (!CANONICAL_URL_SUFFIX.test(m[3])) return void 0;
+	const region = m[2].toLowerCase();
+	return {
+		accountId: m[1],
+		region,
+		suffix: m[3].toLowerCase(),
+		expectedSuffix: derivePartitionAndUrlSuffix(region).urlSuffix.toLowerCase()
+	};
+}
+/**
 * The account + region of an ECR image URI, or `undefined` when the URI is not
 * an ECR registry host for the region it names.
 *
@@ -67114,15 +67212,19 @@ const ECR_URI_HOST_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.([^/]+)\//;
 * `ecs-task-resolver.ts` consume it without breaking the invariant that module
 * documents about itself (it resolves secrets through a separate module for
 * exactly that reason).
+*
+* The returned `region` is LOWER-CASED (issue #1786) — it is consumed as an SDK
+* client region by `ecr-puller.ts` and as the `region` of a `kind: 'ecr'` image
+* by `ecs-task-resolver.ts`, and the canonical spelling of an AWS region id is
+* lower case.
 */
 function parseEcrRegistryHost(imageUri) {
-	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	const m = matchEcrRegistryHost(imageUri);
 	if (!m) return void 0;
-	const region = m[2];
-	if (m[3] !== derivePartitionAndUrlSuffix(region).urlSuffix) return void 0;
+	if (m.suffix !== m.expectedSuffix) return void 0;
 	return {
-		accountId: m[1],
-		region
+		accountId: m.accountId,
+		region: m.region
 	};
 }
 /**
@@ -67136,8 +67238,8 @@ function parseEcrRegistryHost(imageUri) {
 * `undefined`, and only the second is a cdkd gap rather than a user choice.
 */
 function looksLikeEcrHostWithForeignSuffix(imageUri) {
-	const m = ECR_URI_HOST_REGEX.exec(imageUri);
-	return m !== null && m[3] !== derivePartitionAndUrlSuffix(m[2]).urlSuffix;
+	const m = matchEcrRegistryHost(imageUri);
+	return m !== void 0 && m.suffix !== m.expectedSuffix;
 }
 
 //#endregion
@@ -75841,7 +75943,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.7");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;