@go-to-k/cdkd 0.283.1 → 0.283.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-InwDI9o0.js";
+import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-DuYBir2W.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-R3IdAR_3.js";
+import { t as ASGProvider } from "./asg-provider-Cl4ATw1l.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9139,15 +9139,24 @@ var SQSQueueProvider = class {
 		}
 	}
 	/**
-	* Construct SQS queue ARN from account/region/queue name
+	* Construct SQS queue ARN from account/region/queue name.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the queue's `Arn`
+	* attribute, so a commercial literal is structurally valid but wrong in
+	* `aws-cn` / `aws-us-gov` and nothing downstream rejects it.
 	*/
 	async constructArn(queueName) {
 		try {
 			const accountId = (await this.stsClient.send(new GetCallerIdentityCommand({}))).Account;
-			return `arn:aws:sqs:${await this.sqsClient.config.region()}:${accountId}:${queueName}`;
+			const region = await this.sqsClient.config.region();
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 		} catch {
 			this.logger.warn("Failed to construct SQS ARN from STS, using placeholder");
-			return `arn:aws:sqs:unknown:unknown:${queueName}`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:sqs:unknown:unknown:${queueName}`;
 		}
 	}
 	/**
@@ -18425,14 +18434,23 @@ var LogsLogGroupProvider = class {
 		}
 	}
 	/**
-	* Build log group ARN from name
+	* Build log group ARN from name.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the log group's `Arn`
+	* attribute, so a commercial literal is structurally valid but wrong in
+	* `aws-cn` / `aws-us-gov` and nothing downstream rejects it.
 	*/
 	async buildArn(logGroupName) {
 		try {
 			const accountId = (await this.stsClient.send(new GetCallerIdentityCommand({}))).Account;
-			return `arn:aws:logs:${await this.logsClient.config.region() || process.env["AWS_REGION"] || "us-east-1"}:${accountId}:log-group:${logGroupName}:*`;
+			const region = await this.logsClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:logs:${region}:${accountId}:log-group:${logGroupName}:*`;
 		} catch {
-			return `arn:aws:logs:unknown:unknown:log-group:${logGroupName}:*`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:logs:unknown:unknown:log-group:${logGroupName}:*`;
 		}
 	}
 	/**
@@ -18693,9 +18711,12 @@ var CloudWatchAlarmProvider = class {
 			this.logger.debug(`Failed to describe alarm ${alarmName}, constructing ARN from config: ${error instanceof Error ? error.message : String(error)}`);
 		}
 		try {
-			return `arn:aws:cloudwatch:${await this.cloudWatchClient.config.region() || process.env["AWS_REGION"] || "us-east-1"}:*:alarm:${alarmName}`;
+			const region = await this.cloudWatchClient.config.region() || process.env["AWS_REGION"] || "us-east-1";
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:cloudwatch:${region}:*:alarm:${alarmName}`;
 		} catch {
-			return `arn:aws:cloudwatch:*:*:alarm:${alarmName}`;
+			const { partition } = derivePartitionAndUrlSuffix(process.env["AWS_REGION"] ?? "");
+			return `arn:${partition}:cloudwatch:*:*:alarm:${alarmName}`;
 		}
 	}
 	/**
@@ -24983,13 +25004,23 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	/**
 	* Build the ARN for an API Gateway Stage, used for tag mutations.
 	*
-	* Format: `arn:aws:apigateway:{region}::/restapis/{restApiId}/stages/{stageName}`.
+	* Format:
+	* `arn:{partition}:apigateway:{region}::/restapis/{restApiId}/stages/{stageName}`.
 	* The double colon (`::`) is intentional: API Gateway tagging uses an
 	* account-id-less ARN.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws`.
+	* Unlike the pure attribute builders this one is passed straight to
+	* `TagResource` / `UntagResource` as `resourceArn`, so in `aws-cn` /
+	* `aws-us-gov` a commercial literal does not just record a wrong string —
+	* it aims the tag mutation at an ARN that names no stage.
 	*/
 	async buildStageArn(restApiId, stageName) {
 		try {
-			return `arn:aws:apigateway:${await this.apiGatewayClient.config.region()}::/restapis/${restApiId}/stages/${stageName}`;
+			const region = await this.apiGatewayClient.config.region();
+			const { partition } = derivePartitionAndUrlSuffix(region);
+			return `arn:${partition}:apigateway:${region}::/restapis/${restApiId}/stages/${stageName}`;
 		} catch {
 			return;
 		}
@@ -38742,11 +38773,19 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 	/**
 	* Build a namespace ARN from namespace ID.
-	* Format: arn:aws:servicediscovery:{region}:{account}:namespace/{namespaceId}
+	* Format: `arn:{partition}:servicediscovery:{region}:{account}:namespace/{namespaceId}`
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws` —
+	* this ARN is recorded into state and served as the namespace's `Arn`
+	* attribute, so a commercial-partition literal is silently wrong (but
+	* structurally valid, hence unrejected) in `aws-cn` / `aws-us-gov`.
 	*/
 	async buildNamespaceArn(namespaceId) {
 		const accountId = (await this.getStsClient().send(new GetCallerIdentityCommand({}))).Account || "";
-		return `arn:aws:servicediscovery:${await this.getClient().config.region()}:${accountId}:namespace/${namespaceId}`;
+		const region = await this.getClient().config.region();
+		const { partition } = derivePartitionAndUrlSuffix(region);
+		return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${namespaceId}`;
 	}
 };
 
@@ -43394,12 +43433,35 @@ var BudgetsBudgetProvider = class {
 	}
 	/**
 	* Budget ARN for the tagging APIs (`ListTagsForResource` / `TagResource` /
-	* `UntagResource`). Budgets ARNs carry no region component. The `aws`
-	* partition is assumed — consistent with other providers that construct
-	* ARNs; non-`aws` partitions are not supported by cdkd today.
-	*/
-	budgetArn(accountId, budgetName) {
-		return `arn:aws:budgets::${accountId}:budget/${budgetName}`;
+	* `UntagResource`), and the `Arn` attribute recorded into state.
+	*
+	* Budgets ARNs carry no region component, but they DO carry a partition, so
+	* a region is still needed to name it. It is read from the RESOLVED region
+	* of the very client that receives this ARN — the same
+	* `getClient().config.region()` the `delete()` path already consults for
+	* its `assertRegionMatch` guard — and routed through the closed mapping
+	* `${AWS::Partition}` uses (issue #1815).
+	*
+	* Asking the CLIENT rather than `providerRegion` is what makes the ARN and
+	* its consumer agree. `providerRegion` is `process.env['AWS_REGION']`, and
+	* when that is unset `getClient()` builds `new BudgetsClient({})`, leaving
+	* the SDK to resolve the region from its OWN chain (`AWS_DEFAULT_REGION`,
+	* the `~/.aws/config` profile). So a profile-configured `cn-north-1` /
+	* `us-gov-*` caller would have derived the COMMERCIAL partition from an
+	* empty string while the client itself talked to a non-commercial endpoint
+	* — on the PRIMARY path, not a fallback.
+	*
+	* The `aws` partition USED to be hardcoded here on the stated assumption
+	* that non-`aws` partitions were unsupported. That was wrong in the quiet
+	* direction: the literal is structurally valid everywhere, so in `aws-cn` /
+	* `aws-us-gov` nothing rejected it — the ARN was simply recorded into state
+	* and handed to `TagResource` naming no budget. A client whose region is
+	* unset or unrecognized still derives to `aws`, so commercial output is
+	* unchanged byte for byte.
+	*/
+	async budgetArn(accountId, budgetName) {
+		const { partition } = derivePartitionAndUrlSuffix(await this.getClient().config.region() ?? "");
+		return `arn:${partition}:budgets::${accountId}:budget/${budgetName}`;
 	}
 	/**
 	* Convert a CFn `Spend` shape to the SDK shape. CFn templates carry
@@ -43555,7 +43617,7 @@ var BudgetsBudgetProvider = class {
 			this.logger.debug(`Successfully created budget ${logicalId}: ${name}`);
 			return {
 				physicalId: name,
-				attributes: { Arn: this.budgetArn(accountId, name) }
+				attributes: { Arn: await this.budgetArn(accountId, name) }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43582,7 +43644,7 @@ var BudgetsBudgetProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Arn: this.budgetArn(accountId, physicalId) }
+				attributes: { Arn: await this.budgetArn(accountId, physicalId) }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -43698,7 +43760,7 @@ var BudgetsBudgetProvider = class {
 	async reconcileResourceTags(accountId, budgetName, oldTags, newTags) {
 		const sortedJson = (tags) => JSON.stringify([...tags].sort((a, b) => (a.Key ?? "").localeCompare(b.Key ?? "")));
 		if (sortedJson(oldTags) === sortedJson(newTags)) return;
-		const arn = this.budgetArn(accountId, budgetName);
+		const arn = await this.budgetArn(accountId, budgetName);
 		const newKeys = new Set(newTags.map((t) => t.Key));
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
@@ -43741,7 +43803,7 @@ var BudgetsBudgetProvider = class {
 	/**
 	* `Fn::GetAtt` support. CloudFormation documents no attributes for
 	* `AWS::Budgets::Budget`; `Arn` is served as a cdkd convenience (computed
-	* — Budgets ARNs are `arn:aws:budgets::{account}:budget/{name}`, verified
+	* — Budgets ARNs are `arn:{partition}:budgets::{account}:budget/{name}`, verified
 	* to exist via `DescribeBudget` first).
 	*/
 	async getAttribute(physicalId, resourceType, attributeName) {
@@ -43752,7 +43814,7 @@ var BudgetsBudgetProvider = class {
 				AccountId: accountId,
 				BudgetName: physicalId
 			}));
-			return this.budgetArn(accountId, physicalId);
+			return await this.budgetArn(accountId, physicalId);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${cause?.message ?? String(error)}`, resourceType, physicalId, physicalId, cause);
@@ -43777,7 +43839,7 @@ var BudgetsBudgetProvider = class {
 			}));
 			return {
 				physicalId: explicit,
-				attributes: { Arn: this.budgetArn(accountId, explicit) }
+				attributes: { Arn: await this.budgetArn(accountId, explicit) }
 			};
 		} catch (error) {
 			if (error instanceof NotFoundException$5) return null;
@@ -51573,13 +51635,33 @@ var S3DirectoryBucketProvider = class {
 		return { Arn: await this.buildBucketArn(bucketName) };
 	}
 	/**
-	* Directory bucket ARN: `arn:aws:s3express:{region}:{account}:bucket/{name}`.
+	* Directory bucket ARN:
+	* `arn:{partition}:s3express:{region}:{account}:bucket/{name}`.
 	* Also the `ResourceArn` for the S3 Control tag operations. Callers that
 	* already resolved the account (for the S3 Control `AccountId` parameter)
 	* pass it in so the STS lookup runs once per operation.
+	*
+	* The partition is derived from the region through the same closed mapping
+	* `${AWS::Partition}` uses (issue #1815) rather than hardcoded to `aws`.
+	* Here it is load-bearing TWICE over: the value is served as the bucket's
+	* `Arn` attribute AND passed to S3 Control as the `ResourceArn` of a tag
+	* mutation, so outside the commercial partition the wrong literal does not
+	* merely record a bad string — it aims the tag call at an ARN that does not
+	* name this bucket.
+	*
+	* KNOWN BOUND (pre-existing, not introduced by #1815): the region — and now
+	* the partition derived from it — comes from `s3Client`, while the tag
+	* calls that consume this ARN go through `s3ControlClient`, built from
+	* `providerRegion` (`process.env['AWS_REGION']`). Those two can disagree,
+	* so the ARN can name a different region than the client receiving it. The
+	* region SEGMENT already had this exposure before the partition rode along
+	* with it; unifying the two clients' region resolution is a separate change.
 	*/
 	async buildBucketArn(bucketName, accountId) {
-		return `arn:aws:s3express:${await this.getRegion()}:${accountId ?? await this.getAccountId()}:bucket/${bucketName}`;
+		const region = await this.getRegion();
+		const account = accountId ?? await this.getAccountId();
+		const { partition } = derivePartitionAndUrlSuffix(region);
+		return `arn:${partition}:s3express:${region}:${account}:bucket/${bucketName}`;
 	}
 	/**
 	* Create an S3 Express Directory Bucket
@@ -76438,7 +76520,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.2");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;