@go-to-k/cdkd 0.283.14 → 0.283.16

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-B8gQpv93.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-C1wXn1V7.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CgnPBnOS.js";
+import { t as ASGProvider } from "./asg-provider-C3dMUcV4.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2991,6 +2991,28 @@ var IAMPolicyProvider = class {
 //#endregion
 //#region src/provisioning/providers/iam-managed-policy-provider.ts
 /**
+* Matches an AWS-managed IAM policy ARN in ANY AWS partition (issue #1815).
+*
+* AWS-managed policies are the ones whose ACCOUNT segment is the literal
+* `aws` — `arn:<partition>:iam::aws:policy/<path><name>` — as opposed to a
+* customer-managed policy, which carries a 12-digit account id. They exist
+* under every partition (`arn:aws-us-gov:iam::aws:policy/AdministratorAccess`
+* is a real, attachable ARN in GovCloud), so pinning the PARTITION segment to
+* the commercial `aws` recognised only a third of them.
+*
+* The partition is read OFF THE ARN rather than derived from a region through
+* `derivePartitionAndUrlSuffix` (`src/utils/aws-partition.ts`): that helper
+* answers "given a region, which partition am I in", which is the right
+* question when BUILDING an ARN (the seven sites PR #1834 fixed) and the wrong
+* one when CLASSIFYING an ARN the caller already holds. The loose
+* `aws[a-z0-9-]*` partition segment matches `IAM_ROLE_ARN_RE` in
+* `src/utils/role-arn.ts`; a closed partition list is precisely what goes
+* stale when AWS adds a partition, and here staleness fails DANGEROUS (see the
+* refusal's own comment — an unrecognised AWS-managed policy gets adopted, and
+* destroy then detaches it from every principal in the account).
+*/
+const AWS_MANAGED_POLICY_ARN_RE = /^arn:aws[a-z0-9-]*:iam::aws:/;
+/**
 * AWS IAM Managed Policy Provider
 *
 * Implements resource provisioning for AWS::IAM::ManagedPolicy using the IAM SDK.
@@ -3002,7 +3024,7 @@ var IAMPolicyProvider = class {
 *   - Detach-before-delete cleanup (a ManagedPolicy with attached principals
 *     or with non-default versions cannot be deleted directly)
 *
-* Physical id is the policy ARN (`arn:aws:iam::<account>:policy/<path><name>`)
+* Physical id is the policy ARN (`arn:<partition>:iam::<account>:policy/<path><name>`)
 * since path is part of the identity — two policies with the same name in
 * different paths are distinct.
 */
@@ -3239,7 +3261,7 @@ var IAMManagedPolicyProvider = class {
 		const explicit = resolveExplicitPhysicalId(input, "ManagedPolicyName");
 		if (explicit) {
 			if (explicit.startsWith("arn:")) {
-				if (explicit.startsWith("arn:aws:iam::aws:")) throw new Error(`Refusing to import AWS-managed policy ${explicit}: cdkd only adopts customer-managed policies. If you need to attach an AWS-managed policy to a role / user / group, reference it via ManagedPolicyArns on the principal instead.`);
+				if (AWS_MANAGED_POLICY_ARN_RE.test(explicit)) throw new Error(`Refusing to import AWS-managed policy ${explicit}: cdkd only adopts customer-managed policies. If you need to attach an AWS-managed policy to a role / user / group, reference it via ManagedPolicyArns on the principal instead.`);
 				try {
 					await this.iamClient.send(new GetPolicyCommand({ PolicyArn: explicit }));
 					return {
@@ -3468,7 +3490,7 @@ var IAMManagedPolicyProvider = class {
 	}
 };
 /**
-* Recover the policy name from `arn:aws:iam::<account>:policy/<path><name>`.
+* Recover the policy name from `arn:<partition>:iam::<account>:policy/<path><name>`.
 * Used to decide whether `ManagedPolicyName` was mutated relative to the
 * physical id we recorded — name + path are immutable on AWS, so any
 * difference is a replacement signal.
@@ -12354,6 +12376,47 @@ var LambdaUrlProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/lambda-eventsource-provider.ts
+/**
+* Captures the SERVICE segment of an ARN in ANY AWS partition (issue #1815).
+*
+* `arn:<partition>:<service>:<region>:<account>:<rest>` — group 1 is the
+* service. The partition segment is matched loosely as `aws[a-z0-9-]*`, the
+* same shape `IAM_ROLE_ARN_RE` (`src/utils/role-arn.ts`) uses, rather than
+* enumerated: this classifier previously hand-listed `aws` and `aws-cn` per
+* service and so returned `'unknown'` for every OTHER partition — GovCloud,
+* all four iso partitions and `aws-eusc` — which silently disabled the
+* type-discriminator gating below (see the `KINDS_WITH_*` sets) and let
+* `cdkd drift --revert` push `FunctionResponseTypes` / `SourceAccessConfigurations`
+* placeholders AWS rejects. A closed partition list is exactly what goes stale
+* when AWS adds a partition; reading the partition off the ARN cannot.
+*
+* Note the partition is not derived from a region via
+* `derivePartitionAndUrlSuffix` (`src/utils/aws-partition.ts`) because this
+* CLASSIFIES an ARN already in hand — the partition is in the input, and no
+* region reaches this function.
+*/
+const ARN_SERVICE_RE = /^arn:aws[a-z0-9-]*:([^:]+):/;
+/**
+* ARN service segment -> {@link EventSourceKind}. Replaces the per-partition
+* `startsWith` chain; every entry is partition-independent by construction.
+*/
+const ARN_SERVICE_TO_EVENT_SOURCE_KIND = {
+	sqs: "sqs",
+	kinesis: "kinesis",
+	dynamodb: "dynamodb",
+	kafka: "kafka",
+	mq: "mq",
+	rds: "documentdb"
+};
+/**
+* @internal EXPORTED for tests only (issue #1815). Every production consumer is a
+* `Set.has(kind)`, so the `Object.hasOwn` guard below is UNOBSERVABLE through
+* behavior — a prototype member and `'unknown'` both miss every set. That was
+* measured, not assumed: a behavior-level test for it passed with the guard
+* reverted. Rather than ship an unverifiable guard or a test that only looks
+* like one, the classifier's RETURN VALUE is asserted directly. Do not read the
+* export as an invitation to call this from outside the provider.
+*/
 function classifyEventSource(resp) {
 	if (resp.SelfManagedEventSource !== void 0) return "kafka";
 	if (resp.SelfManagedKafkaEventSourceConfig !== void 0) return "kafka";
@@ -12361,13 +12424,9 @@ function classifyEventSource(resp) {
 	if (resp.DocumentDBEventSourceConfig !== void 0) return "documentdb";
 	const arn = resp.EventSourceArn;
 	if (!arn) return "unknown";
-	if (arn.startsWith("arn:aws:sqs:") || arn.startsWith("arn:aws-cn:sqs:")) return "sqs";
-	if (arn.startsWith("arn:aws:kinesis:") || arn.startsWith("arn:aws-cn:kinesis:")) return "kinesis";
-	if (arn.startsWith("arn:aws:dynamodb:") || arn.startsWith("arn:aws-cn:dynamodb:")) return "dynamodb";
-	if (arn.startsWith("arn:aws:kafka:") || arn.startsWith("arn:aws-cn:kafka:")) return "kafka";
-	if (arn.startsWith("arn:aws:mq:") || arn.startsWith("arn:aws-cn:mq:")) return "mq";
-	if (arn.startsWith("arn:aws:rds:") || arn.startsWith("arn:aws-cn:rds:")) return "documentdb";
-	return "unknown";
+	const service = ARN_SERVICE_RE.exec(arn)?.[1];
+	if (!service) return "unknown";
+	return Object.hasOwn(ARN_SERVICE_TO_EVENT_SOURCE_KIND, service) ? ARN_SERVICE_TO_EVENT_SOURCE_KIND[service] : "unknown";
 }
 /**
 * Classify an event source mapping from its CFn property bag (as opposed to
@@ -40209,7 +40268,7 @@ var AppSyncProvider = class {
 		const accountInfo = await getAccountInfo(regionOverride ?? this.providerRegion ?? await this.getClient().config.region());
 		if (accountInfo.fabricated) throw new Error(`cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so an ARN for ${suffix} would be fabricated`);
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
-		return `arn:${partition}:appsync:${accountInfo.region}:${accountInfo.accountId}:${suffix}`;
+		return `arn:${partition}:appsync:${canonicalizeRegion(accountInfo.region)}:${accountInfo.accountId}:${suffix}`;
 	}
 	/**
 	* {@link buildAppSyncArn} for the POST-CREATE sites, where throwing is not an
@@ -55372,7 +55431,10 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.resourceWarnAfterByType && { resourceWarnAfterByType: ctx.destroyOptions.resourceWarnAfterByType },
 			...ctx.destroyOptions?.resourceTimeoutByType && { resourceTimeoutByType: ctx.destroyOptions.resourceTimeoutByType }
 		}));
-		if (childResult.errorCount > 0) throw new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted));
+		if (childResult.errorCount > 0) {
+			const failure = new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted));
+			throw childResult.interrupted ? markNonRetryable(failure) : failure;
+		}
 		if (childResult.skippedCount > 0 || childResult.interrupted) {
 			const causes = [];
 			if (childResult.skippedCount > 0) causes.push(`skipped ${childResult.skippedCount} resource(s)`);
@@ -55410,7 +55472,7 @@ var NestedStackProvider = class {
 	}
 	requireContext() {
 		const ctx = getCurrentNestedStackContext();
-		if (!ctx) throw new Error("NestedStackProvider invoked outside withNestedStackContext() scope. The deploy / destroy CLI entry point must wrap its DeployEngine.deploy / runDestroyForStack call in withNestedStackContext(ctx, () => ...).");
+		if (!ctx) throw markNonRetryable(/* @__PURE__ */ new Error("NestedStackProvider invoked outside withNestedStackContext() scope. The deploy / destroy CLI entry point must wrap its DeployEngine.deploy / runDestroyForStack call in withNestedStackContext(ctx, () => ...)."));
 		return ctx;
 	}
 	requireDeployContext(ctx, op) {
@@ -78664,7 +78726,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.14");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.16");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;