@go-to-k/cdkd 0.283.14 → 0.283.16

package/dist/{deploy-engine-B8gQpv93.js → deploy-engine-C1wXn1V7.js}

@@ -9671,6 +9671,21 @@ async function applyRoleArnIfSet(opts) {
 * - `bucketRegionalDomainName`    -> `<bucket>.s3.<region>.<urlSuffix>`
 * - `bucketDualStackDomainName`   -> `<bucket>.s3.dualstack.<region>.<urlSuffix>`
 * - `bucketWebsiteUrl`            -> `http://<bucket>.<staticWebsiteEndpoint>`
+*
+* The REGION is canonicalized on entry by the three helpers whose output carries
+* a region SEGMENT (issue [#1850](https://github.com/go-to-k/cdkd/issues/1850)).
+* It belongs HERE rather than at either call site for the reason this module
+* exists: `S3BucketProvider.buildAttributes` passes a raw
+* `client.config.region()` while `IntrinsicFunctionResolver.constructAttribute`
+* passes `accountInfo.region`, so folding at one caller alone re-creates exactly
+* the divergence described above. `bucketArn` / `bucketDomainName` need no fold:
+* neither embeds the region, and the URL suffix they DO derive goes through
+* `derivePartitionAndUrlSuffix`, which canonicalizes its own input (#1795).
+*
+* For `WebsiteURL` the fold is not a spelling difference at all: the separator
+* comes from a case-SENSITIVE Set lookup, so an upper-cased region misses the
+* legacy-dash set and takes the wrong separator. It is folded BEFORE that
+* lookup for that reason.
 */
 /**
 * The regions whose S3 static-website endpoint uses the LEGACY hyphen form
@@ -9733,11 +9748,13 @@ function s3BucketDomainName(bucketName, region) {
 }
 /** `<bucket>.s3.<region>.<urlSuffix>` — the regional domain name. */
 function s3BucketRegionalDomainName(bucketName, region) {
-	return `${bucketName}.s3.${region}.${derivePartitionAndUrlSuffix(region).urlSuffix}`;
+	const folded = canonicalizeRegion(region);
+	return `${bucketName}.s3.${folded}.${derivePartitionAndUrlSuffix(folded).urlSuffix}`;
 }
 /** `<bucket>.s3.dualstack.<region>.<urlSuffix>` — the IPv6 dual-stack domain name. */
 function s3BucketDualStackDomainName(bucketName, region) {
-	return `${bucketName}.s3.dualstack.${region}.${derivePartitionAndUrlSuffix(region).urlSuffix}`;
+	const folded = canonicalizeRegion(region);
+	return `${bucketName}.s3.dualstack.${folded}.${derivePartitionAndUrlSuffix(folded).urlSuffix}`;
 }
 /**
 * `http://<bucket>.s3-website[-.]<region>.<urlSuffix>` — the static-website URL.
@@ -9747,8 +9764,9 @@ function s3BucketDualStackDomainName(bucketName, region) {
 * cannot be derived from the partition.
 */
 function s3BucketWebsiteUrl(bucketName, region) {
-	const { urlSuffix } = derivePartitionAndUrlSuffix(region);
-	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(region) ? "-" : "."}${region}.${urlSuffix}`;
+	const folded = canonicalizeRegion(region);
+	const { urlSuffix } = derivePartitionAndUrlSuffix(folded);
+	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(folded) ? "-" : "."}${folded}.${urlSuffix}`;
 }
 
 //#endregion
@@ -11973,7 +11991,8 @@ var IntrinsicFunctionResolver = class {
 	*/
 	async constructAttribute(resource, attributeName, _context, logicalId, accountInfo) {
 		const { resourceType, physicalId } = resource;
-		const { region, accountId, partition } = accountInfo;
+		const { accountId, partition } = accountInfo;
+		const region = canonicalizeRegion(accountInfo.region);
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
 			case "StreamArn": return;
@@ -12984,7 +13003,7 @@ var IntrinsicFunctionResolver = class {
 			case "AWS::StackName": return context?.stackName ?? "UnknownStack";
 			case "AWS::StackId": {
 				const info = await getAccountInfo(this.resolverRegion);
-				return `arn:${info.partition}:cloudformation:${info.region}:${info.accountId}:stack/${context?.stackName ?? "UnknownStack"}/cdkd`;
+				return `arn:${info.partition}:cloudformation:${canonicalizeRegion(info.region)}:${info.accountId}:stack/${context?.stackName ?? "UnknownStack"}/cdkd`;
 			}
 			case "AWS::URLSuffix": return derivePartitionAndUrlSuffix(this.resolverRegion).urlSuffix;
 			case "AWS::NotificationARNs": return "";
@@ -14018,7 +14037,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CgnPBnOS.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C3dMUcV4.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -14255,7 +14274,7 @@ var CloudControlProvider = class {
 				if (!enriched["Arn"]) try {
 					const kmsAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
 					if (kmsAccountInfo) {
-						enriched["Arn"] = `arn:${kmsAccountInfo.partition}:kms:${kmsAccountInfo.region}:${kmsAccountInfo.accountId}:key/${physicalId}`;
+						enriched["Arn"] = `arn:${kmsAccountInfo.partition}:kms:${canonicalizeRegion(kmsAccountInfo.region)}:${kmsAccountInfo.accountId}:key/${physicalId}`;
 						this.logger.debug(`Enriched KMS Key Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
@@ -14273,7 +14292,7 @@ var CloudControlProvider = class {
 				if (!enriched["Arn"]) try {
 					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
 					if (ecrAccountInfo) {
-						enriched["Arn"] = `arn:${ecrAccountInfo.partition}:ecr:${ecrAccountInfo.region}:${ecrAccountInfo.accountId}:repository/${physicalId}`;
+						enriched["Arn"] = `arn:${ecrAccountInfo.partition}:ecr:${canonicalizeRegion(ecrAccountInfo.region)}:${ecrAccountInfo.accountId}:repository/${physicalId}`;
 						this.logger.debug(`Enriched ECR Repository Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
@@ -14283,7 +14302,7 @@ var CloudControlProvider = class {
 					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "RepositoryUri", physicalId);
 					if (ecrAccountInfo) {
 						const { urlSuffix } = derivePartitionAndUrlSuffix(ecrAccountInfo.region);
-						enriched["RepositoryUri"] = `${ecrAccountInfo.accountId}.dkr.ecr.${ecrAccountInfo.region}.${urlSuffix}/${physicalId}`;
+						enriched["RepositoryUri"] = `${ecrAccountInfo.accountId}.dkr.ecr.${canonicalizeRegion(ecrAccountInfo.region)}.${urlSuffix}/${physicalId}`;
 					}
 				} catch {}
 				break;
@@ -14307,7 +14326,7 @@ var CloudControlProvider = class {
 				if (!enriched["Arn"]) try {
 					const kinesisAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
 					if (kinesisAccountInfo) {
-						enriched["Arn"] = `arn:${kinesisAccountInfo.partition}:kinesis:${kinesisAccountInfo.region}:${kinesisAccountInfo.accountId}:stream/${physicalId}`;
+						enriched["Arn"] = `arn:${kinesisAccountInfo.partition}:kinesis:${canonicalizeRegion(kinesisAccountInfo.region)}:${kinesisAccountInfo.accountId}:stream/${physicalId}`;
 						this.logger.debug(`Enriched Kinesis Stream Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
@@ -14840,6 +14859,47 @@ const CR_LOG_TAIL_WARN_MAX_CHARS = 2e3;
 */
 const CR_LOG_TAIL_BOILERPLATE = /^(START|END|REPORT|XRAY|INIT_START|INIT_REPORT|RESTORE_START|RESTORE_REPORT|EXTENSION) /;
 /**
+* Matches an SNS topic ARN in ANY AWS partition (issue #1815).
+*
+* The partition segment is read OFF THE ARN rather than derived from a region
+* through `derivePartitionAndUrlSuffix` (`src/utils/aws-partition.ts`), which
+* is the right tool for the seven sites PR #1834 fixed but the wrong one here.
+* That helper answers "given a region, which partition am I in"; this is a
+* CLASSIFIER over an ARN the caller already holds, so the partition is present
+* in the input and needs no derivation — and there is no region in hand at
+* this call site to derive from anyway.
+*
+* `aws[a-z0-9-]*` deliberately accepts any partition name rather than
+* enumerating today's (`aws` / `aws-cn` / `aws-us-gov` / `aws-iso*` /
+* `aws-eusc`), matching `IAM_ROLE_ARN_RE` in `src/utils/role-arn.ts`. A closed
+* list is exactly the failure this issue is about: it goes stale the moment
+* AWS adds a partition. Being loose is safe for a routing predicate — the
+* service segment (`:sns:`) is what discriminates, and a string that is not a
+* real ARN cannot be a valid ServiceToken in the first place.
+*/
+const SNS_SERVICE_TOKEN_ARN_RE = /^arn:aws[a-z0-9-]*:sns:/;
+/**
+* The synthetic `StackId` handed to a custom-resource handler in place of the
+* CloudFormation stack ARN cdkd does not have.
+*
+* **Its `arn:aws:` prefix is deliberately NOT partition-derived** (issue
+* #1815, which fixed the SNS routing predicate above). Every segment of this
+* value is fabricated — the region is a fixed `us-east-1` rather than the
+* deploy region, and the account is the all-zero placeholder — so it addresses
+* nothing and cannot be made to. Deriving ONLY the partition would produce a
+* strictly LESS coherent ARN (`arn:aws-cn:cloudformation:us-east-1:0000...`,
+* a China partition carrying a commercial region) while fixing nothing a
+* handler could rely on. The coherent fix is to synthesize the real
+* partition / region / account together, which changes what every handler
+* observes and belongs in its own change.
+*
+* Factored into one place so the rationale cannot go stale against two other
+* copies: the create / update / delete request builders all use it.
+*/
+function syntheticStackId(logicalId) {
+	return `arn:aws:cloudformation:us-east-1:000000000000:stack/cdkd-${logicalId}/cdkd`;
+}
+/**
 * `true` when the tail contains at least one line the HANDLER produced.
 *
 * Deliberately a positive test for handler output rather than a length check:
@@ -15072,7 +15132,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResponseURL: invocation.responseURL,
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
-				StackId: `arn:aws:cloudformation:us-east-1:000000000000:stack/cdkd-${logicalId}/cdkd`,
+				StackId: syntheticStackId(logicalId),
 				ResourceProperties: this.stringifyProperties(properties)
 			}));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
@@ -15104,7 +15164,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
-				StackId: `arn:aws:cloudformation:us-east-1:000000000000:stack/cdkd-${logicalId}/cdkd`,
+				StackId: syntheticStackId(logicalId),
 				ResourceProperties: this.stringifyProperties(properties),
 				OldResourceProperties: this.stringifyProperties(previousProperties)
 			}));
@@ -15156,7 +15216,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
-				StackId: `arn:aws:cloudformation:us-east-1:000000000000:stack/cdkd-${logicalId}/cdkd`,
+				StackId: syntheticStackId(logicalId),
 				ResourceProperties: this.stringifyProperties(properties)
 			}));
 			if (cfnResponse.Status === "FAILED") this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}`);
@@ -15166,10 +15226,19 @@ var CustomResourceProvider = class CustomResourceProvider {
 		}
 	}
 	/**
-	* Check if a ServiceToken is an SNS topic ARN
+	* Check if a ServiceToken is an SNS topic ARN.
+	*
+	* This is the SNS-vs-Lambda routing decision for the whole provider — it
+	* gates `sendRequest` (publish to SNS + poll S3 vs synchronous Invoke), the
+	* delete path's backing-Lambda pre-check, and `recycleBackingFunctionExecEnv`.
+	* A hardcoded `arn:aws:` prefix therefore did not merely record a wrong
+	* string outside the commercial partition: an `arn:aws-cn:sns:` /
+	* `arn:aws-us-gov:sns:` ServiceToken was classified Lambda-backed and every
+	* one of those paths took the wrong branch (issue #1815). See
+	* {@link SNS_SERVICE_TOKEN_ARN_RE} for why the partition is read off the ARN.
 	*/
 	isSnsServiceToken(serviceToken) {
-		return serviceToken.startsWith("arn:aws:sns:");
+		return SNS_SERVICE_TOKEN_ARN_RE.test(serviceToken);
 	}
 	/**
 	* Single GetFunction probe used by the delete path's fail-fast pre-check
@@ -21072,7 +21141,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.14";
+	return "0.283.16";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -23289,4 +23358,4 @@ var DeployEngine = class {
 
 //#endregion
 export { coerceCfnBoolean as $, resolveStateBucketWithDefault as $t, cyan as A, MissingCdkCliError as An, AssetModeResolver as At, findSilentDropProperties as B, formatError as Bn, getDockerCmd as Bt, makeCanonicalizePropertiesFn as C, ConfigError as Cn, stringifyValue as Ct, renderStatefulReason as D, LocalMigrateError as Dn, loadPublishableAssetManifest as Dt, isStatefulRecreateTargetSync as E, LocalInvokeBuildError as En, createAssetRedirectResolver as Et, IAMRoleProvider as F, ResourceUpdateNotSupportedError as Fn, validateAssetBucketName as Ft, IntrinsicFunctionResolver as G, isRetryableTransientError as Gn, Synthesizer as Gt, slowCcOperationTimeoutMs as H, normalizeAwsError as Hn, runDockerStreaming as Ht, collectInlinePolicyNamesManagedBySiblings as I, StackHasActiveImportsError as In, validateContainerRepoName as It, refStateLookupFromResource as J, __exportAll as Jn, getLegacyStateBucketName as Jt, cfnRefValueFromPhysicalId as K, isThrottlingError as Kn, synthesisStatusMessage as Kt, clearOnUpdateRemoval as L, StackTerminationProtectionError as Ln, buildDenyExternalAccessPolicy as Lt, green as M, PartialFailureError as Mn, ensureAssetStorage as Mt, red as N, ProvisioningError as Nn, getBootstrapMarkerKey as Nt, formatResourceLine as O, LocalStartServiceError as On, rewriteTemplateAssetReferences as Ot, yellow as P, ResourceTimeoutError as Pn, parseBootstrapMarker as Pt, assertRegionMatch as Q, resolveSkipPrefix as Qt, ProviderRegistry as R, StateError as Rn, buildDockerImage as Rt, unsupportedFinalSnapshotError as S, CdkdError as Sn, AssetPublisher as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, DeployCancelledError as Tn, buildAssetRedirectMap as Tt, disableInstanceApiTermination as U, withErrorHandling as Un, AssetManifestLoader as Ut, CloudControlProvider as V, isCdkdError as Vn, runDockerForeground as Vt, isTerminationProtectionPropagationError as W, isMarkedNonRetryable as Wn, getDockerImageBySourceHash as Wt, normalizeAwsTagsToCfn as X, resolveAutoAssetStorage as Xt, WAFv2WebACLProvider as Y, resolveApp as Yt, resolveExplicitPhysicalId as Z, resolveCaptureObservedState as Zt, buildFinalSnapshotIdentifier as _, AwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, CFN_TEMPLATE_URL_LIMIT as an, requireConfigObject as at, isFinalSnapshotError as b, setAwsClients as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, uploadCfnTemplate as cn, s3BucketDomainName as ct, deleteSkipReason as d, canonicalizeRegion as dn, s3BucketWebsiteUrl as dt, resolveStateBucketWithDefaultAndSource as en, configBooleanRefusal as et, withResourceDeadline as f, derivePartitionAndUrlSuffix as fn, applyRoleArnIfSet as ft, PRE_DELETE_SNAPSHOT_TYPES as g, resolveBucketRegion as gn, DagBuilder as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, clearBucketRegionCache as hn, withRetry as ht, DeploymentEventsReader as i, CFN_TEMPLATE_BODY_LIMIT as in, requireConfigArray as it, gray as j, NestedStackChildDirectDestroyError as jn, BOOTSTRAP_MARKER_PREFIX as jt, bold as k, LockError as kn, escapeRegExp as kt, replayRollback as l, expectedOwnerParam as ln, s3BucketDualStackDomainName as lt, computeImplicitDeleteEdges as m, processStackMessages as mn, describeTypeWithThrottleRetry as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, stateBucketExistenceConfirmed as nn, readConfigString as nt, planFailedOps as o, MIGRATE_TMP_PREFIX as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, AssemblyReader as pn, DiffCalculator as pt, getAccountInfo as q, markNonRetryable as qn, getDefaultStateBucketName as qt, DeployEngine as r, warnDeprecatedNoPrefixCliFlag as rn, replayWarn as rt, planRollback as s, findLargeInlineResources as sn, s3BucketArn as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveUseCdkBootstrapAssets as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, PARTITION_TABLE as un, s3BucketRegionalDomainName as ut, ccRoutedFinalSnapshotError as v, getAwsClients as vn, LockManager as vt, extractDeploymentEventError as w, DependencyError as wn, WorkGraph as wt, refusesFinalSnapshot as x, AssetError as xn, shouldRetainResource as xt, createPreDeleteFinalSnapshot as y, resetAwsClients as yn, S3StateBackend as yt, findActionableSilentDrops as z, SynthesisError as zn, formatDockerLoginError as zt };
-//# sourceMappingURL=deploy-engine-B8gQpv93.js.map
+//# sourceMappingURL=deploy-engine-C1wXn1V7.js.map