@go-to-k/cdkd 0.284.18 → 0.284.19

package/dist/{deploy-engine-HK-oROJf.js → deploy-engine-Bh_LPdju.js}

@@ -5450,6 +5450,68 @@ function getBootstrapMarkerKey(region) {
 	return `${BOOTSTRAP_MARKER_PREFIX}${region}.json`;
 }
 /**
+* Read a region's bootstrap marker, probing the CANONICAL key first and the
+* region's RAW spelling second (issues #1836 / #1995 / #2021).
+*
+* Why two probes: the READ side folds region case (SDK endpoint resolution is
+* case-sensitive, and folding also keeps one region from occupying two cache
+* slots), but the WRITE side does not — `cdkd bootstrap` derives its region as
+* `options.region || AWS_REGION || 'us-east-1'` verbatim and uses that spelling
+* for {@link getBootstrapMarkerKey}. Aligning the write side is issue #1820's
+* lane; until then this read is independent of it.
+*
+* HOW REACHABLE the raw key actually is (measured for #2021, because this PR
+* turns the probe into a SHARED contract for four callers and the earlier
+* per-caller comments overstated it). A plain `AWS_REGION=US-EAST-1 cdkd
+* bootstrap` CANNOT write `cdkd-bootstrap/US-EAST-1.json`: the marker is
+* written LAST, and both resources have to be created first with names derived
+* from that same raw region — `getCdkdAssetBucketName` yields
+* `cdkd-assets-<acct>-US-EAST-1`, which S3 rejects as a bucket name, and
+* `region !== 'us-east-1'` is true for `US-EAST-1` so `CreateBucket` is also
+* handed `LocationConstraint: 'US-EAST-1'`, an invalid enum value. The
+* conventional name is never run through `validateAssetBucketName` (that guards
+* only `--asset-bucket`), so it fails at S3 rather than earlier. The raw key is
+* therefore reachable only when ALL of these hold:
+*
+* 1. both `--asset-bucket` and `--container-repo` are given as valid lowercase
+*    names, so neither conventional name is derived from the raw region; AND
+* 2. the asset bucket ALREADY EXISTS and is owned by this account, so the
+*    `CreateBucket` carrying the bad `LocationConstraint` is never issued;
+*
+* plus, outside that flow, a marker written by hand or by a cdkd predating
+* those guards. Probe 2 is kept rather than dropped because that state is real
+* and losing it silently re-points a bootstrapped region at `cdk gc`-collectable
+* storage — the exact #2021 failure — while the cost is one extra `GetObject`
+* on a non-canonical region only. It is skipped entirely when the region was
+* already canonical, so the common path still costs exactly one `GetObject`.
+* Both conditions are pinned by tests, so this claim cannot rot silently.
+*
+* This helper deliberately does NOT catch: each caller keeps its own policy on
+* top (`cdkd gc` / `cdkd bootstrap --destroy` translate `NoSuchBucket` into a
+* "never bootstrapped" message and hard-error on anything else;
+* `loadBootstrapContainerRepo` is best-effort and warns-and-falls-back).
+*/
+async function readBootstrapMarkerBody(stateBackend, rawRegion, opts = {}) {
+	const canonicalKey = getBootstrapMarkerKey(canonicalizeRegion(rawRegion));
+	const rawKey = getBootstrapMarkerKey(rawRegion);
+	const body = await stateBackend.getRawObject(canonicalKey);
+	if (body !== null || rawKey === canonicalKey) return {
+		body,
+		resolvedKey: canonicalKey
+	};
+	const rawBody = await stateBackend.getRawObject(rawKey);
+	if (rawBody === null) return {
+		body: null,
+		resolvedKey: canonicalKey
+	};
+	const subject = opts.logPrefix ? `${opts.logPrefix}: bootstrap marker` : "Bootstrap marker";
+	getLogger().debug(`${subject} found at the un-folded key '${rawKey}' (none at '${canonicalKey}') — an upper-cased region was used at 'cdkd bootstrap' time.`);
+	return {
+		body: rawBody,
+		resolvedKey: rawKey
+	};
+}
+/**
 * Pragmatic S3 bucket-name check for `cdkd bootstrap --asset-bucket`
 * (issue #1011): 3-63 chars, lowercase letters / digits / dots / hyphens,
 * starting and ending with a letter or digit. Rejecting before any AWS call
@@ -5705,6 +5767,15 @@ async function ensureAssetStorage(options) {
 var AssetModeResolver = class {
 	logger = getLogger().child("AssetMode");
 	cache = /* @__PURE__ */ new Map();
+	/**
+	* NOT load-bearing today — defense-in-depth only. `resolve` sets `cache`
+	* synchronously before the first await, so `doResolve` runs at most once per
+	* canonical region, and the notice arm always returns successfully so the
+	* failure-eviction path cannot re-enter it. This Set was already ineffective
+	* BEFORE the issue #2021 fold (two spellings simply made two entries), so it
+	* is not a regression that fold introduced. Kept so removing or bypassing the
+	* cache cannot silently turn the notice into one line per resolve.
+	*/
 	legacyNoticeShownRegions = /* @__PURE__ */ new Set();
 	stateBackend;
 	accountId;
@@ -5723,24 +5794,37 @@ var AssetModeResolver = class {
 	/**
 	* Resolve the asset mode for a deploy region. Concurrent callers for the
 	* same region share one in-flight resolution.
+	*
+	* The region arrives UNFOLDED (issue #2021): both deploy-time callers derive
+	* it as `options.region || AWS_REGION || 'us-east-1'` and then
+	* `stack.region || baseRegion`, so an env-agnostic stack under
+	* `--region US-EAST-1` (or `AWS_REGION=US-EAST-1`) hands an upper-cased
+	* spelling straight through. A stack whose `env.region` is pinned in CDK is
+	* unaffected — `stack.region` comes from the Cloud Assembly and is canonical.
+	*
+	* Folding at THIS boundary rather than at each caller fixes two things at
+	* once: the marker read below (which used to miss `cdkd-bootstrap/
+	* us-east-1.json` and silently downgrade the whole region to LEGACY —
+	* `cdk gc`-collectable — storage), and the CACHE, where `us-east-1` and
+	* `US-EAST-1` occupied two slots and each re-probed S3.
 	*/
-	resolve(region) {
+	resolve(rawRegion) {
 		if (this.useCdkBootstrapAssets) return Promise.resolve({ mode: "legacy" });
+		const region = canonicalizeRegion(rawRegion);
 		const cached = this.cache.get(region);
 		if (cached) return cached;
-		const inFlight = this.doResolve(region).catch((error) => {
+		const inFlight = this.doResolve(region, rawRegion).catch((error) => {
 			this.cache.delete(region);
 			throw error;
 		});
 		this.cache.set(region, inFlight);
 		return inFlight;
 	}
-	async doResolve(region) {
-		const markerKey = getBootstrapMarkerKey(region);
-		const body = await this.stateBackend.getRawObject(markerKey);
+	async doResolve(region, rawRegion) {
+		const { body, resolvedKey } = await readBootstrapMarkerBody(this.stateBackend, rawRegion);
 		if (body === null) {
 			if (this.autoCreate) {
-				const created = await this.tryAutoCreate(region, markerKey);
+				const created = await this.tryAutoCreate(region, getBootstrapMarkerKey(region));
 				if (created) return created;
 			}
 			if (!this.legacyNoticeShownRegions.has(region) && !this.suppressLegacyNotice) {
@@ -5749,7 +5833,7 @@ var AssetModeResolver = class {
 			}
 			return { mode: "legacy" };
 		}
-		const marker = parseBootstrapMarker(body, markerKey);
+		const marker = parseBootstrapMarker(body, resolvedKey);
 		await verifyAssetStorageExists(marker, this.accountId, region, { ...this.profile && { profile: this.profile } });
 		this.logger.debug(`cdkd asset storage active for region '${region}': ${marker.assetBucket} / ${marker.containerRepo}`);
 		return {
@@ -16514,7 +16598,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-IPF2MfAC.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CuSoYdf6.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -24687,7 +24771,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.18";
+	return "0.284.19";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -27226,5 +27310,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { isTerminationProtectionPropagationError as $, ResourceUpdateNotSupportedError as $n, validateAssetBucketName as $t, renderStatefulReason as A, derivePartitionAndUrlSuffix as An, INTRINSIC_KEYS as At, exportAliasCollisionScrubWarning as B, CdkdError as Bn, stringifyValue as Bt, isFinalSnapshotError as C, CFN_TEMPLATE_URL_LIMIT as Cn, s3BucketArn as Ct, extractDeploymentEventError as D, expectedOwnerParam as Dn, s3BucketWebsiteUrl as Dt, makeCanonicalizePropertiesFn as E, uploadCfnTemplate as En, s3BucketRegionalDomainName as Et, green as F, AwsClients as Fn, LockManager as Ft, collectInlinePolicyNamesManagedBySiblings as G, LocalMigrateError as Gn, rewriteTemplateAssetReferences as Gt, secretBearingStateKeyWarning as H, DependencyError as Hn, buildAssetRedirectMap as Ht, red as I, getAwsClients as In, S3StateBackend as It, findActionableSilentDrops as J, MissingCdkCliError as Jn, AssetModeResolver as Jt, clearOnUpdateRemoval as K, LocalStartServiceError as Kn, escapeRegExp$1 as Kt, yellow as L, resetAwsClients as Ln, rebuildClientForBucketRegion as Lt, bold as M, processStackMessages as Mn, withRetry as Mt, cyan as N, clearBucketRegionCache as Nn, DagBuilder as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, PARTITION_TABLE as On, applyRoleArnIfSet as Ot, gray as P, resolveBucketRegion as Pn, TemplateParser as Pt, disableInstanceApiTermination as Q, ResourceTimeoutError as Qn, parseBootstrapMarker as Qt, collectDeclaredOutputNames as R, setAwsClients as Rn, shouldRetainResource as Rt, createPreDeleteFinalSnapshot as S, CFN_TEMPLATE_BODY_LIMIT as Sn, scrubResourceRecord as St, unsupportedFinalSnapshotError as T, findLargeInlineResources as Tn, s3BucketDualStackDomainName as Tt, stateKeySecretExposure as U, DeployCancelledError as Un, createAssetRedirectResolver as Ut, isExportAliasCollision as V, ConfigError as Vn, WorkGraph as Vt, IAMRoleProvider as W, LocalInvokeBuildError as Wn, loadPublishableAssetManifest as Wt, CloudControlProvider as X, PartialFailureError as Xn, ensureAssetStorage as Xt, findSilentDropProperties as Y, NestedStackChildDirectDestroyError as Yn, BOOTSTRAP_MARKER_PREFIX as Yt, slowCcOperationTimeoutMs as Z, ProvisioningError as Zn, getBootstrapMarkerKey as Zt, computeImplicitDeleteEdges as _, resolveStateBucketWithDefault as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, runDockerForeground as an, isCdkdError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, stateBucketExistenceConfirmed as bn, maskSecretsInText as bt, replayFailedOperations as c, getDockerImageBySourceHash as cn, isMarkedNonRetryable as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDefaultStateBucketName as dn, markNonRetryable as dr, readConfigString as dt, validateContainerRepoName as en, StackHasActiveImportsError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, getLegacyStateBucketName as fn, __exportAll as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveSkipPrefix as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, resolveCaptureObservedState as hn, requireConfigString as ht, DeploymentEventsReader as i, getDockerCmd as in, formatError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, AssemblyReader as jn, describeTypeWithThrottleRetry as jt, isStatefulRecreateTargetSync as k, canonicalizeRegion as kn, DiffCalculator as kt, replayRollback as l, Synthesizer as ln, isRetryableTransientError as lr, configBooleanRefusal as lt, withResourceDeadline as m, resolveAutoAssetStorage as mn, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, buildDockerImage as nn, StateError as nr, getAccountInfo as nt, planFailedOps as o, runDockerStreaming as on, normalizeAwsError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, resolveApp as pn, requireConfigArray as pt, ProviderRegistry as q, LockError as qn, stripControlChars as qt, DeployEngine as r, formatDockerLoginError as rn, SynthesisError as rr, refStateLookupFromResource as rt, planRollback as s, AssetManifestLoader as sn, withErrorHandling as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDenyExternalAccessPolicy as tn, StackTerminationProtectionError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, synthesisStatusMessage as un, isThrottlingError as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveStateBucketWithDefaultAndSource as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, MIGRATE_TMP_PREFIX as wn, s3BucketDomainName as wt, ccRoutedFinalSnapshotError as x, warnDeprecatedNoPrefixCliFlag as xn, redactSecretsForState as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveUseCdkBootstrapAssets as yn, createSecretMasker as yt, collectPublishedOutputNames as z, AssetError as zn, AssetPublisher as zt };
-//# sourceMappingURL=deploy-engine-HK-oROJf.js.map
+export { isTerminationProtectionPropagationError as $, ResourceTimeoutError as $n, readBootstrapMarkerBody as $t, renderStatefulReason as A, canonicalizeRegion as An, INTRINSIC_KEYS as At, exportAliasCollisionScrubWarning as B, AssetError as Bn, stringifyValue as Bt, isFinalSnapshotError as C, CFN_TEMPLATE_BODY_LIMIT as Cn, s3BucketArn as Ct, extractDeploymentEventError as D, uploadCfnTemplate as Dn, s3BucketWebsiteUrl as Dt, makeCanonicalizePropertiesFn as E, findLargeInlineResources as En, s3BucketRegionalDomainName as Et, green as F, resolveBucketRegion as Fn, LockManager as Ft, collectInlinePolicyNamesManagedBySiblings as G, LocalInvokeBuildError as Gn, rewriteTemplateAssetReferences as Gt, secretBearingStateKeyWarning as H, ConfigError as Hn, buildAssetRedirectMap as Ht, red as I, AwsClients as In, S3StateBackend as It, findActionableSilentDrops as J, LockError as Jn, AssetModeResolver as Jt, clearOnUpdateRemoval as K, LocalMigrateError as Kn, escapeRegExp$1 as Kt, yellow as L, getAwsClients as Ln, rebuildClientForBucketRegion as Lt, bold as M, AssemblyReader as Mn, withRetry as Mt, cyan as N, processStackMessages as Nn, DagBuilder as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, expectedOwnerParam as On, applyRoleArnIfSet as Ot, gray as P, clearBucketRegionCache as Pn, TemplateParser as Pt, disableInstanceApiTermination as Q, ProvisioningError as Qn, parseBootstrapMarker as Qt, collectDeclaredOutputNames as R, resetAwsClients as Rn, shouldRetainResource as Rt, createPreDeleteFinalSnapshot as S, warnDeprecatedNoPrefixCliFlag as Sn, scrubResourceRecord as St, unsupportedFinalSnapshotError as T, MIGRATE_TMP_PREFIX as Tn, s3BucketDualStackDomainName as Tt, stateKeySecretExposure as U, DependencyError as Un, createAssetRedirectResolver as Ut, isExportAliasCollision as V, CdkdError as Vn, WorkGraph as Vt, IAMRoleProvider as W, DeployCancelledError as Wn, loadPublishableAssetManifest as Wt, CloudControlProvider as X, NestedStackChildDirectDestroyError as Xn, ensureAssetStorage as Xt, findSilentDropProperties as Y, MissingCdkCliError as Yn, BOOTSTRAP_MARKER_PREFIX as Yt, slowCcOperationTimeoutMs as Z, PartialFailureError as Zn, getBootstrapMarkerKey as Zt, computeImplicitDeleteEdges as _, resolveSkipPrefix as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, getDockerCmd as an, formatError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, resolveUseCdkBootstrapAssets as bn, maskSecretsInText as bt, replayFailedOperations as c, AssetManifestLoader as cn, withErrorHandling as cr, coerceCfnBoolean as ct, updatePartialReason as d, synthesisStatusMessage as dn, isThrottlingError as dr, readConfigString as dt, validateAssetBucketName as en, ResourceUpdateNotSupportedError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, getDefaultStateBucketName as fn, markNonRetryable as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveCaptureObservedState as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, resolveAutoAssetStorage as hn, requireConfigString as ht, DeploymentEventsReader as i, formatDockerLoginError as in, SynthesisError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, derivePartitionAndUrlSuffix as jn, describeTypeWithThrottleRetry as jt, isStatefulRecreateTargetSync as k, PARTITION_TABLE as kn, DiffCalculator as kt, replayRollback as l, getDockerImageBySourceHash as ln, isMarkedNonRetryable as lr, configBooleanRefusal as lt, withResourceDeadline as m, resolveApp as mn, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, buildDenyExternalAccessPolicy as nn, StackTerminationProtectionError as nr, getAccountInfo as nt, planFailedOps as o, runDockerForeground as on, isCdkdError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, getLegacyStateBucketName as pn, __exportAll as pr, requireConfigArray as pt, ProviderRegistry as q, LocalStartServiceError as qn, stripControlChars as qt, DeployEngine as r, buildDockerImage as rn, StateError as rr, refStateLookupFromResource as rt, planRollback as s, runDockerStreaming as sn, normalizeAwsError as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, validateContainerRepoName as tn, StackHasActiveImportsError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, Synthesizer as un, isRetryableTransientError as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveStateBucketWithDefault as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, CFN_TEMPLATE_URL_LIMIT as wn, s3BucketDomainName as wt, ccRoutedFinalSnapshotError as x, stateBucketExistenceConfirmed as xn, redactSecretsForState as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveStateBucketWithDefaultAndSource as yn, createSecretMasker as yt, collectPublishedOutputNames as z, setAwsClients as zn, AssetPublisher as zt };
+//# sourceMappingURL=deploy-engine-Bh_LPdju.js.map