@go-to-k/cdkd 0.284.45 → 0.284.47

package/dist/{deploy-engine-BM0TxXk2.js → deploy-engine-yvTKD2qC.js}

@@ -14555,9 +14555,66 @@ const cachedEc2InstanceAttributes = {};
 *
 * Kept as one helper so the cached and the freshly-resolved paths cannot pick
 * different defaults (issue #1746).
+*
+* FOLDED here, at the source, rather than at each consumer (issue
+* [#1882](https://github.com/go-to-k/cdkd/issues/1882)). This is the value
+* `AWS::Region` returns, the value every `Fn::Sub` in a USER template
+* interpolates, and the `region-name` filter `resolveGetAZs` sends to EC2 when
+* the template names no region — three consumers with three different
+* case-sensitivities, which is why folding at the read beats folding at each of
+* them.
+*
+* #1882 held this raw pending a live CloudFormation A/B, on the reasoning that
+* `AWS::Region` is CFn's own passthrough and a user may legitimately read it
+* back. The A/B was run on 2026-08-25 and removes the premise rather than
+* answering it: a non-canonical region never reaches CloudFormation at all,
+* because SigV4's credential scope is compared case-sensitively by the service.
+* Measured against this repo's vendored SDK, every spelling but the canonical
+* one is refused before the request is served:
+*
+* ```text
+* STSClient({region:'us-east-1'}).send(GetCallerIdentity) -> OK
+* STSClient({region:'US-EAST-1'}).send(GetCallerIdentity) -> SignatureDoesNotMatch
+* STSClient({region:'Us-East-1'}).send(GetCallerIdentity) -> SignatureDoesNotMatch
+* CloudFormationClient({region:'US-EAST-1'}).send(ListStacks) -> SignatureDoesNotMatch
+*     "Credential should be scoped to a valid region."
+* ```
+*
+* Two routes a raw region could take are therefore closed BEFORE this function:
+* `--region` / `AWS_REGION` are folded at the CLI boundary (`foldRegionOption`,
+* issue #2065), and a CDK app declaring `env: { region: 'US-EAST-1' }` fails at
+* `app.synth()` — `EnvironmentUtils.parse` is case-sensitive, measured on
+* aws-cdk-lib 2.244.0.
+*
+* What is NOT closed, and is the reason this fold is more than tidiness: a Cloud
+* Assembly that reaches cdkd with a raw region in its `environment` string.
+* cdkd's own `parseEnvironment` (`src/types/assembly.ts`) accepts any region
+* text, so a hand-authored assembly, a non-CDK toolchain, or a `cdk.out` left
+* behind by a synth that threw AFTER writing the manifest all reach
+* `stackInfo.region` unfolded, and `deploy.ts` passes it on as the resolver's
+* region. That deploy SUCCEEDS — `AwsClients`' constructor folds the region its
+* clients sign with, so SigV4 never sees the raw spelling — and every
+* `${AWS::Region}` a user's `Fn::Sub` interpolates inherits it, producing
+* `arn:aws:s3:US-EAST-1:...`, which no IAM policy matches, and persisting it,
+* while every ARN cdkd itself constructs beside it is canonical (issue #1850).
+* Folding here removes that self-contradiction.
+*
+* UPGRADE CONSEQUENCE, stated because #1850's own entry states it for its fold:
+* a stack deployed that way keeps the raw spelling in its recorded properties,
+* so the next diff of a property interpolating `${AWS::Region}` sees a change,
+* and where the property is create-only that classifies as a REPLACEMENT.
+* Deliberate — the recorded value is unusable, so converging it is the point.
+* State KEYS are unaffected: they are built from `stackRegion`, which this does
+* not touch.
+*
+* The consumer-side `canonicalizeRegion` calls this subsumes are deliberately
+* LEFT in place. Only `s3-endpoints.ts`'s is still reachable from a caller that
+* does not come through here; the rest are now genuinely redundant and are kept
+* as defense in depth, since double-folding is a no-op and a future caller may
+* reach them another way.
 */
 function effectiveAccountInfoRegion(overrideRegion) {
-	return overrideRegion || process.env["AWS_REGION"] || "us-east-1";
+	return canonicalizeRegion(overrideRegion || process.env["AWS_REGION"]) || "us-east-1";
 }
 /**
 * Build the caller's full answer from the cached account identity (issue #1746).
@@ -16748,7 +16805,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
 			roleArn = raw;
 		}
-		if (!roleArn && context.stackName && context.stackName === stackName && region === this.resolverRegion) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${stackName}' in the same region '${region}'`);
+		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${stackName}' in the same region '${region}'`);
 		const loggedStackName = this.maskSecretsForLog(stackName, context);
 		const loggedOutputName = this.maskSecretsForLog(outputName, context);
 		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
@@ -18173,7 +18230,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-kMX2xn6Q.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-_PwR0OUM.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -26869,7 +26926,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.45";
+	return "0.284.47";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -29492,4 +29549,4 @@ var DeployEngine = class {
 
 //#endregion
 export { startInterruptWatch as $, setAwsClients as $n, WorkGraph as $t, renderStatefulReason as A, resolveCaptureObservedState as An, redactSecretsForState as At, exportAliasCollisionScrubWarning as B, findLargeInlineResources as Bn, DiffCalculator as Bt, isFinalSnapshotError as C, getDockerImageBySourceHash as Cn, normalizeAwsError as Cr, TEMPLATE_SOURCED_RULES as Ct, extractDeploymentEventError as D, getLegacyStateBucketName as Dn, isThrottlingError as Dr, isSingleDynamicReferenceToken as Dt, makeCanonicalizePropertiesFn as E, getDefaultStateBucketName as En, isRetryableTransientError as Er, errorCauseChain as Et, green as F, stateBucketExistenceConfirmed as Fn, s3BucketDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, derivePartitionAndUrlSuffix as Gn, TemplateParser as Gt, secretBearingStateKeyWarning as H, expectedOwnerParam as Hn, describeTypeWithThrottleRetry as Ht, red as I, warnDeprecatedNoPrefixCliFlag as In, s3BucketDualStackDomainName as It, findActionableSilentDrops as J, clearBucketRegionCache as Jn, S3StateBackend as Jt, clearOnUpdateRemoval as K, AssemblyReader as Kn, LockManager as Kt, yellow as L, CFN_TEMPLATE_BODY_LIMIT as Ln, s3BucketRegionalDomainName as Lt, bold as M, resolveStateBucketWithDefault as Mn, classifyReplaySecretRegion as Mt, cyan as N, resolveStateBucketWithDefaultAndSource as Nn, producerRegionsFromState as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, resolveApp as On, markNonRetryable as Or, maskSecretsInError as Ot, gray as P, resolveUseCdkBootstrapAssets as Pn, s3BucketArn as Pt, isInterruptedWaitError as Q, resetAwsClients as Qn, stringifyValue as Qt, collectDeclaredOutputNames as R, CFN_TEMPLATE_URL_LIMIT as Rn, s3BucketWebsiteUrl as Rt, createPreDeleteFinalSnapshot as S, AssetManifestLoader as Sn, isCdkdError as Sr, STATE_SOURCED_READBACK_RULES as St, unsupportedFinalSnapshotError as T, synthesisStatusMessage as Tn, isMarkedNonRetryable as Tr, dynamicReferenceTokens as Tt, stateKeySecretExposure as U, PARTITION_TABLE as Un, withRetry as Ut, isExportAliasCollision as V, uploadCfnTemplate as Vn, INTRINSIC_KEYS as Vt, IAMRoleProvider as W, canonicalizeRegion as Wn, DagBuilder as Wt, beginCommandInterruptScope as X, AwsClients as Xn, shouldRetainResource as Xt, findSilentDropProperties as Y, resolveBucketRegion as Yn, rebuildClientForBucketRegion as Yt, endCommandInterruptScope as Z, getAwsClients as Zn, AssetPublisher as Zt, computeImplicitDeleteEdges as _, formatDockerLoginError as _n, StackHasActiveImportsError as _r, replayWarn as _t, DeploymentEventsStore as a, stripControlChars as an, DeployCancelledError as ar, carriesDynamicReference as at, buildFinalSnapshotIdentifier as b, runDockerForeground as bn, SynthesisError as br, requireConfigString as bt, replayFailedOperations as c, ensureAssetStorage as cn, LocalMigrateError as cr, refStateLookupFromResource as ct, updatePartialReason as d, readBootstrapMarkerBody as dn, MissingCdkCliError as dr, resolveExplicitPhysicalId as dt, buildAssetRedirectMap as en, AssetError as er, CloudControlProvider as et, UNSPECIFIED_SKIP_REASON as f, validateAssetBucketName as fn, NestedStackChildDirectDestroyError as fr, assertRegionMatch as ft, IMPLICIT_DELETE_DEPENDENCIES as g, dockerSpawnEnvWithSensitive as gn, ResourceUpdateNotSupportedError as gr, readConfigString as gt, maskingRetryLogger as h, buildDockerImage as hn, ResourceTimeoutError as hr, configStringRefusal as ht, DeploymentEventsReader as i, escapeRegExp$1 as in, DependencyError as ir, IntrinsicFunctionResolver as it, formatResourceLine as j, resolveSkipPrefix as jn, scrubResourceRecord as jt, isStatefulRecreateTargetSync as k, resolveAutoAssetStorage as kn, __exportAll as kr, maskSecretsInText as kt, replayRollback as l, getBootstrapMarkerKey as ln, LocalStartServiceError as lr, WAFv2WebACLProvider as lt, withResourceDeadline as m, buildDenyExternalAccessPolicy as mn, ProvisioningError as mr, configBooleanRefusal as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, loadPublishableAssetManifest as nn, ConfigError as nr, disableInstanceApiTermination as nt, planFailedOps as o, AssetModeResolver as on, DynamicReferenceRegionAmbiguousError as or, cfnRefValueFromPhysicalId as ot, deleteSkipReason as p, validateContainerRepoName as pn, PartialFailureError as pr, coerceCfnBoolean as pt, ProviderRegistry as q, processStackMessages as qn, displaySafe as qt, DeployEngine as r, rewriteTemplateAssetReferences as rn, CrossAccountSecretRefusalError as rr, isTerminationProtectionPropagationError as rt, planRollback as s, BOOTSTRAP_MARKER_PREFIX as sn, LocalInvokeBuildError as sr, getAccountInfo as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, createAssetRedirectResolver as tn, CdkdError as tr, slowCcOperationTimeoutMs as tt, updatePartialMessage as u, parseBootstrapMarker as un, LockError as ur, normalizeAwsTagsToCfn as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, getDockerCmd as vn, StackTerminationProtectionError as vr, requireConfigArray as vt, refusesFinalSnapshot as w, Synthesizer as wn, withErrorHandling as wr, createSecretMasker as wt, ccRoutedFinalSnapshotError as x, runDockerStreaming as xn, formatError as xr, STATE_SOURCED_CROSS_GENERATION_RULES as xt, PRE_DELETE_SNAPSHOT_TYPES as y, partitionSensitiveEnv as yn, StateError as yr, requireConfigObject as yt, collectPublishedOutputNames as z, MIGRATE_TMP_PREFIX as zn, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-BM0TxXk2.js.map
+//# sourceMappingURL=deploy-engine-yvTKD2qC.js.map