@go-to-k/cdkd 0.284.72 → 0.284.73

package/dist/{deploy-engine-Bc0FBOuJ.js → deploy-engine-DjcVPGO-.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-DY_eLvXB.js";
+import { t as getCdkdVersion } from "./version-NRgaYAmx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5873,7 +5873,7 @@ function readBucketRegionHeader(error) {
 * The API answers with an EMPTY constraint for `us-east-1` and the legacy `EU`
 * alias for `eu-west-1`; every other region comes back verbatim.
 */
-function bucketLocationToRegion(constraint) {
+function bucketLocationToRegion$1(constraint) {
 	if (!constraint) return "us-east-1";
 	if (constraint === "EU") return "eu-west-1";
 	return constraint;
@@ -5938,7 +5938,7 @@ async function assertAssetBucketRegion(s3Client, bucketName, expectedRegion, acc
 	const fromHeader = readBucketRegionHeader(cause);
 	if (fromHeader) actual = canonicalizeRegion(fromHeader);
 	else try {
-		actual = canonicalizeRegion(bucketLocationToRegion((await s3Client.send(new GetBucketLocationCommand({
+		actual = canonicalizeRegion(bucketLocationToRegion$1((await s3Client.send(new GetBucketLocationCommand({
 			Bucket: bucketName,
 			ExpectedBucketOwner: accountId
 		}))).LocationConstraint));
@@ -19194,6 +19194,110 @@ function describeJsonKeys(document) {
 	const suffix = pattern.lastIndex < document.length && keys.length >= MAX_LOGGED_MODEL_KEYS ? ", ..." : "";
 	return `keys: ${keys.join(", ")}${suffix}`;
 }
+/**
+* Resource types whose Cloud-Control-routed DELETE gets a pre-flight
+* IDENTITY confirmation -- proof that the physical id the state record names
+* denotes a resource in the region this destroy is targeting -- before
+* `DeleteResource` is issued (issue #2283).
+*
+* WHY THIS IS A HOOK HERE AND NOT A ROUTING CHANGE
+* ------------------------------------------------
+* The issue offered two shapes and called the routing change "much smaller":
+* stop letting `AWS::S3::Bucket` reach Cloud Control at all, now that
+* `S3BucketProvider` carries its own region guard (issues #2227 / #2245).
+* Reading `provider-registry.ts` settles it the other way, for two reasons:
+*
+*  1. There is no per-type "CC auto-route list" to remove the type FROM. The
+*     route at `provider-registry.ts` step 3-5 is the generic issue #614
+*     silent-drop rule: a type WITH an SDK provider goes to Cloud Control
+*     exactly when its template uses a property that provider would silently
+*     DROP. Suppressing it for buckets means `disableCcApiFallback` on
+*     `S3BucketProvider`, which converts those deploys from "provisioned
+*     correctly via CC" into a hard `buildUnroutableSilentDropMessage` throw.
+*     That is a strictly larger behaviour change than this guard, and it
+*     regresses the bug #614 was filed for.
+*
+*  2. It would not even close the hazard. Step 2 of `getProviderFor` is the
+*     STICKY rule: a resource whose state says `provisionedBy: 'cc-api'`
+*     routes to this provider BEFORE the SDK provider is ever consulted, and
+*     `disableCcApiFallback` is not read on that path. The poisoned pre-guard
+*     state record the issue is about is precisely a record that already says
+*     `cc-api`, so it would still arrive here. Only adding the type to
+*     `STICKY_CC_MIGRATION_EXEMPT` would divert it -- and that set is reserved
+*     for types whose CC routing is BROKEN, which would then send the
+*     silent-drop property back down the dropping path on the next deploy.
+*
+* So the confirmation belongs where the delete is actually issued. The set is
+* a set rather than an `if` because the hazard is not S3-specific in kind: any
+* type whose physical id is globally unique but whose RESOURCE is regional can
+* be named by a state record that denotes something in another region.
+* `AWS::S3::Bucket` is the only instance recorded so far (issue #2283).
+*/
+const CC_DELETE_IDENTITY_CHECKED_TYPES = /* @__PURE__ */ new Set(["AWS::S3::Bucket"]);
+/**
+* Whether a Cloud-Control-routed DELETE of `resourceType` is preceded by the
+* pre-flight identity confirmation described on
+* {@link CC_DELETE_IDENTITY_CHECKED_TYPES}.
+*
+* Exported so the routing decision is assertable in BOTH polarities: the
+* guarded type, and a control type that must keep issuing its `DeleteResource`
+* with no extra probe and no new IAM dependency.
+*/
+function requiresCcDeleteIdentityCheck(resourceType) {
+	return CC_DELETE_IDENTITY_CHECKED_TYPES.has(resourceType);
+}
+/**
+* The region a `GetBucketLocation` answer denotes, canonicalized.
+*
+* Two legacy wire shapes, both still returned, which is why this is a function
+* rather than a field read: a bucket in `us-east-1` answers with an EMPTY /
+* null `LocationConstraint` (absent therefore means `us-east-1`, never
+* "unknown" -- folding it to unknown would make the commonest region
+* permanently indeterminate), and `EU` is a legacy alias for `eu-west-1`.
+*
+* THREE copies of this fold exist and neither of the other two is reusable
+* here:
+*
+*  - `providers/s3-bucket-provider.ts`'s private twin is the SDK route's
+*    guard, reached by a different routing decision, and it additionally
+*    reads `x-amz-bucket-region` off a `CreateBucket` 409 -- a signal that
+*    does not exist on this path, where the probe is a PRE-flight with no
+*    prior error to read. Folding them together would export a create-shaped
+*    API into a delete-only call site.
+*  - `utils/aws-region-resolver.ts:147` holds only the us-east-1 HALF of the
+*    fold, inline (`response.LocationConstraint || 'us-east-1'`, with no `EU`
+*    case at all), and is wrong here twice
+*    over: it is fail-OPEN by contract (it never throws and returns
+*    `fallbackRegion` on a failed probe, which would report this deploy's own
+*    region and let the foreign bucket through), and it passes
+*    `ExpectedBucketOwner`, which is the opposite of what this probe needs --
+*    see {@link CloudControlProvider.confirmDeleteTargetIdentity}. It also
+*    caches, so a second call in one process would skip the probe entirely.
+*
+* Each copy is pinned by unit tests on its own side, for exactly the fold it
+* carries: `s3-bucket-provider-already-owned-region.test.ts:223-224` for the
+* SDK twin's `''` / `null` spellings, `aws-region-resolver.test.ts:66` / `:74`
+* for the resolver's us-east-1 half, and this module's own suite for all three
+* us-east-1 spellings plus both polarities of the `EU` alias.
+*/
+function bucketLocationToRegion(constraint) {
+	const value = canonicalizeRegion((constraint ?? "").trim());
+	if (value === "") return "us-east-1";
+	if (value === "eu") return "eu-west-1";
+	return value;
+}
+/**
+* Whether an S3 error means the NAMED BUCKET IS ABSENT, as opposed to the
+* probe being unable to answer.
+*
+* The wire CODE alone, never a message match. Collapsing "absent" into "could
+* not answer" (or the reverse) is the failure mode the issue #2245 review
+* named: a bare 404 from a proxy, `AWS_ENDPOINT_URL`, or an S3-compatible
+* gateway must not be read as a positive statement about a bucket's region.
+*/
+function isNoSuchBucketError(error) {
+	return error?.name === "NoSuchBucket";
+}
 var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
@@ -19352,9 +19456,10 @@ var CloudControlProvider = class {
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
+		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DcAqfBUo.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-xXB0aei5.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -19391,6 +19496,104 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
+	* Confirm that the resource `physicalId` names actually lives in the region
+	* this destroy is targeting, for the types in
+	* {@link CC_DELETE_IDENTITY_CHECKED_TYPES}. No-op for every other type.
+	*
+	* WHAT THIS GUARDS THAT `assertRegionMatch` DOES NOT
+	* ---------------------------------------------------
+	* The existing `assertRegionMatch` in the catch block below compares the
+	* CLIENT's region against the state's region, and only on the `NotFound`
+	* branch. Both halves miss this hazard. An `AWS::S3::Bucket` physical id is
+	* a GLOBALLY unique name, so a state record written before the issue #2227 /
+	* #2245 guards existed can name a bucket that is ours but lives elsewhere --
+	* a cdkd-GENERATED bucket name carries no region or account: for a name cdkd
+	* derives itself, `resource-name.ts:240` builds
+	* `` `${currentStackName}-${name}` `` whenever `resource-name.ts:239`'s
+	* `shouldPrefix` holds, so the same stack deployed to two regions produces
+	* the same bucket name by construction. (That guard has a second, unrelated
+	* path -- it also drops the prefix when there is no ambient stack name at
+	* all -- so it is quoted here rather than enumerated.) And a delete of such a bucket is NOT expected to come back
+	* `NotFound`: the mechanism issues #2245 / #2283 record is that S3 follows
+	* the region redirect for a body-bearing operation, so the delete lands on
+	* the live bucket in the other region and this catch block is never entered.
+	* Nothing downstream can undo that, which is why the confirmation is
+	* pre-flight rather than a wider net around the existing handler. The live
+	* arm in `tests/integration/s3-lifecycle` (phase 0c) is what holds that
+	* mechanism to account on THIS route.
+	*
+	* THE PROBE HAS THREE OUTCOMES AND ALL THREE ARE DISTINCT
+	* -------------------------------------------------------
+	*  - ANSWERED, region matches -> proceed silently. The hot path costs one
+	*    `GetBucketLocation`.
+	*  - ANSWERED, region differs -> REFUSE, non-retryable. Both retry loops
+	*    that wrap a `delete()` honour the marker and would otherwise re-run the
+	*    whole delete for their full budget before surfacing the same
+	*    deterministic message, which reads as flaky AWS: the destroy path's own
+	*    loop (`destroy-runner.ts:1328`, which runs FOUR attempts -- `attempt`
+	*    goes 0..`maxAttempts` and `maxAttempts` is 3 at `:1326` -- with
+	*    `isMarkedNonRetryable` gating both of its retryable arms at `:1372`)
+	*    and the deploy engine's `withRetry` (`retry.ts:332`) on the
+	*    replacement-delete path.
+	*  - COULD NOT ANSWER -> proceed, but WARN at default verbosity. Refusing
+	*    would strand destroys for least-privilege roles that never granted
+	*    `s3:GetBucketLocation`, with no escape hatch. But proceeding SILENTLY
+	*    is what the issue #2245 review rejected: a bucket policy denying
+	*    `s3:GetBucketLocation` -- settable by anyone holding
+	*    `s3:PutBucketPolicy` on the target -- would disable this guard while
+	*    the operator's output stayed identical to a normal destroy. Failing
+	*    closed on 403 alone is not the answer either, because a missing IAM
+	*    grant and a hostile `Deny` are the same wire response.
+	*
+	* A bucket that is ABSENT is a fourth thing and is NOT the warning case: the
+	* name denotes nothing, so there is nothing to delete in the wrong region,
+	* and the `DeleteResource` below reaches its existing `NotFound` /
+	* `assertRegionMatch` handling. Warning there would fire on every ordinary
+	* re-run of an already-completed destroy.
+	*
+	* `GetBucketLocation` and not `HeadBucket`: a cross-region `HeadBucket` 301s
+	* and SDK v3's region-redirect middleware mishandles the empty-body HEAD
+	* response, yielding a synthetic `name: 'Unknown'`. That would land every
+	* foreign-region bucket -- the exact case this exists to catch -- in the
+	* indeterminate arm, which PROCEEDS. `src/utils/aws-region-resolver.ts`
+	* records the same finding, and the SDK-side guard re-learned it the
+	* expensive way.
+	*/
+	async confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context) {
+		if (!requiresCcDeleteIdentityCheck(resourceType)) return;
+		const recordedRegion = context?.expectedRegion?.trim();
+		let expectedRegion = recordedRegion === void 0 || recordedRegion === "" ? void 0 : recordedRegion;
+		if (expectedRegion === void 0) try {
+			const clientRegion = (await this.cloudControlClient.config.region())?.trim();
+			expectedRegion = clientRegion === void 0 || clientRegion === "" ? void 0 : clientRegion;
+		} catch (error) {
+			this.logger.debug(`Could not resolve the Cloud Control client region while confirming ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			expectedRegion = void 0;
+		}
+		if (expectedRegion === void 0) {
+			this.logger.warn(`Could not confirm that ${resourceType} ${physicalId} (${logicalId}) is the resource this destroy targets: neither the stack state nor the AWS client reports a region. Proceeding with the delete.`);
+			return;
+		}
+		const wantRegion = canonicalizeRegion(expectedRegion);
+		let actualRegion;
+		try {
+			actualRegion = bucketLocationToRegion((await getAwsClients().s3.send(new GetBucketLocationCommand({ Bucket: physicalId }))).LocationConstraint);
+		} catch (error) {
+			if (isNoSuchBucketError(error)) {
+				this.logger.debug(`Bucket ${physicalId} (${logicalId}) is already absent; leaving the delete to the Cloud Control idempotency path`);
+				return;
+			}
+			const reason = error instanceof Error ? error.message : String(error);
+			this.logger.warn(`Could not confirm which region S3 bucket ${physicalId} (${logicalId}) lives in before deleting it: ${reason}. S3 bucket names are globally unique, so cdkd cannot rule out that this name denotes a bucket in another region. Grant s3:GetBucketLocation on the bucket to enable the check. Proceeding with the delete.`);
+			return;
+		}
+		if (actualRegion === wantRegion) {
+			this.logger.debug(`Confirmed S3 bucket ${physicalId} (${logicalId}) lives in ${wantRegion} before deleting it`);
+			return;
+		}
+		throw markNonRetryable(new ProvisioningError(`Refusing to delete S3 bucket ${physicalId} for ${logicalId} (${resourceType}): the bucket carrying that name lives in ${actualRegion}, while this destroy targets ${wantRegion}. S3 bucket names are globally unique, so a physical id recorded in cdkd state can denote a bucket in a different region. S3 follows the region redirect for a body-bearing operation, so issuing this delete risks destroying the live bucket in ${actualRegion} instead, unrecoverably, rather than reporting the bucket absent. Confirm the physical id recorded in cdkd state (cdkd state show) and correct the record: --region does not change this comparison, which reads the region stored in the state file, so re-running the destroy with a different flag value will not resolve it.`, resourceType, logicalId, physicalId));
+	}
+	/**
 	* Set a registry-declared deletion-protection property to its "off" value
 	* in-place via a CC UpdateResource patch (issues #1312 / #1314).
 	* Best-effort: failures are logged at warn and swallowed — the subsequent
@@ -31141,4 +31344,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, findLargeInlineResources as $n, scrubResourceRecord as $t, renderStatefulReason as A, formatDockerLoginError as An, StackHasActiveImportsError as Ar, producerRegionsFromState as At, exportAliasCollisionScrubWarning as B, getLegacyStateBucketName as Bn, isThrottlingError as Br, withRetry as Bt, isFinalSnapshotError as C, parseBootstrapMarker as Cn, LockError as Cr, configStringRefusal as Ct, extractDeploymentEventError as D, buildDenyExternalAccessPolicy as Dn, ProvisioningError as Dr, requireConfigObject as Dt, makeCanonicalizePropertiesFn as E, validateContainerRepoName as En, PartialFailureError as Er, requireConfigArray as Et, green as F, AssetManifestLoader as Fn, isCdkdError as Fr, s3BucketWebsiteUrl as Ft, IAMRoleProvider as G, resolveStateBucketWithDefault as Gn, TEMPLATE_SOURCED_RULES as Gt, secretBearingStateKeyWarning as H, resolveAutoAssetStorage as Hn, __exportAll as Hr, TemplateParser as Ht, red as I, getDockerImageBySourceHash as In, normalizeAwsError as Ir, applyRoleArnIfSet as It, ProviderRegistry as J, stateBucketExistenceConfirmed as Jn, errorCauseChain as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveStateBucketWithDefaultAndSource as Kn, createSecretMasker as Kt, yellow as L, Synthesizer as Ln, withErrorHandling as Lr, DiffCalculator as Lt, bold as M, partitionSensitiveEnv as Mn, StateError as Mr, s3BucketDomainName as Mt, cyan as N, runDockerForeground as Nn, SynthesisError as Nr, s3BucketDualStackDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDockerImage as On, ResourceTimeoutError as Or, requireConfigString as Ot, gray as P, runDockerStreaming as Pn, formatError as Pr, s3BucketRegionalDomainName as Pt, maskDeep as Q, MIGRATE_TMP_PREFIX as Qn, redactSecretsForState as Qt, collectDeclaredOutputNames as R, synthesisStatusMessage as Rn, isMarkedNonRetryable as Rr, INTRINSIC_KEYS as Rt, createPreDeleteFinalSnapshot as S, isCrossRegionRedirect as Sn, LocalStartServiceError as Sr, configBooleanRefusal as St, unsupportedFinalSnapshotError as T, validateAssetBucketName as Tn, NestedStackChildDirectDestroyError as Tr, replayWarn as Tt, stateKeySecretExposure as U, resolveCaptureObservedState as Un, STATE_SOURCED_CROSS_GENERATION_RULES as Ut, isExportAliasCollision as V, resolveApp as Vn, markNonRetryable as Vr, DagBuilder as Vt, getCurrentResourceSecrets as W, resolveSkipPrefix as Wn, STATE_SOURCED_READBACK_RULES as Wt, findSilentDropProperties as X, CFN_TEMPLATE_BODY_LIMIT as Xn, maskSecretsInError as Xt, findActionableSilentDrops as Y, warnDeprecatedNoPrefixCliFlag as Yn, isSingleDynamicReferenceToken as Yt, createMaskedRetryLogger as Z, CFN_TEMPLATE_URL_LIMIT as Zn, maskSecretsInText as Zt, computeImplicitDeleteEdges as _, AssetModeResolver as _n, DependencyError as _r, WAFv2WebACLProvider as _t, DeploymentEventsStore as a, importableOutputKeys as an, AssemblyReader as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, ensureAssetStorage as bn, LocalInvokeBuildError as br, assertRegionMatch as bt, replayFailedOperations as c, AssetPublisher as cn, resolveBucketRegion as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, buildAssetRedirectMap as dn, resetAwsClients as dr, IntrinsicFunctionResolver as dt, LockManager as en, uploadCfnTemplate as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, createAssetRedirectResolver as fn, setAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, stripControlChars as gn, CrossAccountSecretRefusalError as gr, refStateLookupFromResource as gt, maskingRetryLogger as h, escapeRegExp$1 as hn, ConfigError as hr, parameterTypeMayLoseSecretIdentity as ht, DeploymentEventsReader as i, exportNamesCarriedFrom as in, derivePartitionAndUrlSuffix as ir, interruptWatchListenerCount as it, formatResourceLine as j, getDockerCmd as jn, StackTerminationProtectionError as jr, s3BucketArn as jt, isStatefulRecreateTargetSync as k, dockerSpawnEnvWithSensitive as kn, ResourceUpdateNotSupportedError as kr, classifyReplaySecretRegion as kt, replayRollback as l, stringifyValue as ln, AwsClients as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, rewriteTemplateAssetReferences as mn, CdkdError as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, S3StateBackend as nn, PARTITION_TABLE as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputs as on, processStackMessages as or, startInterruptWatch as ot, deleteSkipReason as p, loadPublishableAssetManifest as pn, AssetError as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveUseCdkBootstrapAssets as qn, dynamicReferenceTokens as qt, DeployEngine as r, rebuildClientForBucketRegion as rn, canonicalizeRegion as rr, endCommandInterruptScope as rt, planRollback as s, shouldRetainResource as sn, clearBucketRegionCache as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, displaySafe as tn, expectedOwnerParam as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, WorkGraph as un, getAwsClients as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, BOOTSTRAP_MARKER_PREFIX as vn, DeployCancelledError as vr, normalizeAwsTagsToCfn as vt, refusesFinalSnapshot as w, readBootstrapMarkerBody as wn, MissingCdkCliError as wr, readConfigString as wt, ccRoutedFinalSnapshotError as x, getBootstrapMarkerKey as xn, LocalMigrateError as xr, coerceCfnBoolean as xt, PRE_DELETE_SNAPSHOT_TYPES as y, assertAssetBucketRegion as yn, DynamicReferenceRegionAmbiguousError as yr, resolveExplicitPhysicalId as yt, collectPublishedOutputNames as z, getDefaultStateBucketName as zn, isRetryableTransientError as zr, describeTypeWithThrottleRetry as zt };
-//# sourceMappingURL=deploy-engine-Bc0FBOuJ.js.map
+//# sourceMappingURL=deploy-engine-DjcVPGO-.js.map