@go-to-k/cdkd 0.284.73 → 0.284.75

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Cr as LockError, Dr as ProvisioningError, Fr as isCdkdError, G as IAMRoleProvider, Ht as TemplateParser, Ir as normalizeAwsError, J as ProviderRegistry, Ln as Synthesizer, Lt as DiffCalculator, Mr as StateError, Nr as SynthesisError, Pr as formatError, Vt as DagBuilder, _r as DependencyError, ar as AssemblyReader, cn as AssetPublisher, cr as resolveBucketRegion, dr as resetAwsClients, en as LockManager, fr as setAwsClients, hr as ConfigError, lr as AwsClients, mr as CdkdError, nn as S3StateBackend, pr as AssetError, r as DeployEngine, sr as clearBucketRegionCache, st as CloudControlProvider, ur as getAwsClients } from "./deploy-engine-DjcVPGO-.js";
+import { Fr as formatError, G as IAMRoleProvider, Ht as DagBuilder, Ir as isCdkdError, J as ProviderRegistry, Lr as normalizeAwsError, Nr as StateError, Or as ProvisioningError, Pr as SynthesisError, Rn as Synthesizer, Rt as DiffCalculator, Ut as TemplateParser, cr as clearBucketRegionCache, dr as getAwsClients, fr as resetAwsClients, gr as ConfigError, hr as CdkdError, ln as AssetPublisher, lr as resolveBucketRegion, mr as AssetError, or as AssemblyReader, pr as setAwsClients, r as DeployEngine, rn as S3StateBackend, st as CloudControlProvider, tn as LockManager, ur as AwsClients, vr as DependencyError, wr as LockError } from "./deploy-engine-B6xURS3W.js";
 import { i as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-C9-E73FI.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-BlS4t1DG.js → program-DQwxvn6O.js}

@@ -1,7 +1,7 @@
-import { $ as maskerOrIdentity, $n as findLargeInlineResources, $t as scrubResourceRecord, A as renderStatefulReason, An as formatDockerLoginError, Ar as StackHasActiveImportsError, At as producerRegionsFromState, B as exportAliasCollisionScrubWarning, Bn as getLegacyStateBucketName, Br as isThrottlingError, Bt as withRetry, C as isFinalSnapshotError, Cn as parseBootstrapMarker, Ct as configStringRefusal, D as extractDeploymentEventError, Dn as buildDenyExternalAccessPolicy, Dr as ProvisioningError, Dt as requireConfigObject, E as makeCanonicalizePropertiesFn, En as validateContainerRepoName, Er as PartialFailureError, Et as requireConfigArray, F as green, Fn as AssetManifestLoader, Ft as s3BucketWebsiteUrl, G as IAMRoleProvider, Gn as resolveStateBucketWithDefault, Gt as TEMPLATE_SOURCED_RULES, H as secretBearingStateKeyWarning, Hn as resolveAutoAssetStorage, Ht as TemplateParser, I as red, In as getDockerImageBySourceHash, Ir as normalizeAwsError, It as applyRoleArnIfSet, J as ProviderRegistry, Jn as stateBucketExistenceConfirmed, Jt as errorCauseChain, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveStateBucketWithDefaultAndSource, Kt as createSecretMasker, L as yellow, Ln as Synthesizer, Lr as withErrorHandling, Lt as DiffCalculator, M as bold, Mn as partitionSensitiveEnv, Mt as s3BucketDomainName, N as cyan, Nn as runDockerForeground, Nt as s3BucketDualStackDomainName, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDockerImage, Or as ResourceTimeoutError, Ot as requireConfigString, P as gray, Pn as runDockerStreaming, Pt as s3BucketRegionalDomainName, Q as maskDeep, Qn as MIGRATE_TMP_PREFIX, Qt as redactSecretsForState, R as collectDeclaredOutputNames, Rn as synthesisStatusMessage, Rr as isMarkedNonRetryable, Rt as INTRINSIC_KEYS, S as createPreDeleteFinalSnapshot, Sn as isCrossRegionRedirect, Sr as LocalStartServiceError, St as configBooleanRefusal, T as unsupportedFinalSnapshotError, Tn as validateAssetBucketName, Tr as NestedStackChildDirectDestroyError, Tt as replayWarn, U as stateKeySecretExposure, Un as resolveCaptureObservedState, Ut as STATE_SOURCED_CROSS_GENERATION_RULES, V as isExportAliasCollision, Vn as resolveApp, Vr as markNonRetryable, Vt as DagBuilder, W as getCurrentResourceSecrets, Wn as resolveSkipPrefix, Wt as STATE_SOURCED_READBACK_RULES, X as findSilentDropProperties, Xn as CFN_TEMPLATE_BODY_LIMIT, Xt as maskSecretsInError, Y as findActionableSilentDrops, Yn as warnDeprecatedNoPrefixCliFlag, Yt as isSingleDynamicReferenceToken, Z as createMaskedRetryLogger, Zn as CFN_TEMPLATE_URL_LIMIT, Zt as maskSecretsInText, _ as computeImplicitDeleteEdges, _n as AssetModeResolver, _t as WAFv2WebACLProvider, a as DeploymentEventsStore, an as importableOutputKeys, ar as AssemblyReader, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as ensureAssetStorage, br as LocalInvokeBuildError$1, bt as assertRegionMatch, c as replayFailedOperations, cn as AssetPublisher, cr as resolveBucketRegion, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as buildAssetRedirectMap, dr as resetAwsClients, dt as IntrinsicFunctionResolver, en as LockManager, er as uploadCfnTemplate, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as createAssetRedirectResolver, fr as setAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as stripControlChars, gr as CrossAccountSecretRefusalError, gt as refStateLookupFromResource, h as maskingRetryLogger, hn as escapeRegExp, ht as parameterTypeMayLoseSecretIdentity, i as DeploymentEventsReader, in as exportNamesCarriedFrom, ir as derivePartitionAndUrlSuffix, it as interruptWatchListenerCount, j as formatResourceLine, jn as getDockerCmd, jr as StackTerminationProtectionError, jt as s3BucketArn, k as isStatefulRecreateTargetSync, kn as dockerSpawnEnvWithSensitive, kr as ResourceUpdateNotSupportedError, kt as classifyReplaySecretRegion, l as replayRollback, ln as stringifyValue, lr as AwsClients, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as rewriteTemplateAssetReferences, mr as CdkdError, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as S3StateBackend, nr as PARTITION_TABLE, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputs, or as processStackMessages, ot as startInterruptWatch, p as deleteSkipReason, pn as loadPublishableAssetManifest, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveUseCdkBootstrapAssets, qt as dynamicReferenceTokens, r as DeployEngine, rn as rebuildClientForBucketRegion, rr as canonicalizeRegion, rt as endCommandInterruptScope, s as planRollback, sn as shouldRetainResource, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as displaySafe, tr as expectedOwnerParam, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as WorkGraph, ur as getAwsClients, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as BOOTSTRAP_MARKER_PREFIX, vr as DeployCancelledError, vt as normalizeAwsTagsToCfn, w as refusesFinalSnapshot, wn as readBootstrapMarkerBody, wr as MissingCdkCliError, wt as readConfigString, x as ccRoutedFinalSnapshotError, xn as getBootstrapMarkerKey, xr as LocalMigrateError, xt as coerceCfnBoolean, y as PRE_DELETE_SNAPSHOT_TYPES, yn as assertAssetBucketRegion, yr as DynamicReferenceRegionAmbiguousError, yt as resolveExplicitPhysicalId, z as collectPublishedOutputNames, zn as getDefaultStateBucketName, zr as isRetryableTransientError, zt as describeTypeWithThrottleRetry } from "./deploy-engine-DjcVPGO-.js";
+import { $ as maskerOrIdentity, $n as MIGRATE_TMP_PREFIX, $t as redactSecretsForState, A as renderStatefulReason, An as dockerSpawnEnvWithSensitive, Ar as ResourceUpdateNotSupportedError, At as classifyReplaySecretRegion, B as exportAliasCollisionScrubWarning, Bn as getDefaultStateBucketName, Br as isRetryableTransientError, Bt as describeTypeWithThrottleRetry, C as isFinalSnapshotError, Cn as isCrossRegionRedirect, Cr as LocalStartServiceError, Ct as configBooleanRefusal, D as extractDeploymentEventError, Dn as validateContainerRepoName, Dr as PartialFailureError, Dt as requireConfigArray, E as makeCanonicalizePropertiesFn, En as validateAssetBucketName, Er as NestedStackChildDirectDestroyError, Et as replayWarn, F as green, Fn as runDockerStreaming, Ft as s3BucketRegionalDomainName, G as IAMRoleProvider, Gn as resolveSkipPrefix, Gt as STATE_SOURCED_READBACK_RULES, H as secretBearingStateKeyWarning, Hn as resolveApp, Hr as markNonRetryable, Ht as DagBuilder, I as red, In as AssetManifestLoader, It as s3BucketWebsiteUrl, J as ProviderRegistry, Jn as resolveUseCdkBootstrapAssets, Jt as dynamicReferenceTokens, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveStateBucketWithDefault, Kt as TEMPLATE_SOURCED_RULES, L as yellow, Ln as getDockerImageBySourceHash, Lr as normalizeAwsError, Lt as applyRoleArnIfSet, M as bold, Mn as getDockerCmd, Mr as StackTerminationProtectionError, Mt as s3BucketArn, N as cyan, Nn as partitionSensitiveEnv, Nt as s3BucketDomainName, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDenyExternalAccessPolicy, Or as ProvisioningError, Ot as requireConfigObject, P as gray, Pn as runDockerForeground, Pt as s3BucketDualStackDomainName, Q as maskDeep, Qn as CFN_TEMPLATE_URL_LIMIT, Qt as maskSecretsInText, R as collectDeclaredOutputNames, Rn as Synthesizer, Rr as withErrorHandling, Rt as DiffCalculator, S as createPreDeleteFinalSnapshot, Sn as getBootstrapMarkerKey, Sr as LocalMigrateError, St as coerceCfnBoolean, T as unsupportedFinalSnapshotError, Tn as readBootstrapMarkerBody, Tr as MissingCdkCliError, Tt as readConfigString, U as stateKeySecretExposure, Un as resolveAutoAssetStorage, Ut as TemplateParser, V as isExportAliasCollision, Vn as getLegacyStateBucketName, Vr as isThrottlingError, Vt as withRetry, W as getCurrentResourceSecrets, Wn as resolveCaptureObservedState, Wt as STATE_SOURCED_CROSS_GENERATION_RULES, X as findSilentDropProperties, Xn as warnDeprecatedNoPrefixCliFlag, Xt as isSingleDynamicReferenceToken, Y as findActionableSilentDrops, Yn as stateBucketExistenceConfirmed, Yt as errorCauseChain, Z as createMaskedRetryLogger, Zn as CFN_TEMPLATE_BODY_LIMIT, Zt as maskSecretsInError, _ as computeImplicitDeleteEdges, _n as stripControlChars, _r as CrossAccountSecretRefusalError, _t as refStateLookupFromResource, a as DeploymentEventsStore, an as exportNamesCarriedFrom, ar as derivePartitionAndUrlSuffix, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as assertAssetBucketRegion, br as DynamicReferenceRegionAmbiguousError, bt as resolveExplicitPhysicalId, c as replayFailedOperations, cn as shouldRetainResource, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as WorkGraph, dr as getAwsClients, dt as IntrinsicFunctionResolver, en as scrubResourceRecord, er as findLargeInlineResources, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as buildAssetRedirectMap, fr as resetAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as escapeRegExp, gt as parameterTypeMayLoseSecretIdentity, h as maskingRetryLogger, hn as rewriteTemplateAssetReferences, hr as CdkdError, ht as isUnboundTemplateParameter, i as DeploymentEventsReader, in as rebuildClientForBucketRegion, ir as canonicalizeRegion, it as interruptWatchListenerCount, j as formatResourceLine, jn as formatDockerLoginError, jr as StackHasActiveImportsError, jt as producerRegionsFromState, k as isStatefulRecreateTargetSync, kn as buildDockerImage, kr as ResourceTimeoutError, kt as requireConfigString, l as replayRollback, ln as AssetPublisher, lr as resolveBucketRegion, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as loadPublishableAssetManifest, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as displaySafe, nr as expectedOwnerParam, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputKeys, or as AssemblyReader, ot as startInterruptWatch, p as deleteSkipReason, pn as createAssetRedirectResolver, pr as setAwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveStateBucketWithDefaultAndSource, qt as createSecretMasker, r as DeployEngine, rn as S3StateBackend, rr as PARTITION_TABLE, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputs, sr as processStackMessages, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as LockManager, tr as uploadCfnTemplate, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as stringifyValue, ur as AwsClients, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as AssetModeResolver, vt as WAFv2WebACLProvider, w as refusesFinalSnapshot, wn as parseBootstrapMarker, wt as configStringRefusal, x as ccRoutedFinalSnapshotError, xn as ensureAssetStorage, xr as LocalInvokeBuildError$1, xt as assertRegionMatch, y as PRE_DELETE_SNAPSHOT_TYPES, yn as BOOTSTRAP_MARKER_PREFIX, yr as DeployCancelledError, yt as normalizeAwsTagsToCfn, z as collectPublishedOutputNames, zn as synthesisStatusMessage, zr as isMarkedNonRetryable, zt as INTRINSIC_KEYS } from "./deploy-engine-B6xURS3W.js";
 import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-NRgaYAmx.js";
-import { t as ASGProvider } from "./asg-provider-xXB0aei5.js";
+import { t as getCdkdVersion } from "./version-B8O0NnWg.js";
+import { t as ASGProvider } from "./asg-provider-DdsyGm69.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -78187,6 +78187,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 	} catch (err) {
 		logger.debug(`Template condition evaluation failed during import-time property resolution: ${err instanceof Error ? err.message : String(err)} — continuing without conditions.`);
 	}
+	const unboundParameterNames = Object.keys(template.Parameters ?? {}).filter((name) => isUnboundTemplateParameter(name, template, parameters));
 	const baseContext = {
 		template,
 		resources: stackState.resources,
@@ -78204,7 +78205,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		});
 		resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
 	} catch (err) {
-		logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${err instanceof Error ? err.message : String(err)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.`);
+		logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${err instanceof Error ? err.message : String(err)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
 	}
 }
 function printSummary(rows) {
@@ -79432,12 +79433,12 @@ function resolveLambdaLayers(stack, logicalId, props) {
 	for (let i = 0; i < layers.length; i++) {
 		const entry = layers[i];
 		if (typeof entry === "string") {
-			const parsed = parseLayerVersionArn(entry);
-			if (!parsed) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has a Layers entry [${i}] cdkd cannot resolve locally: literal string '${entry}'. Expected a same-stack Ref / Fn::GetAtt to an AWS::Lambda::LayerVersion OR a literal layer-version ARN of the form arn:aws:lambda:<region>:<account>:layer:<name>:<version>.`);
+			const parsed = classifyLayerVersionArn(entry);
+			if (!parsed.ok) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has a Layers entry [${i}] cdkd cannot resolve locally: literal string '${entry}'. Expected a same-stack Ref / Fn::GetAtt to an AWS::Lambda::LayerVersion OR a literal layer-version ARN of the form arn:aws:lambda:<region>:<account>:layer:<name>:<version>.` + describeLayerArnRejection(parsed.rejection));
 			out.push({
 				kind: "arn",
-				logicalId: parsed.arn,
-				...parsed
+				logicalId: parsed.value.arn,
+				...parsed.value
 			});
 			continue;
 		}
@@ -79456,29 +79457,151 @@ function resolveLambdaLayers(stack, logicalId, props) {
 	return out;
 }
 /**
-* Parse a Lambda layer-version ARN string into its segments.
+* `arn:<partition>:lambda:<region>:<account>:layer:<name>:<version>`.
 *
-* Returns `undefined` for anything that does not match the strict
-* `arn:aws:lambda:<region>:<account>:layer:<name>:<version>` shape so
-* the caller can produce a clearer error than a silent
-* misinterpretation of hand-edited templates. The partition segment
-* accepts `aws` / `aws-cn` / `aws-us-gov` so GovCloud / China-region
-* ARNs work without code changes.
-*
-* Exported for unit testing.
+* The PARTITION group is deliberately loose. It is not validated by the
+* pattern at all — {@link classifyLayerVersionArn} checks it against the one
+* the REGION derives, which is a stronger check than any alternation.
 */
-function parseLayerVersionArn(input) {
-	const m = /^arn:(aws|aws-cn|aws-us-gov):lambda:([a-z]{2}-(?:[a-z]+-){1,2}\d+):(\d{12}):layer:([A-Za-z0-9_-]+):(\d+)$/.exec(input);
-	if (!m) return void 0;
+const LAYER_ARN_PATTERN = new RegExp(`^arn:([a-z][a-z0-9-]*):lambda:([a-z]{2,}(?:-[a-z]+)+-\\d+):(\\d{12}):layer:([A-Za-z0-9_-]+):(\\d+)$`);
+/**
+* Classify a Lambda layer-version ARN: its segments, or why it was refused.
+*
+* The single decision point behind both the resolved layer's fields and the
+* caller's error message, so the message cannot describe a different verdict
+* than the parse reached. An earlier revision had the message re-run the
+* pattern in a separate helper, which left an arm — "the partitions agree" —
+* that the sole call site could never reach, because it only asked after the
+* parse had already refused. One classifier with one return value removes the
+* arm rather than justifying it, and runs the regex once.
+*
+* **The partition is DERIVED from the region, not enumerated** (issue #2143).
+* The pre-#2143 spelling hard-listed `aws` / `aws-cn` / `aws-us-gov` and so
+* failed to parse a layer ARN in any of the other five partitions
+* (`aws-iso`, `aws-iso-b`, `aws-iso-e`, `aws-iso-f`, `aws-eusc`) — and the
+* caller HARD-THROWS on an unparsed ARN, so `cdkd local invoke` on a function
+* with a literal-ARN layer failed at RESOLUTION in each of them. Running the
+* region through `derivePartitionAndUrlSuffix` (`src/utils/aws-partition.ts`)
+* is what the repo already does everywhere else it needs a partition, so the
+* list is not spelled a fourth time and cannot go stale here independently.
+*
+* **This fixes the PARSE only, and the download behind it is still commercial-
+* only.** `materializeLayerFromArn` (`src/local/layer-arn-materializer.ts`) is
+* a one-line shim over cdk-local, whose implementation rebuilds the ARN with a
+* hardcoded `aws`:
+*
+* ```js
+* // node_modules/cdk-local/dist/local-studio-BBtUAVNy.js:15214
+* const command = await buildGetLayerVersionCommand(
+*   `arn:aws:lambda:${layer.region}:${layer.accountId}:layer:${layer.name}`, Number(layer.version));
+* ```
+*
+* So a layer in ANY of the seven non-commercial partitions still fails at
+* `lambda:GetLayerVersion`. That includes `aws-cn` and `aws-us-gov`, which the
+* old alternation ALREADY parsed and which therefore gain nothing here. What
+* this change moves is confined to the five that previously did not parse
+* (`aws-iso`, `aws-iso-b`, `aws-iso-e`, `aws-iso-f`, `aws-eusc`): for them the
+* failure shifts from "cdkd cannot resolve locally" to an AWS-side error, so
+* the parse stops being the blocker and the message names the true one. That
+* is a real improvement and it is NOT end-to-end support; nothing in this repo
+* can make it so, and the remaining half is filed as go-to-k/cdk-local#575.
+*
+* Deriving also makes the pair SELF-CONSISTENT, which the alternation could
+* not: `arn:aws-cn:lambda:us-east-1:...` used to parse, pairing China's
+* partition with a commercial region. It is now REFUSED — a deliberate
+* behaviour break, asked for by issue #2143's own direction. Nothing is lost
+* by refusing early, since the commercial-ARN rebuild above means such a layer
+* could never have been fetched from the partition its ARN named.
+*
+* The fallback direction is worth stating, since `derivePartitionAndUrlSuffix`
+* answers `aws` for a region it does not recognise. A brand-new COMMERCIAL
+* region therefore still parses with `arn:aws:` — the direction that must keep
+* working before the table hears about it — while a brand-new region in a
+* future partition is rejected rather than mis-attributed to commercial, which
+* is the same trade every other consumer of that table makes.
+*
+* Deliberately NOT `isClientSafeRegion` (`intrinsic-function-resolver.ts`):
+* that predicate is charset-based because its job is to keep a value inside a
+* hostname label, so it accepts anything lower-case alphanumeric — including
+* strings no region grammar would admit. See the note it carries.
+*
+* THIS is the exported symbol, and a `parseLayerVersionArn` wrapper returning
+* `T | undefined` is deliberately not kept beside it. Once the caller moved to
+* the classifier, that wrapper had no `src/` reference left and existed only
+* for the tests — which `scripts/check-local-reachability.ts` reports as an
+* orphaned export, correctly. That critic's opt-out tag would have been a
+* false statement here — it means "cdk-local owns the live implementation",
+* and cdkd owns this one — so the wrapper is gone rather than tagged. Tests
+* drive this classifier or the real caller instead. (The tag is deliberately
+* not spelled out in this comment: the critic reads tags from JSDoc, so
+* naming it here registers an annotation on a LIVE symbol and is reported as
+* stale. Measured.)
+*/
+function classifyLayerVersionArn(input) {
+	const m = LAYER_ARN_PATTERN.exec(input);
+	if (!m) return {
+		ok: false,
+		rejection: { kind: "shape" }
+	};
+	const partition = m[1];
+	const region = m[2];
+	const derived = derivePartitionAndUrlSuffix(region).partition;
+	if (derived !== partition) return {
+		ok: false,
+		rejection: {
+			kind: "partition",
+			partition,
+			region,
+			derived,
+			derivedFromTable: derived !== "aws"
+		}
+	};
 	return {
-		arn: input,
-		region: m[2],
-		accountId: m[3],
-		name: m[4],
-		version: m[5]
+		ok: true,
+		value: {
+			arn: input,
+			region,
+			accountId: m[3],
+			name: m[4],
+			version: m[5]
+		}
 	};
 }
 /**
+* The one sentence a reader cannot derive from the ARN in front of them.
+*
+* A `'shape'` rejection gets nothing appended, so the message is
+* byte-identical to what it has always been for every pre-#2143 refusal. A
+* `'partition'` rejection is the class this change newly refuses AND the one
+* that looks perfectly well formed, so it says what disagrees.
+*
+* The two `'partition'` arms differ in what cdkd actually KNOWS. On a
+* `PARTITION_TABLE` hit the derived partition is a fact and is stated as one.
+* On a miss it is a FALLBACK, so the sentence states the RESOLUTION instead of
+* asserting membership: `us-east-1` and a hypothetical `us-isog-east-1` both
+* derive `aws`, but only the first is really commercial, and a message that
+* cannot tell them apart teaches the reader something false about the second.
+*
+* **The miss arm is the COMMERCIAL arm, and that is not obvious from its
+* name.** `PARTITION_TABLE` (`src/utils/aws-partition.ts`) holds seven rows
+* and none of them is `aws` — the commercial partition is the fallback
+* `return` at the bottom of `derivePartitionAndUrlSuffix`, not a row. So
+* `derivedFromTable` is FALSE for every genuinely commercial region, the fact
+* arm can never render `derived === 'aws'`, and the miss arm always does. Its
+* wording therefore has to read correctly for `us-east-1` — the commonest
+* region there is, and the one the docs, the integ fixture and the changelog
+* all use as the canonical example. An earlier revision said "no partition
+* prefix **cdkd knows** matches that region", which is true of the mechanism
+* and reads as cdkd failing to recognise `us-east-1`; it now leads with the
+* prefix test and ends on the resolution, which is the fact the reader needs.
+*/
+function describeLayerArnRejection(rejection) {
+	if (rejection.kind === "shape") return "";
+	const { partition, region, derived, derivedFromTable } = rejection;
+	const head = ` The partition '${partition}' does not match region '${region}'`;
+	return derivedFromTable ? `${head}, which is in partition '${derived}'.` : `${head}: no partition prefix matches that region, so cdkd resolves it to the commercial partition '${derived}'.`;
+}
+/**
 * Walk a single Layers-array entry and return the referenced layer's
 * logical ID — or `undefined` for shapes we don't try to resolve in v1.
 *
@@ -88423,4 +88546,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BlS4t1DG.js.map
+//# sourceMappingURL=program-DQwxvn6O.js.map