@go-to-k/cdkd 0.284.85 → 0.285.0

package/dist/aws-client-defaults-D-iYiIJ6.js

@@ -0,0 +1,218 @@
+import { defaultProvider } from "@aws-sdk/credential-provider-node";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+import { Agent } from "node:http";
+import { Agent as Agent$1 } from "node:https";
+import { Agent as Agent$2 } from "agent-base";
+import { HttpProxyAgent } from "http-proxy-agent";
+import { HttpsProxyAgent } from "https-proxy-agent";
+import { getProxyForUrl } from "proxy-from-env";
+
+//#region src/utils/proxy-routing-agent.ts
+/**
+* An `http.Agent` that routes each request through the environment's proxy, or
+* direct, according to `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`.
+*
+* WHY A ROUTING AGENT AND NOT A PLAIN PROXY AGENT
+*
+* `NodeHttpHandler` picks its agent by PROTOCOL alone — `httpsAgent` for an
+* `https:` request, `httpAgent` otherwise — and never consults the request's
+* host. `https-proxy-agent` does not read `NO_PROXY` either. So a statically
+* chosen proxy agent cannot express "this host is exempt", which is the whole
+* of what `NO_PROXY` means. Deciding per REQUEST is the only place the host is
+* known, and `agent-base` gives us that hook: when `connect()` returns an
+* `http.Agent` rather than a socket, the base class delegates the request to it
+* via `socket.addRequest(req, connectOpts)`.
+*
+* That delegation is also why the INNER agents carry `keepAlive` rather than
+* this one: the sockets pool on whichever agent `connect()` hands back, so a
+* `keepAlive` set only here would never be consulted.
+*
+* WHY THE INNER CACHE IS PER INSTANCE
+*
+* Node's `Agent.prototype.destroy()` walks `[this.freeSockets, this.sockets]`,
+* and the second is the ACTIVE set — it aborts in-flight requests, not just
+* idle sockets. `NodeHttpHandler.destroy()` forwards to `httpAgent` and
+* `httpsAgent` unconditionally, external instances included, and cdkd destroys
+* clients mid-run (`deploy` drops the STS client right after
+* `GetCallerIdentity`). A module-global inner cache would therefore let one
+* client's teardown kill another client's live request. Each `AwsClients`
+* client gets its own routing agent, so the cache is scoped to `this` and
+* {@link destroy} forwards to the inner agents — without that forwarding the
+* tunneled sockets would outlive the client and keep the process alive.
+*
+* The cost of not sharing is duplicate CONNECT + TLS handshakes where two
+* clients talk to the same host. Pooling is per host either way, so sharing
+* could never remove the FIRST handshake to each distinct AWS endpoint, and
+* most runtime traffic goes through the per-service `AwsClients` singleton, so
+* the duplicates are few. This is also what the SDK already does: it builds a
+* `keepAlive` agent per client on the unproxied path.
+*/
+/**
+* Applied to every inner agent.
+*
+* The SDK sets these itself, but ONLY when it is handed a plain option bag —
+* an external `Agent` instance is passed through untouched
+* (`@smithy/node-http-handler`'s `NodeHttpHandler` constructor). Since a
+* routing agent IS such an instance, omitting them would silently drop
+* connection reuse for every proxied run, and a concurrent deploy would
+* renegotiate TLS per request.
+*/
+const INNER_AGENT_OPTIONS = {
+	keepAlive: true,
+	maxSockets: 50
+};
+/**
+* Build the absolute URL `getProxyForUrl` needs from what `connect()` is given.
+*
+* An IPv6 literal is bracketed, or the `host:port` join produces a string no
+* URL parser accepts (`https://::1:443`) and `NO_PROXY` could never match an
+* IPv6 entry. Unreachable with AWS hostnames; handled because the alternative
+* is a silent wrong answer rather than an error.
+*/
+function requestUrl(options) {
+	const secure = options.secureEndpoint;
+	const rawHost = options.host ?? "localhost";
+	const host = rawHost.includes(":") && !rawHost.startsWith("[") ? `[${rawHost}]` : rawHost;
+	const port = options.port ?? (secure ? 443 : 80);
+	return `${secure ? "https" : "http"}://${host}:${port}`;
+}
+var ProxyRoutingAgent = class extends Agent$2 {
+	/**
+	* Inner agents by `<scheme>|<proxy url or "direct">`.
+	*
+	* Keyed on the proxy URL and not merely on "proxied or not" because
+	* `NO_PROXY` is not the only thing that varies per host: `HTTP_PROXY` and
+	* `HTTPS_PROXY` may name different proxies, and a single agent bound to one
+	* of them would quietly send the other scheme's traffic to the wrong place.
+	*/
+	innerAgents = /* @__PURE__ */ new Map();
+	connect(_req, options) {
+		const secure = options.secureEndpoint;
+		const proxyUrl = getProxyForUrl(requestUrl(options));
+		const key = `${secure ? "https" : "http"}|${proxyUrl || "direct"}`;
+		const cached = this.innerAgents.get(key);
+		if (cached) return cached;
+		const agent = createInnerAgent(secure, proxyUrl);
+		this.innerAgents.set(key, agent);
+		return agent;
+	}
+	destroy() {
+		for (const agent of this.innerAgents.values()) agent.destroy();
+		this.innerAgents.clear();
+		super.destroy();
+	}
+};
+function createInnerAgent(secure, proxyUrl) {
+	if (!proxyUrl) return secure ? new Agent$1(INNER_AGENT_OPTIONS) : new Agent(INNER_AGENT_OPTIONS);
+	return secure ? new HttpsProxyAgent(proxyUrl, INNER_AGENT_OPTIONS) : new HttpProxyAgent(proxyUrl, INNER_AGENT_OPTIONS);
+}
+
+//#endregion
+//#region src/utils/aws-client-defaults.ts
+/**
+* Client config every AWS SDK client in cdkd must be built with.
+*
+* WHY THIS EXISTS
+*
+* The AWS SDK for JavaScript v3 does NOT read `HTTPS_PROXY` / `HTTP_PROXY` the
+* way botocore (the AWS CLI) and Go's `net/http` do. Its own guide says a proxy
+* is supplied "through a third-party HTTP agent" by whoever constructs the
+* client — so on a machine whose only egress is a corporate proxy, an SDK call
+* dials out directly and fails, typically as
+* `CredentialsProviderError: self-signed certificate in certificate chain`
+* because the direct route is what the network intercepts (issue #2388).
+*
+* Node 24's `NODE_USE_ENV_PROXY=1` is not a way out: it rewires the GLOBAL
+* agent, and every SDK client builds its own.
+*
+* WHY THE CREDENTIAL CHAIN IS INJECTED TOO
+*
+* A client's `requestHandler` does not reach every credential hop:
+*
+* - STS (`role_arn` profiles, web identity) reads `requestHandler` off
+*   `parentClientConfig`, so it INHERITS ours. Nothing to do.
+* - `@aws-sdk/credential-provider-sso` builds its portal client from
+*   `clientConfig` alone, coalescing only `logger`, `region` and
+*   `userAgentAppId` from the caller. `@aws-sdk/token-providers` does the same
+*   for the SSO-OIDC refresh. So an SSO profile fails at
+*   `resolveSSOCredentials` — BEFORE any service call — unless the chain is
+*   constructed here with the handler threaded through `clientConfig`.
+* - IMDS (`@smithy/credential-provider-imds`) and ECS container credentials
+*   (`@aws-sdk/credential-provider-http`) call `node:http` / build their own
+*   handler, so they bypass a proxy on their own and need no special casing.
+*
+* The chain is therefore built per call. `defaultProvider` MEMOIZES resolved
+* credentials inside the chain instance, so one shared instance would hand a
+* client configured for profile A the credentials of profile B. Per call costs
+* nothing relative to today, since each client already builds its own chain.
+*
+* `clientConfig` carries `requestHandler` and NOTHING else — a `region` there
+* would override the SSO portal's own region — and `profile` is passed
+* ALONGSIDE it, because the built-in chain sees a profile through the client
+* config while an injected chain does not.
+*
+* SPREAD THIS FIRST, SITE-SPECIFIC CONFIG SECOND
+*
+* `new S3Client({ ...awsClientDefaults({ profile }), region, ...(creds && { credentials: creds }) })`
+*
+* A site that supplies its own `credentials` must keep them — `config-loader`'s
+* default-bucket probe reuses the STS client's resolved provider on purpose, so
+* that the bucket it probes is checked as the identity the name was derived
+* from. That provider already carries the handler, because the STS client it
+* came from was built through this helper.
+*/
+/**
+* The proxy variables, in the order `proxy-from-env` itself reads them.
+*
+* Only their PRESENCE is decided here. Which one applies to a given request —
+* and whether `NO_PROXY` exempts it — is `getProxyForUrl`'s job, per request,
+* inside {@link ProxyRoutingAgent}. Deciding it here instead would collapse
+* `HTTP_PROXY` and `HTTPS_PROXY` into one answer and send `http://` traffic to
+* an HTTPS proxy.
+*/
+const PROXY_ENV_VARS = [
+	"HTTPS_PROXY",
+	"https_proxy",
+	"HTTP_PROXY",
+	"http_proxy",
+	"ALL_PROXY",
+	"all_proxy"
+];
+let proxyConfigured;
+function isProxyConfigured() {
+	if (proxyConfigured === void 0) {
+		let configured = false;
+		for (const name of PROXY_ENV_VARS) {
+			const value = process.env[name];
+			if (value === void 0 || value === "") continue;
+			if (value.trim() === "") throw new Error(`${name} is set to whitespace only. Set it to a proxy URL (e.g. http://proxy.example:8080) or unset it.`);
+			configured = true;
+		}
+		proxyConfigured = configured;
+	}
+	return proxyConfigured;
+}
+/**
+* Returns `{}` when no proxy is configured, which keeps the unproxied path
+* byte-identical to what the SDK builds on its own and makes this a no-op for
+* every existing user.
+*/
+function awsClientDefaults(options = {}) {
+	if (!isProxyConfigured()) return {};
+	const agent = new ProxyRoutingAgent();
+	const requestHandler = new NodeHttpHandler({
+		httpAgent: agent,
+		httpsAgent: agent
+	});
+	return {
+		requestHandler,
+		credentials: defaultProvider({
+			...options.profile !== void 0 && options.profile !== "" && { profile: options.profile },
+			clientConfig: { requestHandler }
+		})
+	};
+}
+
+//#endregion
+export { awsClientDefaults as t };
+//# sourceMappingURL=aws-client-defaults-D-iYiIJ6.js.map

package/dist/aws-client-defaults-D-iYiIJ6.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-client-defaults-D-iYiIJ6.js","names":["Agent","HttpsAgent","HttpAgent"],"sources":["../src/utils/proxy-routing-agent.ts","../src/utils/aws-client-defaults.ts"],"sourcesContent":["/**\n * An `http.Agent` that routes each request through the environment's proxy, or\n * direct, according to `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`.\n *\n * WHY A ROUTING AGENT AND NOT A PLAIN PROXY AGENT\n *\n * `NodeHttpHandler` picks its agent by PROTOCOL alone — `httpsAgent` for an\n * `https:` request, `httpAgent` otherwise — and never consults the request's\n * host. `https-proxy-agent` does not read `NO_PROXY` either. So a statically\n * chosen proxy agent cannot express \"this host is exempt\", which is the whole\n * of what `NO_PROXY` means. Deciding per REQUEST is the only place the host is\n * known, and `agent-base` gives us that hook: when `connect()` returns an\n * `http.Agent` rather than a socket, the base class delegates the request to it\n * via `socket.addRequest(req, connectOpts)`.\n *\n * That delegation is also why the INNER agents carry `keepAlive` rather than\n * this one: the sockets pool on whichever agent `connect()` hands back, so a\n * `keepAlive` set only here would never be consulted.\n *\n * WHY THE INNER CACHE IS PER INSTANCE\n *\n * Node's `Agent.prototype.destroy()` walks `[this.freeSockets, this.sockets]`,\n * and the second is the ACTIVE set — it aborts in-flight requests, not just\n * idle sockets. `NodeHttpHandler.destroy()` forwards to `httpAgent` and\n * `httpsAgent` unconditionally, external instances included, and cdkd destroys\n * clients mid-run (`deploy` drops the STS client right after\n * `GetCallerIdentity`). A module-global inner cache would therefore let one\n * client's teardown kill another client's live request. Each `AwsClients`\n * client gets its own routing agent, so the cache is scoped to `this` and\n * {@link destroy} forwards to the inner agents — without that forwarding the\n * tunneled sockets would outlive the client and keep the process alive.\n *\n * The cost of not sharing is duplicate CONNECT + TLS handshakes where two\n * clients talk to the same host. Pooling is per host either way, so sharing\n * could never remove the FIRST handshake to each distinct AWS endpoint, and\n * most runtime traffic goes through the per-service `AwsClients` singleton, so\n * the duplicates are few. This is also what the SDK already does: it builds a\n * `keepAlive` agent per client on the unproxied path.\n */\n\nimport { Agent as HttpAgent } from 'node:http';\nimport type { ClientRequest } from 'node:http';\nimport { Agent as HttpsAgent } from 'node:https';\nimport { Agent, type AgentConnectOpts } from 'agent-base';\nimport { HttpProxyAgent } from 'http-proxy-agent';\nimport { HttpsProxyAgent } from 'https-proxy-agent';\nimport { getProxyForUrl } from 'proxy-from-env';\n\n/**\n * Applied to every inner agent.\n *\n * The SDK sets these itself, but ONLY when it is handed a plain option bag —\n * an external `Agent` instance is passed through untouched\n * (`@smithy/node-http-handler`'s `NodeHttpHandler` constructor). Since a\n * routing agent IS such an instance, omitting them would silently drop\n * connection reuse for every proxied run, and a concurrent deploy would\n * renegotiate TLS per request.\n */\nconst INNER_AGENT_OPTIONS = { keepAlive: true, maxSockets: 50 } as const;\n\n/**\n * Build the absolute URL `getProxyForUrl` needs from what `connect()` is given.\n *\n * An IPv6 literal is bracketed, or the `host:port` join produces a string no\n * URL parser accepts (`https://::1:443`) and `NO_PROXY` could never match an\n * IPv6 entry. Unreachable with AWS hostnames; handled because the alternative\n * is a silent wrong answer rather than an error.\n */\nfunction requestUrl(options: AgentConnectOpts): string {\n  const secure = options.secureEndpoint;\n  const rawHost = options.host ?? 'localhost';\n  const host = rawHost.includes(':') && !rawHost.startsWith('[') ? `[${rawHost}]` : rawHost;\n  const port = options.port ?? (secure ? 443 : 80);\n  return `${secure ? 'https' : 'http'}://${host}:${port}`;\n}\n\nexport class ProxyRoutingAgent extends Agent {\n  /**\n   * Inner agents by `<scheme>|<proxy url or \"direct\">`.\n   *\n   * Keyed on the proxy URL and not merely on \"proxied or not\" because\n   * `NO_PROXY` is not the only thing that varies per host: `HTTP_PROXY` and\n   * `HTTPS_PROXY` may name different proxies, and a single agent bound to one\n   * of them would quietly send the other scheme's traffic to the wrong place.\n   */\n  private readonly innerAgents = new Map<string, HttpAgent>();\n\n  connect(_req: ClientRequest, options: AgentConnectOpts): HttpAgent {\n    const secure = options.secureEndpoint;\n    const proxyUrl = getProxyForUrl(requestUrl(options));\n    const key = `${secure ? 'https' : 'http'}|${proxyUrl || 'direct'}`;\n\n    const cached = this.innerAgents.get(key);\n    if (cached) return cached;\n\n    const agent = createInnerAgent(secure, proxyUrl);\n    this.innerAgents.set(key, agent);\n    return agent;\n  }\n\n  override destroy(): void {\n    for (const agent of this.innerAgents.values()) {\n      agent.destroy();\n    }\n    this.innerAgents.clear();\n    super.destroy();\n  }\n}\n\nfunction createInnerAgent(secure: boolean, proxyUrl: string): HttpAgent {\n  if (!proxyUrl) {\n    // No proxy for this host — `NO_PROXY` matched, or no proxy variable is set\n    // for this scheme. A plain agent keeps the request byte-identical to the\n    // unproxied path.\n    return secure ? new HttpsAgent(INNER_AGENT_OPTIONS) : new HttpAgent(INNER_AGENT_OPTIONS);\n  }\n  // `HttpsProxyAgent` opens a CONNECT tunnel and upgrades it to TLS, so the\n  // origin's own certificate is what gets validated; `HttpProxyAgent` rewrites\n  // the request line for a plain `http:` origin. Which one applies is decided\n  // by the ORIGIN's scheme, not the proxy's — a plain `http://` proxy serves\n  // both.\n  return secure\n    ? new HttpsProxyAgent<string>(proxyUrl, INNER_AGENT_OPTIONS)\n    : new HttpProxyAgent<string>(proxyUrl, INNER_AGENT_OPTIONS);\n}\n","/**\n * Client config every AWS SDK client in cdkd must be built with.\n *\n * WHY THIS EXISTS\n *\n * The AWS SDK for JavaScript v3 does NOT read `HTTPS_PROXY` / `HTTP_PROXY` the\n * way botocore (the AWS CLI) and Go's `net/http` do. Its own guide says a proxy\n * is supplied \"through a third-party HTTP agent\" by whoever constructs the\n * client — so on a machine whose only egress is a corporate proxy, an SDK call\n * dials out directly and fails, typically as\n * `CredentialsProviderError: self-signed certificate in certificate chain`\n * because the direct route is what the network intercepts (issue #2388).\n *\n * Node 24's `NODE_USE_ENV_PROXY=1` is not a way out: it rewires the GLOBAL\n * agent, and every SDK client builds its own.\n *\n * WHY THE CREDENTIAL CHAIN IS INJECTED TOO\n *\n * A client's `requestHandler` does not reach every credential hop:\n *\n * - STS (`role_arn` profiles, web identity) reads `requestHandler` off\n *   `parentClientConfig`, so it INHERITS ours. Nothing to do.\n * - `@aws-sdk/credential-provider-sso` builds its portal client from\n *   `clientConfig` alone, coalescing only `logger`, `region` and\n *   `userAgentAppId` from the caller. `@aws-sdk/token-providers` does the same\n *   for the SSO-OIDC refresh. So an SSO profile fails at\n *   `resolveSSOCredentials` — BEFORE any service call — unless the chain is\n *   constructed here with the handler threaded through `clientConfig`.\n * - IMDS (`@smithy/credential-provider-imds`) and ECS container credentials\n *   (`@aws-sdk/credential-provider-http`) call `node:http` / build their own\n *   handler, so they bypass a proxy on their own and need no special casing.\n *\n * The chain is therefore built per call. `defaultProvider` MEMOIZES resolved\n * credentials inside the chain instance, so one shared instance would hand a\n * client configured for profile A the credentials of profile B. Per call costs\n * nothing relative to today, since each client already builds its own chain.\n *\n * `clientConfig` carries `requestHandler` and NOTHING else — a `region` there\n * would override the SSO portal's own region — and `profile` is passed\n * ALONGSIDE it, because the built-in chain sees a profile through the client\n * config while an injected chain does not.\n *\n * SPREAD THIS FIRST, SITE-SPECIFIC CONFIG SECOND\n *\n * `new S3Client({ ...awsClientDefaults({ profile }), region, ...(creds && { credentials: creds }) })`\n *\n * A site that supplies its own `credentials` must keep them — `config-loader`'s\n * default-bucket probe reuses the STS client's resolved provider on purpose, so\n * that the bucket it probes is checked as the identity the name was derived\n * from. That provider already carries the handler, because the STS client it\n * came from was built through this helper.\n */\n\nimport { defaultProvider } from '@aws-sdk/credential-provider-node';\nimport { NodeHttpHandler } from '@smithy/node-http-handler';\n// The `.ts` spelling below is REQUIRED, not a slip.\n//\n// `scripts/audit-provider-coverage.ts` imports `src/utils/aws-clients.ts`\n// directly and runs under `node`'s native type stripping, which resolves\n// relative specifiers LITERALLY — it does not rewrite `.js` to `.ts` the way\n// TypeScript does at emit time. The constraint is TRANSITIVE: it binds every\n// module reachable from `aws-clients.ts`, this one included, so a `./foo.js`\n// import ANYWHERE in that closure breaks `vp run audit:coverage:check` in CI.\n// `tsconfig.json`'s `rewriteRelativeImportExtensions` is what emits the `.ts`\n// spelling as `.js`, and `tests/unit/utils/aws-clients-region-fold.test.ts`\n// fences the whole closure by resolving it the way `node` would.\nimport { ProxyRoutingAgent } from './proxy-routing-agent.ts';\n\nexport interface AwsClientDefaultsOptions {\n  /** The profile the calling site was configured with, if any. */\n  profile?: string | undefined;\n}\n\n/**\n * A partial AWS SDK client config. Empty when no proxy is configured.\n *\n * `credentials` is derived from `defaultProvider` rather than imported from\n * `@smithy/types` so that naming the type costs no new dependency.\n */\nexport interface AwsClientDefaults {\n  requestHandler?: NodeHttpHandler;\n  credentials?: ReturnType<typeof defaultProvider>;\n}\n\n/**\n * The proxy variables, in the order `proxy-from-env` itself reads them.\n *\n * Only their PRESENCE is decided here. Which one applies to a given request —\n * and whether `NO_PROXY` exempts it — is `getProxyForUrl`'s job, per request,\n * inside {@link ProxyRoutingAgent}. Deciding it here instead would collapse\n * `HTTP_PROXY` and `HTTPS_PROXY` into one answer and send `http://` traffic to\n * an HTTPS proxy.\n */\nexport const PROXY_ENV_VARS = [\n  'HTTPS_PROXY',\n  'https_proxy',\n  'HTTP_PROXY',\n  'http_proxy',\n  'ALL_PROXY',\n  'all_proxy',\n] as const;\n\nlet proxyConfigured: boolean | undefined;\n\nfunction isProxyConfigured(): boolean {\n  // Read lazily and memoize only the PARSE RESULT, so module import order\n  // cannot freeze an answer before the CLI has finished setting up, and so a\n  // test can control the environment through `resetAwsClientDefaults()`.\n  if (proxyConfigured === undefined) {\n    // Every spelling is examined before the answer is decided. A `.some()` here\n    // short-circuited at the first VALID variable, so `HTTPS_PROXY=http://ok`\n    // beside a typo'd `http_proxy='   '` never reached the guard below -- and\n    // the typo then resurfaced per request as exactly the unnamed URL-parse\n    // error the guard exists to pre-empt.\n    let configured = false;\n    for (const name of PROXY_ENV_VARS) {\n      const value = process.env[name];\n      if (value === undefined || value === '') continue;\n      if (value.trim() === '') {\n        // Whitespace-only is a typo, not a configuration. Treating it as SET\n        // fails later with a URL-parse error naming neither the variable nor\n        // cdkd; treating it as UNSET is worse still, because the run then goes\n        // direct and fails with the certificate error this whole change exists\n        // to remove -- with no hint that the variable was the cause.\n        //\n        // A plain `Error` rather than `CdkdError`: importing the error module\n        // would add a `.js` relative import to the closure reachable from\n        // `aws-clients.ts`, which is the constraint the header above describes.\n        throw new Error(\n          `${name} is set to whitespace only. Set it to a proxy URL ` +\n            `(e.g. http://proxy.example:8080) or unset it.`\n        );\n      }\n      configured = true;\n    }\n    proxyConfigured = configured;\n  }\n  return proxyConfigured;\n}\n\n/**\n * Returns `{}` when no proxy is configured, which keeps the unproxied path\n * byte-identical to what the SDK builds on its own and makes this a no-op for\n * every existing user.\n */\nexport function awsClientDefaults(options: AwsClientDefaultsOptions = {}): AwsClientDefaults {\n  if (!isProxyConfigured()) return {};\n\n  // A FRESH agent per call. `NodeHttpHandler.destroy()` destroys `httpAgent`\n  // and `httpsAgent` unconditionally, and Node's `Agent.destroy()` aborts\n  // ACTIVE sockets, so a shared agent would let one client's teardown kill\n  // another client's in-flight request. See `proxy-routing-agent.ts`.\n  const agent = new ProxyRoutingAgent();\n  const requestHandler = new NodeHttpHandler({ httpAgent: agent, httpsAgent: agent });\n\n  return {\n    requestHandler,\n    credentials: defaultProvider({\n      ...(options.profile !== undefined && options.profile !== '' && { profile: options.profile }),\n      clientConfig: { requestHandler },\n    }),\n  };\n}\n\n/** Drop the memoized environment read. Test seam; mirrors `resetAwsClients()`. */\nexport function resetAwsClientDefaults(): void {\n  proxyConfigured = undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,MAAM,sBAAsB;CAAE,WAAW;CAAM,YAAY;AAAG;;;;;;;;;AAU9D,SAAS,WAAW,SAAmC;CACrD,MAAM,SAAS,QAAQ;CACvB,MAAM,UAAU,QAAQ,QAAQ;CAChC,MAAM,OAAO,QAAQ,SAAS,GAAG,KAAK,CAAC,QAAQ,WAAW,GAAG,IAAI,IAAI,QAAQ,KAAK;CAClF,MAAM,OAAO,QAAQ,SAAS,SAAS,MAAM;CAC7C,OAAO,GAAG,SAAS,UAAU,OAAO,KAAK,KAAK,GAAG;AACnD;AAEA,IAAa,oBAAb,cAAuCA,QAAM;;;;;;;;;CAS3C,AAAiB,8BAAc,IAAI,IAAuB;CAE1D,QAAQ,MAAqB,SAAsC;EACjE,MAAM,SAAS,QAAQ;EACvB,MAAM,WAAW,eAAe,WAAW,OAAO,CAAC;EACnD,MAAM,MAAM,GAAG,SAAS,UAAU,OAAO,GAAG,YAAY;EAExD,MAAM,SAAS,KAAK,YAAY,IAAI,GAAG;EACvC,IAAI,QAAQ,OAAO;EAEnB,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ;EAC/C,KAAK,YAAY,IAAI,KAAK,KAAK;EAC/B,OAAO;CACT;CAEA,AAAS,UAAgB;EACvB,KAAK,MAAM,SAAS,KAAK,YAAY,OAAO,GAC1C,MAAM,QAAQ;EAEhB,KAAK,YAAY,MAAM;EACvB,MAAM,QAAQ;CAChB;AACF;AAEA,SAAS,iBAAiB,QAAiB,UAA6B;CACtE,IAAI,CAAC,UAIH,OAAO,SAAS,IAAIC,QAAW,mBAAmB,IAAI,IAAIC,MAAU,mBAAmB;CAOzF,OAAO,SACH,IAAI,gBAAwB,UAAU,mBAAmB,IACzD,IAAI,eAAuB,UAAU,mBAAmB;AAC9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/BA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,IAAI;AAEJ,SAAS,oBAA6B;CAIpC,IAAI,oBAAoB,QAAW;EAMjC,IAAI,aAAa;EACjB,KAAK,MAAM,QAAQ,gBAAgB;GACjC,MAAM,QAAQ,QAAQ,IAAI;GAC1B,IAAI,UAAU,UAAa,UAAU,IAAI;GACzC,IAAI,MAAM,KAAK,MAAM,IAUnB,MAAM,IAAI,MACR,GAAG,KAAK,gGAEV;GAEF,aAAa;EACf;EACA,kBAAkB;CACpB;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,kBAAkB,UAAoC,CAAC,GAAsB;CAC3F,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC;CAMlC,MAAM,QAAQ,IAAI,kBAAkB;CACpC,MAAM,iBAAiB,IAAI,gBAAgB;EAAE,WAAW;EAAO,YAAY;CAAM,CAAC;CAElF,OAAO;EACL;EACA,aAAa,gBAAgB;GAC3B,GAAI,QAAQ,YAAY,UAAa,QAAQ,YAAY,MAAM,EAAE,SAAS,QAAQ,QAAQ;GAC1F,cAAc,EAAE,eAAe;EACjC,CAAC;CACH;AACF"}

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-cNxTfzBH.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DdNVYNv2.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -72,7 +72,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program--txqxUQg.js");
+	const { buildProgram } = await import("./program-C0dW-OL8.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-BoDdOfCO.js → deploy-engine-DWmYq7m1.js}

@@ -1,5 +1,6 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-cNxTfzBH.js";
+import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
+import { t as getCdkdVersion } from "./version-DdNVYNv2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1573,20 +1574,27 @@ var aws_clients_exports = /* @__PURE__ */ __exportAll({
 /**
 * {@link canonicalizeRegion}'s body, inlined.
 *
-* This module may NOT import it — `scripts/audit-provider-coverage.ts` runs
-* under `node` with native type stripping and imports this file as
-* `'../src/utils/aws-clients.ts'`, and Node resolves relative specifiers
-* LITERALLY: it does not rewrite `.js` to `.ts` the way TypeScript does at emit
-* time. So a `./aws-partition.js` import here is fine for the bundle and fails
-* the script with `ERR_MODULE_NOT_FOUND` (which is exactly how this was found —
-* 32 `gen-nested-key-coverage` cases went red on the first cut of issue #2065).
-* That constraint had never been written down, because until now this file
-* happened to have NO relative import at all; the script's own import carries
-* the other half of the note.
+* This module may NOT import it AS `./aws-partition.js` —
+* `scripts/audit-provider-coverage.ts` runs under `node` with native type
+* stripping and imports this file as `'../src/utils/aws-clients.ts'`, and Node
+* resolves relative specifiers LITERALLY: it does not rewrite `.js` to `.ts`
+* the way TypeScript does at emit time. So a `./aws-partition.js` import here
+* is fine for the bundle and fails the script with `ERR_MODULE_NOT_FOUND`
+* (which is exactly how this was found — 32 `gen-nested-key-coverage` cases
+* went red on the first cut of issue #2065).
+*
+* A relative import IS allowed, spelled `.ts` — which resolves under both, and
+* which `rewriteRelativeImportExtensions` emits as `.js`. `./aws-client-defaults.ts`
+* is the first one under `src/` (issue #2388); the spelling is established in
+* `scripts/` and `tests/`. The constraint is TRANSITIVE, so it binds every
+* module reachable from here, not just this file's own imports. Inlining
+* `foldRegion` is kept anyway: it is one line, and the alternative is a module
+* in that closure existing solely to hold it.
 *
 * `tests/unit/utils/aws-clients-region-fold.test.ts` fences BOTH halves: that
 * this stays byte-equivalent to `canonicalizeRegion` over a table of spellings,
-* and that this file gains no relative import that would break the script.
+* and that every relative import reachable from this file resolves under
+* literal resolution.
 */
 function foldRegion(region) {
 	return region.toLowerCase();
@@ -1623,6 +1631,7 @@ var AwsClients = class AwsClients {
 	}
 	get clientOptions() {
 		return {
+			...awsClientDefaults({ profile: this.config.profile }),
 			...this.config.region && { region: this.config.region },
 			...this.config.profile && { profile: this.config.profile },
 			...this.config.credentials && { credentials: this.config.credentials }
@@ -2164,16 +2173,18 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 		};
 		const explicitRegion = opts.region ?? opts.fallbackRegion;
 		let client = new S3Client({
-			...explicitRegion && { region: explicitRegion },
-			...auth
+			...awsClientDefaults({ profile: opts.profile }),
+			...auth,
+			...explicitRegion && { region: explicitRegion }
 		});
 		let probeRegion = explicitRegion ?? await readClientRegion(client);
 		if (!probeRegion) {
 			client.destroy();
 			probeRegion = "us-east-1";
 			client = new S3Client({
-				region: probeRegion,
-				...auth
+				...awsClientDefaults({ profile: opts.profile }),
+				...auth,
+				region: probeRegion
 			});
 		}
 		try {
@@ -3755,6 +3766,7 @@ function resolveAccountIdForCredentials(region, credentials) {
 	if (cached) return cached;
 	const promise = (async () => {
 		const sts = new STSClient({
+			...awsClientDefaults(),
 			...typeof region === "string" && region ? { region } : {},
 			credentials: {
 				accessKeyId: credentials.accessKeyId,
@@ -4902,6 +4914,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 	const legacyName = getLegacyStateBucketName(accountId, region);
 	const stsCredentials = stsClient.config?.credentials;
 	const probe = new S3Client({
+		...awsClientDefaults(),
 		region: "us-east-1",
 		...typeof stsCredentials === "function" && { credentials: stsCredentials }
 	});
@@ -6607,8 +6620,14 @@ async function verifyAssetStorageExists(marker, accountId, region, opts = {}) {
 		region,
 		...opts.profile && { profile: opts.profile }
 	};
-	const s3Client = new S3Client(clientOpts);
-	const ecrClient = new ECRClient(clientOpts);
+	const s3Client = new S3Client({
+		...awsClientDefaults({ profile: opts.profile }),
+		...clientOpts
+	});
+	const ecrClient = new ECRClient({
+		...awsClientDefaults({ profile: opts.profile }),
+		...clientOpts
+	});
 	try {
 		try {
 			await s3Client.send(new HeadBucketCommand({
@@ -6903,10 +6922,12 @@ var AssetModeResolver = class {
 		let ecrClient;
 		try {
 			s3Client = new S3Client({
+				...awsClientDefaults({ profile: this.profile }),
 				region,
 				...this.profile && { profile: this.profile }
 			});
 			ecrClient = new ECRClient({
+				...awsClientDefaults({ profile: this.profile }),
 				region,
 				...this.profile && { profile: this.profile }
 			});
@@ -7839,6 +7860,7 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	});
 	const rebuiltCredentials = opts.credentials ? opts.credentials : opts.reuseClientCredentials ? client.config.credentials : void 0;
 	const replacement = new S3Client({
+		...awsClientDefaults({ profile: opts.profile }),
 		region: bucketRegion,
 		...opts.profile && { profile: opts.profile },
 		...rebuiltCredentials !== void 0 && { credentials: rebuiltCredentials },
@@ -20707,7 +20729,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CnpxfVci.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Bfx30mgz.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -32696,4 +32718,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, PartialFailureError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, normalizeAwsError as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, DynamicReferenceRegionAmbiguousError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, LockError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LocalStartServiceError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StackTerminationProtectionError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, markNonRetryable as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isMarkedNonRetryable as Hr, withRetry as Ht, red as I, runDockerForeground as In, StateError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, __exportAll as Jr, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, markRedactedCause as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, SynthesisError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceTimeoutError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, ResourceUpdateNotSupportedError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, MissingCdkCliError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackHasActiveImportsError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, formatError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DeployCancelledError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalMigrateError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isRetryableTransientError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, withErrorHandling as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, isThrottlingError as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, AssetError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, expectedOwnerParam as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, CrossAccountSecretRefusalError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, derivePartitionAndUrlSuffix as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, clearBucketRegionCache as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, resolveBucketRegion as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, setAwsClients as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, resetAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ProvisioningError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, NestedStackChildDirectDestroyError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, AssemblyReader as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, getAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, PARTITION_TABLE as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, AwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, retryClassificationText as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, canonicalizeRegion as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, processStackMessages as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, CdkdError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalInvokeBuildError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DependencyError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, ConfigError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, isCdkdError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-BoDdOfCO.js.map
+//# sourceMappingURL=deploy-engine-DWmYq7m1.js.map