@go-to-k/cdkd 0.291.0 → 0.291.1

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-kDWCn_Jq.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DREZx_Q6.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-Cs7N6T4j.js");
+	const { buildProgram } = await import("./program-B2qAWvE2.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-9CxYEFh_.js → deploy-engine-BZtFQu2S.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-kDWCn_Jq.js";
+import { t as getCdkdVersion } from "./version-DREZx_Q6.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7180,8 +7180,17 @@ function warnAbsoluteAssetPath(w) {
 * an accidental or legacy `..` and costs nothing, which is why it stays — but
 * it is no longer a boundary against anyone who chose the value. The docs say
 * this to users in the same words; do not soften either copy.
+*
+* **The leading positionals stay, and that is not an unfinished half of
+* [#3544](https://github.com/go-to-k/cdkd/issues/3544).** The Docker twin took
+* every parameter into its bag because `(manifestDir, directory)` were two
+* adjacent `string`s and swapping them compiled. Here the second parameter is
+* a `FileAsset`, so the same swap is a type error already. The invariant is
+* "no transposable adjacent same-typed pair", not "both twins look alike" —
+* converting this one buys nothing and costs every call site.
 */
-function resolveFileAssetSourcePath(manifestDir, asset, assetOutdir, sink) {
+function resolveFileAssetSourcePath(manifestDir, asset, opts) {
+	const { assetOutdir, sink } = opts;
 	if (isAbsolute$1(asset.source.path)) {
 		const absolute = resolve$1(asset.source.path);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
@@ -7295,14 +7304,14 @@ var AssetManifestLoader = class {
 	*
 	* @param cdkOutputDir CDK output directory
 	* @param asset File asset
-	* @param assetOutdir The app's outdir — the containment / warning bound.
-	*   REQUIRED for the reason {@link resolveFileAssetSourcePath}'s own
-	*   parameter is: a dropped bound narrows to the manifest directory and
-	*   silently refuses every Stage asset.
+	* @param opts The app's outdir and the sink clause; see
+	*   {@link FileAssetResolveOptions}. A bag rather than positionals because
+	*   both are `string` and a transposition otherwise compiled
+	*   (go-to-k/cdkd#3537).
 	* @returns Absolute path to asset source
 	*/
-	getAssetSourcePath(cdkOutputDir, asset, assetOutdir, sink) {
-		return resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir, sink);
+	getAssetSourcePath(cdkOutputDir, asset, opts) {
+		return resolveFileAssetSourcePath(cdkOutputDir, asset, opts);
 	}
 	/**
 	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
@@ -7401,7 +7410,10 @@ var FileAssetPublisher = class {
 	*/
 	async publish(assetHash, asset, cdkOutputDir, accountId, region, assetOutdir) {
 		const destinations = Object.values(asset.destinations).map((d) => `s3://${this.resolvePlaceholders(d.bucketName, accountId, region)}/${this.resolvePlaceholders(d.objectKey, accountId, region)}`).map((u) => displaySafe(u));
-		const sourcePath = resolveFileAssetSourcePath(cdkOutputDir, asset, assetOutdir, destinations.length > 0 ? `package that path and upload it to ${destinations.join(", ")}` : "package that path, though this manifest names no destination for it");
+		const sourcePath = resolveFileAssetSourcePath(cdkOutputDir, asset, {
+			assetOutdir,
+			sink: destinations.length > 0 ? `package that path and upload it to ${destinations.join(", ")}` : "package that path, though this manifest names no destination for it"
+		});
 		for (const [, dest] of Object.entries(asset.destinations)) {
 			const bucketName = this.resolvePlaceholders(dest.bucketName, accountId, region);
 			const objectKey = this.resolvePlaceholders(dest.objectKey, accountId, region);
@@ -8999,7 +9011,8 @@ function warnUnrecognizedAssetDestination(opts) {
 * Twin of `resolveFileAssetSourcePath` and `resolveVerboseTemplatePath`.
 * Exported for unit testing.
 */
-function resolveDockerContextDirectory(manifestDir, directory, wrapError, assetOutdir, sink, assetId) {
+function resolveDockerContextDirectory(opts) {
+	const { manifestDir, directory, wrapError, assetOutdir, sink, assetId } = opts;
 	if (isAbsolute$1(directory)) {
 		const absolute = resolve$1(directory);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
@@ -9053,12 +9066,22 @@ function dockerSubject(assetId) {
 async function buildDockerImage(asset, cdkOutDir, options) {
 	const source = asset.source;
 	const logger = getLogger().child("docker-build");
-	const contextDirectory = (directory, sink) => resolveDockerContextDirectory(cdkOutDir, directory, options.wrapError, options.assetOutdir ?? cdkOutDir, sink, options.tag);
+	const contextDirectory = (args) => resolveDockerContextDirectory({
+		manifestDir: cdkOutDir,
+		directory: args.directory,
+		wrapError: options.wrapError,
+		assetOutdir: options.assetOutdir ?? cdkOutDir,
+		sink: args.sink,
+		...options.tag !== void 0 && { assetId: options.tag }
+	});
 	if (source.executable && source.executable.length > 0) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
 		warnManifestExecutable(source.executable);
-		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
+		const cwd = source.directory ? contextDirectory({
+			directory: source.directory,
+			sink: "run this asset's source.executable with that directory as its working directory"
+		}) : cdkOutDir;
 		const shownExecutable = redactDockerArgvValues(source.executable).join(" ");
 		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
 		let result;
@@ -9082,7 +9105,10 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	}
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
-	const contextDir = contextDirectory(source.directory, "send that directory to BuildKit as the build context and bake it into the image pushed to the repository this manifest names");
+	const contextDir = contextDirectory({
+		directory: source.directory,
+		sink: "send that directory to BuildKit as the build context and bake it into the image pushed to the repository this manifest names"
+	});
 	buildArgs.push(".");
 	warnEscapingBuildKitPaths(source, contextDir, options.assetOutdir ?? cdkOutDir);
 	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displaySafe(contextDir)})`);
@@ -35149,7 +35175,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CZ5keDoC.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-IJRO7-KI.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -48859,4 +48885,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { yellow as $, derivePartitionAndUrlSuffix as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PartialFailureError as Aa, resolveAutoAssetStorage as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, normalizeAwsError as Ba, CFN_TEMPLATE_URL_LIMIT as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, DynamicReferenceRegionAmbiguousError as Ca, AssetManifestLoader as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, LockError as Da, getDefaultStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, LocalStartServiceError as Ea, synthesisStatusMessage as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, StackTerminationProtectionError as Fa, resolveUseCdkBootstrapAssets as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, isTransientServerError as Ga, injectiveKey as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isMarkedNonRetryable as Ha, findLargeInlineResources as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, StateError as Ia, stateBucketExistenceConfirmed as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, retryClassificationText as Ja, producerRecordKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, markNonRetryable as Ka, injectiveKeyPrefix as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, SynthesisError as La, warnDeprecatedNoPrefixCliFlag as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, ResourceTimeoutError as Ma, resolveSkipPrefix as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, ResourceUpdateNotSupportedError as Na, resolveStateBucketWithDefault as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, MalformedProducerRecordRefusalError as Oa, getLegacyStateBucketName as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StackHasActiveImportsError as Pa, resolveStateBucketWithDefaultAndSource as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, canonicalizeRegion as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, formatError as Ra, ssmResolvedValueType as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, DeployCancelledError as Sa, stripControlChars as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LocalInvokeBuildError as Ta, Synthesizer as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isRetryableTransientError as Ua, uploadCfnTemplate as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, withErrorHandling as Va, MIGRATE_TMP_PREFIX as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isThrottlingError as Wa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, safeStringify$1 as Xa, expectedOwnerParam as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, describeAwsFailure as Ya, decodeListingKey as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, __exportAll as Za, PARTITION_TABLE as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AssetError as _a, partitionSensitiveEnv as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, hasPlainPrototype$1 as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, CrossAccountSecretRefusalError as ba, runDockerStreaming as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, absoluteAssemblyPathEscape as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, clearBucketRegionCache as da, describeDockerCapturedOutput as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, AssemblyReader as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, resolveBucketRegion as fa, describeDockerExecFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, setAwsClients as ga, getDockerCmd as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resetAwsClients as ha, formatDockerLoginError as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasOwnKey as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ProvisioningError as ja, resolveCaptureObservedState as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, NestedStackChildDirectDestroyError as ka, resolveApp as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, renderAssemblyPathEscape as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, getAwsClients as ma, dockerSpawnEnvWithSensitive as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, processStackMessages as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, nullPrototypeRecord as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, AwsClients as pa, describeDockerFailure as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, markRedactedCause as qa, producerCoordinateKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, defineOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, ownValue as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, failedStageNote as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveAssemblyPath as ua, warnManifestExecutable as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CdkdError as va, redactDockerArgvValues as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, IntrinsicResolutionRefusalError as wa, getDockerImageBySourceHash as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DependencyError as xa, escapeRegExp$1 as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, ConfigError as ya, runDockerForeground as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, isCdkdError as za, CFN_TEMPLATE_BODY_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-9CxYEFh_.js.map
+//# sourceMappingURL=deploy-engine-BZtFQu2S.js.map