Currently, the test files are not syntax checked during TypeScript
compilation, only during test running. This makes it hard to pick up on
necessary changes during large-scale refactors.

You will only notice them during test runs, and then every single test
file will fail with a parse error (instead of potentially a single
typechecking error during typechecking phase).

Another complication with the trivial solution of just running `tsc -p
tsconfig.dev.json` is that VSCode will not detect that `test/` files are
included in a tsconfig file if it's not literally called
`tsconfig.json`, so we have to do some trickery to type-check at
compilation time AND convince VSCode to type check as well.

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

The `diff.test` times out trying to get the current account from actual
AWS credentials, if they happen to be in the environment where unit
tests are run.

Make sure a fake SDK provider is used that doesn't do any of that stuff.

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

This makes the plugin host configurable for toolkit users:

## Design decisions

- Every `Toolkit` instance gets a fresh `PluginHost` by default (not a
global singleton `PluginHost`)
- ...in fact, the concept of a global singleton `PluginHost` gets fully
moved to the CLI. That concept disappears from the toolkit and the
helpers, and all functions that used to implicitly assume a global
plugin host now get an explicit parameter, that defaults to a fresh
plugin host if not supplied.

These choices lead to a lot of downstream test changes.

- Plugin module resolution, module deduplication and logging was moved
from the CLI into the plugin host.

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

Errors thrown from async functions passed to `fromAssemblyBuilder` would
not be caught correctly:

```ts
await toolkit.fromAssemblyBuilder(async () => {
  // Oops! Not wrapped the right type of error.
  throw new Error(...);
});
```

Due to a missing `await` in the `try/catch` handler.

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

Bumps
[aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib)
from 2.189.0 to 2.189.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-cdk/releases">aws-cdk-lib's
releases</a>.</em></p>
<blockquote>
<h2>v2.189.1</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>core:</strong> implicit Aspect applications do not override
custom Aspect applications (<a
href="https://redirect.github.com/aws/aws-cdk/issues/34132">#34132</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/b7f4bc7aee1d99b70e4d9d3cedea53e910ee37ef">b7f4bc7</a>)</li>
</ul>
<hr />
<h2>Alpha modules (2.189.1-alpha.0)</h2>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-cdk/blob/v2.189.1/CHANGELOG.v2.alpha.md">aws-cdk-lib's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.
See <a
href="https://github.com/conventional-changelog/standard-version">standard-version</a>
for commit guidelines.</p>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.189.0-alpha.0...v2.189.1-alpha.0">2.189.1-alpha.0</a>
(2025-04-14)</h2>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.188.0-alpha.0...v2.189.0-alpha.0">2.189.0-alpha.0</a>
(2025-04-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>ec2-alpha:</strong> implement mapPublicIpOnLaunch prop in
SubnetV2 (<a
href="https://redirect.github.com/aws/aws-cdk/issues/34057">#34057</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/836c5cf3e4c627f817e4dc8ed2af28a5bba54792">836c5cf</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/32159">#32159</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>amplify:</strong> unable to re-run integ test due to missing
<code>status</code> field in <code>customRule</code> (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33973">#33973</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/6638c08d56afe7ecc4f23cff4cf334b887001e5e">6638c08</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/33962">#33962</a></li>
</ul>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.187.0-alpha.0...v2.188.0-alpha.0">2.188.0-alpha.0</a>
(2025-04-03)</h2>
<h3>Features</h3>
<ul>
<li><strong>ec2:</strong> add mailmanager vpc endpoints (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33996">#33996</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/7ee77d71df569d21c280866976109333e3266132">7ee77d7</a>)</li>
<li><strong>eks-v2-alpha:</strong> add new nodegroup ami type (<a
href="https://redirect.github.com/aws/aws-cdk/issues/34025">#34025</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/864a7c6f6811777971d1349e7552567604167f02">864a7c6</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>ec2-alpha:</strong> addInternetGW handles shared route table
for subnets (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33824">#33824</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/3154d016ba31455f2d57ff5d90ee7b394c25e88f">3154d01</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/33672">#33672</a></li>
</ul>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.186.0-alpha.0...v2.187.0-alpha.0">2.187.0-alpha.0</a>
(2025-03-31)</h2>
<h3>Features</h3>
<ul>
<li><strong>apprunner:</strong> throw ValidationError instead of untyped
errors (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33914">#33914</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/38f89afe2ffdf67b0918e38f861166bdb0f8738f">38f89af</a>)</li>
<li><strong>ec2:</strong> adding <code>placementGroup</code> to
<code>LaunchTemplateProps</code> and <code>LaunchTemplate</code> (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33726">#33726</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/e5f71db53ce985172e565eb9da5692d77ab7b268">e5f71db</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/33721">#33721</a></li>
<li><strong>ec2:</strong> support the new <code>SupportedRegions</code>
property for <code>AWS::EC2::VPCEndpointService</code> (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33959">#33959</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/0c77cb627e1e7e729205624a9603331f5442af8e">0c77cb6</a>)</li>
<li><strong>iot:</strong> backfill enum values in iot module (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33969">#33969</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/2a8a8a36ed872f7f3de4b24fd7d9c874a3da9dbf">2a8a8a3</a>)</li>
</ul>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.185.0-alpha.0...v2.186.0-alpha.0">2.186.0-alpha.0</a>
(2025-03-26)</h2>
<h3>Features</h3>
<ul>
<li><strong>ec2:</strong> backfill missing enums for ec2 (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33821">#33821</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/ae3fd67d3e153187d2e6fa53df9ec78080fe71d0">ae3fd67</a>),
closes <a
href="https://github.com/aws//docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html/issues/cfn-ec2">/docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html#cfn-ec2</a>
<a
href="https://github.com/aws//docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpcendpoint.html/issues/cfn-ec2">/docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpcendpoint.html#cfn-ec2</a></li>
<li><strong>ec2:</strong> support <code>PrefixList.fromLookup()</code>
(<a
href="https://redirect.github.com/aws/aws-cdk/issues/33619">#33619</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/b6a15f384e79eb0020f46ffeea20507f07380a97">b6a15f3</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/33606">aws/aws-cdk#33606</a>
<a
href="https://redirect.github.com/aws/aws-cdk/issues/15115">aws/aws-cdk#15115</a></li>
<li><strong>ec2:</strong> support AWS::EC2::VPCEndpointService
SupportedIpAddressTypes property (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33877">#33877</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/ed5df9cac46dd862ec67751f5d0e6a53f81e8d0a">ed5df9c</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-cdk/commit/e7432ee4f8ae6f4ba000b1c1833188dddeb15624"><code>e7432ee</code></a>
chore(release): 2.189.1</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/b7f4bc7aee1d99b70e4d9d3cedea53e910ee37ef"><code>b7f4bc7</code></a>
fix(core): implicit Aspect applications do not override custom Aspect
applica...</li>
<li>See full diff in <a
href="https://github.com/aws/aws-cdk/commits/v2.189.1/packages/aws-cdk-lib">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aws-cdk-lib&package-manager=npm_and_yarn&previous-version=2.189.0&new-version=2.189.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/aws/aws-cdk-cli/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: github-actions <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ian Hou <[email protected]>
Co-authored-by: github-actions <[email protected]>

Previously, the Toolkit would always use AWS CLI-compatible base
credentials. This is now configurable:

```ts
const toolkit = new Toolkit({
  sdkConfig: {
    baseCredentials: BaseCredentials.custom(...),
  },
});
```

## Design

The `BaseCredentials` (abstract) class is responsible for producing the
following 2 bits of information:

- A credential provider
- A default region

These will be used to initialize an `SdkProvider`, which will then
proceed to use that information:

- To inform the CDK app about the desired target environment
- After synthesis and during lookup:
  - use those credentials directly; or
  - use those credentials to assume roles; or
  - use available plugins to obtain credentials

`requestHandler` (the proxy agent plus some SDK settings) used to be
produced by the `SdkProvider` itself, but it is now produced by the
`Toolkit` and part of the "services" that get passed in. That way, it is
both available to the `AwsCliCompatible` base credentials to initialize
the STS client, as well as to the `SdkProvider` class that now also gets
instantiated by the `Toolkit`.


![image](https://github.com/user-attachments/assets/4ee1656b-d54f-4d1d-8ac7-77cd75c145b2)


## Supporting changes

- Many of the supporting positional arguments to `SdkProvider` have been
grouped into `SdkProviderServices`.
- Change how we mock the SDK in a number of tests (instead of mocking
the SDK Provider, mock the SDK)

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

Upgrades project dependencies. See details in [workflow run].

[Workflow Run]:
https://github.com/aws/aws-cdk-cli/actions/runs/14564738589

------

*Automatically created by projen via the "upgrade" workflow*

---------

Signed-off-by: github-actions <[email protected]>
Co-authored-by: github-actions <[email protected]>

… created with `cdk init` (#295)

Fixes #294

This change also removes `"dom"` from the `tsconfig.json` files of
additional packages that are all intended to run in a Node.js
environment, not in the browser.

Since these packages are not expected to use any web runtime-specific
APIs, removing `"dom"` helps prevent accidental use of browser-only
types across the codebase.

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

---------

Co-authored-by: Momo Kornher <[email protected]>

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

Keeping the CLI integ tests in a [separate
repository](https://github.com/aws/aws-cdk-cli-testing) was a
theoretically good idea and a practically annoying idea.

Let's move them in here, this is much easier to work with.

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

---------

Signed-off-by: github-actions <[email protected]>
Co-authored-by: github-actions <[email protected]>

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

The `cli-integ` tests depend on the `node-pty` package for testing of
interactive terminals. This package needs to be build at install time
using `node-gyp`. Because previously `cli-integ` tests dependet on an
old version of `npm`, we got an old version of `node-gyp` which is
incomaptible with recent python versions.

To fix this, we upgrade the dependency to a more recent version of
`npm`.

Fixes failing Python package release.

Proof this fix works:
https://github.com/aws/aws-cdk-cli/actions/runs/14619849549/job/41016752989?pr=406

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license