chore(kms): cross-stack usage detection depends on NPM tree

packages/@aws-cdk/aws-kms/lib/key.ts

@@ -201,7 +201,7 @@ abstract class KeyBase extends Resource implements IKey {
    */
   private granteeStackDependsOnKeyStack(grantee: iam.IGrantable): string | undefined {
     const grantPrincipal = grantee.grantPrincipal;
-    if (!(grantPrincipal instanceof Construct)) {
+    if (!isConstruct(grantPrincipal)) {
       return undefined;
     }
     // this logic should only apply to newly created
@@ -229,7 +229,7 @@ abstract class KeyBase extends Resource implements IKey {
   }
 
   private isGranteeFromAnotherRegion(grantee: iam.IGrantable): boolean {
-    if (!(grantee instanceof Construct)) {
+    if (!isConstruct(grantee)) {
       return false;
     }
     const bucketStack = Stack.of(this);
@@ -238,7 +238,7 @@ abstract class KeyBase extends Resource implements IKey {
   }
 
   private isGranteeFromAnotherAccount(grantee: iam.IGrantable): boolean {
-    if (!(grantee instanceof Construct)) {
+    if (!isConstruct(grantee)) {
       return false;
     }
     const bucketStack = Stack.of(this);
@@ -675,3 +675,20 @@ export class Key extends KeyBase {
     }));
   }
 }
+
+/**
+ * Whether the given object is a Construct
+ *
+ * Normally we'd do `x instanceof Construct`, but that is not robust against
+ * multiple copies of the `constructs` library on disk. This can happen
+ * when upgrading and downgrading between v2 and v1, and in the use of CDK
+ * Pipelines is going to an error that says "Can't use Pipeline/Pipeline/Role in
+ * a cross-environment fahsion", which is very confusing.
+ */
+function isConstruct(x: any): x is Construct {
+  const sym = Symbol.for('constructs.Construct.node');
+  return (typeof x === 'object' && x &&
+    (x instanceof Construct // happy fast case
+    || !!(x as Construct).node // constructs v10
+    || !!(x as any)[sym])); // constructs v3
+}

packages/aws-cdk/lib/api/cxapp/environments.ts

@@ -27,23 +27,32 @@ export async function globEnvironmentsFromStacks(stacks: StackCollection, enviro
   return environments;
 }
 
+export function parseEnvironmentDescriptor(spec: string): cxapi.Environment | undefined {
+  const parts = spec.replace(/^aws:\/\//, '').split('/');
+  if (parts.length !== 2) {
+    return undefined;
+  }
+
+  return {
+    name: spec,
+    account: parts[0],
+    region: parts[1],
+  };
+}
+
 /**
  * Given a set of "<account>/<region>" strings, construct environments for them
  */
 export function environmentsFromDescriptors(envSpecs: string[]): cxapi.Environment[] {
   const ret = new Array<cxapi.Environment>();
 
   for (const spec of envSpecs) {
-    const parts = spec.replace(/^aws:\/\//, '').split('/');
-    if (parts.length !== 2) {
+    const env = parseEnvironmentDescriptor(spec);
+    if (!env) {
       throw new Error(`Expected environment name in format 'aws://<account>/<region>', got: ${spec}`);
     }
 
-    ret.push({
-      name: spec,
-      account: parts[0],
-      region: parts[1],
-    });
+    ret.push(env);
   }
 
   return ret;