@go-to-k/cdkd 0.151.0 → 0.152.0

package/dist/{deploy-engine-CRxNgcqJ.js → deploy-engine-CV51PIkg.js}

@@ -15,7 +15,7 @@ import { GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { GetCloudFrontOriginAccessIdentityCommand } from "@aws-sdk/client-cloudfront";
 import { createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, join, resolve } from "node:path";
+import { basename, isAbsolute, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { homedir, tmpdir } from "node:os";
 import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } from "@aws-sdk/client-route-53";
@@ -909,7 +909,9 @@ var AssemblyReader = class {
 		for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 			const assetPath = resource.Metadata?.["aws:asset:path"];
-			if (typeof assetPath === "string" && assetPath.length > 0) nestedTemplates[logicalId] = join(assemblyDir, assetPath);
+			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
+			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${stackName}' nested-stack '${logicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+			nestedTemplates[logicalId] = join(assemblyDir, assetPath);
 		}
 		return {
 			stackName,
@@ -9970,4 +9972,4 @@ var DeployEngine = class {
 
 //#endregion
 export { ConfigError as $, AssetPublisher as A, resolveStateBucketWithDefault as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, getDefaultStateBucketName as F, MIGRATE_TMP_PREFIX as G, warnDeprecatedNoPrefixCliFlag as H, getLegacyStateBucketName as I, AssemblyReader as J, findLargeInlineResources as K, resolveApp as L, WorkGraph as M, buildDockerImage as N, S3StateBackend as O, Synthesizer as P, CdkdError as Q, resolveCaptureObservedState as R, IntrinsicFunctionResolver as S, DagBuilder as T, CFN_TEMPLATE_BODY_LIMIT as U, resolveStateBucketWithDefaultAndSource as V, CFN_TEMPLATE_URL_LIMIT as W, resolveBucketRegion as X, clearBucketRegionCache as Y, AssetError as Z, normalizeAwsTagsToCfn as _, isCdkdError as _t, withRetry as a, MissingCdkCliError as at, CloudControlProvider as b, cyan as c, ProvisioningError as ct, red as d, RouteDiscoveryError as dt, DependencyError as et, yellow as f, StackHasActiveImportsError as ft, matchesCdkPath as g, formatError as gt, CDK_PATH_TAG as h, SynthesisError as ht, withResourceDeadline as i, LockError as it, stringifyValue as j, shouldRetainResource as k, gray as l, ResourceTimeoutError as lt, collectInlinePolicyNamesManagedBySiblings as m, StateError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LocalMigrateError as nt, IMPLICIT_DELETE_DEPENDENCIES as o, NestedStackChildDirectDestroyError as ot, IAMRoleProvider as p, StackTerminationProtectionError as pt, uploadCfnTemplate as q, DeployEngine as r, LocalStartServiceError as rt, bold as s, PartialFailureError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LocalInvokeBuildError as tt, green as u, ResourceUpdateNotSupportedError as ut, resolveExplicitPhysicalId as v, normalizeAwsError as vt, DiffCalculator as w, assertRegionMatch as x, ProviderRegistry as y, withErrorHandling as yt, resolveSkipPrefix as z };
-//# sourceMappingURL=deploy-engine-CRxNgcqJ.js.map
+//# sourceMappingURL=deploy-engine-CV51PIkg.js.map