@go-to-k/cdkd 0.235.0 → 0.236.0

package/dist/{deploy-engine-Cbi5IzWV.js → deploy-engine-DqAIXGA_.js}

@@ -1,5 +1,7 @@
-import { B as generateResourceName, E as SynthesisError, F as getLiveRenderer, M as getLogger, S as ResourceUpdateNotSupportedError, T as StateError, U as withStackName, V as generateResourceNameWithFallback, a as normalizeAwsTagsToCfn, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, s as assertRegionMatch, t as disableInstanceApiTermination, x as ResourceTimeoutError, z as applyDefaultNameForFallback } from "./ec2-termination-protection-uvVnteGl.js";
-import { r as getAwsClients } from "./aws-clients-pjPwZz1r.js";
+import { a as getLiveRenderer, d as generateResourceNameWithFallback, l as applyDefaultNameForFallback, n as getLogger, p as withStackName, u as generateResourceName } from "./logger-BzO-joNR.js";
+import { E as SynthesisError, S as ResourceUpdateNotSupportedError, T as StateError, a as normalizeAwsTagsToCfn, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, s as assertRegionMatch, t as disableInstanceApiTermination, x as ResourceTimeoutError } from "./ec2-termination-protection-q-WGWgxa.js";
+import { r as getAwsClients } from "./aws-clients-B15NAPbL.js";
+import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
@@ -77,7 +79,11 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 			...opts.credentials && { credentials: opts.credentials }
 		});
 		try {
-			return (await client.send(new GetBucketLocationCommand({ Bucket: bucketName }))).LocationConstraint || "us-east-1";
+			const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
+			return (await client.send(new GetBucketLocationCommand({
+				Bucket: bucketName,
+				...await expectedOwnerParam(client)
+			}))).LocationConstraint || "us-east-1";
 		} catch {
 			return opts.fallbackRegion ?? "us-east-1";
 		} finally {
@@ -1366,6 +1372,7 @@ async function uploadCfnTemplate(args) {
 	const key = `${MIGRATE_TMP_PREFIX}/${stackName}/${Date.now()}.${ext}`;
 	try {
 		await s3.send(new PutObjectCommand({
+			...await expectedOwnerParam(s3),
 			Bucket: bucket,
 			Key: key,
 			Body: body,
@@ -1380,7 +1387,8 @@ async function uploadCfnTemplate(args) {
 		try {
 			await s3.send(new DeleteObjectCommand({
 				Bucket: bucket,
-				Key: key
+				Key: key,
+				...await expectedOwnerParam(s3)
 			}));
 		} finally {
 			s3.destroy();
@@ -1928,7 +1936,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-pjPwZz1r.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-B15NAPbL.js").then((n) => n.n);
 	const accountId = (await getAwsClients().sts.send(new GetCallerIdentityCommand({}))).Account;
 	const newName = getDefaultStateBucketName(accountId);
 	const legacyName = getLegacyStateBucketName(accountId, region);
@@ -1986,11 +1994,13 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 */
 async function bucketHasAnyState(client, bucketName) {
 	const { ListObjectsV2Command } = await import("@aws-sdk/client-s3");
+	const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
 	try {
 		return ((await client.send(new ListObjectsV2Command({
 			Bucket: bucketName,
 			Prefix: "cdkd/",
-			MaxKeys: 1
+			MaxKeys: 1,
+			...await expectedOwnerParam(client)
 		}))).KeyCount ?? 0) > 0;
 	} catch {
 		return true;
@@ -2011,8 +2021,12 @@ async function bucketHasAnyState(client, bucketName) {
 */
 async function bucketExists(client, bucketName) {
 	const { HeadBucketCommand } = await import("@aws-sdk/client-s3");
+	const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
 	try {
-		await client.send(new HeadBucketCommand({ Bucket: bucketName }));
+		await client.send(new HeadBucketCommand({
+			Bucket: bucketName,
+			...await expectedOwnerParam(client)
+		}));
 		return true;
 	} catch (error) {
 		const err = error;
@@ -4171,10 +4185,24 @@ var S3StateBackend = class {
 	* synthetic `UnknownError` (e.g. cross-region HEAD) becomes a concrete
 	* "Bucket does not exist" / "Access denied" / "different region" message.
 	*/
+	/**
+	* `ExpectedBucketOwner` spread for every state-bucket S3 call — S3 itself
+	* rejects the call (403) when the bucket is owned by another account,
+	* closing the predictable-name squatting hole (a foreign bucket that
+	* ALLOWS this account would otherwise silently receive state
+	* reads/writes). Best-effort: resolves to an empty object for
+	* non-standard clients (test doubles) — see expected-bucket-owner.ts.
+	*/
+	async ownerParam() {
+		return expectedOwnerParam(this.s3Client);
+	}
 	async verifyBucketExists() {
 		await this.ensureClientForBucket();
 		try {
-			await this.s3Client.send(new HeadBucketCommand({ Bucket: this.config.bucket }));
+			await this.s3Client.send(new HeadBucketCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam()
+			}));
 		} catch (error) {
 			const name = error.name;
 			if (name === "NotFound" || name === "NoSuchBucket") throw new StateError(`State bucket '${this.config.bucket}' does not exist. Run 'cdkd bootstrap' to create it, or specify an existing bucket via --state-bucket, CDKD_STATE_BUCKET, or cdk.json context.cdkd.stateBucket.`);
@@ -4221,6 +4249,7 @@ var S3StateBackend = class {
 			this.logger.debug(`Getting state for stack: ${stackName} (${region})`);
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: newKey
 			}));
 			if (!response.Body) throw new StateError(`State file for stack '${stackName}' (${region}) has no body`);
@@ -4283,6 +4312,7 @@ var S3StateBackend = class {
 			const bodyString = JSON.stringify(body, null, 2);
 			const response = await this.s3Client.send(new PutObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: newKey,
 				Body: bodyString,
 				ContentLength: Buffer.byteLength(bodyString),
@@ -4294,6 +4324,7 @@ var S3StateBackend = class {
 			if (migrateLegacy) try {
 				await this.s3Client.send(new DeleteObjectCommand({
 					Bucket: this.config.bucket,
+					...await this.ownerParam(),
 					Key: this.getLegacyStateKey(stackName)
 				}));
 				this.logger.info(`Migrated state for stack '${stackName}' to region-scoped layout (${region})`);
@@ -4323,11 +4354,13 @@ var S3StateBackend = class {
 			this.logger.debug(`Deleting state: ${stackName} (${region})`);
 			await this.s3Client.send(new DeleteObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: this.getStateKey(stackName, region)
 			}));
 			if (await this.legacyMatchesRegion(stackName, region)) {
 				await this.s3Client.send(new DeleteObjectCommand({
 					Bucket: this.config.bucket,
+					...await this.ownerParam(),
 					Key: this.getLegacyStateKey(stackName)
 				}));
 				this.logger.debug(`Deleted legacy state for stack: ${stackName}`);
@@ -4366,6 +4399,7 @@ var S3StateBackend = class {
 			do {
 				const response = await this.s3Client.send(new ListObjectsV2Command({
 					Bucket: this.config.bucket,
+					...await this.ownerParam(),
 					Prefix: prefix,
 					...continuationToken && { ContinuationToken: continuationToken }
 				}));
@@ -4425,6 +4459,7 @@ var S3StateBackend = class {
 		await this.ensureClientForBucket();
 		await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.config.bucket,
+			...await this.ownerParam(),
 			Key: key,
 			Body: body,
 			ContentLength: Buffer.byteLength(body),
@@ -4440,6 +4475,7 @@ var S3StateBackend = class {
 		try {
 			return await (await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key
 			}))).Body?.transformToString() ?? null;
 		} catch (error) {
@@ -4459,6 +4495,7 @@ var S3StateBackend = class {
 		do {
 			const response = await this.s3Client.send(new ListObjectsV2Command({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Prefix: keyPrefix,
 				...continuationToken && { ContinuationToken: continuationToken }
 			}));
@@ -4489,6 +4526,7 @@ var S3StateBackend = class {
 			const chunk = keys.slice(i, i + 1e3);
 			const response = await this.s3Client.send(new DeleteObjectsCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Delete: {
 					Objects: chunk.map((Key) => ({ Key })),
 					Quiet: true
@@ -4506,6 +4544,7 @@ var S3StateBackend = class {
 		try {
 			await this.s3Client.send(new HeadObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key
 			}));
 			return true;
@@ -4523,6 +4562,7 @@ var S3StateBackend = class {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: this.getLegacyStateKey(stackName)
 			}));
 			if (!response.Body) return void 0;
@@ -4546,6 +4586,7 @@ var S3StateBackend = class {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: this.getLegacyStateKey(stackName)
 			}));
 			if (!response.Body || !response.ETag) return null;
@@ -4643,6 +4684,14 @@ var LockManager = class {
 	* so when the state backend has already resolved the same bucket this
 	* incurs no additional `GetBucketLocation` call.
 	*/
+	/**
+	* `ExpectedBucketOwner` spread for every state-bucket S3 call (squatting
+	* hardening — see src/utils/expected-bucket-owner.ts). Best-effort:
+	* resolves to an empty object for non-standard clients (test doubles).
+	*/
+	async ownerParam() {
+		return expectedOwnerParam(this.s3Client);
+	}
 	async ensureClientForBucket() {
 		if (this.clientResolved) return;
 		if (this.resolveInFlight) return this.resolveInFlight;
@@ -4732,6 +4781,7 @@ var LockManager = class {
 			const lockBody = JSON.stringify(lockInfo, null, 2);
 			await this.s3Client.send(new PutObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key,
 				Body: lockBody,
 				ContentLength: Buffer.byteLength(lockBody),
@@ -4751,6 +4801,7 @@ var LockManager = class {
 						const retryBody = JSON.stringify(lockInfo, null, 2);
 						await this.s3Client.send(new PutObjectCommand({
 							Bucket: this.config.bucket,
+							...await this.ownerParam(),
 							Key: key,
 							Body: retryBody,
 							ContentLength: Buffer.byteLength(retryBody),
@@ -4786,6 +4837,7 @@ var LockManager = class {
 			this.logger.debug(`Getting lock info for stack: ${stackName}`);
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key
 			}));
 			if (!response.Body) throw new LockError(`Lock file for stack '${stackName}' has no body`);
@@ -4823,6 +4875,7 @@ var LockManager = class {
 			this.logger.debug(`Releasing lock for stack: ${stackName} (${region})`);
 			await this.s3Client.send(new DeleteObjectCommand({
 				Bucket: this.config.bucket,
+				...await this.ownerParam(),
 				Key: key
 			}));
 			this.logger.debug(`Lock released for stack: ${stackName} (${region})`);
@@ -4856,6 +4909,7 @@ var LockManager = class {
 		const key = this.getLockKey(stackName, region);
 		await this.s3Client.send(new DeleteObjectCommand({
 			Bucket: this.config.bucket,
+			...await this.ownerParam(),
 			Key: key
 		}));
 	}
@@ -9527,7 +9581,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dd9Xze-T.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dbl1_mwT.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -15843,5 +15897,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { AssetManifestLoader as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, buildDockerImage as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, runDockerStreaming as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, getDockerCmd as X, formatDockerLoginError as Y, runDockerForeground as Z, green as _, uploadCfnTemplate as _t, withRetry as a, resolveApp as at, IAMRoleProvider as b, resolveBucketRegion as bt, computeImplicitDeleteEdges as c, resolveSkipPrefix as ct, isStatefulRecreateTargetSync as d, resolveUseCdkBootstrapAssets as dt, getDockerImageBySourceHash as et, renderStatefulReason as f, warnDeprecatedNoPrefixCliFlag as ft, gray as g, findLargeInlineResources as gt, cyan as h, MIGRATE_TMP_PREFIX as ht, withResourceDeadline as i, getLegacyStateBucketName as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveStateBucketWithDefault as lt, bold as m, CFN_TEMPLATE_URL_LIMIT as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, synthesisStatusMessage as nt, isRetryableTransientError as o, resolveAutoAssetStorage as ot, formatResourceLine as p, CFN_TEMPLATE_BODY_LIMIT as pt, parseBootstrapMarker as q, DeployEngine as r, getDefaultStateBucketName as rt, IMPLICIT_DELETE_DEPENDENCIES as s, resolveCaptureObservedState as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, Synthesizer as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveStateBucketWithDefaultAndSource as ut, red as v, AssemblyReader as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, clearBucketRegionCache as yt, WorkGraph as z };
-//# sourceMappingURL=deploy-engine-Cbi5IzWV.js.map
+export { runDockerStreaming as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, parseBootstrapMarker as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, runDockerForeground as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, formatDockerLoginError as X, buildDockerImage as Y, getDockerCmd as Z, green as _, findLargeInlineResources as _t, withRetry as a, getLegacyStateBucketName as at, IAMRoleProvider as b, clearBucketRegionCache as bt, computeImplicitDeleteEdges as c, resolveCaptureObservedState as ct, isStatefulRecreateTargetSync as d, resolveStateBucketWithDefaultAndSource as dt, AssetManifestLoader as et, renderStatefulReason as f, resolveUseCdkBootstrapAssets as ft, gray as g, MIGRATE_TMP_PREFIX as gt, cyan as h, CFN_TEMPLATE_URL_LIMIT as ht, withResourceDeadline as i, getDefaultStateBucketName as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveSkipPrefix as lt, bold as m, CFN_TEMPLATE_BODY_LIMIT as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, Synthesizer as nt, isRetryableTransientError as o, resolveApp as ot, formatResourceLine as p, warnDeprecatedNoPrefixCliFlag as pt, getBootstrapMarkerKey as q, DeployEngine as r, synthesisStatusMessage as rt, IMPLICIT_DELETE_DEPENDENCIES as s, resolveAutoAssetStorage as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, getDockerImageBySourceHash as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveStateBucketWithDefault as ut, red as v, uploadCfnTemplate as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, resolveBucketRegion as xt, yellow as y, AssemblyReader as yt, WorkGraph as z };
+//# sourceMappingURL=deploy-engine-DqAIXGA_.js.map