@go-to-k/cdkd 0.284.66 → 0.284.68

package/dist/{deploy-engine-CgAjJmth.js → deploy-engine-PNoV56rY.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-B2nyZsKC.js";
+import { t as getCdkdVersion } from "./version-r1IKN_QV.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -18844,7 +18844,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CIhU7iyC.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CRANVDS-.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -20506,6 +20506,94 @@ function hasHandlerLogOutput(logTail) {
 	return logTail.split("\n").some((line) => line.trim().length > 0 && !CR_LOG_TAIL_BOILERPLATE.test(line.trimStart()));
 }
 /**
+* Parse a response body without trusting it. The body is written by the
+* customer's Lambda handler through a pre-signed URL, so it is UNTRUSTED
+* input: it may be truncated, may be a JSON scalar, or may be `null`. Every
+* one of those must be a normal "keep polling" outcome rather than a throw.
+*/
+function parseCfnResponseBody(body) {
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return { kind: "unparseable" };
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return { kind: "non-object" };
+	return {
+		kind: "envelope",
+		response: value
+	};
+}
+/**
+* Every field of the response is HANDLER-CONTROLLED, so each one is made safe
+* to render before it reaches a log line, and capped.
+*
+* Both halves are regressions this function introduced and a review caught.
+* The line it replaced printed `body.substring(0, 200)` -- raw WIRE json, where
+* the encoder had already escaped control characters as `\u001b`, and which was
+* capped at 200 characters by construction. Parsing first UNDOES the escaping:
+* an ESC and a newline reach the terminal as real bytes, so a handler (or
+* anyone holding the pre-signed response URL) could clear the screen and print
+* a forged `ERROR [cdkd]` line into a CI transcript. Measured: a
+* `PhysicalResourceId` carrying `ESC[2J` plus a newline rendered both. And
+* dropping the substring removed the bound -- a 5000-char id with 300 `Data`
+* keys rendered a 19,714-character line, re-emitted on EVERY poll.
+*
+* `displaySafe` is this repo's one answer to the first (issue
+* https://github.com/go-to-k/cdkd/issues/2170); `state.ts` already applies the
+* same treatment to this very value when it prints a state record.
+*/
+function capForLog(value) {
+	const safe = displaySafe(value);
+	const capped = safe.length > DESCRIBE_MAX_FIELD_CHARS ? `${safe.slice(0, DESCRIBE_MAX_FIELD_CHARS)}...(${safe.length} chars)` : safe;
+	return JSON.stringify(capped);
+}
+/** Per-field cap for the poll log line. */
+const DESCRIBE_MAX_FIELD_CHARS = 200;
+/** Whole-line clamp, applied after the per-field caps. */
+const DESCRIBE_MAX_LINE_CHARS = 1e3;
+/** How many `Data` key names the poll log line names before counting the rest. */
+const DESCRIBE_MAX_DATA_KEYS = 20;
+/**
+* Render a NON-SENSITIVE one-line summary of a custom-resource response body
+* for the poll's debug log (issue #2250).
+*
+* The body is the CloudFormation custom-resource response document, and its
+* `Data` field is the documented place a handler returns a GENERATED VALUE —
+* including a generated secret. The previous log line emitted
+* `body.substring(0, 200)`, which put those values on the terminal (and, in
+* CI, into the retained build log) on every poll under `--verbose`.
+*
+* What survives here is everything the line was actually useful for: WHICH
+* resource answered (the caller adds the logical id), WHETHER it succeeded
+* (`Status`), what identity it claimed (`PhysicalResourceId` — already
+* persisted to state.json, so not a new channel), and WHICH keys came back
+* (`Object.keys(Data)`). The `Data` VALUES never appear, and neither does
+* `Reason`, which is free-form handler text that can quote them.
+*
+* For a body that is not a usable envelope, only its LENGTH is reported —
+* never its bytes. That keeps the diagnostic for the case it matters most in
+* (a handler writing a malformed response) without turning the fallback into
+* the same prefix echo through another door.
+*/
+function describeCfnResponseBody(body, parsed) {
+	if (parsed.kind !== "envelope") return `${parsed.kind === "unparseable" ? "unparseable body" : "JSON body is not an object"} (${body.length} chars)`;
+	const envelope = parsed.response;
+	const status = typeof envelope["Status"] === "string" ? envelope["Status"] : "<absent>";
+	const physicalId = typeof envelope["PhysicalResourceId"] === "string" ? envelope["PhysicalResourceId"] : "<absent>";
+	const data = envelope["Data"];
+	let dataPart;
+	if (data === void 0) dataPart = "Data absent";
+	else if (typeof data === "object" && data !== null && !Array.isArray(data)) {
+		const keys = Object.keys(data);
+		const shown = keys.slice(0, DESCRIBE_MAX_DATA_KEYS).map((k) => capForLog(k));
+		const omitted = keys.length - shown.length;
+		dataPart = `Data keys [${shown.join(", ")}${omitted > 0 ? `, +${omitted} more` : ""}]`;
+	} else dataPart = "Data not an object";
+	const line = `Status=${capForLog(status)} PhysicalResourceId=${capForLog(physicalId)} ${dataPart}`;
+	return line.length > DESCRIBE_MAX_LINE_CHARS ? `${line.slice(0, DESCRIBE_MAX_LINE_CHARS)}...(${line.length} chars total)` : line;
+}
+/**
 * Custom Resource Provider
 *
 * Implements Lambda-backed custom resources by invoking the Lambda function
@@ -21188,7 +21276,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	}
 	/** Truncate a CR FAILED reason for log readability. */
 	truncateReason(reason, max = 200) {
-		const r = reason ?? "Unknown reason";
+		const r = displaySafe(reason ?? "Unknown reason");
 		return r.length > max ? `${r.slice(0, max)}...` : r;
 	}
 	/**
@@ -21503,16 +21591,15 @@ var CustomResourceProvider = class CustomResourceProvider {
 						Key: responseKey
 					}))).Body?.transformToString();
 					if (body && body.length > 0) {
-						this.logger.debug(`Got S3 response for ${logicalId}: ${body.substring(0, 200)}`);
-						try {
-							const cfnResponse = JSON.parse(body);
+						const parsed = parseCfnResponseBody(body);
+						this.logger.debug(`Got S3 response for ${logicalId}: ${describeCfnResponseBody(body, parsed)}`);
+						if (parsed.kind === "envelope") {
+							const cfnResponse = parsed.response;
 							if (cfnResponse.Status === "SUCCESS" || cfnResponse.Status === "FAILED") {
 								await this.cleanupResponseObject(responseKey);
 								return cfnResponse;
 							}
-						} catch {
-							this.logger.debug(`S3 response not yet valid JSON for ${logicalId}, retrying...`);
-						}
+						} else this.logger.debug(`S3 response not yet valid JSON for ${logicalId}, retrying...`);
 					}
 				} catch (error) {
 					const err = error;
@@ -30544,4 +30631,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, findLargeInlineResources as $n, TemplateParser as $t, renderStatefulReason as A, formatDockerLoginError as An, StackHasActiveImportsError as Ar, STATE_SOURCED_READBACK_RULES as At, exportAliasCollisionScrubWarning as B, getLegacyStateBucketName as Bn, isThrottlingError as Br, classifyReplaySecretRegion as Bt, isFinalSnapshotError as C, parseBootstrapMarker as Cn, LockError as Cr, configStringRefusal as Ct, extractDeploymentEventError as D, buildDenyExternalAccessPolicy as Dn, ProvisioningError as Dr, requireConfigObject as Dt, makeCanonicalizePropertiesFn as E, validateContainerRepoName as En, PartialFailureError as Er, requireConfigArray as Et, green as F, AssetManifestLoader as Fn, isCdkdError as Fr, isSingleDynamicReferenceToken as Ft, IAMRoleProvider as G, resolveStateBucketWithDefault as Gn, s3BucketRegionalDomainName as Gt, secretBearingStateKeyWarning as H, resolveAutoAssetStorage as Hn, __exportAll as Hr, s3BucketArn as Ht, red as I, getDockerImageBySourceHash as In, normalizeAwsError as Ir, maskSecretsInError as It, ProviderRegistry as J, stateBucketExistenceConfirmed as Jn, DiffCalculator as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveStateBucketWithDefaultAndSource as Kn, s3BucketWebsiteUrl as Kt, yellow as L, Synthesizer as Ln, withErrorHandling as Lr, maskSecretsInText as Lt, bold as M, partitionSensitiveEnv as Mn, StateError as Mr, createSecretMasker as Mt, cyan as N, runDockerForeground as Nn, SynthesisError as Nr, dynamicReferenceTokens as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDockerImage as On, ResourceTimeoutError as Or, requireConfigString as Ot, gray as P, runDockerStreaming as Pn, formatError as Pr, errorCauseChain as Pt, maskDeep as Q, MIGRATE_TMP_PREFIX as Qn, DagBuilder as Qt, collectDeclaredOutputNames as R, synthesisStatusMessage as Rn, isMarkedNonRetryable as Rr, redactSecretsForState as Rt, createPreDeleteFinalSnapshot as S, isCrossRegionRedirect as Sn, LocalStartServiceError as Sr, configBooleanRefusal as St, unsupportedFinalSnapshotError as T, validateAssetBucketName as Tn, NestedStackChildDirectDestroyError as Tr, replayWarn as Tt, stateKeySecretExposure as U, resolveCaptureObservedState as Un, s3BucketDomainName as Ut, isExportAliasCollision as V, resolveApp as Vn, markNonRetryable as Vr, producerRegionsFromState as Vt, getCurrentResourceSecrets as W, resolveSkipPrefix as Wn, s3BucketDualStackDomainName as Wt, findSilentDropProperties as X, CFN_TEMPLATE_BODY_LIMIT as Xn, describeTypeWithThrottleRetry as Xt, findActionableSilentDrops as Y, warnDeprecatedNoPrefixCliFlag as Yn, INTRINSIC_KEYS as Yt, createMaskedRetryLogger as Z, CFN_TEMPLATE_URL_LIMIT as Zn, withRetry as Zt, computeImplicitDeleteEdges as _, AssetModeResolver as _n, DependencyError as _r, WAFv2WebACLProvider as _t, DeploymentEventsStore as a, importableOutputKeys as an, AssemblyReader as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, ensureAssetStorage as bn, LocalInvokeBuildError as br, assertRegionMatch as bt, replayFailedOperations as c, AssetPublisher as cn, resolveBucketRegion as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, buildAssetRedirectMap as dn, resetAwsClients as dr, IntrinsicFunctionResolver as dt, LockManager as en, uploadCfnTemplate as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, createAssetRedirectResolver as fn, setAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, stripControlChars as gn, CrossAccountSecretRefusalError as gr, refStateLookupFromResource as gt, maskingRetryLogger as h, escapeRegExp$1 as hn, ConfigError as hr, parameterTypeMayLoseSecretIdentity as ht, DeploymentEventsReader as i, exportNamesCarriedFrom as in, derivePartitionAndUrlSuffix as ir, interruptWatchListenerCount as it, formatResourceLine as j, getDockerCmd as jn, StackTerminationProtectionError as jr, TEMPLATE_SOURCED_RULES as jt, isStatefulRecreateTargetSync as k, dockerSpawnEnvWithSensitive as kn, ResourceUpdateNotSupportedError as kr, STATE_SOURCED_CROSS_GENERATION_RULES as kt, replayRollback as l, stringifyValue as ln, AwsClients as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, rewriteTemplateAssetReferences as mn, CdkdError as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, S3StateBackend as nn, PARTITION_TABLE as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputs as on, processStackMessages as or, startInterruptWatch as ot, deleteSkipReason as p, loadPublishableAssetManifest as pn, AssetError as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveUseCdkBootstrapAssets as qn, applyRoleArnIfSet as qt, DeployEngine as r, rebuildClientForBucketRegion as rn, canonicalizeRegion as rr, endCommandInterruptScope as rt, planRollback as s, shouldRetainResource as sn, clearBucketRegionCache as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, displaySafe as tn, expectedOwnerParam as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, WorkGraph as un, getAwsClients as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, BOOTSTRAP_MARKER_PREFIX as vn, DeployCancelledError as vr, normalizeAwsTagsToCfn as vt, refusesFinalSnapshot as w, readBootstrapMarkerBody as wn, MissingCdkCliError as wr, readConfigString as wt, ccRoutedFinalSnapshotError as x, getBootstrapMarkerKey as xn, LocalMigrateError as xr, coerceCfnBoolean as xt, PRE_DELETE_SNAPSHOT_TYPES as y, assertAssetBucketRegion as yn, DynamicReferenceRegionAmbiguousError as yr, resolveExplicitPhysicalId as yt, collectPublishedOutputNames as z, getDefaultStateBucketName as zn, isRetryableTransientError as zr, scrubResourceRecord as zt };
-//# sourceMappingURL=deploy-engine-CgAjJmth.js.map
+//# sourceMappingURL=deploy-engine-PNoV56rY.js.map