@go-to-k/cdkd 0.284.67 → 0.284.69

package/dist/{deploy-engine-wrIe6cV6.js → deploy-engine-CHLe31Fh.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-DNFFsbnH.js";
+import { t as getCdkdVersion } from "./version-C-t2pnSY.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12545,10 +12545,16 @@ function isUniquelyKeyedBy(items, key) {
 *   the unchanged-resource path the value scan is also a no-op, so such a leaf
 *   keeps its plaintext — narrow (an identity field is a name, not a
 *   credential) but real.
-* - **Arrays of arrays.** `M: [[{Name, Value}]]` pairs nothing, because the
+* - **Arrays of arrays.** `M: [[{Name, Value}]]` pairs nothing HERE, because the
 *   OUTER elements are arrays rather than plain objects and have no identity
-*   field to key on. Positional descent into the outer list would reintroduce
-*   the order assumption this function exists to avoid.
+*   field to key on. Blind positional descent into the outer list would
+*   reintroduce the order assumption this function exists to avoid. On the
+*   READBACK paths it is no longer a dead end:
+*   {@link refuseUncertifiedReadbackPositions} (issue #2012) walks the outer
+*   list positionally when {@link unkeyedArrayPairsByAnchors} says the inner
+*   elements' own anchors vouch for the alignment, which meets the order
+*   objection instead of ignoring it. The gate decides; it does not walk. Everywhere else — and whenever
+*   those anchors do not match — the shape still falls to the value scan.
 */
 function identityKeyFor(bag, source) {
 	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
@@ -12822,6 +12828,286 @@ function mixedLeafMayCarryPublicReference(source, secrets) {
 	return dynamicReferenceTokens(source).some((token) => token.startsWith("{{resolve:ssm:") && !isRecordedSecretExpression(token));
 }
 /**
+* Does this value carry an ORDINARY object prototype?
+*
+* `isPlainObject` answers `typeof === 'object' && !Array.isArray`, which admits
+* CLASS INSTANCES, and that is a hole under {@link deepEqualJsonValue}: an AWS
+* SDK v3 readback reaching `drainObservedCaptures` is PRE-JSON and really does
+* carry `Date` values (`LastModified`, `CreationDate`). `Object.keys(new
+* Date())` is `[]`, so without this check a `Date` compared equal to `{}` and
+* to every other `Date` -- an anchor that corroborates a pairing while proving
+* nothing. Widening `isPlainObject` itself was rejected: it is read by three
+* other walks whose behaviour would change with it, and the defect is in what
+* EQUALITY means here, not in what counts as a container.
+*
+* A `Date` anchor now corroborates NOTHING, so an element carrying one refuses
+* rather than pairs. That is the conservative direction this module always
+* takes -- the residual stays a refusal -- and it is stated because the
+* opposite reading (that a `Date` on both sides is evidence) is the one a
+* future edit will be tempted by.
+*/
+function hasPlainPrototype(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/**
+* Structural equality over the JSON shapes this module walks (issue #2012).
+*
+* Own ENUMERABLE keys only, and a key count on both sides, so an inherited
+* field is not equality and neither is a bag that merely CONTAINS the source's
+* keys. That agrees with the two walks beside it -- `isUniquelyKeyedBy` and the
+* object arm of {@link refuseUncertifiedReadbackPositions} both use
+* `Object.hasOwn` -- and it matters here rather than being hygiene: this
+* predicate is the evidence an anchor pairing rests on, so a comparison that
+* reads the prototype chain would let a constructed bag corroborate a pairing
+* it does not actually match.
+*
+* `JSON.stringify` was the obvious alternative and is wrong twice over: it is
+* key-ORDER sensitive (an AWS readback routinely reorders object keys, which
+* says nothing about the values) and it silently drops `undefined`, so
+* `{A: undefined}` and `{}` would compare equal while their key counts differ.
+*/
+function deepEqualJsonValue(a, b) {
+	if (a === b) return true;
+	if (Array.isArray(a)) {
+		if (!Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
+	}
+	if (isPlainObject$2(a)) {
+		if (!isPlainObject$2(b)) return false;
+		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
+		const keys = Object.keys(a);
+		if (keys.length !== Object.keys(b).length) return false;
+		return keys.every((k) => Object.hasOwn(b, k) && deepEqualJsonValue(a[k], b[k]));
+	}
+	return false;
+}
+/**
+* Is an equal SOURCE value at an anchor position actually EVIDENCE that the two
+* containers describe the same element?
+*
+* A NON-EMPTY STRING is, and deliberately nothing else is. This is the same bar
+* {@link isUniquelyKeyedBy} already applies to an identity field, and for the
+* same reason: `''` is not a distinguishing value (it is also why the value
+* scan refuses it as a needle), and a non-string carries so few inhabitants
+* that equality is nearly free -- `{Name: 1, Value: <literal>}` and `{Name: 1,
+* Value: <expression>}` agree on `Name` whether or not they are the same entry,
+* so pairing on it would copy a secret reference onto an unrelated literal.
+* Both shapes are pinned in `secret-redaction-array-identity.test.ts` on the
+* IDENTITY arm and again in `secret-redaction-anchor-pairing.test.ts` on this
+* one; an anchor that accepted them would reopen from the positional side
+* exactly what that arm refuses.
+*
+* Containers count when something inside them does, so a nested literal object
+* can anchor a pairing its own level cannot. That recursion is also why this
+* predicate ALONE is not enough, and the review that measured it is worth
+* recording: `AWS::AmazonMQ::Broker.Users` renders `Groups: ['admin']`
+* identically on every element, which is distinguishing by this test and yet
+* tells two users APART not at all. Distinguishing is a property of ONE value;
+* telling elements apart is a property of the WHOLE array, and
+* {@link unkeyedArrayPairsByAnchors} is where the second one is enforced.
+*
+* This is a REFINEMENT of the formulation recorded on issue #2012, which said
+* only "every position whose SOURCE carries no dynamic reference is deep-equal
+* on both sides". Taken literally that admits a pairing corroborated ONLY by
+* `Name: ''` or `Name: 1`, which is measurably wrong: the counterexample the
+* issue states (`{Name:'', Value:'lit'}` against `{Name:'db', Value:<expr>}`)
+* has DIFFERING names and refuses on inequality alone, but the fence actually
+* in the tree carries `Name: ''` on BOTH sides, where equality holds and only
+* this predicate stands between an unrelated literal and a false redaction.
+*/
+function isDistinguishingAnchor(value) {
+	if (typeof value === "string") return value !== "";
+	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
+	if (isPlainObject$2(value)) return Object.values(value).some(isDistinguishingAnchor);
+	return false;
+}
+/**
+* Stands in for a reference-bearing leaf inside an {@link anchorSignature}.
+*
+* Written UNQUOTED while `JSON.stringify` quotes every real string, so no
+* literal can spell it and collide with a masked reference.
+*/
+const ANCHOR_REFERENCE_MASK = "<ref>";
+/**
+* The part of a SOURCE element the anchors can actually see: the element with
+* every reference-bearing leaf masked, serialized canonically.
+*
+* Two elements with the same signature are INDISTINGUISHABLE to this pass --
+* the anchors say the same thing about both -- so a permutation swapping them
+* preserves every anchor and the alignment is not determined. That is the
+* property {@link isUniquelyKeyedBy} enforces for an identity FIELD, restated
+* for a whole projection instead of a single key.
+*
+* The signature is ORDER-INSENSITIVE in both directions -- object keys AND list
+* elements are sorted -- and that is not cosmetic normalisation. Rule 3's
+* question is "could AWS hand these two elements back SWAPPED without the swap
+* being visible", so the projection has to quotient by everything AWS may
+* itself reorder. Outer list order is the gate's own subject; order WITHIN an
+* anchor's list is this function's, for exactly the reason `descendArrays:
+* false` exists at all. A first cut sorted only the keys, and the security
+* review measured the hole on `AWS::AmazonMQ::Broker.Users`: two users whose
+* `Groups` were `['admin','ops']` and `['ops','admin']` signed DIFFERENTLY, so
+* rule 3 passed while the anchors still deep-equalled position for position,
+* and a reordered `DescribeBroker` put the admin's `Username` / `Password`
+* expressions at the app user's index. Byte-identical anchor content was being
+* assumed -- the order assumption this module refuses everywhere else.
+*
+* Sorting FAILS CLOSED, which is why it is the right shape of fix: it can only
+* make two signatures COLLIDE that previously differed, never the reverse, so
+* its only possible effect is an extra refusal. A missed closure, never a leak.
+*
+* The asymmetry with {@link deepEqualJsonValue} is deliberate and must survive
+* a reader who notices it. That predicate stays order-SENSITIVE on lists
+* because rule 1 asks a different question -- "did AWS return THIS position
+* unchanged" -- and a reordered list is a changed position. Making rule 1
+* order-blind too would weaken the corroboration rather than align it; the case
+* pinning that is `REFUSES an anchor list REORDERED in place` in
+* `secret-redaction-anchor-pairing.test.ts`.
+*/
+function anchorSignature(source) {
+	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
+	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
+	if (isPlainObject$2(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	return JSON.stringify(source) ?? "undefined";
+}
+/**
+* ANCHOR PAIRING (issue #2012): do these two containers corroborate each other
+* position by position?
+*
+* Two conditions, both required:
+*
+* 1. the key sets (objects) or index counts (arrays) match, and
+* 2. every position whose SOURCE carries no dynamic reference is deep-equal on
+*    both sides -- the *anchors*.
+*
+* Anchors are what make the pairing EVIDENCE rather than a guess: a position
+* AWS did not rewrite proves the two containers describe the same element. It
+* answers the `descendArrays: false` objection on its own terms the way keying
+* does -- a REORDERED list normally puts a different element under each index,
+* so its anchors stop matching and the whole array is refused.
+*
+* "Normally" is doing real work in that sentence, and an earlier revision of it
+* did not have the word. A reorder is INVISIBLE to the anchors when the
+* elements it swaps look the same to them, which is the whole subject of
+* {@link unkeyedArrayPairsByAnchors}. This function answers only "does position
+* i corroborate position i"; whether the array as a whole may be walked at all
+* is decided there, and nothing here is sufficient on its own.
+*
+* What it deliberately CANNOT buy is baseline content. Every substitution the
+* caller then makes is a STRING leaf at a position the bag already has, so a
+* corroborated pairing never adds a key, adds an element, or writes a scalar
+* over a container. The principle this module is built on -- **redaction may
+* not buy itself a fabricated baseline** -- is preserved structurally rather
+* than by a special case, which is what the first attempt at these rows (taking
+* the SOURCE array wholesale) failed to do.
+*
+* The cost, stated rather than discovered: one deep compare per candidate
+* position, and a yield that drops to ZERO as soon as AWS normalises any
+* sibling field in the same container. That is common, so this closes a SUBSET
+* of the shapes issue #2012 lists rather than all of them, and the residual
+* stays a refusal -- which is the correct direction to be wrong in here.
+*/
+function anchorsCorroboratePairing(bag, source, anchors) {
+	if (!subtreeHasDynamicReference(source)) {
+		if (!deepEqualJsonValue(bag, source)) return false;
+		if (isDistinguishingAnchor(source)) anchors.distinguishing += 1;
+		return true;
+	}
+	if (isDynamicReferenceString(source)) return typeof bag === "string";
+	if (isPlainObject$2(source)) {
+		if (!isPlainObject$2(bag)) return false;
+		const sourceKeys = Object.keys(source);
+		if (sourceKeys.length !== Object.keys(bag).length) return false;
+		return sourceKeys.every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
+	}
+	if (Array.isArray(source)) {
+		if (!Array.isArray(bag) || bag.length !== source.length) return false;
+		return source.every((item, i) => anchorsCorroboratePairing(bag[i], item, anchors));
+	}
+	return false;
+}
+/**
+* May this UNKEYED array be walked positionally? The gate the anchor relaxation
+* actually rests on (issue #2012 review).
+*
+* {@link anchorsCorroboratePairing} answers per POSITION. Asking it once for
+* the whole array and requiring one distinguishing anchor ANYWHERE in the
+* result -- which an earlier revision did -- is unsound in two INDEPENDENT
+* ways, both measured by review against real shapes rather than reasoned about:
+*
+* - **Evidence for one element was credited to another.** `[{Name:'db',
+*   Value:<exprA>}, {Name:'', Value:<exprB>}]` has a distinguishing anchor at
+*   index 0 and NONE at index 1, and the array-wide counter licensed both -- so
+*   an unrelated literal at index 1 took `<exprB>`. That is precisely the false
+*   redaction `isDistinguishingAnchor` exists to prevent, arriving through the
+*   counter's SCOPE instead of through its definition.
+* - **Equal anchors cannot detect a reorder.** `['--pw', <exprA>, '--pw',
+*   <exprB>]` against a readback holding the two values swapped matches every
+*   anchor at every index, because both anchors are `'--pw'` -- so each
+*   position was pinned to the OTHER secret's expression.
+*   `AWS::AmazonMQ::Broker.Users` is the shape that makes this real rather than
+*   contrived: no `Name`/`Key`, both `Username` and `Password` rendered through
+*   `secretValueFromJson`, and `Groups: ['admin']` equal on every element, so a
+*   `DescribeBroker` returning the users in the other order records the ADMIN
+*   credential's reference at the app user's position -- which `cdkd drift
+*   --revert` then pushes to the live broker.
+*
+* So the gate is:
+*
+* 1. **Every position corroborates**, with the counter scoped PER top-level
+*    element rather than shared across the array.
+* 2. **Every reference-bearing element carries its own evidence.** A CONTAINER
+*    must hold a distinguishing anchor INSIDE it: it has an interior where an
+*    identity could live, so the absence of one is meaningful. A BARE reference
+*    leaf has no interior, so absence says nothing about it and the only
+*    evidence available is the FRAME -- the array's non-reference-bearing
+*    elements, which must then supply a distinguishing anchor between them.
+*    That distinction is exactly what separates `['--pw', <expr>, '--verbose']`
+*    (CLOSES: the literal flags pin the one free slot) from `[{V:'us-east-1'},
+*    {V:<expr>}]` (REFUSES: the second element could hold anything, and
+*    overwriting it would erase a genuine out-of-band change from the drift
+*    baseline, so `cdkd drift` reports clean and `--revert` never sees it).
+* 3. **Reference-bearing elements are pairwise DISTINGUISHABLE**, by
+*    {@link anchorSignature}. Two elements the anchors describe identically
+*    admit a permutation that preserves every anchor, so the alignment is not
+*    determined and no amount of per-position equality makes it so.
+*
+* Checking uniqueness on the SOURCE side alone is sufficient, and the argument
+* is worth stating because the bag side looks like it needs checking too: rule
+* 1 has already established that the bag matches the source at every anchor
+* position, so the two projections are equal element-wise. If some permutation
+* other than the identity also satisfied the anchors, two SOURCE elements would
+* have to share a signature -- which rule 3 excludes. This is the same
+* multiset-correctness argument `isUniquelyKeyedBy` makes for a single field.
+*
+* NESTED arrays are not re-checked here, and do not need to be: the caller
+* recurses through {@link refuseUncertifiedReadbackPositions}, which re-enters
+* its own array arm for every nested list and consults this gate again with
+* that list's own elements. A nested array whose elements are indistinguishable
+* is therefore refused on its own terms while its parent may still pair.
+*/
+function unkeyedArrayPairsByAnchors(bag, source) {
+	if (bag.length !== source.length) return false;
+	const distinguishingPerElement = [];
+	for (const [i, item] of source.entries()) {
+		const anchors = { distinguishing: 0 };
+		if (!anchorsCorroboratePairing(bag[i], item, anchors)) return false;
+		distinguishingPerElement.push(anchors.distinguishing);
+	}
+	const frameDistinguishing = source.reduce((total, item, i) => subtreeHasDynamicReference(item) ? total : total + distinguishingPerElement[i], 0);
+	const signatures = /* @__PURE__ */ new Set();
+	for (const [i, item] of source.entries()) {
+		if (!subtreeHasDynamicReference(item)) continue;
+		const signature = anchorSignature(item);
+		if (signatures.has(signature)) return false;
+		signatures.add(signature);
+		if (distinguishingPerElement[i] > 0) continue;
+		if (!isDynamicReferenceString(item) || frameDistinguishing === 0) return false;
+	}
+	return true;
+}
+/**
 * Refuse to persist a readback leaf the path pass could not CERTIFY, at any
 * position the STATE source proves is secret-bearing (issue #1926 review).
 *
@@ -12841,8 +13127,9 @@ function mixedLeafMayCarryPublicReference(source, secrets) {
 *   -----------------------------------------------  ------------  ---------------
 *   `postgres://u:{{resolve:...}}@h` (MIXED string)   LEAK          take source
 *   ...the same MIXED leaf inside a PAIRED element    LEAK          take source
-*   `['--pw', '{{resolve:...}}']` (no identity key)   LEAK          LEAK (#2012)
-*   `[{Field, Val: '{{resolve:...}}'}]` (no `Name`)   LEAK          LEAK (#2012)
+*   `['--pw', '{{resolve:...}}']` (no identity key)   LEAK          take source*
+*   `[{Field, Val: '{{resolve:...}}'}]` (no `Name`)   LEAK          take source*
+*   ...either of those, but REORDERED / normalised    LEAK          LEAK (#2012)
 *   an UNPAIRED element beside a paired one           LEAK          LEAK (#2012)
 *   an observed KEY the source does not carry         LEAK          LEAK (#2012)
 *   whole `{{resolve:...}}` token                     ok            ok
@@ -12864,7 +13151,27 @@ function mixedLeafMayCarryPublicReference(source, secrets) {
 * not a WHOLE token. Everything it takes is the record's own value at the
 * record's own path.
 *
-* The four residual rows are one root cause, not four: no needle and no
+* The starred rows are the two ANCHOR PAIRING closed for issue #2012, and the
+* star is load-bearing: they close only when the pairing is CORROBORATED. Four
+* conditions, all required — the index counts match; every position the source
+* does not spell as a reference is deep-equal on both sides; every
+* reference-bearing ELEMENT carries its own distinguishing anchor, or, being a
+* bare reference leaf with no interior to carry one, leans on the array's
+* literal FRAME; and no two reference-bearing elements look alike to the
+* anchors. That is why the row beneath them exists. As soon as AWS reorders the
+* list or normalises any sibling field, the anchors stop matching and the same
+* two shapes refuse again, so the closure is a SUBSET of each row rather than
+* the whole of it.
+*
+* An earlier revision of this paragraph stated only the first two conditions
+* plus "at least one of them distinguishing", which was the gate BEFORE the
+* #2012 review — under it `['--pw', <exprA>, '--pw', <exprB>]` closes and
+* misattributes, so the text documented the defect as the design. See
+* {@link unkeyedArrayPairsByAnchors}, which is where all four live;
+* {@link anchorsCorroboratePairing} answers only one of them and its own doc
+* says nothing in it is sufficient alone.
+*
+* The residual rows are one root cause, not several: no needle and no
 * position, so nothing distinguishes a resolved secret from an ordinary
 * literal. They are NOT closed by taking the source subtree, which an earlier
 * revision did and the issue #1915 fences correctly rejected — measured, it
@@ -12872,7 +13179,9 @@ function mixedLeafMayCarryPublicReference(source, secrets) {
 * turned an AWS-reported `[{Value:'x'}]` into `[{Name:'db', Value:<expr>}]`,
 * fabricating drift-baseline content AWS never reported that `cdkd drift
 * --revert` then pushes to the live resource. Redaction may not buy itself a
-* fabricated baseline.
+* fabricated baseline — which is also the bar anchor pairing had to clear, and
+* clears structurally: it only ever licenses a walk of positions the BAG
+* already has, so it can add no key, no element and no scalar-over-container.
 *
 * The MIXED row is the shape this module itself calls DOMINANT for CDK — an
 * `Fn::Join` around `secret.secretValueFromJson(...)`.
@@ -12907,7 +13216,10 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets) {
 	}
 	if (Array.isArray(bag) && Array.isArray(source)) {
 		const key = identityKeyFor(bag, source);
-		if (key === void 0) return bag;
+		if (key === void 0) {
+			if (!unkeyedArrayPairsByAnchors(bag, source)) return bag;
+			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets));
+		}
 		const sourceByIdentity = /* @__PURE__ */ new Map();
 		for (const item of source) sourceByIdentity.set(item[key], item);
 		return bag.map((item) => {
@@ -18844,7 +19156,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-fy2cEq7m.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CLnf8ct8.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -20506,6 +20818,94 @@ function hasHandlerLogOutput(logTail) {
 	return logTail.split("\n").some((line) => line.trim().length > 0 && !CR_LOG_TAIL_BOILERPLATE.test(line.trimStart()));
 }
 /**
+* Parse a response body without trusting it. The body is written by the
+* customer's Lambda handler through a pre-signed URL, so it is UNTRUSTED
+* input: it may be truncated, may be a JSON scalar, or may be `null`. Every
+* one of those must be a normal "keep polling" outcome rather than a throw.
+*/
+function parseCfnResponseBody(body) {
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return { kind: "unparseable" };
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return { kind: "non-object" };
+	return {
+		kind: "envelope",
+		response: value
+	};
+}
+/**
+* Every field of the response is HANDLER-CONTROLLED, so each one is made safe
+* to render before it reaches a log line, and capped.
+*
+* Both halves are regressions this function introduced and a review caught.
+* The line it replaced printed `body.substring(0, 200)` -- raw WIRE json, where
+* the encoder had already escaped control characters as `\u001b`, and which was
+* capped at 200 characters by construction. Parsing first UNDOES the escaping:
+* an ESC and a newline reach the terminal as real bytes, so a handler (or
+* anyone holding the pre-signed response URL) could clear the screen and print
+* a forged `ERROR [cdkd]` line into a CI transcript. Measured: a
+* `PhysicalResourceId` carrying `ESC[2J` plus a newline rendered both. And
+* dropping the substring removed the bound -- a 5000-char id with 300 `Data`
+* keys rendered a 19,714-character line, re-emitted on EVERY poll.
+*
+* `displaySafe` is this repo's one answer to the first (issue
+* https://github.com/go-to-k/cdkd/issues/2170); `state.ts` already applies the
+* same treatment to this very value when it prints a state record.
+*/
+function capForLog(value) {
+	const safe = displaySafe(value);
+	const capped = safe.length > DESCRIBE_MAX_FIELD_CHARS ? `${safe.slice(0, DESCRIBE_MAX_FIELD_CHARS)}...(${safe.length} chars)` : safe;
+	return JSON.stringify(capped);
+}
+/** Per-field cap for the poll log line. */
+const DESCRIBE_MAX_FIELD_CHARS = 200;
+/** Whole-line clamp, applied after the per-field caps. */
+const DESCRIBE_MAX_LINE_CHARS = 1e3;
+/** How many `Data` key names the poll log line names before counting the rest. */
+const DESCRIBE_MAX_DATA_KEYS = 20;
+/**
+* Render a NON-SENSITIVE one-line summary of a custom-resource response body
+* for the poll's debug log (issue #2250).
+*
+* The body is the CloudFormation custom-resource response document, and its
+* `Data` field is the documented place a handler returns a GENERATED VALUE —
+* including a generated secret. The previous log line emitted
+* `body.substring(0, 200)`, which put those values on the terminal (and, in
+* CI, into the retained build log) on every poll under `--verbose`.
+*
+* What survives here is everything the line was actually useful for: WHICH
+* resource answered (the caller adds the logical id), WHETHER it succeeded
+* (`Status`), what identity it claimed (`PhysicalResourceId` — already
+* persisted to state.json, so not a new channel), and WHICH keys came back
+* (`Object.keys(Data)`). The `Data` VALUES never appear, and neither does
+* `Reason`, which is free-form handler text that can quote them.
+*
+* For a body that is not a usable envelope, only its LENGTH is reported —
+* never its bytes. That keeps the diagnostic for the case it matters most in
+* (a handler writing a malformed response) without turning the fallback into
+* the same prefix echo through another door.
+*/
+function describeCfnResponseBody(body, parsed) {
+	if (parsed.kind !== "envelope") return `${parsed.kind === "unparseable" ? "unparseable body" : "JSON body is not an object"} (${body.length} chars)`;
+	const envelope = parsed.response;
+	const status = typeof envelope["Status"] === "string" ? envelope["Status"] : "<absent>";
+	const physicalId = typeof envelope["PhysicalResourceId"] === "string" ? envelope["PhysicalResourceId"] : "<absent>";
+	const data = envelope["Data"];
+	let dataPart;
+	if (data === void 0) dataPart = "Data absent";
+	else if (typeof data === "object" && data !== null && !Array.isArray(data)) {
+		const keys = Object.keys(data);
+		const shown = keys.slice(0, DESCRIBE_MAX_DATA_KEYS).map((k) => capForLog(k));
+		const omitted = keys.length - shown.length;
+		dataPart = `Data keys [${shown.join(", ")}${omitted > 0 ? `, +${omitted} more` : ""}]`;
+	} else dataPart = "Data not an object";
+	const line = `Status=${capForLog(status)} PhysicalResourceId=${capForLog(physicalId)} ${dataPart}`;
+	return line.length > DESCRIBE_MAX_LINE_CHARS ? `${line.slice(0, DESCRIBE_MAX_LINE_CHARS)}...(${line.length} chars total)` : line;
+}
+/**
 * Custom Resource Provider
 *
 * Implements Lambda-backed custom resources by invoking the Lambda function
@@ -21188,7 +21588,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	}
 	/** Truncate a CR FAILED reason for log readability. */
 	truncateReason(reason, max = 200) {
-		const r = reason ?? "Unknown reason";
+		const r = displaySafe(reason ?? "Unknown reason");
 		return r.length > max ? `${r.slice(0, max)}...` : r;
 	}
 	/**
@@ -21503,16 +21903,15 @@ var CustomResourceProvider = class CustomResourceProvider {
 						Key: responseKey
 					}))).Body?.transformToString();
 					if (body && body.length > 0) {
-						this.logger.debug(`Got S3 response for ${logicalId}: ${body.substring(0, 200)}`);
-						try {
-							const cfnResponse = JSON.parse(body);
+						const parsed = parseCfnResponseBody(body);
+						this.logger.debug(`Got S3 response for ${logicalId}: ${describeCfnResponseBody(body, parsed)}`);
+						if (parsed.kind === "envelope") {
+							const cfnResponse = parsed.response;
 							if (cfnResponse.Status === "SUCCESS" || cfnResponse.Status === "FAILED") {
 								await this.cleanupResponseObject(responseKey);
 								return cfnResponse;
 							}
-						} catch {
-							this.logger.debug(`S3 response not yet valid JSON for ${logicalId}, retrying...`);
-						}
+						} else this.logger.debug(`S3 response not yet valid JSON for ${logicalId}, retrying...`);
 					}
 				} catch (error) {
 					const err = error;
@@ -30544,4 +30943,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, findLargeInlineResources as $n, TemplateParser as $t, renderStatefulReason as A, formatDockerLoginError as An, StackHasActiveImportsError as Ar, STATE_SOURCED_READBACK_RULES as At, exportAliasCollisionScrubWarning as B, getLegacyStateBucketName as Bn, isThrottlingError as Br, classifyReplaySecretRegion as Bt, isFinalSnapshotError as C, parseBootstrapMarker as Cn, LockError as Cr, configStringRefusal as Ct, extractDeploymentEventError as D, buildDenyExternalAccessPolicy as Dn, ProvisioningError as Dr, requireConfigObject as Dt, makeCanonicalizePropertiesFn as E, validateContainerRepoName as En, PartialFailureError as Er, requireConfigArray as Et, green as F, AssetManifestLoader as Fn, isCdkdError as Fr, isSingleDynamicReferenceToken as Ft, IAMRoleProvider as G, resolveStateBucketWithDefault as Gn, s3BucketRegionalDomainName as Gt, secretBearingStateKeyWarning as H, resolveAutoAssetStorage as Hn, __exportAll as Hr, s3BucketArn as Ht, red as I, getDockerImageBySourceHash as In, normalizeAwsError as Ir, maskSecretsInError as It, ProviderRegistry as J, stateBucketExistenceConfirmed as Jn, DiffCalculator as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveStateBucketWithDefaultAndSource as Kn, s3BucketWebsiteUrl as Kt, yellow as L, Synthesizer as Ln, withErrorHandling as Lr, maskSecretsInText as Lt, bold as M, partitionSensitiveEnv as Mn, StateError as Mr, createSecretMasker as Mt, cyan as N, runDockerForeground as Nn, SynthesisError as Nr, dynamicReferenceTokens as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDockerImage as On, ResourceTimeoutError as Or, requireConfigString as Ot, gray as P, runDockerStreaming as Pn, formatError as Pr, errorCauseChain as Pt, maskDeep as Q, MIGRATE_TMP_PREFIX as Qn, DagBuilder as Qt, collectDeclaredOutputNames as R, synthesisStatusMessage as Rn, isMarkedNonRetryable as Rr, redactSecretsForState as Rt, createPreDeleteFinalSnapshot as S, isCrossRegionRedirect as Sn, LocalStartServiceError as Sr, configBooleanRefusal as St, unsupportedFinalSnapshotError as T, validateAssetBucketName as Tn, NestedStackChildDirectDestroyError as Tr, replayWarn as Tt, stateKeySecretExposure as U, resolveCaptureObservedState as Un, s3BucketDomainName as Ut, isExportAliasCollision as V, resolveApp as Vn, markNonRetryable as Vr, producerRegionsFromState as Vt, getCurrentResourceSecrets as W, resolveSkipPrefix as Wn, s3BucketDualStackDomainName as Wt, findSilentDropProperties as X, CFN_TEMPLATE_BODY_LIMIT as Xn, describeTypeWithThrottleRetry as Xt, findActionableSilentDrops as Y, warnDeprecatedNoPrefixCliFlag as Yn, INTRINSIC_KEYS as Yt, createMaskedRetryLogger as Z, CFN_TEMPLATE_URL_LIMIT as Zn, withRetry as Zt, computeImplicitDeleteEdges as _, AssetModeResolver as _n, DependencyError as _r, WAFv2WebACLProvider as _t, DeploymentEventsStore as a, importableOutputKeys as an, AssemblyReader as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, ensureAssetStorage as bn, LocalInvokeBuildError as br, assertRegionMatch as bt, replayFailedOperations as c, AssetPublisher as cn, resolveBucketRegion as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, buildAssetRedirectMap as dn, resetAwsClients as dr, IntrinsicFunctionResolver as dt, LockManager as en, uploadCfnTemplate as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, createAssetRedirectResolver as fn, setAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, stripControlChars as gn, CrossAccountSecretRefusalError as gr, refStateLookupFromResource as gt, maskingRetryLogger as h, escapeRegExp$1 as hn, ConfigError as hr, parameterTypeMayLoseSecretIdentity as ht, DeploymentEventsReader as i, exportNamesCarriedFrom as in, derivePartitionAndUrlSuffix as ir, interruptWatchListenerCount as it, formatResourceLine as j, getDockerCmd as jn, StackTerminationProtectionError as jr, TEMPLATE_SOURCED_RULES as jt, isStatefulRecreateTargetSync as k, dockerSpawnEnvWithSensitive as kn, ResourceUpdateNotSupportedError as kr, STATE_SOURCED_CROSS_GENERATION_RULES as kt, replayRollback as l, stringifyValue as ln, AwsClients as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, rewriteTemplateAssetReferences as mn, CdkdError as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, S3StateBackend as nn, PARTITION_TABLE as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputs as on, processStackMessages as or, startInterruptWatch as ot, deleteSkipReason as p, loadPublishableAssetManifest as pn, AssetError as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveUseCdkBootstrapAssets as qn, applyRoleArnIfSet as qt, DeployEngine as r, rebuildClientForBucketRegion as rn, canonicalizeRegion as rr, endCommandInterruptScope as rt, planRollback as s, shouldRetainResource as sn, clearBucketRegionCache as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, displaySafe as tn, expectedOwnerParam as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, WorkGraph as un, getAwsClients as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, BOOTSTRAP_MARKER_PREFIX as vn, DeployCancelledError as vr, normalizeAwsTagsToCfn as vt, refusesFinalSnapshot as w, readBootstrapMarkerBody as wn, MissingCdkCliError as wr, readConfigString as wt, ccRoutedFinalSnapshotError as x, getBootstrapMarkerKey as xn, LocalMigrateError as xr, coerceCfnBoolean as xt, PRE_DELETE_SNAPSHOT_TYPES as y, assertAssetBucketRegion as yn, DynamicReferenceRegionAmbiguousError as yr, resolveExplicitPhysicalId as yt, collectPublishedOutputNames as z, getDefaultStateBucketName as zn, isRetryableTransientError as zr, scrubResourceRecord as zt };
-//# sourceMappingURL=deploy-engine-wrIe6cV6.js.map
+//# sourceMappingURL=deploy-engine-CHLe31Fh.js.map