@go-to-k/cdkd 0.284.79 → 0.284.80

package/dist/{deploy-engine-C411KMRS.js → deploy-engine-Dsd8oL2h.js}

@@ -1,8 +1,8 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-Hlzx3l_O.js";
+import { t as getCdkdVersion } from "./version-CdU_rRxd.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
-import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
 import { SQSClient } from "@aws-sdk/client-sqs";
@@ -7524,6 +7524,145 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	return replacement;
 }
 
+//#endregion
+//#region src/state/s3-noncurrent-version-purge.ts
+/**
+* `DeleteObjects` is capped at 1000 entries per call.
+*
+* DEFENCE IN DEPTH, and unreachable today: `stale` is accumulated from a
+* SINGLE `ListObjectVersions` page, whose `Versions` + `DeleteMarkers` are
+* capped at 1000 COMBINED by `MaxKeys`, so the chunking below never takes its
+* second iteration. It is kept because the invariant it guards ("never hand
+* DeleteObjects more than 1000") is one a future change accumulating across
+* pages would silently break.
+*
+* Mutation coverage of this constant is ASYMMETRIC, which is worth stating
+* because the obvious summary is wrong in one direction: RAISING it is green
+* (nothing ever reaches the second chunk, so a bigger ceiling changes
+* nothing), while LOWERING it to 500 is RED — the multi-page fixture's
+* thousand-entry pages then split and the asserted batch shape changes. So the
+* value is fenced from below and not from above.
+*/
+const DELETE_BATCH_SIZE = 1e3;
+/** How many failing keys the warning names before it truncates. */
+const MAX_NAMED_FAILURES = 5;
+/**
+* Label for a `DeleteObjects` error entry that carries no `Key`.
+*
+* S3 always populates it in practice; the point is that an unnameable failure
+* must still COUNT, because the alternative measured here was `failed.size`
+* reaching 0 and the whole warning disappearing.
+*
+* Each keyless entry gets its OWN slot (`<unknown key #1>`, `#2`, ...) rather
+* than sharing one. Collapsing them was defended as "the honest reading", but
+* it is honest about NAMING and not about COUNTING: N keyless failures then
+* reported `1 key(s)`, which is the same prefixes-not-keys under-count this
+* change was raised to fix, arriving through the branch that fixed it. One
+* slot per failure can over-count if S3 ever returns two entries for one
+* object, which is the direction that errs toward reporting too much.
+*
+* The slot name is SYNTHETIC and its uniqueness is not enforced: a real key
+* literally called `<unknown key #1>` would merge with the first keyless
+* entry and under-count by one. Unreachable here — every caller passes
+* `custom-resource-responses/<requestId>.json` — and stated rather than left
+* implied, because "the name cannot collide" is the kind of unstated
+* invariant this module exists to stop asserting.
+*/
+const UNKNOWN_KEY_PREFIX = "<unknown key #";
+/** Reason recorded when a page says it is truncated but names no next key. */
+const TRUNCATED_NO_MARKER = "listing reported IsTruncated with no NextKeyMarker; the walk stopped early and versions may remain";
+/** Record a per-key failure reason without losing an earlier one. */
+function recordFailure(failed, key, reason) {
+	const existing = failed.get(key);
+	if (existing) existing.push(reason);
+	else failed.set(key, [reason]);
+}
+const describe$1 = (error) => error instanceof Error ? error.message : String(error);
+async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {}) {
+	if (keys.length === 0) return;
+	const logger = options.logger ?? getLogger().child("s3-version-purge");
+	const requestFields = options.requestFields ?? {};
+	const wanted = new Set(keys);
+	const prefixes = options.listPrefix !== void 0 ? [options.listPrefix] : keys;
+	const failed = /* @__PURE__ */ new Map();
+	const unknown = { n: 0 };
+	for (const prefix of prefixes) try {
+		await purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown);
+	} catch (error) {
+		const affected = options.listPrefix !== void 0 ? keys : [prefix];
+		for (const key of affected) recordFailure(failed, key, describe$1(error));
+	}
+	if (failed.size > 0) {
+		const named = [...failed.entries()].slice(0, MAX_NAMED_FAILURES).map(([key, reasons]) => `${key} (${reasons.join("; ")})`);
+		const elided = failed.size - named.length;
+		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${bucket}. Their previous versions survive and remain readable via GetObject with a VersionId (for a custom-resource response object that is the handler's full response body, including \`Data\`). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
+	}
+}
+/**
+* Paginate `ListObjectVersions` under one prefix and delete every returned
+* entry that is in `wanted` and is not the current version.
+*
+* Throws only when the LISTING fails; per-key delete failures are recorded in
+* `failed` and do not stop the walk.
+*
+* Safe on an UNVERSIONED bucket: S3 answers there with the single live object
+* carrying `VersionId: 'null'` and `IsLatest: true`, which the `IsLatest`
+* filter drops — so nothing is deleted and nothing throws. A `'null'` version
+* id is NOT filtered out on its own, because a bucket whose versioning was
+* SUSPENDED can carry a genuine noncurrent `'null'` version holding the body.
+*/
+async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown) {
+	let keyMarker;
+	let versionIdMarker;
+	do {
+		const resp = await s3Client.send(new ListObjectVersionsCommand({
+			Bucket: bucket,
+			...requestFields,
+			Prefix: prefix,
+			...keyMarker !== void 0 && { KeyMarker: keyMarker },
+			...versionIdMarker !== void 0 && { VersionIdMarker: versionIdMarker }
+		}));
+		const stale = [];
+		for (const entry of [...resp.Versions ?? [], ...resp.DeleteMarkers ?? []]) {
+			if (entry.Key === void 0 || !wanted.has(entry.Key)) continue;
+			if (entry.IsLatest !== false) continue;
+			if (!entry.VersionId) continue;
+			stale.push({
+				Key: entry.Key,
+				VersionId: entry.VersionId
+			});
+		}
+		for (let i = 0; i < stale.length; i += DELETE_BATCH_SIZE) {
+			const batch = stale.slice(i, i + DELETE_BATCH_SIZE);
+			try {
+				const deleted = await s3Client.send(new DeleteObjectsCommand({
+					Bucket: bucket,
+					...requestFields,
+					Delete: {
+						Objects: batch,
+						Quiet: true
+					}
+				}));
+				for (const err of deleted.Errors ?? []) {
+					const reason = `version ${err.VersionId ?? "<unknown>"}: ${err.Code ?? "Error"}` + (err.Message ? ` - ${err.Message}` : "");
+					if (err.Key !== void 0) recordFailure(failed, err.Key, reason);
+					else {
+						unknown.n += 1;
+						recordFailure(failed, `${UNKNOWN_KEY_PREFIX}${unknown.n}>`, reason);
+					}
+				}
+			} catch (error) {
+				for (const object of batch) recordFailure(failed, object.Key, describe$1(error));
+			}
+		}
+		if (resp.IsTruncated === true && resp.NextKeyMarker === void 0) {
+			for (const key of wanted) if (key.startsWith(prefix)) recordFailure(failed, key, TRUNCATED_NO_MARKER);
+		}
+		keyMarker = resp.IsTruncated === true ? resp.NextKeyMarker : void 0;
+		versionIdMarker = keyMarker !== void 0 ? resp.NextVersionIdMarker : void 0;
+	} while (keyMarker !== void 0);
+}
+
 //#endregion
 //#region src/state/s3-state-backend.ts
 /**
@@ -8065,6 +8204,44 @@ var S3StateBackend = class {
 		if (failures.length > 0) throw new StateError(`Failed to delete ${failures.length} object(s) from bucket '${this.config.bucket}': ${failures.join("; ")}`);
 	}
 	/**
+	* Delete the NONCURRENT versions of raw sidecar keys in the state bucket
+	* (issue [#2340](https://github.com/go-to-k/cdkd/issues/2340)).
+	*
+	* The versioned-bucket companion to {@link deleteRawObjects}, and
+	* deliberately NOT folded into it. `deleteRawObjects` has SIX call sites,
+	* ENUMERATED rather than given as a grep so that a comment quoting the
+	* command cannot end up matching itself and reporting seven:
+	* `deployment-events-store.ts` x4, `gc.ts`, `bootstrap-destroy.ts`. Four of
+	* the six are in `deployment-events-store.ts`, whose objects
+	* `tests/integration/s3-versions.sh` records as deliberately surviving as
+	* CURRENT objects; a blanket purge there would
+	* change that behaviour AND widen the IAM every caller needs
+	* (`s3:ListBucketVersions`, `s3:DeleteObjectVersion`). So the purge is
+	* opt-in, and today `cdkd gc`'s custom-resource response sweep is the one
+	* caller that opts in.
+	*
+	* NEVER THROWS, and the try/catch below is what makes that true rather than
+	* the helper alone. `ensureClientForBucket()` and `ownerParam()` sit OUTSIDE
+	* the helper's guarantee and both reach AWS — `GetBucketLocation` can be
+	* denied or throttled. Without the wrap, that rejection escaped at
+	* `gc.ts`'s call site and skipped the `✓ Deleted ...` line after the delete
+	* had already succeeded, which is precisely the outcome the comment there
+	* says is impossible.
+	*/
+	async purgeNoncurrentVersions(keys, options = {}) {
+		if (keys.length === 0) return;
+		try {
+			await this.ensureClientForBucket();
+			await purgeNoncurrentKeyVersions(this.s3Client, this.config.bucket, keys, {
+				...options,
+				requestFields: await this.ownerParam(),
+				logger: this.logger
+			});
+		} catch (error) {
+			this.logger.warn(`Could not purge noncurrent versions of ${keys.length} key(s) in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	/**
 	* Load the rollback journal for a stack (issue #1183). Returns `null` when
 	* no journal exists (the common case — a journal only lives between a
 	* failed/interrupted deploy and its `cdkd rollback`). Throws
@@ -20058,7 +20235,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CujMYGki.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-lbqsxGkM.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -22940,16 +23117,37 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return `${this.responsePrefix}/${requestId}.json`;
 	}
 	/**
-	* Cleanup response object from S3
+	* Cleanup response object from S3.
+	*
+	* TWO steps, and the second one is not housekeeping (issue
+	* [#2340](https://github.com/go-to-k/cdkd/issues/2340)). `cdkd bootstrap`
+	* turns VERSIONING ON for the state bucket, so a bare `DeleteObject` writes
+	* a DELETE MARKER and leaves every prior version readable through
+	* `GetObject` with a `VersionId`. The object at this key is not a
+	* placeholder by then: the handler replied through the pre-signed
+	* ResponseURL and PUT its FULL cfn-response body there, `Data` included —
+	* which is exactly where a handler-minted secret (a generated password, an
+	* issued API key) lives. Delete-only cleanup therefore reports success while
+	* the secret stays retrievable by anyone holding `s3:GetObjectVersion` on
+	* the state bucket.
+	*
+	* The purge itself lives in `purgeNoncurrentKeyVersions`, SHARED with `cdkd
+	* gc`'s sweep of the abandoned objects at this same prefix — see that
+	* module for why it is scoped to the exact key and to what is not
+	* `IsLatest`, and why it never throws.
 	*/
 	async cleanupResponseObject(responseKey) {
 		if (!this.responseBucket) return;
+		const bucket = this.responseBucket;
 		try {
 			await this.s3Client.send(new DeleteObjectCommand({
-				Bucket: this.responseBucket,
+				Bucket: bucket,
 				Key: responseKey
 			}));
-		} catch {}
+		} catch (error) {
+			this.logger.debug(`Failed to delete custom-resource response object s3://${bucket}/${responseKey}; it remains as a current object. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		await purgeNoncurrentKeyVersions(this.s3Client, bucket, [responseKey], { logger: this.logger });
 	}
 	/**
 	* Convert property values to strings for CloudFormation compatibility
@@ -31952,4 +32150,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, CFN_TEMPLATE_URL_LIMIT as $n, redactSecretsForState as $t, renderStatefulReason as A, buildDockerImage as An, ResourceTimeoutError as Ar, classifyReplaySecretRegion as At, exportAliasCollisionScrubWarning as B, synthesisStatusMessage as Bn, isMarkedNonRetryable as Br, describeTypeWithThrottleRetry as Bt, isFinalSnapshotError as C, isCrossRegionRedirect as Cn, LocalMigrateError as Cr, configBooleanRefusal as Ct, extractDeploymentEventError as D, validateContainerRepoName as Dn, NestedStackChildDirectDestroyError as Dr, requireConfigArray as Dt, makeCanonicalizePropertiesFn as E, validateAssetBucketName as En, MissingCdkCliError as Er, replayWarn as Et, green as F, runDockerForeground as Fn, SynthesisError as Fr, s3BucketRegionalDomainName as Ft, IAMRoleProvider as G, resolveCaptureObservedState as Gn, retryClassificationText as Gr, STATE_SOURCED_READBACK_RULES as Gt, secretBearingStateKeyWarning as H, getLegacyStateBucketName as Hn, isThrottlingError as Hr, DagBuilder as Ht, red as I, runDockerStreaming as In, formatError as Ir, s3BucketWebsiteUrl as It, ProviderRegistry as J, resolveStateBucketWithDefaultAndSource as Jn, dynamicReferenceTokens as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveSkipPrefix as Kn, __exportAll as Kr, TEMPLATE_SOURCED_RULES as Kt, yellow as L, AssetManifestLoader as Ln, isCdkdError as Lr, applyRoleArnIfSet as Lt, bold as M, formatDockerLoginError as Mn, StackHasActiveImportsError as Mr, s3BucketArn as Mt, cyan as N, getDockerCmd as Nn, StackTerminationProtectionError as Nr, s3BucketDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDenyExternalAccessPolicy as On, PartialFailureError as Or, requireConfigObject as Ot, gray as P, partitionSensitiveEnv as Pn, StateError as Pr, s3BucketDualStackDomainName as Pt, maskDeep as Q, CFN_TEMPLATE_BODY_LIMIT as Qn, maskSecretsInText as Qt, collectDeclaredOutputNames as R, getDockerImageBySourceHash as Rn, normalizeAwsError as Rr, DiffCalculator as Rt, createPreDeleteFinalSnapshot as S, getBootstrapMarkerKey as Sn, LocalInvokeBuildError as Sr, coerceCfnBoolean as St, unsupportedFinalSnapshotError as T, readBootstrapMarkerBody as Tn, LockError as Tr, readConfigString as Tt, stateKeySecretExposure as U, resolveApp as Un, markNonRetryable as Ur, TemplateParser as Ut, isExportAliasCollision as V, getDefaultStateBucketName as Vn, isRetryableTransientError as Vr, withRetry as Vt, getCurrentResourceSecrets as W, resolveAutoAssetStorage as Wn, markRedactedCause as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, findSilentDropProperties as X, stateBucketExistenceConfirmed as Xn, isSingleDynamicReferenceToken as Xt, findActionableSilentDrops as Y, resolveUseCdkBootstrapAssets as Yn, errorCauseChain as Yt, createMaskedRetryLogger as Z, warnDeprecatedNoPrefixCliFlag as Zn, maskSecretsInError as Zt, computeImplicitDeleteEdges as _, stripControlChars as _n, ConfigError as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, exportNamesCarriedFrom as an, canonicalizeRegion as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, assertAssetBucketRegion as bn, DeployCancelledError as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, shouldRetainResource as cn, processStackMessages as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, WorkGraph as dn, AwsClients as dr, IntrinsicFunctionResolver as dt, scrubResourceRecord as en, MIGRATE_TMP_PREFIX as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, buildAssetRedirectMap as fn, getAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, escapeRegExp$1 as gn, CdkdError as gr, parameterTypeMayLoseSecretIdentity as gt, maskingRetryLogger as h, rewriteTemplateAssetReferences as hn, AssetError as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, rebuildClientForBucketRegion as in, PARTITION_TABLE as ir, interruptWatchListenerCount as it, formatResourceLine as j, dockerSpawnEnvWithSensitive as jn, ResourceUpdateNotSupportedError as jr, producerRegionsFromState as jt, isStatefulRecreateTargetSync as k, describeAwsFailure as kn, ProvisioningError as kr, requireConfigString as kt, replayRollback as l, AssetPublisher as ln, clearBucketRegionCache as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, loadPublishableAssetManifest as mn, setAwsClients as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, displaySafe as nn, uploadCfnTemplate as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputKeys as on, derivePartitionAndUrlSuffix as or, startInterruptWatch as ot, deleteSkipReason as p, createAssetRedirectResolver as pn, resetAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveStateBucketWithDefault as qn, createSecretMasker as qt, DeployEngine as r, S3StateBackend as rn, expectedOwnerParam as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputs as sn, AssemblyReader as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockManager as tn, findLargeInlineResources as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, stringifyValue as un, resolveBucketRegion as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, AssetModeResolver as vn, CrossAccountSecretRefusalError as vr, WAFv2WebACLProvider as vt, refusesFinalSnapshot as w, parseBootstrapMarker as wn, LocalStartServiceError as wr, configStringRefusal as wt, ccRoutedFinalSnapshotError as x, ensureAssetStorage as xn, DynamicReferenceRegionAmbiguousError as xr, assertRegionMatch as xt, PRE_DELETE_SNAPSHOT_TYPES as y, BOOTSTRAP_MARKER_PREFIX as yn, DependencyError as yr, normalizeAwsTagsToCfn as yt, collectPublishedOutputNames as z, Synthesizer as zn, withErrorHandling as zr, INTRINSIC_KEYS as zt };
-//# sourceMappingURL=deploy-engine-C411KMRS.js.map
+//# sourceMappingURL=deploy-engine-Dsd8oL2h.js.map