@go-to-k/cdkd 0.285.5 → 0.285.6

package/dist/{deploy-engine-CSBoL-Az.js → deploy-engine-BgpCWFvY.js}

@@ -1,6 +1,6 @@
-import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-Dz3Le2Pw.js";
+import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-DyTk5GeO.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-neBHYAq9.js";
+import { t as getCdkdVersion } from "./version-De6foYg3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5525,8 +5525,13 @@ var FileAssetPublisher = class {
 * Output handling: stdout/stderr are collected in memory unconditionally so
 * `runDockerStreaming` can return them to the caller for error wrapping.
 * When the logger is at debug level (i.e. the user passed `--verbose`),
-* the chunks are ALSO mirrored to `process.stdout` / `process.stderr` so
-* the user sees live build progress.
+* the chunks are ALSO mirrored live so the user sees build progress —
+* stderr always to `process.stderr`, and stdout to `process.stdout` EXCEPT
+* while a command holds a payload reservation
+* ({@link isStdoutReservedForPayload}), where it joins the logger on stderr
+* so a child's diagnostics cannot land in the payload
+* ([#2410](https://github.com/go-to-k/cdkd/issues/2410)). The same
+* reservation redirects `spawnForeground`'s inherited fd 1 to fd 2.
 */
 /**
 * Return the docker-compatible CLI binary to invoke. Matches CDK CLI:
@@ -5573,7 +5578,8 @@ async function spawnStreaming(cmd, args, options = {}) {
 		const stderrChunks = [];
 		child.stdout.on("data", (chunk) => {
 			stdoutChunks.push(chunk);
-			if (streamLive) process.stdout.write(chunk);
+			if (streamLive) if (isStdoutReservedForPayload()) process.stderr.write(chunk);
+			else process.stdout.write(chunk);
 		});
 		child.stderr.on("data", (chunk) => {
 			stderrChunks.push(chunk);
@@ -5617,25 +5623,42 @@ async function spawnStreaming(cmd, args, options = {}) {
 * exit, so the caller can wrap with its own error class.
 *
 * Differs from {@link runDockerStreaming} in two ways:
-*   1. `stdio: 'inherit'` — output is NOT captured, so terminal control codes
-*      (color, progress bar overwrites) flow through unchanged. This is the
-*      load-bearing reason for the split: `docker pull`'s progress bars only
-*      animate properly when stdout is a real TTY connected to the parent.
+*   1. The child INHERITS descriptors — output is NOT captured, so terminal
+*      control codes (color, progress bar overwrites) flow through
+*      unchanged. That is the load-bearing reason for the split:
+*      `docker pull`'s progress bars only animate when the child writes to a
+*      real TTY rather than a pipe. Under a payload reservation the child's
+*      fd 1 is redirected to the parent's fd 2 rather than piped, precisely
+*      so it keeps a descriptor and not a pipe — though the animation then
+*      depends on STDERR being a terminal, and degrades to plain lines under
+*      `2> file` (issue
+*      [#2410](https://github.com/go-to-k/cdkd/issues/2410)).
 *   2. No `input` / `streamLive` options — inherit-mode has nothing to
 *      capture and nothing to mirror.
 *
-* Used by the `--verbose`-mode `docker pull` plumbing in `docker-runner.ts`
-* and `ecr-puller.ts` (visible layer progress). Non-verbose pulls go through
-* {@link runDockerStreaming} so stderr can be folded into the error message.
+* Used by the `docker pull` plumbing in `docker-runner.ts` and
+* `ecr-puller.ts`. Those two callers differ, and the difference matters
+* enough to state: `docker-runner.ts` reaches this only under `--verbose`,
+* while `ecr-puller.ts` runs it UNCONDITIONALLY, which is what made the
+* pre-#2410 stdout leak reachable with no flag at all. Non-verbose pulls in
+* `docker-runner.ts` go through {@link runDockerStreaming} instead, so
+* stderr can be folded into the error message.
 */
 async function runDockerForeground(args, options = {}) {
 	return spawnForeground(getDockerCmd(), args, options);
 }
 /**
-* Foreground (stdio-inherit) spawn — the inherit-mode counterpart to
+* Foreground (descriptor-inheriting) spawn — the inherit-mode counterpart to
 * {@link spawnStreaming}. Used by {@link runDockerForeground} for docker-CLI
 * subprocesses.
 *
+* "inherit" is not unqualified, and THIS is the function that qualifies it:
+* while a command holds a payload reservation
+* ({@link isStdoutReservedForPayload}) the child's fd 1 is redirected to the
+* parent's fd 2, so its output cannot land in the payload
+* ([#2410](https://github.com/go-to-k/cdkd/issues/2410)). stdin and stderr
+* are inherited either way. See the inline note at the `spawn` call.
+*
 * The ENOENT branch crafts a docker-specific install hint ("Install Docker
 * (or set CDK_DOCKER ...)"), so non-docker callers reusing this helper
 * would see a misleading error on missing-binary failures. Keep the binary
@@ -5648,7 +5671,11 @@ async function spawnForeground(cmd, args, options = {}) {
 		const child = spawn(cmd, args, {
 			cwd: options.cwd,
 			env,
-			stdio: "inherit"
+			stdio: isStdoutReservedForPayload() ? [
+				"inherit",
+				2,
+				"inherit"
+			] : "inherit"
 		});
 		child.once("error", (err) => {
 			if (err.code === "ENOENT") {
@@ -21313,7 +21340,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BBSPZtne.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DsyALMVT.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -33258,4 +33285,4 @@ var DeployEngine = class {
 
 //#endregion
 export { DEFAULT_STATE_PREFIX as $, warnDeprecatedNoPrefixCliFlag as $n, maskSecretsInError as $t, bold as A, buildDenyExternalAccessPolicy as An, NestedStackChildDirectDestroyError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, getDockerImageBySourceHash as Bn, isCdkdError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, ensureAssetStorage as Cn, DeployCancelledError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, readBootstrapMarkerBody as Dn, LocalStartServiceError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, parseBootstrapMarker as En, LocalMigrateError as Er, configStringRefusal as Et, yellow as F, getDockerCmd as Fn, StackHasActiveImportsError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, resolveApp as Gn, isThrottlingError as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, synthesisStatusMessage as Hn, withErrorHandling as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, partitionSensitiveEnv as In, StackTerminationProtectionError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveSkipPrefix as Jn, markRedactedCause as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, resolveAutoAssetStorage as Kn, isTransientServerError as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, runDockerForeground as Ln, StateError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDockerImage as Mn, ProvisioningError as Mr, classifyReplaySecretRegion as Mt, green as N, dockerSpawnEnvWithSensitive as Nn, ResourceTimeoutError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, validateAssetBucketName as On, LockError as Or, replayWarn as Ot, red as P, formatDockerLoginError as Pn, ResourceUpdateNotSupportedError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, stateBucketExistenceConfirmed as Qn, isSingleDynamicReferenceToken as Qt, exportAliasCollisionScrubWarning as R, runDockerStreaming as Rn, SynthesisError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, assertAssetBucketRegion as Sn, DependencyError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, isCrossRegionRedirect as Tn, LocalInvokeBuildError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, getDefaultStateBucketName as Un, isMarkedNonRetryable as Ur, withRetry as Ut, stateKeySecretExposure as V, Synthesizer as Vn, normalizeAwsError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, getLegacyStateBucketName as Wn, isRetryableTransientError as Wr, DagBuilder as Wt, maskDeep as X, resolveStateBucketWithDefaultAndSource as Xn, __exportAll as Xr, dynamicReferenceTokens as Xt, createMaskedRetryLogger as Y, resolveStateBucketWithDefault as Yn, retryClassificationText as Yr, createSecretMasker as Yt, maskerOrIdentity as Z, resolveUseCdkBootstrapAssets as Zn, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, rewriteTemplateAssetReferences as _n, setAwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, S3StateBackend as an, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, AssetModeResolver as bn, ConfigError as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, importableOutputKeys as cn, canonicalizeRegion as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, AssetPublisher as dn, processStackMessages as dr, isTerminationProtectionPropagationError as dt, maskSecretsInText as en, CFN_TEMPLATE_BODY_LIMIT as er, beginCommandInterruptScope as et, withResourceDeadline as f, stringifyValue as fn, clearBucketRegionCache as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, loadPublishableAssetManifest as gn, resetAwsClients as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, createAssetRedirectResolver as hn, getAwsClients as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, displaySafe as in, uploadCfnTemplate as ir, startInterruptWatch as it, cyan as j, describeAwsFailure as jn, PartialFailureError as jr, requireConfigString as jt, formatResourceLine as k, validateContainerRepoName as kn, MissingCdkCliError as kr, requireConfigArray as kt, replayRollback as l, importableOutputs as ln, derivePartitionAndUrlSuffix as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildAssetRedirectMap as mn, AwsClients as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, scrubResourceRecord as nn, MIGRATE_TMP_PREFIX as nr, interruptWatchListenerCount as nt, planFailedOps as o, rebuildClientForBucketRegion as on, expectedOwnerParam as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, WorkGraph as pn, resolveBucketRegion as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveCaptureObservedState as qn, markNonRetryable as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, LockManager as rn, findLargeInlineResources as rr, isInterruptedWaitError as rt, planRollback as s, exportNamesCarriedFrom as sn, PARTITION_TABLE as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, redactSecretsForState as tn, CFN_TEMPLATE_URL_LIMIT as tr, endCommandInterruptScope as tt, updatePartialMessage as u, shouldRetainResource as un, AssemblyReader as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, escapeRegExp$1 as vn, AssetError as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, getBootstrapMarkerKey as wn, DynamicReferenceRegionAmbiguousError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, BOOTSTRAP_MARKER_PREFIX as xn, CrossAccountSecretRefusalError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, stripControlChars as yn, CdkdError as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, AssetManifestLoader as zn, formatError as zr, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-CSBoL-Az.js.map
+//# sourceMappingURL=deploy-engine-BgpCWFvY.js.map