fix(llmo): cap delivery-source name at CloudWatch 60-char limit (LLMO-5566)

Address MysticatBot non-blocking suggestions on PR #2680:
- buildDeliverySourceName now hash-truncates names over 60 chars (CloudWatch Logs limit)
  using a deterministic sha256 suffix, so long IMS org / resource ids stay valid and the
  name remains stable across calls (idempotency depends on it)
- document why deliveryId may be undefined after a ConflictException race (eventual
  consistency; delivery is enabled regardless, so no retry loop)

Introduced by: #2680

Author: cboldis

src/support/cdn-log-delivery.js

@@ -10,6 +10,7 @@
  * governing permissions and limitations under the License.
  */
 
+import crypto from 'crypto';
 import {
   CloudWatchLogsClient,
   PutDeliverySourceCommand,
@@ -77,14 +78,26 @@ export function buildDeliveryDestinationArn({
   return `arn:aws:logs:${region}:${adobeAccountId}:delivery-destination:${name}`;
 }
 
+// CloudWatch Logs caps a delivery-source name at 60 characters.
+const MAX_DELIVERY_SOURCE_NAME_LENGTH = 60;
+
 /** Per-resource delivery-source name, scoped by provider + org + resource. */
 export function buildDeliverySourceName({
   provider = DEFAULT_CDN_PROVIDER,
   imsOrgId,
   resourceId,
 }) {
   const { sourceNamePrefix } = getProviderConfig(provider);
-  return `${sourceNamePrefix}-${toSafeAwsName(imsOrgId)}-${resourceId}`;
+  const name = `${sourceNamePrefix}-${toSafeAwsName(imsOrgId)}-${resourceId}`;
+  if (name.length <= MAX_DELIVERY_SOURCE_NAME_LENGTH) {
+    return name;
+  }
+  // For unusually long org/resource ids, keep the readable head and append a deterministic hash
+  // of the full name. Determinism matters: the name is regenerated on every call and idempotency
+  // (GetDeliverySource) relies on it being byte-for-byte stable for the same inputs.
+  const suffix = crypto.createHash('sha256').update(name).digest('hex').slice(0, 12);
+  const head = name.slice(0, MAX_DELIVERY_SOURCE_NAME_LENGTH - suffix.length - 1);
+  return `${head}-${suffix}`;
 }
 
 /**
@@ -195,6 +208,10 @@ export async function createCdnLogDelivery(credentials, {
     // preserve the idempotency contract instead of surfacing a 500.
     if (err?.name === 'ConflictException' || err?.name === 'ResourceAlreadyExistsException') {
       const existing = await findExistingDelivery();
+      // deliveryId may be undefined here if DescribeDeliveries hasn't caught up to the winning
+      // CreateDelivery yet (eventual consistency). That is acceptable: delivery IS enabled — the
+      // id is informational, and the caller already treats this as a successful no-op. We don't
+      // retry-loop for the id since the idempotency outcome (alreadyExisted) is already correct.
       return {
         created: false,
         alreadyExisted: true,

test/support/cdn-log-delivery.test.js

@@ -84,6 +84,20 @@ describe('cdn-log-delivery support', () => {
       expect(() => mod.buildDeliverySourceName({ provider: 'nope', imsOrgId: 'x', resourceId: 'y' }))
         .to.throw('Unsupported CDN provider');
     });
+
+    it('hashes-truncates to <=60 chars (deterministically) for long ids', () => {
+      const imsOrgId = `${'A'.repeat(40)}@AdobeOrg`;
+      const resourceId = 'E'.repeat(40);
+      const name1 = mod.buildDeliverySourceName({ imsOrgId, resourceId });
+      const name2 = mod.buildDeliverySourceName({ imsOrgId, resourceId });
+
+      expect(name1.length).to.equal(60);
+      expect(name1).to.equal(name2); // deterministic — required for idempotency
+      expect(name1).to.match(/^llmo-cf-/);
+      // Different inputs must not collide on the truncated name.
+      const other = mod.buildDeliverySourceName({ imsOrgId, resourceId: 'F'.repeat(40) });
+      expect(other).to.not.equal(name1);
+    });
   });
 
   describe('createCdnLogDelivery', () => {