@go-to-k/cdkd 0.274.0 → 0.275.1

package/dist/{deploy-engine-BVpbuTRu.js → deploy-engine-C44YX-go.js}

@@ -5280,6 +5280,32 @@ var WorkGraph = class {
 
 //#endregion
 //#region src/utils/stringify.ts
+/**
+* Attribute names whose VALUES must never reach a log line, even at debug
+* level. `Fn::GetAtt` resolution debug-logs the resolved value, and some
+* attributes carry live long-lived credentials — the first was
+* `AWS::IAM::AccessKey.SecretAccessKey` (issue #1323), where a `--verbose`
+* deploy (or a CI log) would otherwise print a usable IAM secret key.
+* Matched against the ATTRIBUTE NAME (not the value), so legitimate
+* non-secret attributes keep full debug output.
+*/
+const SENSITIVE_ATTRIBUTE_NAME = /secret|password|credential/i;
+/**
+* Names that MATCH the sensitive pattern but denote identifiers, not the
+* credential material itself (`SecretArn`, `MasterUserSecret.SecretArn`,
+* `SecretId`, ...). ARNs / ids are load-bearing debug output — redacting them
+* would hurt debuggability without protecting anything.
+*/
+const NON_SENSITIVE_SUFFIX = /(arn|id|name|url|alias|status)$/i;
+/**
+* Render an attribute value for a debug log line, redacting values whose
+* attribute name looks credential-bearing (see
+* {@link SENSITIVE_ATTRIBUTE_NAME}).
+*/
+function stringifyAttributeForLog(attributeName, value) {
+	if (SENSITIVE_ATTRIBUTE_NAME.test(attributeName) && !NON_SENSITIVE_SUFFIX.test(attributeName)) return "<redacted>";
+	return stringifyValue(value);
+}
 function stringifyValue(value) {
 	switch (typeof value) {
 		case "string": return value;
@@ -7708,6 +7734,7 @@ const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"does not have required permissions",
 	"Trusted Entity",
 	"Invalid principal in policy",
+	"The user with name",
 	"Policy Error: PrincipalNotFound",
 	"Invalid value for the parameter Policy",
 	"required permissions for: ENHANCED_MONITORING",
@@ -9800,6 +9827,18 @@ function collectReferencedParameterNames(template) {
 	}
 	return referenced;
 }
+/**
+* Render a parameter VALUE for a debug log line, honoring the definition's
+* `NoEcho` flag (issue #1329). `NoEcho: true` is the template author's
+* explicit "this value is sensitive" declaration — CloudFormation masks such
+* values everywhere it echoes them, so cdkd's `--verbose` output must not
+* print them either. Sibling of `stringifyAttributeForLog` (which redacts
+* `Fn::GetAtt` ATTRIBUTE values by name heuristic; here the author told us).
+*/
+function stringifyParameterForLog(paramDef, value) {
+	if (paramDef?.NoEcho === true) return "<redacted>";
+	return stringifyValue(value);
+}
 var IntrinsicFunctionResolver = class {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
@@ -9856,7 +9895,7 @@ var IntrinsicFunctionResolver = class {
 				const userValue = userParameters[name];
 				if (userValue !== void 0) {
 					parameters[name] = this.coerceParameterValue(userValue, paramDef.Type);
-					this.logger.debug(`Parameter ${name}: using user-provided value ${userValue}`);
+					this.logger.debug(`Parameter ${name}: using user-provided value ${stringifyParameterForLog(paramDef, userValue)}`);
 					continue;
 				}
 			}
@@ -9871,11 +9910,11 @@ var IntrinsicFunctionResolver = class {
 					this.logger.debug(`Parameter ${name}: resolving SSM parameter path ${ssmPath}`);
 					const resolved = await this.resolveSSMParameter(ssmPath);
 					parameters[name] = resolved;
-					this.logger.debug(`Parameter ${name}: resolved SSM value ${resolved}`);
+					this.logger.debug(`Parameter ${name}: resolved SSM value ${stringifyParameterForLog(paramDef, resolved)}`);
 					continue;
 				}
 				parameters[name] = paramDef.Default;
-				this.logger.debug(`Parameter ${name}: using default value ${stringifyValue(paramDef.Default)}`);
+				this.logger.debug(`Parameter ${name}: using default value ${stringifyParameterForLog(paramDef, paramDef.Default)}`);
 				continue;
 			}
 			throw new Error(`Parameter ${name} is required but no value was provided and no default exists`);
@@ -10004,7 +10043,8 @@ var IntrinsicFunctionResolver = class {
 		}
 		if (context.parameters && logicalId in context.parameters) {
 			const value = context.parameters[logicalId];
-			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${stringifyValue(value)}`);
+			const paramDef = context.template.Parameters?.[logicalId];
+			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${stringifyParameterForLog(paramDef, value)}`);
 			return value;
 		}
 		const pseudoValue = await this.resolvePseudoParameter(logicalId, context);
@@ -10092,7 +10132,7 @@ var IntrinsicFunctionResolver = class {
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const flatValue = resource.attributes[attributeName];
 			if (flatValue !== void 0) {
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyValue(flatValue)}`);
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
 				return flatValue;
 			}
 			if (attributeName.includes(".")) {
@@ -10104,13 +10144,13 @@ var IntrinsicFunctionResolver = class {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${attributeName} -> ${stringifyValue(cursor)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, cursor)}`);
 					return cursor;
 				}
 			}
 		}
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${attributeName} -> ${stringifyValue(value)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, value)}`);
 		return value;
 	}
 	/**
@@ -11520,7 +11560,6 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::DAX::ParameterGroup",
 	"AWS::DAX::SubnetGroup",
 	"AWS::DirectoryService::MicrosoftAD",
-	"AWS::DMS::Endpoint",
 	"AWS::DMS::EventSubscription",
 	"AWS::DMS::ReplicationInstance",
 	"AWS::DMS::ReplicationSubnetGroup",
@@ -11569,7 +11608,6 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::Greengrass::SubscriptionDefinitionVersion",
 	"AWS::GreengrassV2::Component",
 	"AWS::GreengrassV2::CoreDevice",
-	"AWS::IAM::AccessKey",
 	"AWS::IdentityStore::AllGroupMemberships",
 	"AWS::ImageBuilder::AllImageBuildVersions",
 	"AWS::ImageBuilder::AllWorkflowBuildVersions",
@@ -12002,7 +12040,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C1xO9Hg8.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-c0TMaGXW.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -14670,6 +14708,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
+	["AWS::IAM::AccessKey", {
+		handled: /* @__PURE__ */ new Set([
+			"Serial",
+			"Status",
+			"UserName"
+		]),
+		silentDrop: /* @__PURE__ */ new Map()
+	}],
 	["AWS::IAM::Group", {
 		handled: /* @__PURE__ */ new Set([
 			"GroupName",
@@ -17771,7 +17817,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.274.0";
+	return "0.275.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -19817,4 +19863,4 @@ var DeployEngine = class {
 
 //#endregion
 export { WorkGraph as $, LockError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LocalStartServiceError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalInvokeBuildError as Xt, rebuildClientForBucketRegion as Y, DeployCancelledError as Yt, AssetPublisher as Z, LocalMigrateError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, ResourceUpdateNotSupportedError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, StateError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, isCdkdError as dn, buildDockerImage as dt, MissingCdkCliError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, normalizeAwsError as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceTimeoutError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, SynthesisError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, __exportAll as mn, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, PartialFailureError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackHasActiveImportsError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, withErrorHandling as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ProvisioningError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StackTerminationProtectionError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, NestedStackChildDirectDestroyError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, formatError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
-//# sourceMappingURL=deploy-engine-BVpbuTRu.js.map
+//# sourceMappingURL=deploy-engine-C44YX-go.js.map