@go-to-k/cdkd 0.275.0 → 0.275.2

package/dist/{deploy-engine-DkdxZIwS.js → deploy-engine-D30XI_UX.js}

@@ -9827,6 +9827,18 @@ function collectReferencedParameterNames(template) {
 	}
 	return referenced;
 }
+/**
+* Render a parameter VALUE for a debug log line, honoring the definition's
+* `NoEcho` flag (issue #1329). `NoEcho: true` is the template author's
+* explicit "this value is sensitive" declaration — CloudFormation masks such
+* values everywhere it echoes them, so cdkd's `--verbose` output must not
+* print them either. Sibling of `stringifyAttributeForLog` (which redacts
+* `Fn::GetAtt` ATTRIBUTE values by name heuristic; here the author told us).
+*/
+function stringifyParameterForLog(paramDef, value) {
+	if (paramDef?.NoEcho === true) return "<redacted>";
+	return stringifyValue(value);
+}
 var IntrinsicFunctionResolver = class {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
@@ -9883,7 +9895,7 @@ var IntrinsicFunctionResolver = class {
 				const userValue = userParameters[name];
 				if (userValue !== void 0) {
 					parameters[name] = this.coerceParameterValue(userValue, paramDef.Type);
-					this.logger.debug(`Parameter ${name}: using user-provided value ${userValue}`);
+					this.logger.debug(`Parameter ${name}: using user-provided value ${stringifyParameterForLog(paramDef, userValue)}`);
 					continue;
 				}
 			}
@@ -9898,11 +9910,11 @@ var IntrinsicFunctionResolver = class {
 					this.logger.debug(`Parameter ${name}: resolving SSM parameter path ${ssmPath}`);
 					const resolved = await this.resolveSSMParameter(ssmPath);
 					parameters[name] = resolved;
-					this.logger.debug(`Parameter ${name}: resolved SSM value ${resolved}`);
+					this.logger.debug(`Parameter ${name}: resolved SSM value ${stringifyParameterForLog(paramDef, resolved)}`);
 					continue;
 				}
 				parameters[name] = paramDef.Default;
-				this.logger.debug(`Parameter ${name}: using default value ${stringifyValue(paramDef.Default)}`);
+				this.logger.debug(`Parameter ${name}: using default value ${stringifyParameterForLog(paramDef, paramDef.Default)}`);
 				continue;
 			}
 			throw new Error(`Parameter ${name} is required but no value was provided and no default exists`);
@@ -10031,7 +10043,8 @@ var IntrinsicFunctionResolver = class {
 		}
 		if (context.parameters && logicalId in context.parameters) {
 			const value = context.parameters[logicalId];
-			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${stringifyValue(value)}`);
+			const paramDef = context.template.Parameters?.[logicalId];
+			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${stringifyParameterForLog(paramDef, value)}`);
 			return value;
 		}
 		const pseudoValue = await this.resolvePseudoParameter(logicalId, context);
@@ -12027,7 +12040,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BfdF-bjF.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-2hct1hkv.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -17654,7 +17667,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy
 					});
-					await provider.delete(op.logicalId, op.physicalId, op.resourceType, void 0, { expectedRegion: ctx.region });
+					await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.attemptedProperties, { expectedRegion: ctx.region });
 					delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -17804,7 +17817,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.275.0";
+	return "0.275.2";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -19331,7 +19344,10 @@ var DeployEngine = class {
 	*/
 	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps) {
 		try {
-			await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, { expectedRegion: this.stackRegion });
+			await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+				expectedRegion: this.stackRegion,
+				forceDataDelete: this.options.forceStatefulRecreation === true
+			});
 		} catch (deleteError) {
 			throw new Error(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
 		}
@@ -19472,7 +19488,10 @@ var DeployEngine = class {
 						else {
 							this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
 							try {
-								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, { expectedRegion: this.stackRegion });
+								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+									expectedRegion: this.stackRegion,
+									forceDataDelete: this.options.forceStatefulRecreation === true
+								});
 								this.logger.info(`  ${green("✓")} Old resource deleted`);
 							} catch (deleteError) {
 								throw new Error(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
@@ -19514,7 +19533,10 @@ var DeployEngine = class {
 						else {
 							this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
 							try {
-								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, { expectedRegion: this.stackRegion });
+								await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+									expectedRegion: this.stackRegion,
+									forceDataDelete: this.options.forceStatefulRecreation === true
+								});
 								this.logger.info(`  ${green("✓")} Old resource deleted`);
 							} catch (deleteError) {
 								this.logger.warn(`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
@@ -19560,7 +19582,10 @@ var DeployEngine = class {
 							}
 							this.logger.info(`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							try {
-								await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, { expectedRegion: this.stackRegion });
+								await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
+									expectedRegion: this.stackRegion,
+									forceDataDelete: this.options.forceStatefulRecreation === true
+								});
 							} catch (deleteError) {
 								const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
 								if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
@@ -19850,4 +19875,4 @@ var DeployEngine = class {
 
 //#endregion
 export { WorkGraph as $, LockError as $t, slowCcOperationTimeoutMs as A, warnDeprecatedNoPrefixCliFlag as At, applyRoleArnIfSet as B, resolveBucketRegion as Bt, yellow as C, resolveAutoAssetStorage as Ct, ProviderRegistry as D, resolveStateBucketWithDefaultAndSource as Dt, clearOnUpdateRemoval as E, resolveStateBucketWithDefault as Et, refStateLookupFromResource as F, uploadCfnTemplate as Ft, DagBuilder as G, AssetError as Gt, describeTypeWithThrottleRetry as H, getAwsClients as Ht, WAFv2WebACLProvider as I, expectedOwnerParam as It, S3StateBackend as J, DependencyError as Jt, TemplateParser as K, CdkdError as Kt, normalizeAwsTagsToCfn as L, AssemblyReader as Lt, isTerminationProtectionPropagationError as M, CFN_TEMPLATE_URL_LIMIT as Mt, IntrinsicFunctionResolver as N, MIGRATE_TMP_PREFIX as Nt, findActionableSilentDrops as O, resolveUseCdkBootstrapAssets as Ot, cfnRefValueFromPhysicalId as P, findLargeInlineResources as Pt, stringifyValue as Q, LocalStartServiceError as Qt, resolveExplicitPhysicalId as R, processStackMessages as Rt, red as S, resolveApp as St, collectInlinePolicyNamesManagedBySiblings as T, resolveSkipPrefix as Tt, withRetry as U, resetAwsClients as Ut, DiffCalculator as V, AwsClients as Vt, isRetryableTransientError as W, setAwsClients as Wt, shouldRetainResource as X, LocalInvokeBuildError as Xt, rebuildClientForBucketRegion as Y, DeployCancelledError as Yt, AssetPublisher as Z, LocalMigrateError as Zt, formatResourceLine as _, getDockerImageBySourceHash as _t, DeploymentEventsStore as a, ResourceUpdateNotSupportedError as an, BOOTSTRAP_MARKER_PREFIX as at, gray as b, getDefaultStateBucketName as bt, replayFailedOperations as c, StateError as cn, parseBootstrapMarker as ct, IMPLICIT_DELETE_DEPENDENCIES as d, isCdkdError as dn, buildDockerImage as dt, MissingCdkCliError as en, buildAssetRedirectMap as et, computeImplicitDeleteEdges as f, normalizeAwsError as fn, formatDockerLoginError as ft, renderStatefulReason as g, AssetManifestLoader as gt, isStatefulRecreateTargetSync as h, runDockerStreaming as ht, DeploymentEventsReader as i, ResourceTimeoutError as in, AssetModeResolver as it, disableInstanceApiTermination as j, CFN_TEMPLATE_BODY_LIMIT as jt, CloudControlProvider as k, stateBucketExistenceConfirmed as kt, replayRollback as l, SynthesisError as ln, validateAssetBucketName as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, __exportAll as mn, runDockerForeground as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, PartialFailureError as nn, loadPublishableAssetManifest as nt, planFailedOps as o, StackHasActiveImportsError as on, ensureAssetStorage as ot, extractDeploymentEventError as p, withErrorHandling as pn, getDockerCmd as pt, LockManager as q, ConfigError as qt, DeployEngine as r, ProvisioningError as rn, rewriteTemplateAssetReferences as rt, planRollback as s, StackTerminationProtectionError as sn, getBootstrapMarkerKey as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, NestedStackChildDirectDestroyError as tn, createAssetRedirectResolver as tt, withResourceDeadline as u, formatError as un, validateContainerRepoName as ut, bold as v, Synthesizer as vt, IAMRoleProvider as w, resolveCaptureObservedState as wt, green as x, getLegacyStateBucketName as xt, cyan as y, synthesisStatusMessage as yt, assertRegionMatch as z, clearBucketRegionCache as zt };
-//# sourceMappingURL=deploy-engine-DkdxZIwS.js.map
+//# sourceMappingURL=deploy-engine-D30XI_UX.js.map