@go-to-k/cdkd 0.283.21 → 0.283.23

package/dist/{deploy-engine-ISSt01TI.js → deploy-engine-CQXpKq7o.js}

@@ -14220,6 +14220,35 @@ function handlerAuthFailureHint(statusMessage) {
 	if (/cloudcontrol/i.test(service)) return "";
 	return ` [hint: this 403 was returned by ${service} to the AWS-managed resource handler running the operation, not to cdkd directly — these credentials already passed Cloud Control's own auth to start it. If the equivalent ${service} API call succeeds with the same credentials, the resource handler itself is failing (an upstream AWS issue worth retrying later), not your local credential setup.]`;
 }
+/** How many key names a malformed-model log line may carry. */
+const MAX_LOGGED_MODEL_KEYS = 12;
+/**
+* Summarize a JSON document by its KEY NAMES, for a log line that must not
+* carry the document's values (issue #1908).
+*
+* The document failed to parse, so the keys cannot be read structurally; this
+* matches the `"name":` lexical form instead. That is a deliberate trade: the
+* pattern requires the colon, so a bare string VALUE is never reported, and the
+* only way a value reaches the line is if the document contains a string that
+* is itself followed by a colon -- which for an AWS readback means a nested
+* key. Values are what must not leak, and a key-shaped token is not one.
+*/
+function describeJsonKeys(document) {
+	const keys = [];
+	const seen = /* @__PURE__ */ new Set();
+	const pattern = /"([^"\\]{1,64})"\s*:/g;
+	let match;
+	while ((match = pattern.exec(document)) !== null) {
+		const key = match[1];
+		if (seen.has(key)) continue;
+		seen.add(key);
+		keys.push(key);
+		if (keys.length >= MAX_LOGGED_MODEL_KEYS) break;
+	}
+	if (keys.length === 0) return "no readable key names";
+	const suffix = pattern.lastIndex < document.length && keys.length >= MAX_LOGGED_MODEL_KEYS ? ", ..." : "";
+	return `keys: ${keys.join(", ")}${suffix}`;
+}
 var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
@@ -14239,7 +14268,7 @@ var CloudControlProvider = class {
 		try {
 			const ccProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
 			const desiredState = JSON.stringify(ccProperties);
-			this.logger.debug(`DesiredState for ${logicalId}: ${desiredState}`);
+			this.logger.debug(`DesiredState for ${logicalId}: keys=${JSON.stringify(Object.keys(ccProperties))}`);
 			const createResponse = await this.cloudControlClient.send(new CreateResourceCommand({
 				TypeName: resourceType,
 				DesiredState: desiredState
@@ -14380,7 +14409,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DKjoomrX.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BKIOy3_q.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -14500,14 +14529,28 @@ var CloudControlProvider = class {
 		throw new ProvisioningError(`${operation} timeout for ${logicalId} after ${maxWaitMs / 1e3}s`, "Unknown", logicalId);
 	}
 	/**
-	* Parse resource model JSON string
+	* Parse resource model JSON string.
+	*
+	* On a parse failure this logs the error plus the model's SHAPE — never its
+	* body (issue #1908, a GHSA-p5qg-v9gv-hc7w residual). The model is an AWS
+	* readback, and a read handler cannot return write-only properties (the #809
+	* premise), so the common secret shapes are absent — but a `{{resolve:...}}`
+	* secret resolved into a NON-write-only property can round-trip back here,
+	* and the previous `Raw model: <first 500 chars>` line would have printed it.
+	* Truncation is not a mitigation: 500 characters is precisely where a
+	* document's leading values sit.
+	*
+	* KEY NAMES are logged and values are not, which is the whole distinction —
+	* a key is a property name from the type's schema, a value is the data. That
+	* keeps the line diagnostic (it says WHICH document failed to parse) without
+	* carrying anything sensitive.
 	*/
 	parseResourceModel(resourceModel) {
 		try {
 			return JSON.parse(resourceModel);
 		} catch (error) {
 			const errorMessage = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Failed to parse resource model: ${errorMessage}\nRaw model: ${resourceModel.substring(0, 500)}${resourceModel.length > 500 ? "..." : ""}`);
+			this.logger.warn(`Failed to parse resource model: ${errorMessage}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
 			return {};
 		}
 	}
@@ -21553,7 +21596,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.21";
+	return "0.283.23";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -23888,4 +23931,4 @@ var DeployEngine = class {
 
 //#endregion
 export { coerceCfnBoolean as $, resolveCaptureObservedState as $t, cyan as A, LocalStartServiceError as An, rewriteTemplateAssetReferences as At, findSilentDropProperties as B, StateError as Bn, buildDockerImage as Bt, makeCanonicalizePropertiesFn as C, AssetError as Cn, shouldRetainResource as Ct, renderStatefulReason as D, DeployCancelledError as Dn, buildAssetRedirectMap as Dt, isStatefulRecreateTargetSync as E, DependencyError as En, WorkGraph as Et, IAMRoleProvider as F, ProvisioningError as Fn, getBootstrapMarkerKey as Ft, IntrinsicFunctionResolver as G, withErrorHandling as Gn, AssetManifestLoader as Gt, slowCcOperationTimeoutMs as H, formatError as Hn, getDockerCmd as Ht, collectInlinePolicyNamesManagedBySiblings as I, ResourceTimeoutError as In, parseBootstrapMarker as It, refStateLookupFromResource as J, isThrottlingError as Jn, synthesisStatusMessage as Jt, cfnRefValueFromPhysicalId as K, isMarkedNonRetryable as Kn, getDockerImageBySourceHash as Kt, clearOnUpdateRemoval as L, ResourceUpdateNotSupportedError as Ln, validateAssetBucketName as Lt, green as M, MissingCdkCliError as Mn, AssetModeResolver as Mt, red as N, NestedStackChildDirectDestroyError as Nn, BOOTSTRAP_MARKER_PREFIX as Nt, formatResourceLine as O, LocalInvokeBuildError as On, createAssetRedirectResolver as Ot, yellow as P, PartialFailureError as Pn, ensureAssetStorage as Pt, assertRegionMatch as Q, resolveAutoAssetStorage as Qt, ProviderRegistry as R, StackHasActiveImportsError as Rn, validateContainerRepoName as Rt, unsupportedFinalSnapshotError as S, setAwsClients as Sn, rebuildClientForBucketRegion as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, ConfigError as Tn, stringifyValue as Tt, disableInstanceApiTermination as U, isCdkdError as Un, runDockerForeground as Ut, CloudControlProvider as V, SynthesisError as Vn, formatDockerLoginError as Vt, isTerminationProtectionPropagationError as W, normalizeAwsError as Wn, runDockerStreaming as Wt, normalizeAwsTagsToCfn as X, __exportAll as Xn, getLegacyStateBucketName as Xt, WAFv2WebACLProvider as Y, markNonRetryable as Yn, getDefaultStateBucketName as Yt, resolveExplicitPhysicalId as Z, resolveApp as Zt, buildFinalSnapshotIdentifier as _, clearBucketRegionCache as _n, withRetry as _t, DeploymentEventsStore as a, warnDeprecatedNoPrefixCliFlag as an, requireConfigObject as at, isFinalSnapshotError as b, getAwsClients as bn, LockManager as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as cn, scrubResourceRecord as ct, deleteSkipReason as d, expectedOwnerParam as dn, s3BucketDualStackDomainName as dt, resolveSkipPrefix as en, configBooleanRefusal as et, withResourceDeadline as f, PARTITION_TABLE as fn, s3BucketRegionalDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, processStackMessages as gn, describeTypeWithThrottleRetry as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, AssemblyReader as hn, DiffCalculator as ht, DeploymentEventsReader as i, stateBucketExistenceConfirmed as in, requireConfigArray as it, gray as j, LockError as jn, escapeRegExp$1 as jt, bold as k, LocalMigrateError as kn, loadPublishableAssetManifest as kt, replayRollback as l, findLargeInlineResources as ln, s3BucketArn as lt, computeImplicitDeleteEdges as m, derivePartitionAndUrlSuffix as mn, applyRoleArnIfSet as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveStateBucketWithDefaultAndSource as nn, readConfigString as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, canonicalizeRegion as pn, s3BucketWebsiteUrl as pt, getAccountInfo as q, isRetryableTransientError as qn, Synthesizer as qt, DeployEngine as r, resolveUseCdkBootstrapAssets as rn, replayWarn as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sn, redactSecretsForState as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefault as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, uploadCfnTemplate as un, s3BucketDomainName as ut, ccRoutedFinalSnapshotError as v, resolveBucketRegion as vn, DagBuilder as vt, extractDeploymentEventError as w, CdkdError as wn, AssetPublisher as wt, refusesFinalSnapshot as x, resetAwsClients as xn, S3StateBackend as xt, createPreDeleteFinalSnapshot as y, AwsClients as yn, TemplateParser as yt, findActionableSilentDrops as z, StackTerminationProtectionError as zn, buildDenyExternalAccessPolicy as zt };
-//# sourceMappingURL=deploy-engine-ISSt01TI.js.map
+//# sourceMappingURL=deploy-engine-CQXpKq7o.js.map