@go-to-k/cdkd 0.283.22 → 0.283.24

package/dist/{deploy-engine-e1ay5aqR.js → deploy-engine-Cu6OO-8t.js}

@@ -9842,6 +9842,102 @@ function buildNeedleRegex(values) {
 	if (needles.length === 0) return void 0;
 	return new RegExp(needles.map(escapeRegExp).join("|"), "g");
 }
+/** The bag was produced by resolving the source: same shape, template source. */
+const TEMPLATE_DERIVED_RULES = {
+	descendArrays: true,
+	trustAnyExpression: false
+};
+/** An AWS readback projected from a persisted STATE bag. */
+const STATE_SOURCED_READBACK_RULES = {
+	descendArrays: false,
+	trustAnyExpression: true
+};
+/** An AWS readback projected from the TEMPLATE: neither relaxation applies. */
+const TEMPLATE_SOURCED_READBACK_RULES = {
+	descendArrays: false,
+	trustAnyExpression: false
+};
+function isDynamicReferenceString(value) {
+	return typeof value === "string" && value.includes("{{resolve:");
+}
+/**
+* Is this template expression one whose resolved value is a SECRET?
+*
+* Two independent answers, and both are needed:
+*
+* - A `secretsmanager` reference is secret BY DEFINITION, so spelling settles
+*   it with no lookup. This arm is what makes the #1904 fix work at all: when
+*   two expressions resolve to the same value the value-keyed map keeps only the
+*   last, so asking the map whether the LOSING expression was a secret answers
+*   "no" — precisely for the pair the fix exists to separate.
+* - An `ssm` reference is secret only when its parameter is a `SecureString`
+*   (issue #1901), which is not derivable from the string, so that arm consults
+*   what the resolver actually recorded.
+*
+* The residue is narrow and safe: two SecureString ssm references sharing one
+* resolved value still collapse, because the map cannot distinguish them and
+* spelling cannot either. That is the pre-existing behavior, it leaks nothing
+* (both are redacted, just to one expression), and closing it needs the resolver
+* to record expressions in their own set rather than as map values.
+*/
+function isKnownSecretExpression(expression, secretExpressions) {
+	return expression.startsWith("{{resolve:secretsmanager:") || secretExpressions.has(expression);
+}
+/**
+* Is this source leaf a SINGLE complete `{{resolve:...}}` token and nothing
+* else?
+*
+* Whole-leaf substitution is only correct for that shape. A MIXED leaf --
+* `pre{{resolve:ssm:/public}}-{{resolve:secretsmanager:x}}post`, i.e. anything
+* the resolver substituted INTO rather than replaced -- must fall to the value
+* scan, which rewrites just the secret substring. Substituting the whole leaf
+* there would re-introduce every other token in it, including a public ssm
+* reference the resolver deliberately left resolved (issue #1901).
+*/
+function isSingleDynamicReferenceToken(value) {
+	return /^\{\{resolve:[^{}]*\}\}$/.test(value);
+}
+function isPlainObject$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* PATH-based redaction: walk `bag` alongside a SOURCE bag that still carries the
+* unresolved `{{resolve:...}}` expressions, and wherever the source leaf is such
+* a string, persist THAT string verbatim.
+*
+* This exists because value-keyed redaction cannot answer the question at all
+* when two expressions share one resolved value (issue #1904): the map is keyed
+* by the plaintext, so the two collapse and every site is rewritten to whichever
+* expression was recorded last — state then holds an expression the template
+* does not have at that leaf, and the stack takes a permanent spurious UPDATE.
+* Position is the only disambiguator, and the source bag supplies it.
+*
+* It also covers the case where there is no secrets map to consult at all
+* (issue #1900): an UNCHANGED resource is never resolved during a deploy, so its
+* `perResourceSecrets` entry is empty, and a live readback that echoes a secret
+* would be persisted in plaintext. Projecting from the resource's OWN state
+* record — which already holds the expressions — redacts it with no secret
+* fetch and no value matching.
+*
+* The value scan is still applied wherever the source cannot answer: a source
+* leaf that is an intrinsic OBJECT (`Fn::Join` / `Fn::Sub`) resolves to a string
+* embedding the secret, and only a value match can find it inside. So the two
+* passes are complementary rather than alternatives — path where position is
+* knowable, value where it is not.
+*/
+function redactByPath(bag, source, secrets, rules, secretExpressions) {
+	if (isDynamicReferenceString(source) && typeof bag === "string") {
+		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) return source;
+		return redactSecretsForState(bag, secrets);
+	}
+	if (rules.descendArrays && Array.isArray(bag) && Array.isArray(source) && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
+	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+		const out = {};
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions) : redactSecretsForState(v, secrets);
+		return out;
+	}
+	return redactSecretsForState(bag, secrets);
+}
 /**
 * Deep-clone `bag`, replacing every occurrence of a recorded secret value with
 * the unresolved `{{resolve:...}}` expression it came from. A string whose WHOLE
@@ -9851,8 +9947,9 @@ function buildNeedleRegex(values) {
 * is nothing to redact, so callers can persist the original object unchanged in
 * the common no-secret case.
 */
-function redactSecretsForState(bag, secrets) {
-	if (secrets.size === 0) return bag;
+function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
+	if (secrets.size === 0 && source === void 0) return bag;
+	if (source !== void 0) return redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
 	const regex = buildNeedleRegex(secrets.keys());
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
 	const walk = (value) => {
@@ -9883,12 +9980,12 @@ function redactSecretsForState(bag, secrets) {
 * detect a no-op cheaply. Shared by the deploy engine's save choke point and
 * the `cdkd scrub` command so both scrub the same three fields identically.
 */
-function scrubResourceRecord(record, secrets) {
-	if (secrets.size === 0) return record;
+function scrubResourceRecord(record, secrets, sourceProperties) {
+	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
-	next.properties = redactSecretsForState(record.properties, secrets);
+	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
 	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets);
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_READBACK_RULES);
 	return next;
 }
 /**
@@ -14220,6 +14317,35 @@ function handlerAuthFailureHint(statusMessage) {
 	if (/cloudcontrol/i.test(service)) return "";
 	return ` [hint: this 403 was returned by ${service} to the AWS-managed resource handler running the operation, not to cdkd directly — these credentials already passed Cloud Control's own auth to start it. If the equivalent ${service} API call succeeds with the same credentials, the resource handler itself is failing (an upstream AWS issue worth retrying later), not your local credential setup.]`;
 }
+/** How many key names a malformed-model log line may carry. */
+const MAX_LOGGED_MODEL_KEYS = 12;
+/**
+* Summarize a JSON document by its KEY NAMES, for a log line that must not
+* carry the document's values (issue #1908).
+*
+* The document failed to parse, so the keys cannot be read structurally; this
+* matches the `"name":` lexical form instead. That is a deliberate trade: the
+* pattern requires the colon, so a bare string VALUE is never reported, and the
+* only way a value reaches the line is if the document contains a string that
+* is itself followed by a colon -- which for an AWS readback means a nested
+* key. Values are what must not leak, and a key-shaped token is not one.
+*/
+function describeJsonKeys(document) {
+	const keys = [];
+	const seen = /* @__PURE__ */ new Set();
+	const pattern = /"([^"\\]{1,64})"\s*:/g;
+	let match;
+	while ((match = pattern.exec(document)) !== null) {
+		const key = match[1];
+		if (seen.has(key)) continue;
+		seen.add(key);
+		keys.push(key);
+		if (keys.length >= MAX_LOGGED_MODEL_KEYS) break;
+	}
+	if (keys.length === 0) return "no readable key names";
+	const suffix = pattern.lastIndex < document.length && keys.length >= MAX_LOGGED_MODEL_KEYS ? ", ..." : "";
+	return `keys: ${keys.join(", ")}${suffix}`;
+}
 var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
@@ -14380,7 +14506,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C7y3ACZk.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C9Mq493c.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -14500,14 +14626,28 @@ var CloudControlProvider = class {
 		throw new ProvisioningError(`${operation} timeout for ${logicalId} after ${maxWaitMs / 1e3}s`, "Unknown", logicalId);
 	}
 	/**
-	* Parse resource model JSON string
+	* Parse resource model JSON string.
+	*
+	* On a parse failure this logs the error plus the model's SHAPE — never its
+	* body (issue #1908, a GHSA-p5qg-v9gv-hc7w residual). The model is an AWS
+	* readback, and a read handler cannot return write-only properties (the #809
+	* premise), so the common secret shapes are absent — but a `{{resolve:...}}`
+	* secret resolved into a NON-write-only property can round-trip back here,
+	* and the previous `Raw model: <first 500 chars>` line would have printed it.
+	* Truncation is not a mitigation: 500 characters is precisely where a
+	* document's leading values sit.
+	*
+	* KEY NAMES are logged and values are not, which is the whole distinction —
+	* a key is a property name from the type's schema, a value is the data. That
+	* keeps the line diagnostic (it says WHICH document failed to parse) without
+	* carrying anything sensitive.
 	*/
 	parseResourceModel(resourceModel) {
 		try {
 			return JSON.parse(resourceModel);
 		} catch (error) {
 			const errorMessage = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Failed to parse resource model: ${errorMessage}\nRaw model: ${resourceModel.substring(0, 500)}${resourceModel.length > 500 ? "..." : ""}`);
+			this.logger.warn(`Failed to parse resource model: ${errorMessage}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
 			return {};
 		}
 	}
@@ -21553,7 +21693,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.22";
+	return "0.283.24";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22167,6 +22307,17 @@ var DeployEngine = class {
 	*/
 	perResourceSecrets = /* @__PURE__ */ new Map();
 	/**
+	* PER-RESOURCE unresolved TEMPLATE properties, keyed by logicalId (issues
+	* #1904 / #1900). The redaction choke point uses this as the POSITION source:
+	* wherever the template leaf is a `{{resolve:...}}` string, state persists
+	* that string verbatim instead of asking the value-keyed map which expression
+	* a plaintext came from — a question that map cannot answer when two
+	* expressions resolve to the same value. Captured at the same two sites that
+	* populate `perResourceSecrets`, where the unresolved bag is already in hand.
+	* Reset per `deploy()`.
+	*/
+	perResourceTemplateProps = /* @__PURE__ */ new Map();
+	/**
 	* Resolved secrets recorded while resolving the stack OUTPUTS (a `CfnOutput`
 	* whose Value resolves a `{{resolve:...}}` reference). Separate from the
 	* per-resource maps for the same anti-cross-contamination reason. Reset per
@@ -22215,6 +22366,7 @@ var DeployEngine = class {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
+		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
@@ -22286,7 +22438,8 @@ var DeployEngine = class {
 		const resources = {};
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.perResourceSecrets.get(logicalId);
-			resources[logicalId] = secrets ? scrubResourceRecord(record, secrets) : record;
+			const templateProps = this.perResourceTemplateProps.get(logicalId);
+			resources[logicalId] = scrubResourceRecord(record, secrets ?? /* @__PURE__ */ new Map(), templateProps);
 		}
 		return {
 			...state,
@@ -23300,6 +23453,7 @@ var DeployEngine = class {
 					...conditions && { conditions }
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
+				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
@@ -23344,6 +23498,7 @@ var DeployEngine = class {
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				this.perResourceSecrets.set(logicalId, updateSecrets);
+				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				if (JSON.stringify(this.redactPropsWith(resolvedProps, updateSecrets)) === JSON.stringify(currentProps)) {
@@ -23888,4 +24043,4 @@ var DeployEngine = class {
 
 //#endregion
 export { coerceCfnBoolean as $, resolveCaptureObservedState as $t, cyan as A, LocalStartServiceError as An, rewriteTemplateAssetReferences as At, findSilentDropProperties as B, StateError as Bn, buildDockerImage as Bt, makeCanonicalizePropertiesFn as C, AssetError as Cn, shouldRetainResource as Ct, renderStatefulReason as D, DeployCancelledError as Dn, buildAssetRedirectMap as Dt, isStatefulRecreateTargetSync as E, DependencyError as En, WorkGraph as Et, IAMRoleProvider as F, ProvisioningError as Fn, getBootstrapMarkerKey as Ft, IntrinsicFunctionResolver as G, withErrorHandling as Gn, AssetManifestLoader as Gt, slowCcOperationTimeoutMs as H, formatError as Hn, getDockerCmd as Ht, collectInlinePolicyNamesManagedBySiblings as I, ResourceTimeoutError as In, parseBootstrapMarker as It, refStateLookupFromResource as J, isThrottlingError as Jn, synthesisStatusMessage as Jt, cfnRefValueFromPhysicalId as K, isMarkedNonRetryable as Kn, getDockerImageBySourceHash as Kt, clearOnUpdateRemoval as L, ResourceUpdateNotSupportedError as Ln, validateAssetBucketName as Lt, green as M, MissingCdkCliError as Mn, AssetModeResolver as Mt, red as N, NestedStackChildDirectDestroyError as Nn, BOOTSTRAP_MARKER_PREFIX as Nt, formatResourceLine as O, LocalInvokeBuildError as On, createAssetRedirectResolver as Ot, yellow as P, PartialFailureError as Pn, ensureAssetStorage as Pt, assertRegionMatch as Q, resolveAutoAssetStorage as Qt, ProviderRegistry as R, StackHasActiveImportsError as Rn, validateContainerRepoName as Rt, unsupportedFinalSnapshotError as S, setAwsClients as Sn, rebuildClientForBucketRegion as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, ConfigError as Tn, stringifyValue as Tt, disableInstanceApiTermination as U, isCdkdError as Un, runDockerForeground as Ut, CloudControlProvider as V, SynthesisError as Vn, formatDockerLoginError as Vt, isTerminationProtectionPropagationError as W, normalizeAwsError as Wn, runDockerStreaming as Wt, normalizeAwsTagsToCfn as X, __exportAll as Xn, getLegacyStateBucketName as Xt, WAFv2WebACLProvider as Y, markNonRetryable as Yn, getDefaultStateBucketName as Yt, resolveExplicitPhysicalId as Z, resolveApp as Zt, buildFinalSnapshotIdentifier as _, clearBucketRegionCache as _n, withRetry as _t, DeploymentEventsStore as a, warnDeprecatedNoPrefixCliFlag as an, requireConfigObject as at, isFinalSnapshotError as b, getAwsClients as bn, LockManager as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as cn, scrubResourceRecord as ct, deleteSkipReason as d, expectedOwnerParam as dn, s3BucketDualStackDomainName as dt, resolveSkipPrefix as en, configBooleanRefusal as et, withResourceDeadline as f, PARTITION_TABLE as fn, s3BucketRegionalDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, processStackMessages as gn, describeTypeWithThrottleRetry as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, AssemblyReader as hn, DiffCalculator as ht, DeploymentEventsReader as i, stateBucketExistenceConfirmed as in, requireConfigArray as it, gray as j, LockError as jn, escapeRegExp$1 as jt, bold as k, LocalMigrateError as kn, loadPublishableAssetManifest as kt, replayRollback as l, findLargeInlineResources as ln, s3BucketArn as lt, computeImplicitDeleteEdges as m, derivePartitionAndUrlSuffix as mn, applyRoleArnIfSet as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveStateBucketWithDefaultAndSource as nn, readConfigString as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, canonicalizeRegion as pn, s3BucketWebsiteUrl as pt, getAccountInfo as q, isRetryableTransientError as qn, Synthesizer as qt, DeployEngine as r, resolveUseCdkBootstrapAssets as rn, replayWarn as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sn, redactSecretsForState as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefault as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, uploadCfnTemplate as un, s3BucketDomainName as ut, ccRoutedFinalSnapshotError as v, resolveBucketRegion as vn, DagBuilder as vt, extractDeploymentEventError as w, CdkdError as wn, AssetPublisher as wt, refusesFinalSnapshot as x, resetAwsClients as xn, S3StateBackend as xt, createPreDeleteFinalSnapshot as y, AwsClients as yn, TemplateParser as yt, findActionableSilentDrops as z, StackTerminationProtectionError as zn, buildDenyExternalAccessPolicy as zt };
-//# sourceMappingURL=deploy-engine-e1ay5aqR.js.map
+//# sourceMappingURL=deploy-engine-Cu6OO-8t.js.map