@go-to-k/cdkd 0.284.19 → 0.284.20

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isTerminationProtectionPropagationError, $n as ResourceTimeoutError, $t as readBootstrapMarkerBody, A as renderStatefulReason, An as canonicalizeRegion, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_BODY_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as uploadCfnTemplate, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as findLargeInlineResources, Et as s3BucketRegionalDomainName, F as green, Fn as resolveBucketRegion, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalInvokeBuildError$1, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as AwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalMigrateError, Kt as escapeRegExp, L as yellow, Ln as getAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as AssemblyReader, Mt as withRetry, N as cyan, Nn as processStackMessages, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as expectedOwnerParam, Ot as applyRoleArnIfSet, P as gray, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ProvisioningError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as resetAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as warnDeprecatedNoPrefixCliFlag, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as MIGRATE_TMP_PREFIX, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vn as CdkdError, Vt as WorkGraph, W as IAMRoleProvider, Wn as DeployCancelledError, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as NestedStackChildDirectDestroyError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as MissingCdkCliError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as PartialFailureError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveSkipPrefix, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as getDockerCmd, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as resolveUseCdkBootstrapAssets, bt as maskSecretsInText, c as replayFailedOperations, cn as AssetManifestLoader, cr as withErrorHandling, ct as coerceCfnBoolean, d as updatePartialReason, dn as synthesisStatusMessage, dr as isThrottlingError, dt as readConfigString, en as validateAssetBucketName, er as ResourceUpdateNotSupportedError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getDefaultStateBucketName, fr as markNonRetryable, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveCaptureObservedState, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveAutoAssetStorage, ht as requireConfigString, i as DeploymentEventsReader, in as formatDockerLoginError, it as WAFv2WebACLProvider, j as formatResourceLine, jn as derivePartitionAndUrlSuffix, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as PARTITION_TABLE, kt as DiffCalculator, l as replayRollback, ln as getDockerImageBySourceHash, lr as isMarkedNonRetryable, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveApp, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDenyExternalAccessPolicy, nr as StackTerminationProtectionError, nt as getAccountInfo, o as planFailedOps, on as runDockerForeground, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as getLegacyStateBucketName, pt as requireConfigArray, q as ProviderRegistry, qn as LocalStartServiceError, qt as stripControlChars, r as DeployEngine, rn as buildDockerImage, rt as refStateLookupFromResource, s as planRollback, sn as runDockerStreaming, sr as normalizeAwsError, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as validateContainerRepoName, tr as StackHasActiveImportsError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as Synthesizer, ur as isRetryableTransientError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefault, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as CFN_TEMPLATE_URL_LIMIT, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as stateBucketExistenceConfirmed, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveStateBucketWithDefaultAndSource, yt as createSecretMasker, z as collectPublishedOutputNames, zn as setAwsClients, zt as AssetPublisher } from "./deploy-engine-Bh_LPdju.js";
+import { $ as isTerminationProtectionPropagationError, $n as PartialFailureError, $t as getBootstrapMarkerKey, A as renderStatefulReason, An as expectedOwnerParam, At as applyRoleArnIfSet, B as exportAliasCollisionScrubWarning, Bn as resetAwsClients, Bt as shouldRetainResource, C as isFinalSnapshotError, Cn as stateBucketExistenceConfirmed, Ct as redactSecretsForState, D as extractDeploymentEventError, Dn as MIGRATE_TMP_PREFIX, Dt as s3BucketDualStackDomainName, E as makeCanonicalizePropertiesFn, En as CFN_TEMPLATE_URL_LIMIT, Et as s3BucketDomainName, F as green, Fn as processStackMessages, Ft as DagBuilder, G as collectInlinePolicyNamesManagedBySiblings, Gt as createAssetRedirectResolver, H as secretBearingStateKeyWarning, Ht as stringifyValue, I as red, It as TemplateParser, J as findActionableSilentDrops, Jn as LocalMigrateError, Jt as escapeRegExp, K as clearOnUpdateRemoval, Kn as DeployCancelledError, Kt as loadPublishableAssetManifest, L as yellow, Ln as resolveBucketRegion, Lt as LockManager, M as bold, Mn as canonicalizeRegion, Mt as INTRINSIC_KEYS, N as cyan, Nn as derivePartitionAndUrlSuffix, Nt as describeTypeWithThrottleRetry, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as findLargeInlineResources, Ot as s3BucketRegionalDomainName, P as gray, Pn as AssemblyReader, Pt as withRetry, Q as disableInstanceApiTermination, Qn as NestedStackChildDirectDestroyError, Qt as ensureAssetStorage, R as collectDeclaredOutputNames, Rn as AwsClients, Rt as S3StateBackend, S as createPreDeleteFinalSnapshot, Sn as resolveUseCdkBootstrapAssets, St as maskSecretsInText, T as unsupportedFinalSnapshotError, Tn as CFN_TEMPLATE_BODY_LIMIT, Tt as s3BucketArn, U as stateKeySecretExposure, Un as CdkdError, Ut as WorkGraph, V as isExportAliasCollision, Vn as setAwsClients, Vt as AssetPublisher, W as IAMRoleProvider, Wt as buildAssetRedirectMap, X as CloudControlProvider, Xt as AssetModeResolver, Y as findSilentDropProperties, Yn as LocalStartServiceError, Yt as stripControlChars, Z as slowCcOperationTimeoutMs, Zn as MissingCdkCliError, Zt as BOOTSTRAP_MARKER_PREFIX, _ as computeImplicitDeleteEdges, _n as resolveAutoAssetStorage, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as buildDockerImage, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as resolveStateBucketWithDefault, bt as dynamicReferenceTokens, c as replayFailedOperations, cn as runDockerForeground, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDockerImageBySourceHash, dr as isMarkedNonRetryable, dt as readConfigString, en as parseBootstrapMarker, er as ProvisioningError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as Synthesizer, fr as isRetryableTransientError, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveApp, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as getLegacyStateBucketName, ht as requireConfigString, i as DeploymentEventsReader, in as buildDenyExternalAccessPolicy, ir as StackTerminationProtectionError, it as WAFv2WebACLProvider, j as formatResourceLine, jn as PARTITION_TABLE, jt as DiffCalculator, k as isStatefulRecreateTargetSync, kn as uploadCfnTemplate, kt as s3BucketWebsiteUrl, l as replayRollback, ln as runDockerStreaming, lr as normalizeAwsError, lt as configBooleanRefusal, m as withResourceDeadline, mn as getDefaultStateBucketName, mr as markNonRetryable, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as validateAssetBucketName, nr as ResourceUpdateNotSupportedError, nt as getAccountInfo, o as planFailedOps, on as formatDockerLoginError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as synthesisStatusMessage, pr as isThrottlingError, pt as requireConfigArray, q as ProviderRegistry, qn as LocalInvokeBuildError$1, qt as rewriteTemplateAssetReferences, r as DeployEngine, rn as validateContainerRepoName, rr as StackHasActiveImportsError, rt as refStateLookupFromResource, s as planRollback, sn as getDockerCmd, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as readBootstrapMarkerBody, tr as ResourceTimeoutError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as AssetManifestLoader, ur as withErrorHandling, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveCaptureObservedState, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as warnDeprecatedNoPrefixCliFlag, wt as scrubResourceRecord, x as ccRoutedFinalSnapshotError, xn as resolveStateBucketWithDefaultAndSource, xt as isSingleDynamicReferenceToken, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveSkipPrefix, yt as createSecretMasker, z as collectPublishedOutputNames, zn as getAwsClients, zt as rebuildClientForBucketRegion } from "./deploy-engine-C6gt7NcL.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CuSoYdf6.js";
+import { t as ASGProvider } from "./asg-provider-Cq-oDB62.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -63407,7 +63407,7 @@ function isSecretBySpelling(token) {
 * token is a reference NAME and carries no value, so it is always safe to show.
 */
 function survivingDynamicReferences(value) {
-	return value.match(/\{\{resolve:[^}]+\}\}/g) ?? [];
+	return dynamicReferenceTokens(value);
 }
 /**
 * Record the dotted path of every leaf holding a `{{resolve:...}}` string.
@@ -63549,29 +63549,10 @@ function redactDriftValue(value, secrets, secretBearing) {
 	const redacted = redactSecretsForState(value, secrets);
 	if (!secretBearing) return redacted;
 	if (redacted === void 0 || redacted === null) return redacted;
-	if (typeof redacted === "string" && isWholeDynamicReference(redacted)) return redacted;
+	if (typeof redacted === "string" && isSingleDynamicReferenceToken(redacted)) return redacted;
 	return "***";
 }
 /**
-* Is the WHOLE string a single `{{resolve:...}}` token and nothing else?
-*
-* Byte-for-byte `secret-redaction.ts`'s `isSingleDynamicReferenceToken`,
-* including the `[^{}]*` character class. The difference from `[^}]+` is
-* narrow and worth stating correctly: it is a `{` INSIDE the token, e.g.
-* `{{resolve:ssm:/a{b}}`. (A previous version of this comment claimed
-* `{{resolve:a}}{{resolve:b}}` would pass under `[^}]+` — it would not, since
-* `[^}]+` cannot span the `}` in the middle either.) Matching the sibling
-* exactly is what matters here: this predicate decides whether a value may be
-* shown INSTEAD of `SECRET_MASK`, and `redactByPath` uses its copy to decide
-* whether a leaf is already an expression, so a disagreement would let one of
-* them treat as a token what the other treats as data. Copied rather than
-* imported because that helper is module-private and this file may not widen
-* that module's exports.
-*/
-function isWholeDynamicReference(value) {
-	return /^\{\{resolve:[^{}]*\}\}$/.test(value);
-}
-/**
 * Why `--accept` must not persist this drift, or `undefined` when it may.
 *
 * Shared by the WRITE (`runAccept`) and the PLAN (`printAcceptPlan`) so the two
@@ -64296,7 +64277,7 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 function preserveLiveValuesAtUnresolvedTokens(send, awsProperties, secrets) {
 	const walk = (value, live) => {
 		if (typeof value === "string" && value.includes("{{resolve:")) {
-			if (!isWholeDynamicReference(value)) return value;
+			if (!isSingleDynamicReferenceToken(value)) return value;
 			if (live === void 0) return value;
 			if (typeof live === "string" && live.length >= MIN_SECRET_NEEDLE_LENGTH && isSecretBySpelling(value)) secrets.set(live, value);
 			return live;
@@ -83750,7 +83731,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.19");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.20");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;