@go-to-k/cdkd 0.284.19 → 0.284.20

package/dist/{deploy-engine-Bh_LPdju.js → deploy-engine-C6gt7NcL.js}

@@ -10464,8 +10464,86 @@ function isKnownSecretExpression(expression, secretExpressions) {
 	return expression.startsWith("{{resolve:secretsmanager:") || secretExpressions.has(expression) || isRecordedSecretExpression(expression);
 }
 /**
-* Is this source leaf a SINGLE complete `{{resolve:...}}` token and nothing
-* else?
+* The character class a `{{resolve:...}}` reference's INNER text is built from,
+* and the SINGLE SOURCE OF TRUTH every dynamic-reference predicate in cdkd
+* derives from (issue
+* [#1936](https://github.com/go-to-k/cdkd/issues/1936)).
+*
+* **THE AUTHORITY IS THE RESOLVER.**
+* `IntrinsicFunctionResolver.resolveDynamicReferences`
+* (`src/deployment/intrinsic-function-resolver.ts`) scans with
+* `/\{\{resolve:([^}]+)\}\}/g`, so what cdkd will actually RESOLVE is exactly
+* `{{resolve:` followed by one or more non-`}` characters followed by `}}`.
+* A predicate that answers a different question than that scan is answering
+* about a string the resolver already substituted a value INTO, which is how a
+* leaf ends up classified as "not a token" while holding the plaintext the
+* resolver put there.
+*
+* Three sites disagreed before this constant existed, and the STRICTEST of them
+* was the one that persisted plaintext. `isSingleDynamicReferenceToken` here and
+* `isWholeDynamicReference` in `src/cli/commands/drift.ts` both spelled the
+* inner class `[^{}]*`, while `survivingDynamicReferences` (same file) spelled
+* it `[^}]+` to match the resolver. For a reference whose inner text contains a
+* `{` — a Secrets Manager JSON key or a secret name, e.g.
+* `{{resolve:secretsmanager:app/db:SecretString:my{key}}` — the resolver
+* resolves it fine, but the strict spelling said it was not a single token, so
+* `redactByPath`'s source arm refused it and on an EMPTY-map path the RESOLVED
+* PLAINTEXT was persisted verbatim. A disclosure, narrow and pre-existing.
+*
+* `cdkd scrub` is the only leaking command, and it leaks on BOTH of its walks
+* -- the second one named after the issue #2088 security review, which found
+* the first draft of this note incomplete:
+*
+* - the `properties` walk under `TEMPLATE_SOURCED_RULES`, where
+*   `isKnownSecretExpression` answers true by SPELLING but the strict
+*   predicate refused the leaf before it could; and
+* - the cross-generation `observedProperties` walk, whose value scan has no
+*   needles (issue #1900).
+*
+* The empty map is reachable on both because `scrub.ts` resolves BEST-EFFORT
+* (a deleted secret, or a role lacking read permission on it, leaves
+* `recordedSecretValues` empty) and then records `perResourceTemplateProps`
+* UNCONDITIONALLY while recording `perResourceSecrets` only when non-empty --
+* so the position source is present with no map beside it.
+*
+* `cdkd state refresh-observed` and the deploy's `drainObservedCaptures` are
+* NOT affected: they take `STATE_SOURCED_READBACK_RULES`, which sets
+* `sourceIsSameGeneration`, so {@link refuseUncertifiedReadbackPositions}
+* restores the source even under the old strict class.
+*
+* Excluding `{` bought nothing. The mangled / concatenated shapes it might seem
+* to guard — `{{resolve:a}}{{resolve:b}}`, a spliced token — are already
+* rejected by `[^}]+` under an ANCHORED pattern, because the class cannot cross
+* the first `}`. (A claim that `[^}]+` would let `{{resolve:a}}{{resolve:b}}`
+* through circulated in review and is FALSE: that string does not match
+* `^\{\{resolve:[^}]+\}\}$` either.) The only strings the two spellings
+* classify differently are the ones with a `{` inside a single token, i.e.
+* exactly the disclosure above.
+*
+* `+` rather than `*` for the same reason: `{{resolve:}}` is not something the
+* resolver would try to resolve, so nothing here may call it a token.
+*
+* The class is exported as a STRING rather than as a finished `RegExp` because
+* three different pattern shapes are built from it — anchored, global, and
+* {@link SKELETON_WILDCARD}'s zero-or-more form — and a shared global `RegExp`
+* instance would carry `lastIndex` across callers.
+*/
+const DYNAMIC_REFERENCE_INNER_CHAR = "[^}]";
+/**
+* The inner-text pattern fragment of a complete `{{resolve:...}}` reference,
+* byte-identical to the resolver's own `([^}]+)` capture. See
+* {@link DYNAMIC_REFERENCE_INNER_CHAR} for why this is one constant.
+*/
+const DYNAMIC_REFERENCE_INNER = `${DYNAMIC_REFERENCE_INNER_CHAR}+`;
+/**
+* Anchored: the WHOLE string is one complete `{{resolve:...}}` token.
+*
+* A non-global `RegExp`, so `.test` carries no `lastIndex` state and the shared
+* instance is safe to reuse.
+*/
+const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REFERENCE_INNER}\\}\\}$`);
+/**
+* Is this leaf a SINGLE complete `{{resolve:...}}` token and nothing else?
 *
 * Whole-leaf substitution is only correct for that shape. A MIXED leaf --
 * `pre{{resolve:ssm:/public}}-{{resolve:secretsmanager:x}}post`, i.e. anything
@@ -10473,9 +10551,15 @@ function isKnownSecretExpression(expression, secretExpressions) {
 * scan, which rewrites just the secret substring. Substituting the whole leaf
 * there would re-introduce every other token in it, including a public ssm
 * reference the resolver deliberately left resolved (issue #1901).
+*
+* EXPORTED since issue #1936 so `src/cli/commands/drift.ts` can consume this
+* one definition instead of carrying a hand-copied twin. Its copy's own comment
+* said "copied rather than imported because that helper is module-private and
+* this file may not widen that module's exports" — widening the exports is the
+* cheaper half of that trade once the copies have provably disagreed.
 */
 function isSingleDynamicReferenceToken(value) {
-	return /^\{\{resolve:[^{}]*\}\}$/.test(value);
+	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
 function isPlainObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -10484,14 +10568,18 @@ function isPlainObject$2(value) {
 * Stands in for a source part the skeleton cannot know — an `Fn::Join` element
 * that is itself an intrinsic, or an `Fn::Sub` `${...}` variable.
 *
-* `[^}]*` rather than `.*` because a recorded expression's INNER text never
-* contains `}`: the resolver matches them with `/\{\{resolve:([^}]+)\}\}/`, so
-* the first `}` after `{{resolve:` is already the terminator. Excluding it
-* means a wildcard can never swallow one token's terminator and run into the
-* next, so a skeleton for ONE reference cannot match a candidate built from a
-* different one.
+* Built from {@link DYNAMIC_REFERENCE_INNER_CHAR} rather than `.` because a
+* recorded expression's INNER text never contains `}`: the resolver matches
+* them with `/\{\{resolve:([^}]+)\}\}/`, so the first `}` after `{{resolve:` is
+* already the terminator. Excluding it means a wildcard can never swallow one
+* token's terminator and run into the next, so a skeleton for ONE reference
+* cannot match a candidate built from a different one.
+*
+* Zero-or-more here, unlike {@link DYNAMIC_REFERENCE_INNER}: this stands in for
+* an unknown SPAN, which may legitimately be empty (an `Fn::Join` part that
+* resolved to `''`), whereas a token with no inner text is not a token.
 */
-const SKELETON_WILDCARD = "[^}]*";
+const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
 /**
 * More wildcards than this and the skeleton is REFUSED outright.
 *
@@ -10947,9 +11035,51 @@ function subtreeHasDynamicReference(value) {
 	if (isPlainObject$2(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
-/** Every complete `{{resolve:...}}` token inside a string. */
+/**
+* Every complete `{{resolve:...}}` token inside a string.
+*
+* This was a FOURTH spelling of the token pattern (`[^{}]*`, global) and is
+* built from {@link DYNAMIC_REFERENCE_INNER} since issue #1936, so it agrees
+* with the resolver like every other predicate here.
+*
+* EXPORTED, and `drift.ts`'s `survivingDynamicReferences` calls it rather than
+* re-spelling the scan (issue #2088 review). The character CLASS was shared
+* from #1936, but the assembled PATTERN was still byte-duplicated in the two
+* files — which is how a later flag or anchor change re-forks exactly the way
+* the four spellings did.
+*
+* The pattern is a module-level constant. An earlier revision built a fresh
+* `RegExp` per call, justified as "a shared global instance carries
+* `lastIndex` between callers" — that is FALSE for this use and was measured:
+* `String.prototype.match` with a `/g` pattern sets `lastIndex` to 0 on entry
+* and leaves it 0, so no state crosses callers. The per-call construction was
+* compiling a pattern per string leaf at the persist choke point, which walks
+* every record. Do NOT call `.exec` / `.test` on this constant — those DO
+* advance `lastIndex`, which is exactly why the shared instance is safe only
+* for `.match`.
+*
+* Widening it changes one answer, in the SAFE direction for BOTH readers.
+*
+* `drift.ts`'s `survivingDynamicReferences` is the reader that is easy to
+* forget, because it lives in another file — it feeds `isSecretBySpelling`,
+* so seeing MORE tokens can only mask more, never less. Do not shorten this
+* to "the only reader": that sentence is what a later editor uses to bound
+* the blast radius of touching the class, and getting it wrong points them
+* away from the report / `--json` / `--accept` path where an unmasked
+* `ssm-secure` survivor would surface.
+*
+* The other reader is the DECLARED direction for issue #1901:
+* {@link mixedLeafMayCarryPublicReference}, which asks whether a MIXED leaf
+* embeds a `{{resolve:ssm:` token the verdict store does not know. A token
+* carrying a `{` inside it used to be INVISIBLE here, so such a leaf was
+* always treated as secret-bearing and the source expression was substituted
+* over the resolved value. Now it is seen and classified by the same rule as
+* every other token — which, on a POPULATED map, means a genuinely public ssm
+* parameter keeps the resolved value it is supposed to keep.
+*/
+const DYNAMIC_REFERENCE_TOKEN_SCAN = new RegExp(`\\{\\{resolve:${DYNAMIC_REFERENCE_INNER}\\}\\}`, "g");
 function dynamicReferenceTokens(value) {
-	return value.match(/\{\{resolve:[^{}]*\}\}/g) ?? [];
+	return value.match(DYNAMIC_REFERENCE_TOKEN_SCAN) ?? [];
 }
 /**
 * Does this MIXED leaf embed a reference that may be PUBLIC config?
@@ -16598,7 +16728,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CuSoYdf6.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Cq-oDB62.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -24771,7 +24901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.19";
+	return "0.284.20";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -27310,5 +27440,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { isTerminationProtectionPropagationError as $, ResourceTimeoutError as $n, readBootstrapMarkerBody as $t, renderStatefulReason as A, canonicalizeRegion as An, INTRINSIC_KEYS as At, exportAliasCollisionScrubWarning as B, AssetError as Bn, stringifyValue as Bt, isFinalSnapshotError as C, CFN_TEMPLATE_BODY_LIMIT as Cn, s3BucketArn as Ct, extractDeploymentEventError as D, uploadCfnTemplate as Dn, s3BucketWebsiteUrl as Dt, makeCanonicalizePropertiesFn as E, findLargeInlineResources as En, s3BucketRegionalDomainName as Et, green as F, resolveBucketRegion as Fn, LockManager as Ft, collectInlinePolicyNamesManagedBySiblings as G, LocalInvokeBuildError as Gn, rewriteTemplateAssetReferences as Gt, secretBearingStateKeyWarning as H, ConfigError as Hn, buildAssetRedirectMap as Ht, red as I, AwsClients as In, S3StateBackend as It, findActionableSilentDrops as J, LockError as Jn, AssetModeResolver as Jt, clearOnUpdateRemoval as K, LocalMigrateError as Kn, escapeRegExp$1 as Kt, yellow as L, getAwsClients as Ln, rebuildClientForBucketRegion as Lt, bold as M, AssemblyReader as Mn, withRetry as Mt, cyan as N, processStackMessages as Nn, DagBuilder as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, expectedOwnerParam as On, applyRoleArnIfSet as Ot, gray as P, clearBucketRegionCache as Pn, TemplateParser as Pt, disableInstanceApiTermination as Q, ProvisioningError as Qn, parseBootstrapMarker as Qt, collectDeclaredOutputNames as R, resetAwsClients as Rn, shouldRetainResource as Rt, createPreDeleteFinalSnapshot as S, warnDeprecatedNoPrefixCliFlag as Sn, scrubResourceRecord as St, unsupportedFinalSnapshotError as T, MIGRATE_TMP_PREFIX as Tn, s3BucketDualStackDomainName as Tt, stateKeySecretExposure as U, DependencyError as Un, createAssetRedirectResolver as Ut, isExportAliasCollision as V, CdkdError as Vn, WorkGraph as Vt, IAMRoleProvider as W, DeployCancelledError as Wn, loadPublishableAssetManifest as Wt, CloudControlProvider as X, NestedStackChildDirectDestroyError as Xn, ensureAssetStorage as Xt, findSilentDropProperties as Y, MissingCdkCliError as Yn, BOOTSTRAP_MARKER_PREFIX as Yt, slowCcOperationTimeoutMs as Z, PartialFailureError as Zn, getBootstrapMarkerKey as Zt, computeImplicitDeleteEdges as _, resolveSkipPrefix as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, getDockerCmd as an, formatError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, resolveUseCdkBootstrapAssets as bn, maskSecretsInText as bt, replayFailedOperations as c, AssetManifestLoader as cn, withErrorHandling as cr, coerceCfnBoolean as ct, updatePartialReason as d, synthesisStatusMessage as dn, isThrottlingError as dr, readConfigString as dt, validateAssetBucketName as en, ResourceUpdateNotSupportedError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, getDefaultStateBucketName as fn, markNonRetryable as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveCaptureObservedState as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, resolveAutoAssetStorage as hn, requireConfigString as ht, DeploymentEventsReader as i, formatDockerLoginError as in, SynthesisError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, derivePartitionAndUrlSuffix as jn, describeTypeWithThrottleRetry as jt, isStatefulRecreateTargetSync as k, PARTITION_TABLE as kn, DiffCalculator as kt, replayRollback as l, getDockerImageBySourceHash as ln, isMarkedNonRetryable as lr, configBooleanRefusal as lt, withResourceDeadline as m, resolveApp as mn, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, buildDenyExternalAccessPolicy as nn, StackTerminationProtectionError as nr, getAccountInfo as nt, planFailedOps as o, runDockerForeground as on, isCdkdError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, getLegacyStateBucketName as pn, __exportAll as pr, requireConfigArray as pt, ProviderRegistry as q, LocalStartServiceError as qn, stripControlChars as qt, DeployEngine as r, buildDockerImage as rn, StateError as rr, refStateLookupFromResource as rt, planRollback as s, runDockerStreaming as sn, normalizeAwsError as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, validateContainerRepoName as tn, StackHasActiveImportsError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, Synthesizer as un, isRetryableTransientError as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveStateBucketWithDefault as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, CFN_TEMPLATE_URL_LIMIT as wn, s3BucketDomainName as wt, ccRoutedFinalSnapshotError as x, stateBucketExistenceConfirmed as xn, redactSecretsForState as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveStateBucketWithDefaultAndSource as yn, createSecretMasker as yt, collectPublishedOutputNames as z, setAwsClients as zn, AssetPublisher as zt };
-//# sourceMappingURL=deploy-engine-Bh_LPdju.js.map
+export { isTerminationProtectionPropagationError as $, PartialFailureError as $n, getBootstrapMarkerKey as $t, renderStatefulReason as A, expectedOwnerParam as An, applyRoleArnIfSet as At, exportAliasCollisionScrubWarning as B, resetAwsClients as Bn, shouldRetainResource as Bt, isFinalSnapshotError as C, stateBucketExistenceConfirmed as Cn, redactSecretsForState as Ct, extractDeploymentEventError as D, MIGRATE_TMP_PREFIX as Dn, s3BucketDualStackDomainName as Dt, makeCanonicalizePropertiesFn as E, CFN_TEMPLATE_URL_LIMIT as En, s3BucketDomainName as Et, green as F, processStackMessages as Fn, DagBuilder as Ft, collectInlinePolicyNamesManagedBySiblings as G, DependencyError as Gn, createAssetRedirectResolver as Gt, secretBearingStateKeyWarning as H, AssetError as Hn, stringifyValue as Ht, red as I, clearBucketRegionCache as In, TemplateParser as It, findActionableSilentDrops as J, LocalMigrateError as Jn, escapeRegExp$1 as Jt, clearOnUpdateRemoval as K, DeployCancelledError as Kn, loadPublishableAssetManifest as Kt, yellow as L, resolveBucketRegion as Ln, LockManager as Lt, bold as M, canonicalizeRegion as Mn, INTRINSIC_KEYS as Mt, cyan as N, derivePartitionAndUrlSuffix as Nn, describeTypeWithThrottleRetry as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, findLargeInlineResources as On, s3BucketRegionalDomainName as Ot, gray as P, AssemblyReader as Pn, withRetry as Pt, disableInstanceApiTermination as Q, NestedStackChildDirectDestroyError as Qn, ensureAssetStorage as Qt, collectDeclaredOutputNames as R, AwsClients as Rn, S3StateBackend as Rt, createPreDeleteFinalSnapshot as S, resolveUseCdkBootstrapAssets as Sn, maskSecretsInText as St, unsupportedFinalSnapshotError as T, CFN_TEMPLATE_BODY_LIMIT as Tn, s3BucketArn as Tt, stateKeySecretExposure as U, CdkdError as Un, WorkGraph as Ut, isExportAliasCollision as V, setAwsClients as Vn, AssetPublisher as Vt, IAMRoleProvider as W, ConfigError as Wn, buildAssetRedirectMap as Wt, CloudControlProvider as X, LockError as Xn, AssetModeResolver as Xt, findSilentDropProperties as Y, LocalStartServiceError as Yn, stripControlChars as Yt, slowCcOperationTimeoutMs as Z, MissingCdkCliError as Zn, BOOTSTRAP_MARKER_PREFIX as Zt, computeImplicitDeleteEdges as _, resolveAutoAssetStorage as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, buildDockerImage as an, StateError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, resolveStateBucketWithDefault as bn, dynamicReferenceTokens as bt, replayFailedOperations as c, runDockerForeground as cn, isCdkdError as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDockerImageBySourceHash as dn, isMarkedNonRetryable as dr, readConfigString as dt, parseBootstrapMarker as en, ProvisioningError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, Synthesizer as fn, isRetryableTransientError as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveApp as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, getLegacyStateBucketName as hn, __exportAll as hr, requireConfigString as ht, DeploymentEventsReader as i, buildDenyExternalAccessPolicy as in, StackTerminationProtectionError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, PARTITION_TABLE as jn, DiffCalculator as jt, isStatefulRecreateTargetSync as k, uploadCfnTemplate as kn, s3BucketWebsiteUrl as kt, replayRollback as l, runDockerStreaming as ln, normalizeAwsError as lr, configBooleanRefusal as lt, withResourceDeadline as m, getDefaultStateBucketName as mn, markNonRetryable as mr, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, validateAssetBucketName as nn, ResourceUpdateNotSupportedError as nr, getAccountInfo as nt, planFailedOps as o, formatDockerLoginError as on, SynthesisError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, synthesisStatusMessage as pn, isThrottlingError as pr, requireConfigArray as pt, ProviderRegistry as q, LocalInvokeBuildError as qn, rewriteTemplateAssetReferences as qt, DeployEngine as r, validateContainerRepoName as rn, StackHasActiveImportsError as rr, refStateLookupFromResource as rt, planRollback as s, getDockerCmd as sn, formatError as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, readBootstrapMarkerBody as tn, ResourceTimeoutError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, AssetManifestLoader as un, withErrorHandling as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveCaptureObservedState as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, warnDeprecatedNoPrefixCliFlag as wn, scrubResourceRecord as wt, ccRoutedFinalSnapshotError as x, resolveStateBucketWithDefaultAndSource as xn, isSingleDynamicReferenceToken as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveSkipPrefix as yn, createSecretMasker as yt, collectPublishedOutputNames as z, getAwsClients as zn, rebuildClientForBucketRegion as zt };
+//# sourceMappingURL=deploy-engine-C6gt7NcL.js.map