@go-to-k/cdkd 0.284.21 → 0.284.22

package/dist/{deploy-engine--N_xnvjI.js → deploy-engine-DOlhIeGv.js}

@@ -11106,6 +11106,29 @@ function dynamicReferenceTokens(value) {
 	return value.match(DYNAMIC_REFERENCE_TOKEN_SCAN) ?? [];
 }
 /**
+* Where each complete `{{resolve:...}}` token sits in the string, as
+* `[start, end)` offsets. The OFFSETS are what {@link dynamicReferenceTokens}
+* cannot give, and the value scan needs them to decide whether a needle match
+* lies inside a reference or merely beside one.
+*
+* `lastIndex` is reset before `matchAll`, and that is load-bearing rather than
+* defensive. `String.prototype.matchAll` does not MUTATE the pattern's
+* `lastIndex` — it clones — but it SEEDS the clone from it, so a caller that
+* left the shared constant dirty (the constant's own doc forbids `.exec` /
+* `.test` on it for exactly this reason) would make this function skip every
+* span before that offset, silently restoring the splice this offsets are used
+* to prevent. Measured, not assumed.
+*/
+function dynamicReferenceSpans(value) {
+	DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
+	const spans = [];
+	for (const match of value.matchAll(DYNAMIC_REFERENCE_TOKEN_SCAN)) spans.push({
+		start: match.index,
+		end: match.index + match[0].length
+	});
+	return spans;
+}
+/**
 * Does this MIXED leaf embed a reference that may be PUBLIC config?
 *
 * A plain `{{resolve:ssm:...}}` is classified by the parameter's TYPE, not by
@@ -11283,6 +11306,92 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	}
 	const regex = buildNeedleRegex(secrets.keys());
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
+	/**
+	* The SUBSTRING arm for a leaf the resolver substituted INTO rather than
+	* replaced. ONE rule over the WHOLE leaf (issue
+	* [#1935](https://github.com/go-to-k/cdkd/issues/1935)):
+	*
+	* > replace every recorded-plaintext match EXCEPT one that lies STRICTLY
+	* > INSIDE a complete `{{resolve:...}}` span.
+	*
+	* "Strictly inside" means contained by a span and SHORTER than it. The four
+	* positions a match can take, and why each lands where it does:
+	*
+	* - **strictly inside a span** -> KEPT. This is the defect: a plaintext that
+	*   happens to occur inside a token's own TEXT was spliced into the
+	*   reference. Deploy 1 persists
+	*   `jdbc://appdb:{{resolve:secretsmanager:appdb/creds:SecretString:password}}@host`;
+	*   deploy 2 records an ssm SecureString whose plaintext is `appdb`; the walk
+	*   wrote `{{resolve:secretsmanager:{{resolve:ssm:/app/dbname}}/creds:...}}`.
+	*   `resolveReplayProps` scans with `([^}]+)`, which stops at the FIRST `}`,
+	*   so the replay asks Secrets Manager for the secret id
+	*   `{{resolve:ssm:/app/dbname` — rollback blocked, or garbage applied to a
+	*   live resource. `cdkd scrub` writes the same wreckage into `properties`
+	*   and `observedProperties`.
+	* - **coextensive with a span** -> REPLACED. A secret whose resolved
+	*   PLAINTEXT is itself a `{{resolve:...}}` string (issue #1917), embedded in
+	*   a larger leaf. This is why "mask only OUTSIDE the spans" is wrong on its
+	*   own: that plaintext IS a span, so span-skipping would stop redacting it
+	*   and trade a mangling bug for a disclosure.
+	* - **containing or straddling a span** -> REPLACED. A recorded plaintext
+	*   that embeds a whole reference plus surrounding text. Nothing is spliced,
+	*   because the whole reference is consumed by the replacement. An earlier
+	*   revision of this fix expressed the rule as TWO rules — replace a span
+	*   that is a recorded plaintext, value-scan the text between spans — and
+	*   that form DROPPED this case at both ends (it is neither a whole span nor
+	*   contained in the text between spans), persisting the plaintext in the
+	*   clear where the pre-fix code had redacted it. A REGRESSION, caught by the
+	*   security review, and the reason the rule is one predicate over the whole
+	*   leaf rather than a split.
+	* - **disjoint from every span** -> REPLACED. The ordinary embedded secret.
+	*
+	* Scanning the WHOLE leaf in ONE pass is also what preserves what needle
+	* PRECEDENCE there is. {@link buildNeedleRegex} sorts alternatives
+	* longest-first, which decides only between alternatives matching at the SAME
+	* offset; the scan itself is LEFTMOST-first, so a shorter secret starting
+	* EARLIER still wins and the tail of the longer one survives in the clear
+	* (`zzABCDEFzz` with needles `ABCD` / `BCDEF` leaves `EF`). That is regex
+	* semantics, identical before and after this change, and is not something
+	* this rule claims to fix.
+	*
+	* What the single pass DOES restore is the same-offset ordering across a span
+	* boundary. The two-rule form scanned each BETWEEN-span stretch separately,
+	* so a long straddling needle was never even a candidate and a short one
+	* starting later in the tail won by default — the leaf took the WRONG
+	* expression, which the replay then re-resolves and applies (the issue #1910
+	* class).
+	*
+	* TWO KNOWN RESIDUALS around a STRAY `{{resolve:` opener, both pinned by
+	* tests rather than left as prose, and they fail in OPPOSITE directions
+	* because the span grammar is greedy `[^}]+` (deliberately — it is the
+	* resolver's own spelling, unified by issue #1936):
+	*
+	* - **no later `}}` in the leaf** -> no span, so a needle after the opener is
+	*   REPLACED and the result reads as a reference to a bogus secret id.
+	*   Identical to the pre-fix code. Refusing to redact there would leave
+	*   PLAINTEXT behind two characters any string can contain.
+	* - **a later `}}` anywhere in the leaf** -> the opener and that `}}` form
+	*   ONE span swallowing everything between them, so a needle in that region
+	*   is KEPT — the only shape where this rule redacts LESS than the code it
+	*   replaced. Narrow but real, and the reachable carrier is named rather than
+	*   waved at: the resolver shares this grammar, so such a leaf could not have
+	*   resolved on the deploy path, which leaves an `observedProperties`
+	*   READBACK (arbitrary text from AWS) as the way one arrives.
+	*
+	* Narrowing the span pattern here would close the second and open two worse
+	* holes: it would re-fork the one grammar issue #1936 unified, and it would
+	* make an ALREADY-MANGLED legacy leaf parse differently and be spliced again,
+	* contradicting this change's own "not repaired, not made worse" property.
+	* So the residual is documented, not fixed.
+	*/
+	const scanLeaf = (value, needles) => {
+		const spans = isDynamicReferenceString(value) ? dynamicReferenceSpans(value) : [];
+		return value.replace(needles, (match, offset) => {
+			const end = offset + match.length;
+			if (spans.some((span) => span.start <= offset && end <= span.end && (span.start !== offset || span.end !== end))) return match;
+			return secrets.get(match) ?? "***";
+		});
+	};
 	const walk = (value) => {
 		if (typeof value === "string") {
 			const whole = wholeValueExpr(value);
@@ -11291,8 +11400,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 			if (!regex) return value;
 			regex.lastIndex = 0;
 			if (!regex.test(value)) return value;
-			regex.lastIndex = 0;
-			return value.replace(regex, (m) => secrets.get(m) ?? "***");
+			return scanLeaf(value, regex);
 		}
 		if (Array.isArray(value)) return value.map(walk);
 		if (value !== null && typeof value === "object") {
@@ -16752,7 +16860,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D5G53CUp.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DLU0EEhO.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -24925,7 +25033,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.21";
+	return "0.284.22";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25670,7 +25778,7 @@ var DeployEngine = class {
 	*/
 	redactOutputs(outputs) {
 		if (this.outputSecrets.size === 0) return outputs;
-		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0);
+		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES);
 	}
 	/**
 	* Redact resolved secret plaintext out of rollback-journal operations (GHSA
@@ -27465,4 +27573,4 @@ var DeployEngine = class {
 
 //#endregion
 export { isTerminationProtectionPropagationError as $, PartialFailureError as $n, getBootstrapMarkerKey as $t, renderStatefulReason as A, expectedOwnerParam as An, applyRoleArnIfSet as At, exportAliasCollisionScrubWarning as B, resetAwsClients as Bn, shouldRetainResource as Bt, isFinalSnapshotError as C, stateBucketExistenceConfirmed as Cn, redactSecretsForState as Ct, extractDeploymentEventError as D, MIGRATE_TMP_PREFIX as Dn, s3BucketDualStackDomainName as Dt, makeCanonicalizePropertiesFn as E, CFN_TEMPLATE_URL_LIMIT as En, s3BucketDomainName as Et, green as F, processStackMessages as Fn, DagBuilder as Ft, collectInlinePolicyNamesManagedBySiblings as G, DependencyError as Gn, createAssetRedirectResolver as Gt, secretBearingStateKeyWarning as H, AssetError as Hn, stringifyValue as Ht, red as I, clearBucketRegionCache as In, TemplateParser as It, findActionableSilentDrops as J, LocalMigrateError as Jn, escapeRegExp$1 as Jt, clearOnUpdateRemoval as K, DeployCancelledError as Kn, loadPublishableAssetManifest as Kt, yellow as L, resolveBucketRegion as Ln, LockManager as Lt, bold as M, canonicalizeRegion as Mn, INTRINSIC_KEYS as Mt, cyan as N, derivePartitionAndUrlSuffix as Nn, describeTypeWithThrottleRetry as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, findLargeInlineResources as On, s3BucketRegionalDomainName as Ot, gray as P, AssemblyReader as Pn, withRetry as Pt, disableInstanceApiTermination as Q, NestedStackChildDirectDestroyError as Qn, ensureAssetStorage as Qt, collectDeclaredOutputNames as R, AwsClients as Rn, S3StateBackend as Rt, createPreDeleteFinalSnapshot as S, resolveUseCdkBootstrapAssets as Sn, maskSecretsInText as St, unsupportedFinalSnapshotError as T, CFN_TEMPLATE_BODY_LIMIT as Tn, s3BucketArn as Tt, stateKeySecretExposure as U, CdkdError as Un, WorkGraph as Ut, isExportAliasCollision as V, setAwsClients as Vn, AssetPublisher as Vt, IAMRoleProvider as W, ConfigError as Wn, buildAssetRedirectMap as Wt, CloudControlProvider as X, LockError as Xn, AssetModeResolver as Xt, findSilentDropProperties as Y, LocalStartServiceError as Yn, stripControlChars as Yt, slowCcOperationTimeoutMs as Z, MissingCdkCliError as Zn, BOOTSTRAP_MARKER_PREFIX as Zt, computeImplicitDeleteEdges as _, resolveAutoAssetStorage as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, buildDockerImage as an, StateError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, resolveStateBucketWithDefault as bn, dynamicReferenceTokens as bt, replayFailedOperations as c, runDockerForeground as cn, isCdkdError as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDockerImageBySourceHash as dn, isMarkedNonRetryable as dr, readConfigString as dt, parseBootstrapMarker as en, ProvisioningError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, Synthesizer as fn, isRetryableTransientError as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveApp as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, getLegacyStateBucketName as hn, __exportAll as hr, requireConfigString as ht, DeploymentEventsReader as i, buildDenyExternalAccessPolicy as in, StackTerminationProtectionError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, PARTITION_TABLE as jn, DiffCalculator as jt, isStatefulRecreateTargetSync as k, uploadCfnTemplate as kn, s3BucketWebsiteUrl as kt, replayRollback as l, runDockerStreaming as ln, normalizeAwsError as lr, configBooleanRefusal as lt, withResourceDeadline as m, getDefaultStateBucketName as mn, markNonRetryable as mr, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, validateAssetBucketName as nn, ResourceUpdateNotSupportedError as nr, getAccountInfo as nt, planFailedOps as o, formatDockerLoginError as on, SynthesisError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, synthesisStatusMessage as pn, isThrottlingError as pr, requireConfigArray as pt, ProviderRegistry as q, LocalInvokeBuildError as qn, rewriteTemplateAssetReferences as qt, DeployEngine as r, validateContainerRepoName as rn, StackHasActiveImportsError as rr, refStateLookupFromResource as rt, planRollback as s, getDockerCmd as sn, formatError as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, readBootstrapMarkerBody as tn, ResourceTimeoutError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, AssetManifestLoader as un, withErrorHandling as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveCaptureObservedState as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, warnDeprecatedNoPrefixCliFlag as wn, scrubResourceRecord as wt, ccRoutedFinalSnapshotError as x, resolveStateBucketWithDefaultAndSource as xn, isSingleDynamicReferenceToken as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveSkipPrefix as yn, createSecretMasker as yt, collectPublishedOutputNames as z, getAwsClients as zn, rebuildClientForBucketRegion as zt };
-//# sourceMappingURL=deploy-engine--N_xnvjI.js.map
+//# sourceMappingURL=deploy-engine-DOlhIeGv.js.map