@go-to-k/cdkd 0.284.7 → 0.284.8

package/dist/{deploy-engine-CJncZQEi.js → deploy-engine-36yWG1OT.js}

@@ -10604,13 +10604,227 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
 	}
 	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
-		const out = {};
+		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions) : redactSecretsForState(v, secrets);
 		return out;
 	}
 	return redactSecretsForState(bag, secrets);
 }
 /**
+* Is this rules constant one whose BAG is an AWS readback and whose SOURCE is a
+* persisted STATE bag?
+*
+* Today that is {@link STATE_SOURCED_READBACK_RULES} alone: the path where the
+* secrets map can be EMPTY by construction (nothing was resolved), so the value
+* scan has no needles and POSITION is the only mechanism left. Derived from the
+* flags rather than compared against the constant so a future one with the same
+* shape is covered automatically. `trustAnyExpression` says the source is a
+* persisted record (holding no PUBLIC reference, so any `{{resolve:...}}` in it
+* is by construction a secret); `!descendArrays` says the bag came back from
+* AWS and may be reordered.
+*
+* `sourceIsSameGeneration` is the third conjunct and it is the one that took a
+* measurement to get right. Without it this also selected
+* {@link STATE_SOURCED_CROSS_GENERATION_RULES} — `cdkd scrub`'s observed walk,
+* whose `properties` have ALREADY been repositioned onto TODAY's template — and
+* taking a source subtree there rewrote a baseline holding the DEPLOYED
+* `:AWSPREVIOUS` reference onto the template's edited `:AWSCURRENT` one. That
+* is precisely the issue #1917 hazard, and `cdkd drift --revert` pushes the
+* baseline to AWS, so it would have applied a reference the stack never
+* deployed. A refusal may only take a source that is the same generation as the
+* bag beside it.
+*
+* A TEMPLATE-sourced caller is deliberately excluded: its source can carry a
+* public `ssm:` reference whose resolved value must STAY resolved (issue
+* #1901), and it always has a populated map, so the value scan already covers
+* the shapes below. So is the rollback replay
+* ({@link STATE_DERIVED_RULES}) — full map, and its bag descends positionally
+* because it was produced by resolving the source.
+*/
+function isReadbackProjectedFromState(rules) {
+	return rules.trustAnyExpression && !rules.descendArrays && rules.sourceIsSameGeneration;
+}
+/**
+* Does this subtree carry a dynamic reference anywhere?
+*
+* A BOOLEAN, not the occurrence COUNTS an earlier revision collected. The
+* counts existed to decide whether a bag "covered" every reference its source
+* carried, which was the vouching rule for taking a source array wholesale —
+* and that rule is gone (see the array arm), so counting would be a
+* measurement nothing reads.
+*/
+function subtreeHasDynamicReference(value) {
+	if (isDynamicReferenceString(value)) return true;
+	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
+	if (isPlainObject$2(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	return false;
+}
+/** Every complete `{{resolve:...}}` token inside a string. */
+function dynamicReferenceTokens(value) {
+	return value.match(/\{\{resolve:[^{}]*\}\}/g) ?? [];
+}
+/**
+* Does this MIXED leaf embed a reference that may be PUBLIC config?
+*
+* A plain `{{resolve:ssm:...}}` is classified by the parameter's TYPE, not by
+* its spelling (issue #1901): a `String` / `StringList` parameter is public and
+* is legitimately persisted RESOLVED. Substituting the expression over it gives
+* the drift baseline a value AWS does not hold, which is phantom drift on
+* ordinary config — and `--revert` then pushes the literal expression.
+*
+* `trustAnyExpression` is what would otherwise wave this through, and its
+* premise ("a persisted STATE bag holds no public expression") is documented as
+* FALSE in one place: `cdkd import`'s warn path can leave one there. The
+* whole-token arm accepts that risk knowingly and `cdkd drift --accept`
+* re-checks its write; the MIXED arm added later has no such re-check, so it
+* declines instead.
+*
+* A reference the resolver RECORDED as secret is kept: that is the ssm
+* `SecureString` case, where the verdict came off the same `GetParameter`
+* response that carried the value. `{{resolve:ssm-secure:` does not match this
+* prefix at all (the next character is `-`), so it is never refused here.
+*
+* The verdict store only carries signal where something RESOLVED, so this
+* splits on whether a secrets map exists at all.
+*
+* WITH a map, a pass resolved this bag: the engine's change detection walks
+* every template property with `skipDynamicReferences`, which only flips
+* `decrypt` on the ssm branch — the `GetParameter` still runs, a definitive
+* `SecureString` is recorded, and a parameter that comes back public has its
+* memo RETRACTED. Absence from the store is then real evidence of a public
+* parameter, and the resolved value is kept.
+*
+* WITHOUT one, absence means only that the question was never asked HERE. It
+* does not mean nothing was resolved: the deploy path resolves every template
+* property with `skipDynamicReferences`, which records or retracts the
+* `SecureString` verdict even for an UNCHANGED resource -- that bag simply is
+* not the one this call receives. The leaf is treated as
+* secret-bearing and refused. That is not merely the cautious branch, it is the
+* SAME premise the whole-token arm one level up already acts on: a PUBLIC
+* `String` / `StringList` reference is persisted RESOLVED (issue #1901), so a
+* `{{resolve:ssm:` token that SURVIVES in a persisted state bag is a
+* SecureString by construction. An earlier revision applied a stricter rule to
+* a MIXED leaf than to a whole token on the identical source, and that
+* inconsistency is what persisted a decrypted secret.
+*
+* ACCEPTED CONSEQUENCE, recorded rather than papered over: on the empty-map
+* paths a genuinely PUBLIC ssm mixed leaf is now OVER-redacted, so the baseline
+* no longer matches AWS and `cdkd drift` reports a phantom on it. That is
+* reachable only through the one documented hole in the premise above — `cdkd
+* import`'s warn path, which can leave a public expression in state. The trade
+* is deliberate and asymmetric: under-redaction persists a decrypted secret,
+* which is a disclosure and is what this lane exists to prevent, while
+* over-redaction is visible, recoverable and discloses nothing. Closing it
+* properly needs a real TYPE classification on these paths, which is issue
+* [#2012](https://github.com/go-to-k/cdkd/issues/2012)'s mechanism; the
+* over-redaction itself is tracked as issue
+* [#2036](https://github.com/go-to-k/cdkd/issues/2036).
+*
+* `tests/integration/secrets-dynamic-ref` is the end-to-end proof on BOTH
+* paths, and it is the only place the empty-map defect surfaced: Phase 1g
+* covers the populated-map deploy and Phase 1f the empty-map command.
+*/
+function mixedLeafMayCarryPublicReference(source, secrets) {
+	if (secrets.size === 0) return false;
+	return dynamicReferenceTokens(source).some((token) => token.startsWith("{{resolve:ssm:") && !isRecordedSecretExpression(token));
+}
+/**
+* Refuse to persist a readback leaf the path pass could not CERTIFY, at any
+* position the STATE source proves is secret-bearing (issue #1926 review).
+*
+* {@link redactByPath} substitutes only where the source leaf is a WHOLE
+* `{{resolve:...}}` token. On the paths {@link isReadbackProjectedFromState}
+* selects the secrets map may be EMPTY, so its value-scan fallback is a no-op,
+* and four shapes reached `state.json` holding the DECRYPTED value. Measured
+* against this module before this pass existed — three by `cdkd state
+* refresh-observed`, and the same three by a plain `cdkd deploy`, whose
+* `drainObservedCaptures` baseline reaches the persist choke point with exactly
+* this configuration. `cdkd scrub` is NOT one of them: its observed walk is
+* CROSS-generation, so {@link isReadbackProjectedFromState} excludes it by
+* design:
+*
+* ```text
+*   source leaf in the STATE record                  before        now
+*   -----------------------------------------------  ------------  ---------------
+*   `postgres://u:{{resolve:...}}@h` (MIXED string)   LEAK          take source
+*   ...the same MIXED leaf inside a PAIRED element    LEAK          take source
+*   `['--pw', '{{resolve:...}}']` (no identity key)   LEAK          LEAK (#2012)
+*   `[{Field, Val: '{{resolve:...}}'}]` (no `Name`)   LEAK          LEAK (#2012)
+*   an UNPAIRED element beside a paired one           LEAK          LEAK (#2012)
+*   an observed KEY the source does not carry         LEAK          LEAK (#2012)
+*   whole `{{resolve:...}}` token                     ok            ok
+*   `Environment[]` keyed by `Name` (issue #1915)     ok            ok
+*   PUBLIC ssm MIXED leaf, POPULATED map               ok            ok
+*   PUBLIC ssm MIXED leaf, EMPTY map                   ok            over-redacts
+* ```
+*
+* The last row is the price of the row above it and is tracked as issue
+* [#2036](https://github.com/go-to-k/cdkd/issues/2036): with no map nothing was
+* resolved, so nothing distinguishes a public parameter from a `SecureString`
+* and the leaf is refused. Phantom drift, not a disclosure — see
+* {@link mixedLeafMayCarryPublicReference} for why that is the right way to be
+* wrong here.
+*
+* What this pass closes is the row POSITION can actually justify: a leaf whose
+* KEY the source carries, where the source is the same generation and the only
+* thing the older code lacked was the willingness to substitute a leaf that was
+* not a WHOLE token. Everything it takes is the record's own value at the
+* record's own path.
+*
+* The four residual rows are one root cause, not four: no needle and no
+* position, so nothing distinguishes a resolved secret from an ordinary
+* literal. They are NOT closed by taking the source subtree, which an earlier
+* revision did and the issue #1915 fences correctly rejected — measured, it
+* rewrote `{Name:'', Value:'an-unrelated-literal'}` onto the expression and
+* turned an AWS-reported `[{Value:'x'}]` into `[{Name:'db', Value:<expr>}]`,
+* fabricating drift-baseline content AWS never reported that `cdkd drift
+* --revert` then pushes to the live resource. Redaction may not buy itself a
+* fabricated baseline.
+*
+* The MIXED row is the shape this module itself calls DOMINANT for CDK — an
+* `Fn::Join` around `secret.secretValueFromJson(...)`.
+*
+* TAKE SOURCE rather than a {@link SECRET_MASK} on the rows it does close, for
+* the same reason the whole-token arm does: a mask is not a value `cdkd drift`
+* can re-resolve, so it would report a permanent phantom — and `cdkd drift
+* --revert` pushes the BASELINE to AWS, so a masked baseline would write the
+* literal `***` onto the live resource (the issue #1498 / #1501 class).
+*
+* KNOWN RESIDUAL, the last row: an observed KEY the source object does not
+* carry has no source leaf to take and no needle to match. It is NOT refused
+* the way an unpaired array ELEMENT is, and the asymmetry is deliberate rather
+* than an oversight — an extra array element is a PEER of the secret-bearing
+* ones (another `Environment` entry), so suspicion is warranted and extras are
+* rare, while an extra object KEY is a different FIELD entirely (`Runtime`,
+* `FunctionArn`, `LastModified`) and is the NORM in an AWS readback. Refusing
+* those would empty the drift baseline of every secret-bearing resource.
+* Tracked as issue [#2012](https://github.com/go-to-k/cdkd/issues/2012).
+*/
+function refuseUncertifiedReadbackPositions(bag, source, secrets) {
+	if (isDynamicReferenceString(source) && typeof bag === "string") {
+		if (isSingleDynamicReferenceToken(source)) return source;
+		if (mixedLeafMayCarryPublicReference(source, secrets)) return bag;
+		return source;
+	}
+	if (!subtreeHasDynamicReference(source)) return bag;
+	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets) : v;
+		return out;
+	}
+	if (Array.isArray(bag) && Array.isArray(source)) {
+		const key = identityKeyFor(bag, source);
+		if (key === void 0) return bag;
+		const sourceByIdentity = /* @__PURE__ */ new Map();
+		for (const item of source) sourceByIdentity.set(item[key], item);
+		return bag.map((item) => {
+			const partner = sourceByIdentity.get(item[key]);
+			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets);
+		});
+	}
+	return bag;
+}
+/**
 * Deep-clone `bag`, replacing every occurrence of a recorded secret value with
 * the unresolved `{{resolve:...}}` expression it came from. A string whose WHOLE
 * value equals a secret is replaced by that secret's expression exactly; a
@@ -10621,7 +10835,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 */
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
 	if (secrets.size === 0 && source === void 0) return bag;
-	if (source !== void 0) return redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
+	if (source !== void 0) {
+		const positioned = redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
+		return isReadbackProjectedFromState(rules) ? refuseUncertifiedReadbackPositions(positioned, source, secrets) : positioned;
+	}
 	const regex = buildNeedleRegex(secrets.keys());
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
 	const walk = (value) => {
@@ -10637,7 +10854,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		}
 		if (Array.isArray(value)) return value.map(walk);
 		if (value !== null && typeof value === "object") {
-			const out = {};
+			const out = Object.create(null);
 			for (const [k, v] of Object.entries(value)) out[k] = walk(v);
 			return out;
 		}
@@ -15643,7 +15860,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DOdJgPLS.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-jYyUCsx_.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -23221,7 +23438,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.7";
+	return "0.284.8";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25690,4 +25907,4 @@ var DeployEngine = class {
 
 //#endregion
 export { IntrinsicFunctionResolver as $, StackHasActiveImportsError as $n, validateContainerRepoName as $t, formatResourceLine as A, AssemblyReader as An, describeTypeWithThrottleRetry as At, isExportAliasCollision as B, ConfigError as Bn, WorkGraph as Bt, refusesFinalSnapshot as C, MIGRATE_TMP_PREFIX as Cn, s3BucketDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, PARTITION_TABLE as Dn, applyRoleArnIfSet as Dt, extractDeploymentEventError as E, expectedOwnerParam as En, s3BucketWebsiteUrl as Et, red as F, getAwsClients as Fn, S3StateBackend as Ft, clearOnUpdateRemoval as G, LocalStartServiceError as Gn, escapeRegExp$1 as Gt, stateKeySecretExposure as H, DeployCancelledError as Hn, createAssetRedirectResolver as Ht, yellow as I, resetAwsClients as In, rebuildClientForBucketRegion as It, findSilentDropProperties as J, NestedStackChildDirectDestroyError as Jn, BOOTSTRAP_MARKER_PREFIX as Jt, ProviderRegistry as K, LockError as Kn, stripControlChars as Kt, collectDeclaredOutputNames as L, setAwsClients as Ln, shouldRetainResource as Lt, cyan as M, clearBucketRegionCache as Mn, DagBuilder as Mt, gray as N, resolveBucketRegion as Nn, TemplateParser as Nt, isStatefulRecreateTargetSync as O, canonicalizeRegion as On, DiffCalculator as Ot, green as P, AwsClients as Pn, LockManager as Pt, isTerminationProtectionPropagationError as Q, ResourceUpdateNotSupportedError as Qn, validateAssetBucketName as Qt, collectPublishedOutputNames as R, AssetError as Rn, AssetPublisher as Rt, isFinalSnapshotError as S, CFN_TEMPLATE_URL_LIMIT as Sn, s3BucketArn as St, makeCanonicalizePropertiesFn as T, uploadCfnTemplate as Tn, s3BucketRegionalDomainName as Tt, IAMRoleProvider as U, LocalInvokeBuildError as Un, loadPublishableAssetManifest as Ut, secretBearingStateKeyWarning as V, DependencyError as Vn, buildAssetRedirectMap as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalMigrateError as Wn, rewriteTemplateAssetReferences as Wt, slowCcOperationTimeoutMs as X, ProvisioningError as Xn, getBootstrapMarkerKey as Xt, CloudControlProvider as Y, PartialFailureError as Yn, ensureAssetStorage as Yt, disableInstanceApiTermination as Z, ResourceTimeoutError as Zn, parseBootstrapMarker as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveStateBucketWithDefaultAndSource as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, runDockerStreaming as an, normalizeAwsError as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, warnDeprecatedNoPrefixCliFlag as bn, redactSecretsForState as bt, replayFailedOperations as c, Synthesizer as cn, isRetryableTransientError as cr, configBooleanRefusal as ct, updatePartialReason as d, getLegacyStateBucketName as dn, __exportAll as dr, replayWarn as dt, buildDenyExternalAccessPolicy as en, StackTerminationProtectionError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveApp as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefault as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveSkipPrefix as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerForeground as in, isCdkdError as ir, normalizeAwsTagsToCfn as it, bold as j, processStackMessages as jn, withRetry as jt, renderStatefulReason as k, derivePartitionAndUrlSuffix as kn, INTRINSIC_KEYS as kt, replayRollback as l, synthesisStatusMessage as ln, isThrottlingError as lr, configStringRefusal as lt, withResourceDeadline as m, resolveCaptureObservedState as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatDockerLoginError as nn, SynthesisError as nr, refStateLookupFromResource as nt, planFailedOps as o, AssetManifestLoader as on, withErrorHandling as or, assertRegionMatch as ot, deleteSkipReason as p, resolveAutoAssetStorage as pn, requireConfigObject as pt, findActionableSilentDrops as q, MissingCdkCliError as qn, AssetModeResolver as qt, DeployEngine as r, getDockerCmd as rn, formatError as rr, WAFv2WebACLProvider as rt, planRollback as s, getDockerImageBySourceHash as sn, isMarkedNonRetryable as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDockerImage as tn, StateError as tr, getAccountInfo as tt, updatePartialMessage as u, getDefaultStateBucketName as un, markNonRetryable as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, resolveUseCdkBootstrapAssets as vn, createSecretMasker as vt, unsupportedFinalSnapshotError as w, findLargeInlineResources as wn, s3BucketDualStackDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_BODY_LIMIT as xn, scrubResourceRecord as xt, buildFinalSnapshotIdentifier as y, stateBucketExistenceConfirmed as yn, maskSecretsInText as yt, exportAliasCollisionScrubWarning as z, CdkdError as zn, stringifyValue as zt };
-//# sourceMappingURL=deploy-engine-CJncZQEi.js.map
+//# sourceMappingURL=deploy-engine-36yWG1OT.js.map