@go-to-k/cdkd 0.290.0 → 0.290.1

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DH53RtuA.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DTli1mA9.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-DUmAMwgQ.js");
+	const { buildProgram } = await import("./program-CnTfNj2k.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-C287P1jL.js → deploy-engine-aYUEGRRl.js}

@@ -1,6 +1,6 @@
 import { b as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, y as UNRENDERABLE } from "./logger-DTEUzYP_.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DH53RtuA.js";
+import { t as getCdkdVersion } from "./version-DTli1mA9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12260,11 +12260,35 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 * (`'port:q7' -> 'port:{{resolve:...}}'`) as an ordinary WHOLE-VALUE entry of
 * the parent's own bag, under five conditions:
 *
-*   (i)   `positioned[name] === sourceLeaf` -- the pass CERTIFIED the leaf.
-*         On a literal source the span arm returns the source verbatim, so a
-*         mismatch proves it did not fire -- refusal 2b's test, applied to
-*         a literal source; pinned by the "map NO RESOLVER populated" case,
+*   (i)   The pass CERTIFIED the leaf, and the certified SPELLING is what
+*         every later condition reads. On a LITERAL source it is the source:
+*         the span arm returns the source verbatim, so `positioned[name] ===
+*         sourceLeaf` proves it fired -- refusal 2b's test, applied to a
+*         literal source; pinned by the "map NO RESOLVER populated" case,
 *         where (ii) and (iii) both pass and only the missing pair refuses.
+*         On an OBJECT source (`Fn::Join` / `Fn::Sub`, issue #3062) there is
+*         no source text to compare, so the spelling is what the pass WROTE,
+*         admitted only when `positioned[name] !== resolvedValue`. Sound
+*         together with (ii), not alone: on a value the scan is silent on,
+*         the cross-stack and skeleton arms both refuse (each requires the
+*         WHOLE leaf to be a key of the map, which would make the scan's
+*         whole-value arm fire), the list arm needs an array, and the value
+*         scan leaves the leaf alone -- so the frame arm is the only writer
+*         that can have rewritten it, on its pair and the engine's mark. A
+*         frame that is not wholly literal makes that arm refuse, the leaf
+*         comes back unrewritten, and (i) refuses too. The object arm
+*         certifies only a source whose OWN rendered token starts with a
+*         spelled-secret prefix (`secretsmanager:` / `ssm-secure:`), read from
+*         the source and never from what the pass wrote: the frame arm
+*         matches among RECORDED references and a public `ssm` parameter
+*         records none, so a public leaf whose source spells `ssm:`, or leaves
+*         the service to an intrinsic part, can match a recorded secret
+*         sibling and be written as the sibling's reference. A SecureString
+*         spelled either way is indistinguishable here, so both are refused
+*         (see (e)). The STATE-derived
+*         call sites reach this arm as well: `cdkd import` can leave raw
+*         intrinsics in a record's `properties`, which a rollback replay
+*         passes as its source, and the frame arm does not read `rules`.
 *   (ii)  `redactSecretsForState(resolvedValue, secrets) === resolvedValue`
 *         -- the value scan is SILENT on it: the sub-floor gate, byte-for-byte
 *         the bound the span arm accepted. What it refuses is a middle at or
@@ -12295,8 +12319,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         beside `port:` + B -- passes that bound and keeps its own token. A
 *         DIFFERENT frame (`port:` + `q7` beside `port` + `:q7`, each passing
 *         (i)-(iii) on its own), a leaf (iii) refused under a different
-*         frame, an object spelling and a plain literal equal to the value
-*         all fail it and would take the entry's frame -- and so would a
+*         frame, an object spelling the frame arm refused and a plain
+*         literal equal to the value all fail it and would take the entry's
+*         frame (an object spelling the arm POSITIONED whose own source
+*         spells a secret service is a frame like a literal one, issue
+*         #3062; one whose source does not counts as unframed) -- and so
+*         would a
 *         same-frame sibling whose token this pass never resolved to the
 *         middle: a PUBLIC `ssm` reference in the same `port:` frame holding
 *         the same two characters is kept RESOLVED on the record, and the
@@ -12389,12 +12417,20 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 * OUTPUT carrying the framed value re-resolves in the parent to `port:q7`,
 * where the cross-stack seam refuses a non-token and the consumer's leaf
 * persists the plaintext -- the same class as the nonliteral-frame deferral.
-* (e) An OBJECT-spelled parameter source (`Fn::Join` / `Fn::Sub` in the
-* parent's own `Parameters` block) is out of this arm's reach -- (i) cannot
-* hold for one. #2745 scopes this site to the literal spelling; the object
-* spelling is issue #3062. (f) A child record persisted BEFORE this carry
+* (e) CLOSED for a wholly literal frame by (i)'s object arm (issue #3062;
+* was: an `Fn::Join` / `Fn::Sub` source in the parent's own `Parameters`
+* block was never carried). What remains of it: an object source whose frame
+* is NOT wholly literal -- a region `Ref` outside the token -- is refused by
+* the frame arm, so (i) refuses it and the child leaf keeps the plaintext,
+* the same nonliteral-frame deferral the parent's own record has; and an
+* intrinsic frame whose token spells `ssm:`, or leaves its service to an
+* intrinsic part, is refused by (i) whatever the parameter's type, so a 1-3
+* character SecureString spelled that way keeps the plaintext in the child
+* too. That refusal is what keeps the frame arm's own wrong-reference
+* residual -- a public leaf matching a recorded sibling -- on the parent's
+* record instead of carrying it into the child's. (f) A child record persisted BEFORE this carry
 * keeps `port:q7` until the child is next redeployed: the parent's own row
-* already held the frame (the literal arm), so a parent deploy whose child
+* already held the frame (the literal or frame arm), so a parent deploy whose child
 * row is unchanged never re-runs the child, and `cdkd scrub` cannot repair
 * it either -- it walks the child's stored bag with no inherited bag.
 */
@@ -12428,10 +12464,30 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	}
 	const framesByValue = /* @__PURE__ */ new Map();
 	const tokensOf = /* @__PURE__ */ new Map();
+	const frameSpellingOf = (name, resolvedValue) => {
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string") return sourceLeaf;
+		if (!isPlainObject$2(sourceLeaf)) return void 0;
+		const written = positioned[name];
+		if (typeof written !== "string" || written === resolvedValue) return void 0;
+		const segments = intrinsicSkeletonSegments(sourceLeaf);
+		if (segments === void 0) return void 0;
+		const rendered = segments.map((s) => s === UNKNOWN_PART ? UNKNOWN_PART_PLACEHOLDER : s).join("");
+		const spans = dynamicReferenceSpans(rendered);
+		if (spans.length !== 1) return void 0;
+		const [span] = spans;
+		const ownToken = rendered.slice(span.start, span.end);
+		return SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix)) ? written : void 0;
+	};
+	const certifiedSpellingOf = (name, resolvedValue) => {
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string") return positioned[name] === sourceLeaf ? sourceLeaf : void 0;
+		return frameSpellingOf(name, resolvedValue);
+	};
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string") continue;
-		const sourceLeaf = sourceParameters[name];
-		const frame = typeof sourceLeaf === "string" ? singleSpanFrame(resolvedValue, sourceLeaf) : void 0;
+		const spelling = frameSpellingOf(name, resolvedValue);
+		const frame = spelling === void 0 ? void 0 : singleSpanFrame(resolvedValue, spelling);
 		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
 		const unframed = frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle;
 		frames.add(unframed ? UNFRAMED_SPELLING : `${frame.prefix.length}:${frame.prefix}${frame.suffix}`);
@@ -12448,11 +12504,11 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	const framed = /* @__PURE__ */ new Map();
 	const framedByName = [];
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
-		const sourceLeaf = sourceParameters[name];
-		if (typeof resolvedValue !== "string" || typeof sourceLeaf !== "string") continue;
-		if (positioned[name] !== sourceLeaf) continue;
+		if (typeof resolvedValue !== "string") continue;
+		const spelling = certifiedSpellingOf(name, resolvedValue);
+		if (spelling === void 0) continue;
 		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
-		const frame = singleSpanFrame(resolvedValue, sourceLeaf);
+		const frame = singleSpanFrame(resolvedValue, spelling);
 		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
 		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
 		const isNeedle = resolvedValue.length >= 4;
@@ -12476,11 +12532,11 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (embedded) continue;
 		framedByName.push([
 			name,
-			sourceLeaf,
+			spelling,
 			resolvedValue
 		]);
 		if (secrets.get(frame.middle) !== frame.token && tokensOf.get(resolvedValue)?.size !== 1) continue;
-		framed.set(resolvedValue, sourceLeaf);
+		framed.set(resolvedValue, spelling);
 	}
 	for (const [plaintext, expression] of framed) secrets.set(plaintext, expression);
 	for (const [name, expression, plaintext] of framedByName) {
@@ -28430,7 +28486,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DVXRJSN_.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-e05iqtU_.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -40986,4 +41042,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { getCurrentResourceSecrets as $, validateAssetBucketName as $n, DependencyError as $r, findActionableSilentDrops as $t, planOrphanAdoption as A, CUSTOM_RESOURCE_RESPONSE_PREFIX as An, warnDeprecatedNoPrefixCliFlag as Ar, resolveExplicitPhysicalId as At, bold as B, WorkGraph as Bn, derivePartitionAndUrlSuffix as Br, requireConfigObject as Bt, createPreDeleteFinalSnapshot as C, markNonRetryable as Ci, S3StateBackend as Cn, resolveAutoAssetStorage as Cr, coerceParameterTypedValue as Ct, makeCanonicalizePropertiesFn as D, forceQuitRecoveryClause as Dn, resolveStateBucketWithDefaultAndSource as Dr, refStateLookupFromResource as Dt, unsupportedFinalSnapshotError as E, __exportAll as Ei, buildLockContentionMessage as En, resolveStateBucketWithDefault as Er, parameterTypeMayLoseSecretIdentity as Et, WARM_THROUGHPUT_MEMBERS as F, orphansAfterRollback as Fn, uploadCfnTemplate as Fr, configIntegerRefusal as Ft, yellow as G, AssetModeResolver as Gn, AwsClients as Gr, s3BucketArn as Gt, gray as H, createAssetRedirectResolver as Hn, processStackMessages as Hr, classifyReplaySecretRegion as Ht, coerceWarmThroughput as I, orphansCarriedFrom as In, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ir, configStringRefusal as It, exportAliasCollisionScrubWarning as J, ensureAssetStorage as Jn, setAwsClients as Jr, s3BucketRegionalDomainName as Jt, collectDeclaredOutputNames as K, BOOTSTRAP_MARKER_PREFIX as Kn, getAwsClients as Kr, s3BucketDomainName as Kt, isWarmThroughputDecrease as L, shouldRetainResource as Ln, expectedOwnerParam as Lr, readConfigString as Lt, isStatefulRecreateTargetForReplace as M, exportNamesCarriedFrom as Mn, CFN_TEMPLATE_URL_LIMIT as Mr, coerceCfnBoolean as Mt, isStatefulRecreateTargetSync as N, importableOutputKeys as Nn, MIGRATE_TMP_PREFIX as Nr, coerceCfnInteger as Nt, extractDeploymentEventError as O, formatLockExpiry as On, resolveUseCdkBootstrapAssets as Or, WAFv2WebACLProvider as Ot, renderStatefulReason as P, importableOutputs as Pn, findLargeInlineResources as Pr, configBooleanRefusal as Pt, secretSafeKeyDisplay as Q, readBootstrapMarkerBody as Qn, CrossAccountSecretRefusalError as Qr, INTRINSIC_KEYS as Qt, toFiniteNumber as R, AssetPublisher as Rn, PARTITION_TABLE as Rr, replayWarn as Rt, ccRoutedFinalSnapshotError as S, isTransientServerError as Si, LockManager as Sn, resolveApp as Sr, cfnRefValueFromPhysicalId as St, refusesFinalSnapshot as T, retryClassificationText as Ti, buildForceUnlockCommand as Tn, resolveSkipPrefix as Tr, isUnboundTemplateParameter as Tt, green as U, loadPublishableAssetManifest as Un, clearBucketRegionCache as Ur, producerRegionsFromState as Ut, cyan as V, buildAssetRedirectMap as Vn, AssemblyReader as Vr, requireConfigString as Vt, red as W, rewriteTemplateAssetReferences as Wn, resolveBucketRegion as Wr, withSharedDrainBudget as Wt, secretBearing as X, isCrossRegionRedirect as Xn, CdkdError as Xr, applyRoleArnIfSet as Xt, isExportAliasCollision as Y, getBootstrapMarkerKey as Yn, AssetError as Yr, s3BucketWebsiteUrl as Yt, secretBearingStateKeyWarning as Z, parseBootstrapMarker as Zn, ConfigError as Zr, DiffCalculator as Zt, isSecretBearingReferenceString as _, normalizeAwsError as _i, maskSecretsInText as _n, getDockerImageBySourceHash as _r, deleteSkipReason as _t, DeploymentEventsStore as a, LockError as ai, STATE_SOURCED_BASELINE_RULES as an, describeDockerExecFailure as ar, createMaskedRetryLogger as at, PRE_DELETE_SNAPSHOT_TYPES as b, isRetryableTransientError as bi, redactSecretsForState as bn, getDefaultStateBucketName as br, IntrinsicFunctionResolver as bt, replayFailedOperations as c, ProvisioningError as ci, TEMPLATE_SOURCED_RULES as cn, formatDockerLoginError as cr, beginCommandInterruptScope as ct, updatePartialReason as d, StackHasActiveImportsError as di, dynamicReferenceTokens as dn, redactDockerArgvValues as dr, isInterruptedWaitError as dt, DeployCancelledError as ei, findSilentDropProperties as en, validateContainerRepoName as er, IAMRoleProvider as et, withResourceDeadline as f, StackTerminationProtectionError as fi, errorCauseChain as fn, runDockerForeground as fr, startInterruptWatch as ft, bagHoldsSecretExpression as g, isCdkdError as gi, maskSecretsInError as gn, AssetManifestLoader as gr, deleteIndeterminateGuards as gt, computeImplicitDeleteEdges as h, formatError as hi, markSameGenerationBag as hn, stripControlChars as hr, UNSPECIFIED_SKIP_REASON as ht, DeploymentEventsReader as i, LocalStartServiceError as ii, TemplateParser as in, describeDockerCapturedOutput as ir, wouldReturnToSdkProvider as it, MULTI_REGION_RECREATE_BLOCKED_TYPES as j, DEFAULT_STATE_PREFIX as jn, CFN_TEMPLATE_BODY_LIMIT as jr, assertRegionMatch as jt, makeSiblingClaimReader as k, shellQuote as kn, stateBucketExistenceConfirmed as kr, normalizeAwsTagsToCfn as kt, replayRollback as l, ResourceTimeoutError as li, carriesSecretMask as ln, getDockerCmd as lr, endCommandInterruptScope as lt, IMPLICIT_DELETE_DEPENDENCIES as m, SynthesisError as mi, isSingleDynamicReferenceToken as mn, escapeRegExp$1 as mr, slowCcOperationTimeoutMs as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, IntrinsicResolutionRefusalError as ni, withRetry as nn, describeAwsFailure as nr, clearOnUpdateRemoval as nt, planFailedOps as o, NestedStackChildDirectDestroyError as oi, STATE_SOURCED_CROSS_GENERATION_RULES as on, describeDockerFailure as or, maskDeep as ot, maskingRetryLogger as p, StateError as pi, identityKeyFor as pn, runDockerStreaming as pr, CloudControlProvider as pt, collectPublishedOutputNames as q, assertAssetBucketRegion as qn, resetAwsClients as qr, s3BucketDualStackDomainName as qt, DeployEngine as r, LocalInvokeBuildError as ri, DagBuilder as rn, buildDockerImage as rr, ProviderRegistry as rt, planRollback as s, PartialFailureError as si, STATE_SOURCED_READBACK_RULES as sn, dockerSpawnEnvWithSensitive as sr, maskerOrIdentity as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DynamicReferenceRegionAmbiguousError as ti, describeTypeWithThrottleRetry as tn, buildDenyExternalAccessPolicy as tr, collectInlinePolicyNamesManagedBySiblings as tt, updatePartialMessage as u, ResourceUpdateNotSupportedError as ui, createSecretMasker as un, partitionSensitiveEnv as ur, interruptWatchListenerCount as ut, bindingSkippedOutputs as v, withErrorHandling as vi, recordMaskOnlyValue as vn, Synthesizer as vr, disableInstanceApiTermination as vt, isFinalSnapshotError as w, markRedactedCause as wi, rebuildClientForBucketRegion as wn, resolveCaptureObservedState as wr, getAccountInfo as wt, buildFinalSnapshotIdentifier as x, isThrottlingError as xi, scrubResourceRecord as xn, getLegacyStateBucketName as xr, carriesDynamicReference as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, isMarkedNonRetryable as yi, recoverMaskedOutput as yn, synthesisStatusMessage as yr, isTerminationProtectionPropagationError as yt, formatResourceLine as z, stringifyValue as zn, canonicalizeRegion as zr, requireConfigArray as zt };
-//# sourceMappingURL=deploy-engine-C287P1jL.js.map
+//# sourceMappingURL=deploy-engine-aYUEGRRl.js.map