@go-to-k/cdkd 0.290.16 → 0.290.17

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-1FTpsWNc.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CT2xso6V.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-U03H43s7.js");
+	const { buildProgram } = await import("./program-CbHndlOj.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-B91NMqm1.js → deploy-engine-BYTwDxet.js}

@@ -1,6 +1,6 @@
 import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-1FTpsWNc.js";
+import { t as getCdkdVersion } from "./version-CT2xso6V.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15989,11 +15989,31 @@ function errorCauseChain(root) {
 * Returns the ORIGINAL object by identity when NOTHING ANYWHERE IN THE CHAIN
 * changed, so a non-secret failure keeps referential equality and the common
 * path allocates nothing.
-*/
-function maskSecretsInError(error, secrets) {
-	if (secrets.size === 0 || !(error instanceof Error)) return error;
+*
+* `extraMask` is an OPTIONAL text transform run on every link's `message` and
+* `stack` BEFORE the bag pass, for the class the bag structurally cannot reach
+* (issue [#3234](https://github.com/go-to-k/cdkd/issues/3234)): a name masked
+* BY POSITION rather than by value. A bag masks a sub-`MIN_NEEDLE_LENGTH`
+* plaintext only as the WHOLE text, so a 1-3 character secret EMBEDDED in a
+* longer name that another module quoted back is invisible here — while the
+* caller that resolved the name holds both it and its masked log text and can
+* substitute one for the other exactly. BEFORE rather than after, because the
+* substitution matches the RAW name: a bag pass that had already rewritten part
+* of it would leave nothing for the transform to find.
+*
+* It is a pure `(text) => text` so this module stays a no-import LEAF. With
+* `extraMask` supplied the empty-bag short-circuit no longer applies — an empty
+* bag plus a positional transform still has work to do.
+*
+* THE BOUND, unchanged by `extraMask`: a thrown value that is not an `Error`
+* is handed back BY IDENTITY and masked by neither pass. A caller whose
+* callees can reject with a non-`Error` owes that case its own handling.
+*/
+function maskSecretsInError(error, secrets, extraMask) {
+	if (!(error instanceof Error) || secrets.size === 0 && !extraMask) return error;
+	const maskText = (text) => maskSecretsInText(extraMask ? extraMask(text) : text, secrets);
 	const chain = errorCauseChain(error);
-	const maskedMessages = chain.map((link) => maskSecretsInText(link.message, secrets));
+	const maskedMessages = chain.map((link) => maskText(link.message));
 	if (maskedMessages.every((masked, i) => masked === chain[i].message)) return error;
 	const clones = /* @__PURE__ */ new Map();
 	for (const [i, original] of chain.entries()) {
@@ -16012,7 +16032,7 @@ function maskSecretsInError(error, secrets) {
 		});
 		const originalStack = original.stack;
 		if (typeof originalStack === "string") Object.defineProperty(clone, "stack", {
-			value: maskSecretsInText(originalStack, secrets),
+			value: maskText(originalStack),
 			writable: true,
 			enumerable: false,
 			configurable: true
@@ -27186,7 +27206,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(loggedRegionText, context)}): ${this.maskSecretsForLog(message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			const cfnNameMask = this.positionalNameMask([[stackName, this.maskSecretsForLog(stackName, context)], [region, this.maskSecretsForLog(loggedRegionText, context)]]);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(loggedRegionText, context)}): ${this.maskSecretsForLog(cfnNameMask ? cfnNameMask(message) : message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -27311,7 +27332,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const loggedOutputName = this.maskSecretsForLog(outputName, context);
 		const loggedRegion = this.maskSecretsForLog(loggedRegionText, context);
 		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
-		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
+		let stateData;
+		try {
+			stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
+		} catch (error) {
+			this.maskStateReadError(error, [[stackName, loggedStackName], [region, loggedRegion]], context);
+		}
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
 				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context, loggedRegionText);
@@ -27360,6 +27386,98 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		});
 	}
 	/**
+	* A text transform replacing each RAW name this frame handed to another
+	* module with the masked spelling it holds for it (issue
+	* [#3234](https://github.com/go-to-k/cdkd/issues/3234)), or `undefined` when
+	* no pair carries a mask.
+	*
+	* This is what the BAGS structurally cannot do. A bag masks by VALUE, and a
+	* plaintext shorter than `MIN_NEEDLE_LENGTH` matches only as the WHOLE text,
+	* so a 1-3 character secret an `Fn::Sub` assembled into a longer name is
+	* invisible to it — while this frame knows the exact spans.
+	*
+	* A pair that DOES carry a mask contributes its raw spelling AND the spelling
+	* the reader will actually see. `S3StateBackend` prints names through
+	* `displaySafe(..., { asciiOnly: true })`, which REPLACES every non-printable
+	* character with a space and then trims, so a secret carrying one is a
+	* DIFFERENT string by the time it is quoted back and matching the raw form
+	* alone would miss it while reporting success — the one-string-space rule
+	* `outputs-export-alias.ts` states for its own scan: the text that was tested
+	* and the text that is printed must be the same text. The CloudFormation
+	* fallback does NOT sanitize (it rethrows the SDK's message as it is), so the
+	* second spelling is inert at that call site and costs one comparison.
+	*
+	* NO MINIMUM LENGTH beyond non-empty, deliberately. A one-character masked
+	* name rewrites every occurrence of that character in the sentence
+	* (`a` -> `***` turns `us-east-1` into `us-e***st-1`), which is unreadable
+	* but SAFE — the direction this function must never get wrong is printing
+	* too little, not too much, and a floor here would be a floor on masking.
+	*
+	* `raw !== ''` is DEFENSIVE, and it is NOT the guard that handles a name
+	* whose sanitized form is empty — that one inspects `shown`, below, and its
+	* own comment says why. What this clause is not is redundant against
+	* `raw !== masked`: `rememberLogTwin` has no empty-key guard and
+	* `splitLogTwins` registers every piece it produces, so `registeredLogTwin`
+	* can answer `***` for the empty string and make `maskSecretsForLog('')`
+	* differ from `''`. Neither call site can reach it — both refuse an empty
+	* name upstream — so it fences nothing measured today.
+	*
+	* LONGEST KEY FIRST — over every key, raw and sanitized alike, which is what
+	* the comparator sees — so a key that contains another is rewritten as itself
+	* rather than having the inner one replaced underneath it. **That ordering
+	* is DEFENSIVE and this suite does not distinguish it** — measured: reversing
+	* the comparator leaves every case green. The reason is that no case here
+	* builds two raws that NEST: the one case with two surviving pairs masks a
+	* stack name and a region that share no substring, and everywhere else one
+	* pair is dropped for carrying no mask. It earns its place on the shape that
+	* DOES diverge — a shorter raw whose mask is not a prefix of the longer's
+	* (`q7` -> `***` beside `q7x` -> `***` turns `q7x` into `***x` shortest-first,
+	* leaking the `x`) — which needs two separately recorded secrets, one of them
+	* masked WHOLE, and is not constructed here. Recorded as measured rather than
+	* claimed fenced.
+	*/
+	positionalNameMask(pairs) {
+		const substitutions = pairs.filter(([raw, masked]) => raw !== "" && raw !== masked).flatMap(([raw, masked]) => {
+			const shown = displaySafe(raw, { asciiOnly: true });
+			if (shown === raw) return [[raw, masked]];
+			const shownMask = displaySafe(masked, { asciiOnly: true });
+			return shown === "" || shownMask === "" ? [[raw, masked]] : [[raw, masked], [shown, shownMask]];
+		}).sort(([a], [b]) => b.length - a.length);
+		if (substitutions.length === 0) return void 0;
+		return (text) => {
+			let out = text;
+			for (const [raw, masked] of substitutions) out = out.split(raw).join(masked);
+			return out;
+		};
+	}
+	/**
+	* Mask a failure raised by a module this resolver handed RAW names to (issue
+	* [#3234](https://github.com/go-to-k/cdkd/issues/3234)).
+	*
+	* Returns a masked CLONE of the whole cause chain, not a new wrapper, and
+	* that is the point: `formatError` renders `Caused by: <cause>`, so masking
+	* only a fresh top-level message leaves the original message one link down
+	* and prints it anyway. The clone keeps the class, every own descriptor
+	* (`markNonRetryable`'s non-enumerable symbol, `$metadata`, `Code`, `name`)
+	* and the chain shape, so every reader that classifies this error still
+	* does — see `maskSecretsInError`'s own doc.
+	*
+	* `pairs` are (raw, masked-log-text) for the names this frame handed over;
+	* {@link positionalNameMask} turns them into the transform and owns why.
+	*/
+	maskStateReadError(error, pairs, context) {
+		const extraMask = this.positionalNameMask(pairs);
+		let masked = error;
+		let positional = extraMask;
+		for (const bag of [context?.inheritedSecrets, context?.recordedSecretValues]) {
+			if (!bag || bag.size === 0) continue;
+			masked = maskSecretsInError(masked, bag, positional);
+			positional = void 0;
+		}
+		if (positional) masked = maskSecretsInError(masked, /* @__PURE__ */ new Map(), positional);
+		throw masked;
+	}
+	/**
 	* Read the producer's state from the SAME AWS account (no RoleArn).
 	*
 	* Uses the consumer's shared `context.stateBackend` — the same backend
@@ -29652,7 +29770,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CvkcE8rH.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BPBdAAGQ.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -42413,4 +42531,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, BOOTSTRAP_MARKER_PREFIX as $n, getAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, markNonRetryable as Ai, buildForceUnlockCommand as An, resolveAutoAssetStorage as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, importableOutputs as Bn, MIGRATE_TMP_PREFIX as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, isCdkdError as Ci, recordMaskOnlyValue as Cn, AssetManifestLoader as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isRetryableTransientError as Di, LockManager as Dn, getDefaultStateBucketName as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isMarkedNonRetryable as Ei, scrubResourceRecord as En, synthesisStatusMessage as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, resolveUseCdkBootstrapAssets as Fr, resolveExplicitPhysicalId as Ft, gray as G, AssetPublisher as Gn, PARTITION_TABLE as Gr, requireConfigObject as Gt, formatResourceLine as H, orphansAfterRollback as Hn, uploadCfnTemplate as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, stateBucketExistenceConfirmed as Ir, assertRegionMatch as It, yellow as J, buildAssetRedirectMap as Jn, AssemblyReader as Jr, producerRegionsFromState as Jt, green as K, stringifyValue as Kn, canonicalizeRegion as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, warnDeprecatedNoPrefixCliFlag as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, retryClassificationText as Mi, forceQuitRecoveryClause as Mn, resolveSkipPrefix as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, __exportAll as Ni, formatLockExpiry as Nn, resolveStateBucketWithDefault as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, isThrottlingError as Oi, S3StateBackend as On, getLegacyStateBucketName as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, resolveStateBucketWithDefaultAndSource as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, AssetModeResolver as Qn, AwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, hasReadableExportSet as Rn, CFN_TEMPLATE_BODY_LIMIT as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, formatError as Si, maskSecretsInText as Sn, stripControlChars as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, withErrorHandling as Ti, redactSecretsForState as Tn, Synthesizer as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, orphansCarriedFrom as Un, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ur, replayWarn as Ut, toFiniteNumber as V, isReadableBag as Vn, findLargeInlineResources as Vr, configStringRefusal as Vt, cyan as W, shouldRetainResource as Wn, expectedOwnerParam as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, loadPublishableAssetManifest as Xn, clearBucketRegionCache as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, createAssetRedirectResolver as Yn, processStackMessages as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, rewriteTemplateAssetReferences as Zn, resolveBucketRegion as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, ResourceUpdateNotSupportedError as _i, errorCauseChain as _n, partitionSensitiveEnv as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as ai, findSilentDropProperties as an, readBootstrapMarkerBody as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, StateError as bi, markSameGenerationBag as bn, runDockerStreaming as br, deleteSkipReason as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ci, DagBuilder as cn, buildDenyExternalAccessPolicy as cr, createMaskedRetryLogger as ct, updatePartialReason as d, LocalStartServiceError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerCapturedOutput as dr, beginCommandInterruptScope as dt, resetAwsClients as ei, s3BucketWebsiteUrl as en, assertAssetBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, LockError as fi, STATE_SOURCED_READBACK_RULES as fn, describeDockerExecFailure as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, ResourceTimeoutError as gi, dynamicReferenceTokens as gn, getDockerCmd as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ProvisioningError as hi, createSecretMasker as hn, formatDockerLoginError as hr, startInterruptWatch as ht, DeploymentEventsReader as i, ConfigError as ii, findActionableSilentDrops as in, parseBootstrapMarker as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, markRedactedCause as ji, buildLockContentionMessage as jn, resolveCaptureObservedState as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, isTransientServerError as ki, rebuildClientForBucketRegion as kn, resolveApp as kr, isUnboundTemplateParameter as kt, replayRollback as l, IntrinsicResolutionRefusalError as li, TemplateParser as ln, describeAwsFailure as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, PartialFailureError as mi, carriesSecretMask as mn, dockerSpawnEnvWithSensitive as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as ni, DiffCalculator as nn, getBootstrapMarkerKey as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DependencyError as oi, describeTypeWithThrottleRetry as on, validateAssetBucketName as or, ProviderRegistry as ot, maskingRetryLogger as p, NestedStackChildDirectDestroyError as pi, TEMPLATE_SOURCED_RULES as pn, describeDockerFailure as pr, interruptWatchListenerCount as pt, red as q, WorkGraph as qn, derivePartitionAndUrlSuffix as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CdkdError as ri, INTRINSIC_KEYS as rn, isCrossRegionRedirect as rr, IAMRoleProvider as rt, planRollback as s, DeployCancelledError as si, withRetry as sn, validateContainerRepoName as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ti, applyRoleArnIfSet as tn, ensureAssetStorage as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LocalInvokeBuildError as ui, STATE_SOURCED_BASELINE_RULES as un, buildDockerImage as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StackHasActiveImportsError as vi, identityKeyFor as vn, redactDockerArgvValues as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, normalizeAwsError as wi, recoverMaskedOutput as wn, getDockerImageBySourceHash as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, SynthesisError as xi, maskSecretsInError as xn, escapeRegExp$1 as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, StackTerminationProtectionError as yi, isSingleDynamicReferenceToken as yn, runDockerForeground as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputKeys as zn, CFN_TEMPLATE_URL_LIMIT as zr, configBooleanRefusal as zt };
-//# sourceMappingURL=deploy-engine-B91NMqm1.js.map
+//# sourceMappingURL=deploy-engine-BYTwDxet.js.map