@go-to-k/cdkd 0.290.3 → 0.290.4

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BTao4oxo.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BUcQz4SU.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-CoRRfEe_.js");
+	const { buildProgram } = await import("./program-20PIJFu9.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-0Wg4MwP2.js → deploy-engine-DD7JE_Ic.js}

@@ -1,6 +1,6 @@
 import { b as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BTao4oxo.js";
+import { t as getCdkdVersion } from "./version-BUcQz4SU.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12964,7 +12964,8 @@ function isPlainObject$2(value) {
 }
 /**
 * Stands in for a source part the skeleton cannot know — an `Fn::Join` element
-* that is itself an intrinsic, or an `Fn::Sub` `${...}` variable.
+* that is itself an intrinsic or any other non-scalar or `null` part (see
+* {@link joinPartLiteralText}), or an `Fn::Sub` `${...}` variable.
 *
 * Built from {@link DYNAMIC_REFERENCE_INNER_CHAR} rather than `.` because a
 * recorded expression's INNER text never contains `}`: the resolver matches
@@ -13033,7 +13034,7 @@ const MAX_SKELETON_CANDIDATE_LENGTH = 512;
 * between them. Measured on a ~120-char candidate, before the collapse:
 * 4 adjacent wildcards 39ms, 5 ~1s, 6 20s, 8 did not finish in two minutes. Two
 * legal CFn shapes CDK can emit produce ADJACENT ones — an `Fn::Join` with an
-* EMPTY delimiter and consecutive non-string parts, and an `Fn::Sub` with
+* EMPTY delimiter and consecutive intrinsic (or `null`) parts, and an `Fn::Sub` with
 * adjacent `${a}${b}` variables — and the collapse takes both to a single
 * wildcard. It does NOT close the class, which is why the cap exists beside it.
 *
@@ -13115,7 +13116,8 @@ function anchoredSkeletonPattern(segments) {
 }
 /**
 * A source part the skeleton cannot know — an `Fn::Join` element that is
-* itself an intrinsic, or an `Fn::Sub` `${...}` variable. The segment form of
+* itself an intrinsic or any other non-scalar or `null` part (see
+* {@link joinPartLiteralText}), or an `Fn::Sub` `${...}` variable. The segment form of
 * {@link SKELETON_WILDCARD}: what a part IS, before {@link anchoredSkeletonPattern}
 * — the one speller — turns it into the wildcard.
 */
@@ -13132,13 +13134,51 @@ const UNKNOWN_PART = Symbol("unknown intrinsic part");
 */
 const UNKNOWN_PART_PLACEHOLDER = "\0";
 /**
+* The literal text an `Fn::Join` PART contributes, or `undefined` when the
+* part is not knowable from the template (issue #3055).
+*
+* The resolver joins every part as `String(await resolveValue(part))`, and
+* `resolveValue` returns a NUMBER or BOOLEAN unchanged, so such a part
+* contributes exactly `String(part)` -- `8080` joins as `8080`, `true` as
+* `true`. A string part is its raw text here as it always was (a
+* `{{resolve:` inside it is the token the readers look for, not text this
+* function resolves). Reading only strings as literal made the other two a
+* wildcard for the skeleton arm (a candidate differing at that position could
+* match) and a placeholder for the frame arm (whose rendered frame then no
+* longer equals the leaf's text around the middle, so the arm refuses) -- and,
+* through the frame arm's rewrite, for the nested-stack parameter recorder's
+* `frameSpellingOf`, which carries a framed parameter to the child only when
+* that arm wrote it. The recorder's own rendering of such a part does not
+* decide the case: a part outside the token leaves its one span and service
+* prefix the same either way.
+*
+* `null` stays unknowable although the resolver would join it as `null`, as it
+* was before this function existed: it is not a part a CloudFormation template
+* can carry meaningfully. Being a wildcard, it can still let the skeleton arm
+* match a lone candidate spelling something else at that position -- the
+* arm's existing wrong-reference residual, not narrowed here. The literal
+* reading reaches that same residual in a few more places: a source that left
+* two candidates matching as a wildcard can now leave ONE, which the arm
+* accepts even when the leaf's own reference was never recorded (a public
+* `ssm` parameter). An object or array part (an intrinsic, a list, or any
+* other object) stays {@link UNKNOWN_PART}.
+*/
+function joinPartLiteralText(part) {
+	if (typeof part === "string") return part;
+	if (typeof part === "number" || typeof part === "boolean") return String(part);
+}
+/**
 * The text of an `Fn::Join` / `Fn::Sub` source in order: a literal part as its
-* RAW text, an unknowable part as {@link UNKNOWN_PART}. ONE parser for the two
+* RAW text (a number or boolean `Fn::Join` part as the text the resolver joins
+* it as, {@link joinPartLiteralText}), an unknowable part as
+* {@link UNKNOWN_PART}. ONE parser for the three
 * readers of that shape — {@link intrinsicSkeletonPattern}, which hands every
-* segment to {@link anchoredSkeletonPattern} to spell as a regex, and
+* segment to {@link anchoredSkeletonPattern} to spell as a regex,
 * {@link positionByIntrinsicFrame}, which needs the
-* literal text VERBATIM to know where a token's frame begins and ends — so
-* the two cannot disagree about what a source says (issue #2745).
+* literal text VERBATIM to know where a token's frame begins and ends, and
+* `frameSpellingOf` in {@link recordNestedStackParameterExpressions}, which
+* renders the same text to find the token a carried frame spells — so
+* they cannot disagree about what a source says (issues #2745, #3062).
 *
 * `undefined` for any source this cannot describe, per the pattern reader's
 * doc: a delimiter that is itself an intrinsic, a non-array `Fn::Join`, a
@@ -13156,7 +13196,7 @@ function intrinsicSkeletonSegments(source) {
 		const segments = [];
 		parts.forEach((part, index) => {
 			if (index > 0) segments.push(delimiter);
-			segments.push(typeof part === "string" ? part : UNKNOWN_PART);
+			segments.push(joinPartLiteralText(part) ?? UNKNOWN_PART);
 		});
 		return segments;
 	}
@@ -13410,9 +13450,10 @@ function positionByCrossStackSource(bag, source, secrets) {
 *
 * One residual is worth naming rather than leaving to be rediscovered: a single
 * WRONG candidate can win only when this leaf's own expression is in NEITHER
-* store — which is exactly an `ssm` reference whose `Type` came back
-* unclassifiable (deliberately unpinned per #1901) and which then lost the
-* value collapse. `recordedSecretExpressions` is process-wide, so the winner
+* store — an `ssm` reference whose `Type` came back unclassifiable
+* (deliberately unpinned per #1901) and which then lost the value collapse, or
+* a PUBLIC `ssm` reference (stored resolved, #1901) whose value coincides with
+* a recorded secret's plaintext. `recordedSecretExpressions` is process-wide, so the winner
 * could in principle come from another resource, and condition 3 cannot refuse
 * one the pass never recorded.
 *
@@ -13421,7 +13462,7 @@ function positionByCrossStackSource(bag, source, secrets) {
 * `resolveReplayProps` RE-RESOLVES the persisted expression against AWS and
 * hands the result to `provider.update`, so a rollback replays the wrong secret
 * — immediately, if the two references already resolve to different values. It
-* is narrow (unclassifiable-`ssm` leaves only) but it is not cosmetic, and an
+* is narrow (unclassifiable or public `ssm` leaves only) but it is not cosmetic, and an
 * earlier draft of this paragraph called it "a spurious UPDATE rather than a
 * disclosure", which understated it.
 *
@@ -28975,7 +29016,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-RLnpBIKj.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-NffO_bpL.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -41632,4 +41673,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretSafeKeyDisplay as $, parseBootstrapMarker as $n, ConfigError as $r, DiffCalculator as $t, planOrphanAdoption as A, formatLockExpiry as An, resolveUseCdkBootstrapAssets as Ar, WAFv2WebACLProvider as At, formatResourceLine as B, AssetPublisher as Bn, PARTITION_TABLE as Br, replayWarn as Bt, createPreDeleteFinalSnapshot as C, isThrottlingError as Ci, scrubResourceRecord as Cn, getLegacyStateBucketName as Cr, cfnRefValueFromPhysicalId as Ct, makeCanonicalizePropertiesFn as D, retryClassificationText as Di, buildForceUnlockCommand as Dn, resolveSkipPrefix as Dr, parameterTypeMayLoseSecretIdentity as Dt, unsupportedFinalSnapshotError as E, markRedactedCause as Ei, rebuildClientForBucketRegion as En, resolveCaptureObservedState as Er, isUnboundTemplateParameter as Et, WARM_THROUGHPUT_MEMBERS as F, importableOutputKeys as Fn, MIGRATE_TMP_PREFIX as Fr, coerceCfnInteger as Ft, red as G, loadPublishableAssetManifest as Gn, clearBucketRegionCache as Gr, producerRegionsFromState as Gt, cyan as H, WorkGraph as Hn, derivePartitionAndUrlSuffix as Hr, requireConfigObject as Ht, coerceWarmThroughput as I, importableOutputs as In, findLargeInlineResources as Ir, configBooleanRefusal as It, collectPublishedOutputNames as J, BOOTSTRAP_MARKER_PREFIX as Jn, getAwsClients as Jr, s3BucketDomainName as Jt, yellow as K, rewriteTemplateAssetReferences as Kn, resolveBucketRegion as Kr, withSharedDrainBudget as Kt, isWarmThroughputDecrease as L, orphansAfterRollback as Ln, uploadCfnTemplate as Lr, configIntegerRefusal as Lt, isStatefulRecreateTargetForReplace as M, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mn, warnDeprecatedNoPrefixCliFlag as Mr, resolveExplicitPhysicalId as Mt, isStatefulRecreateTargetSync as N, DEFAULT_STATE_PREFIX as Nn, CFN_TEMPLATE_BODY_LIMIT as Nr, assertRegionMatch as Nt, extractDeploymentEventError as O, __exportAll as Oi, buildLockContentionMessage as On, resolveStateBucketWithDefault as Or, refStateLookupFromResource as Ot, renderStatefulReason as P, exportNamesCarriedFrom as Pn, CFN_TEMPLATE_URL_LIMIT as Pr, coerceCfnBoolean as Pt, secretBearingStateKeyWarning as Q, isCrossRegionRedirect as Qn, CdkdError as Qr, applyRoleArnIfSet as Qt, toCfnInteger as R, orphansCarriedFrom as Rn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Rr, configStringRefusal as Rt, ccRoutedFinalSnapshotError as S, isRetryableTransientError as Si, redactSecretsForState as Sn, getDefaultStateBucketName as Sr, carriesDynamicReference as St, refusesFinalSnapshot as T, markNonRetryable as Ti, S3StateBackend as Tn, resolveAutoAssetStorage as Tr, getAccountInfo as Tt, gray as U, buildAssetRedirectMap as Un, AssemblyReader as Ur, requireConfigString as Ut, bold as V, stringifyValue as Vn, canonicalizeRegion as Vr, requireConfigArray as Vt, green as W, createAssetRedirectResolver as Wn, processStackMessages as Wr, classifyReplaySecretRegion as Wt, isExportAliasCollision as X, ensureAssetStorage as Xn, setAwsClients as Xr, s3BucketRegionalDomainName as Xt, exportAliasCollisionScrubWarning as Y, assertAssetBucketRegion as Yn, resetAwsClients as Yr, s3BucketDualStackDomainName as Yt, secretBearing as Z, getBootstrapMarkerKey as Zn, AssetError as Zr, s3BucketWebsiteUrl as Zt, isSecretBearingReferenceString as _, formatError as _i, markSameGenerationBag as _n, stripControlChars as _r, deleteIndeterminateGuards as _t, DeploymentEventsStore as a, LocalInvokeBuildError as ai, DagBuilder as an, buildDockerImage as ar, wouldReturnToSdkProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, withErrorHandling as bi, recordMaskOnlyValue as bn, Synthesizer as br, isTerminationProtectionPropagationError as bt, replayFailedOperations as c, NestedStackChildDirectDestroyError as ci, STATE_SOURCED_CROSS_GENERATION_RULES as cn, describeDockerFailure as cr, maskerOrIdentity as ct, updatePartialReason as d, ResourceTimeoutError as di, carriesSecretMask as dn, getDockerCmd as dr, interruptWatchListenerCount as dt, CrossAccountSecretRefusalError as ei, INTRINSIC_KEYS as en, readBootstrapMarkerBody as er, getCurrentResourceSecrets as et, withResourceDeadline as f, ResourceUpdateNotSupportedError as fi, createSecretMasker as fn, partitionSensitiveEnv as fr, isInterruptedWaitError as ft, bagHoldsSecretExpression as g, SynthesisError as gi, isSingleDynamicReferenceToken as gn, escapeRegExp$1 as gr, UNSPECIFIED_SKIP_REASON as gt, computeImplicitDeleteEdges as h, StateError as hi, identityKeyFor as hn, runDockerStreaming as hr, slowCcOperationTimeoutMs as ht, DeploymentEventsReader as i, IntrinsicResolutionRefusalError as ii, withRetry as in, describeAwsFailure as ir, ProviderRegistry as it, MULTI_REGION_RECREATE_BLOCKED_TYPES as j, shellQuote as jn, stateBucketExistenceConfirmed as jr, normalizeAwsTagsToCfn as jt, makeSiblingClaimReader as k, forceQuitRecoveryClause as kn, resolveStateBucketWithDefaultAndSource as kr, isSettledInstanceState as kt, replayRollback as l, PartialFailureError as li, STATE_SOURCED_READBACK_RULES as ln, dockerSpawnEnvWithSensitive as lr, beginCommandInterruptScope as lt, IMPLICIT_DELETE_DEPENDENCIES as m, StackTerminationProtectionError as mi, errorCauseChain as mn, runDockerForeground as mr, CloudControlProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DeployCancelledError as ni, findSilentDropProperties as nn, validateContainerRepoName as nr, collectInlinePolicyNamesManagedBySiblings as nt, planFailedOps as o, LocalStartServiceError as oi, TemplateParser as on, describeDockerCapturedOutput as or, createMaskedRetryLogger as ot, maskingRetryLogger as p, StackHasActiveImportsError as pi, dynamicReferenceTokens as pn, redactDockerArgvValues as pr, startInterruptWatch as pt, collectDeclaredOutputNames as q, AssetModeResolver as qn, AwsClients as qr, s3BucketArn as qt, DeployEngine as r, DynamicReferenceRegionAmbiguousError as ri, describeTypeWithThrottleRetry as rn, buildDenyExternalAccessPolicy as rr, clearOnUpdateRemoval as rt, planRollback as s, LockError as si, STATE_SOURCED_BASELINE_RULES as sn, describeDockerExecFailure as sr, maskDeep as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DependencyError as ti, findActionableSilentDrops as tn, validateAssetBucketName as tr, IAMRoleProvider as tt, updatePartialMessage as u, ProvisioningError as ui, TEMPLATE_SOURCED_RULES as un, formatDockerLoginError as ur, endCommandInterruptScope as ut, bindingSkippedOutputs as v, isCdkdError as vi, maskSecretsInError as vn, AssetManifestLoader as vr, deleteSkipReason as vt, isFinalSnapshotError as w, isTransientServerError as wi, LockManager as wn, resolveApp as wr, coerceParameterTypedValue as wt, buildFinalSnapshotIdentifier as x, isMarkedNonRetryable as xi, recoverMaskedOutput as xn, synthesisStatusMessage as xr, IntrinsicFunctionResolver as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, normalizeAwsError as yi, maskSecretsInText as yn, getDockerImageBySourceHash as yr, disableInstanceApiTermination as yt, toFiniteNumber as z, shouldRetainResource as zn, expectedOwnerParam as zr, readConfigString as zt };
-//# sourceMappingURL=deploy-engine-0Wg4MwP2.js.map
+//# sourceMappingURL=deploy-engine-DD7JE_Ic.js.map