@go-to-k/cdkd 0.290.39 → 0.290.40

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DzcgAjCn.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-CEKVu0mE.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-BC_cHG7r.js");
+	const { buildProgram } = await import("./program-BmtaBtO_.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-Vze2lc-H.js → deploy-engine-DJxLBuTb.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BkcLg0jL.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-DzcgAjCn.js";
+import { t as getCdkdVersion } from "./version-CEKVu0mE.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2843,7 +2843,7 @@ function collectStackMessages(assemblyDir, artifact) {
 				merged[path] = [...merged[path] ?? [], ...entries];
 			}
 		} catch (error) {
-			throw new SynthesisError(`Failed to read stack metadata file ${metadataPath}: ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			throw new SynthesisError(`Failed to read stack metadata file ${displaySafe(metadataPath)}: ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
 	}
 	const messages = [];
@@ -2899,6 +2899,22 @@ function processStackMessages(stacks, logger, options = {}) {
 //#region src/synthesis/assembly-reader.ts
 /**
 * Reads and parses Cloud Assembly from cdk.out directory
+*
+* EVERY value this class renders into a message or a log line goes through
+* `displaySafe` (issue [#3277](https://github.com/go-to-k/cdkd/issues/3277)).
+* The reason is the one its absolute-`aws:asset:path` refusal states in its own
+* text: a manifest key, a template key, a `Metadata` string, a
+* `directoryName`-derived path and the `JSON.parse` failure quoting a hand-fed
+* file are all chosen by whoever wrote the assembly, and this is the FIRST
+* layer the CLI reaches, so on a hostile assembly its output is what a user is
+* asked to trust. C1 bytes and the bidi overrides survive ordinary string
+* building, and `formatError` sanitizes only an error's `cause`, never its own
+* `message` — so a crafted value otherwise appends what reads as a second,
+* cdkd-authored line. `displaySafe` is the identity on every well-formed
+* assembly: it neither truncates nor quotes, so a legitimate long asset path
+* still renders in full and byte-identically. The same rule, for the same
+* reason, guards the twin refusals in `src/cli/commands/diff-recursive.ts`
+* (go-to-k/cdkd#3243).
 */
 var AssemblyReader = class {
 	logger = getLogger().child("AssemblyReader");
@@ -2910,10 +2926,10 @@ var AssemblyReader = class {
 		try {
 			const content = readFileSync(manifestPath, "utf-8");
 			const manifest = JSON.parse(content);
-			this.logger.debug(`Loaded manifest: version=${manifest.version}`);
+			this.logger.debug(`Loaded manifest: version=${displaySafe(manifest.version)}`);
 			return manifest;
 		} catch (error) {
-			throw new SynthesisError(`Failed to read cloud assembly manifest from ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			throw new SynthesisError(`Failed to read cloud assembly manifest from ${displaySafe(manifestPath)}: ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -2938,7 +2954,7 @@ var AssemblyReader = class {
 					const nestedStacks = this.getAllStacks(nestedDir, nestedManifest);
 					stacks.push(...nestedStacks);
 				} catch (error) {
-					this.logger.warn(`Failed to read nested assembly '${props.directoryName}': ${error instanceof Error ? error.message : String(error)}`);
+					this.logger.warn(`Failed to read nested assembly '${displaySafe(props.directoryName)}': ${displaySafe(error instanceof Error ? error.message : String(error))}`);
 				}
 			}
 		}
@@ -2951,7 +2967,7 @@ var AssemblyReader = class {
 	getStack(assemblyDir, manifest, stackName) {
 		const stacks = this.getAllStacks(assemblyDir, manifest);
 		const stack = stacks.find((s) => s.stackName === stackName);
-		if (!stack) throw new SynthesisError(`Stack '${stackName}' not found in assembly. Available: ${stacks.map((s) => s.stackName).join(", ")}`);
+		if (!stack) throw new SynthesisError(`Stack '${displaySafe(stackName)}' not found in assembly. Available: ${stacks.map((s) => displaySafe(s.stackName)).join(", ")}`);
 		return stack;
 	}
 	/**
@@ -2980,21 +2996,21 @@ var AssemblyReader = class {
 		const props = artifact.properties;
 		const stackName = props?.stackName || artifactId;
 		const templateFile = props?.templateFile;
-		if (!templateFile) throw new SynthesisError(`Stack '${stackName}' has no templateFile property`);
+		if (!templateFile) throw new SynthesisError(`Stack '${displaySafe(stackName)}' has no templateFile property`);
 		const templatePath = join(assemblyDir, templateFile);
 		let template;
 		try {
 			const content = readFileSync(templatePath, "utf-8");
 			template = JSON.parse(content);
 		} catch (error) {
-			throw new SynthesisError(`Failed to read template for stack '${stackName}': ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			throw new SynthesisError(`Failed to read template for stack '${displaySafe(stackName)}': ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
-		this.logger.debug(`Stack: ${stackName}, Resources: ${Object.keys(template.Resources ?? {}).length}`);
+		this.logger.debug(`Stack: ${displaySafe(stackName)}, Resources: ${Object.keys(template.Resources ?? {}).length}`);
 		let assetManifestPath;
 		if (artifact.dependencies) {
 			for (const depId of artifact.dependencies) if (assetManifestMap.has(depId)) {
 				assetManifestPath = assetManifestMap.get(depId);
-				this.logger.debug(`Found asset manifest for ${stackName}: ${depId}`);
+				this.logger.debug(`Found asset manifest for ${displaySafe(stackName)}: ${displaySafe(depId)}`);
 				break;
 			}
 		}
@@ -3006,7 +3022,7 @@ var AssemblyReader = class {
 				if (depName !== stackName) dependencyNames.push(depName);
 			}
 		}
-		if (dependencyNames.length > 0) this.logger.debug(`Stack '${stackName}' depends on: [${dependencyNames.join(", ")}]`);
+		if (dependencyNames.length > 0) this.logger.debug(`Stack '${displaySafe(stackName)}' depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
 		if (artifact.environment) env = parseEnvironment(artifact.environment);
 		const nestedTemplates = {};
@@ -3014,7 +3030,7 @@ var AssemblyReader = class {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 			const assetPath = resource.Metadata?.["aws:asset:path"];
 			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${stackName}' nested-stack '${logicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+			if (isAbsolute(assetPath) || /^[a-zA-Z]:[\\/]/.test(assetPath) || assetPath.startsWith("\\\\")) throw new SynthesisError(`Stack '${displaySafe(stackName)}' nested-stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 			nestedTemplates[logicalId] = join(assemblyDir, assetPath);
 		}
 		return {
@@ -33547,7 +33563,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CH4oHOxq.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DPTeR_IT.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -47256,4 +47272,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { yellow as $, CrossAccountSecretRefusalError as $i, TemplateParser as $n, validateAssetBucketName as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, __exportAll as Aa, ssmResolvedValueType as Ai, malformedResourcePropertiesWarning as An, hasReasonlessBaselineRefusal as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, canonicalizeRegion as Bi, refuseMalformedResourcesForDestroy as Bn, WorkGraph as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, isThrottlingError as Ca, resolveCaptureObservedState as Ci, malformedExportSourceWarning as Cn, forceQuitRecoveryClause as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, retryClassificationText as Da, resolveUseCdkBootstrapAssets as Di, malformedOutputsWarning as Dn, DEFAULT_STATE_PREFIX as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, markRedactedCause as Ea, resolveStateBucketWithDefaultAndSource as Ei, malformedOutputsRefusalMessage as En, CUSTOM_RESOURCE_RESPONSE_PREFIX as Er, deleteSkipReason as Et, extractDeploymentEventError as F, uploadCfnTemplate as Fi, refuseMalformedNestedChildOutputs as Fn, orphansAfterRollback as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, resolveBucketRegion as Gi, repairMalformedResourcesForReadOnly as Gn, AssetModeResolver as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, AssemblyReader as Hi, repairMalformedOutputsForReadOnly as Hn, createAssetRedirectResolver as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ii, refuseMalformedOutputs as In, orphansCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, resetAwsClients as Ji, findActionableSilentDrops as Jn, ensureAssetStorage as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, AwsClients as Ki, safeRegion as Kn, BOOTSTRAP_MARKER_PREFIX as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, decodeListingKey as Li, refuseMalformedOutputsForDestroy as Ln, shouldRetainResource as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, CFN_TEMPLATE_URL_LIMIT as Mi, malformedStateRefusalMessage as Mn, importableOutputKeys as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MIGRATE_TMP_PREFIX as Ni, producerRecordKey as Nn, importableOutputs as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, describeAwsFailure as Oa, stateBucketExistenceConfirmed as Oi, malformedRenderedContainersWarning as On, exportNamesCarriedFrom as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, findLargeInlineResources as Pi, refuseDivergentRecordRegionForDestroy as Pn, isReadableBag as Pr, getAccountInfo as Pt, red as Q, ConfigError as Qi, DagBuilder as Qn, readBootstrapMarkerBody as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, expectedOwnerParam as Ri, refuseMalformedResourceEntries as Rn, AssetPublisher as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, isRetryableTransientError as Sa, resolveAutoAssetStorage as Si, malformedExportNamesWarning as Sn, buildLockContentionMessage as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, markNonRetryable as Ta, resolveStateBucketWithDefault as Ti, malformedOrphanRecordsWarning as Tn, shellQuote as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, processStackMessages as Ui, repairMalformedResourceEntriesForReadOnly as Un, loadPublishableAssetManifest as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, derivePartitionAndUrlSuffix as Vi, refuseMalformedState as Vn, buildAssetRedirectMap as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, clearBucketRegionCache as Wi, repairMalformedResourcePropertiesForReadOnly as Wn, rewriteTemplateAssetReferences as Wr, assertRegionMatch as Wt, gray as X, AssetError as Xi, describeTypeWithThrottleRetry as Xn, isCrossRegionRedirect as Xr, readConfigString as Xt, cyan as Y, setAwsClients as Yi, findSilentDropProperties as Yn, getBootstrapMarkerKey as Yr, configStringRefusal as Yt, green as Z, CdkdError as Zi, withRetry as Zn, parseBootstrapMarker as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, formatError as _a, Synthesizer as _i, UNREADABLE_RESOURCES_MAP_ROW as _n, LockManager as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, LocalStartServiceError as aa, describeDockerFailure as ai, s3BucketDomainName as an, createSecretMasker as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, withErrorHandling as ba, getLegacyStateBucketName as bi, hasReadableResources as bn, UNREPRODUCIBLE_LOCK_CLAUSE as br, startInterruptWatch as bt, replayFailedOperations as c, NestedStackChildDirectDestroyError as ca, getDockerCmd as ci, s3BucketWebsiteUrl as cn, identityKeyFor as cr, IAMRoleProvider as ct, updatePartialMessage as d, ResourceTimeoutError as da, runDockerForeground as di, applyCallerIdentityCredentials as dn, maskSecretsInError as dr, ProviderRegistry as dt, DependencyError as ea, validateContainerRepoName as ei, requireConfigString as en, STATE_SOURCED_BASELINE_RULES as er, collectDeclaredOutputNames as et, updatePartialReason as f, ResourceUpdateNotSupportedError as fa, runDockerStreaming as fi, callerEnvCredentials as fn, maskSecretsInText as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, SynthesisError as ga, getDockerImageBySourceHash as gi, STATE_RESOURCES_MALFORMED as gn, scrubResourceRecord as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, StateError as ha, AssetManifestLoader as hi, INTRINSIC_KEYS as hn, redactSecretsForState as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, LocalInvokeBuildError as ia, describeDockerExecFailure as ii, s3BucketArn as in, carriesSecretMask as ir, secretBearing as it, isFinalSnapshotError as j, CFN_TEMPLATE_BODY_LIMIT as ji, malformedResourcesWarning as jn, hasUnverifiableParameterRefusal as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, safeStringify$1 as ka, warnDeprecatedNoPrefixCliFlag as ki, malformedResourceEntriesWarning as kn, hasReadableExportSet as kr, IntrinsicFunctionResolver as kt, replayRollback as l, PartialFailureError as la, partitionSensitiveEnv as li, applyRoleArnIfSet as ln, isSingleDynamicReferenceToken as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, StackTerminationProtectionError as ma, stripControlChars as mi, DiffCalculator as mn, recoverMaskedOutput as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DynamicReferenceRegionAmbiguousError as na, buildDockerImage as ni, producerRegionsFromState as nn, STATE_SOURCED_READBACK_RULES as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, LockError as oa, dockerSpawnEnvWithSensitive as oi, s3BucketDualStackDomainName as on, dynamicReferenceTokens as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, StackHasActiveImportsError as pa, escapeRegExp$1 as pi, envCredentialsAreAssumedRole as pn, recordMaskOnlyValue as pr, createMaskedRetryLogger as pt, formatResourceLine as q, getAwsClients as qi, safeStackName as qn, assertAssetBucketRegion as qr, configBooleanRefusal as qt, DeployEngine as r, IntrinsicResolutionRefusalError as ra, describeDockerCapturedOutput as ri, withSharedDrainBudget as rn, TEMPLATE_SOURCED_RULES as rr, isExportAliasCollision as rt, planRollback as s, MalformedProducerRecordRefusalError as sa, formatDockerLoginError as si, s3BucketRegionalDomainName as sn, errorCauseChain as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DeployCancelledError as ta, buildDenyExternalAccessPolicy as ti, classifyReplaySecretRegion as tn, STATE_SOURCED_CROSS_GENERATION_RULES as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, ProvisioningError as ua, redactDockerArgvValues as ui, AWS_CREDENTIAL_ENV_KEYS as un, markSameGenerationBag as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, isCdkdError as va, synthesisStatusMessage as vi, displayLogicalId as vn, S3StateBackend as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, isTransientServerError as wa, resolveSkipPrefix as wi, malformedLocalOutputsWarning as wn, formatLockExpiry as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, isMarkedNonRetryable as xa, resolveApp as xi, isReadableResourceEntry as xn, buildForceUnlockCommand as xr, CloudControlProvider as xt, keptWholeReasonText as y, normalizeAwsError as ya, getDefaultStateBucketName as yi, hasReadableOutputs as yn, rebuildClientForBucketRegion as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, PARTITION_TABLE as zi, refuseMalformedResourcePropertiesForOrphan as zn, stringifyValue as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-Vze2lc-H.js.map
+//# sourceMappingURL=deploy-engine-DJxLBuTb.js.map