@aws-blocks/bb-app-setting 0.2.1 → 0.3.0

package/dist/index.aws.d.ts

@@ -4,6 +4,7 @@ import type { AppSettingOptions } from './types.js';
 import type { ChildLogger } from '@aws-blocks/bb-logger';
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 /**
  * A single application configuration value backed by SSM Parameter Store.
  *

package/dist/index.aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.aws.d.ts","sourceRoot":"","sources":["../src/index.aws.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAA6C,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAG/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAqBpD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;OAMG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,QAAQ,CAAC,MAAM,gBAAW;IAC1B,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAC1B,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAY;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAczE;;;;;;;;;;;;;OAaG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IA2BvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}
+{"version":3,"file":"index.aws.d.ts","sourceRoot":"","sources":["../src/index.aws.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAA6C,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAG/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAqB9D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;OAMG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,QAAQ,CAAC,MAAM,gBAAW;IAC1B,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAC1B,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAY;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAczE;;;;;;;;;;;;;OAaG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IA2BvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/index.aws.js

@@ -7,6 +7,7 @@ import { BB_NAME, BB_VERSION } from './version.js';
 import { Logger } from '@aws-blocks/bb-logger';
 // Re-export public types from types module (canonical source)
 export { AppSettingErrors } from './errors.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 // ── Helpers ─────────────────────────────────────────────────────────────────
 function blocksError(name, message) {
     const err = new Error(`${name}: ${message}`);

package/dist/index.browser.d.ts

@@ -1,3 +1,4 @@
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 export declare class AppSetting {
     static fromExisting(...args: any[]): any;
     constructor(...args: any[]);

package/dist/index.browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAIA,qBAAa,UAAU;IACtB,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG;gBAG5B,GAAG,IAAI,EAAE,GAAG,EAAE;CAC1B"}
+{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,qBAAa,UAAU;IACtB,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG;gBAG5B,GAAG,IAAI,EAAE,GAAG,EAAE;CAC1B"}

package/dist/index.browser.js

@@ -1,6 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 // Browser stub - AppSetting runs server-side only
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 export class AppSetting {
     static fromExisting(...args) {
         return new AppSetting();

package/dist/index.cdk.d.ts

@@ -1,8 +1,9 @@
-import { Scope } from '@aws-blocks/core/cdk';
+import { BuildingBlockScope } from '@aws-blocks/core/cdk';
 import type { ScopeParent } from '@aws-blocks/core';
 import type { AppSettingOptions } from './types.js';
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 /**
  * CDK construct for AppSetting. Creates a single SSM parameter (String or
  * SecureString) and grants the shared Lambda handler read/write permissions.
@@ -14,7 +15,7 @@ export type { AppSettingOptions } from './types.js';
  *   or with a customer-managed key when `kmsKeyArn` is provided (the handler is
  *   then granted `kms:Decrypt`/`Encrypt` on that specific key ARN).
  */
-export declare class AppSetting<T = string> extends Scope {
+export declare class AppSetting<T = string> extends BuildingBlockScope {
     /**
      * Reference an SSM parameter that is created and owned **outside this stack**
      * (e.g. a connection string seeded by `ensureSecrets` before deploy). The

package/dist/index.cdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,EAAwC,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;gBAKJ,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAyJzE"}
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,kBAAkB,EAAwC,MAAM,sBAAsB,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAI9D;;;;;;;;;;GAUG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,kBAAkB;IAC7D;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;gBAKJ,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAyJzE"}

package/dist/index.cdk.js

@@ -6,9 +6,12 @@ import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
 import * as cr from 'aws-cdk-lib/custom-resources';
-import { Scope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import { BuildingBlockScope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
 import { AppSettingErrors } from './errors.js';
 export { AppSettingErrors } from './errors.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
+import { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 /**
  * CDK construct for AppSetting. Creates a single SSM parameter (String or
  * SecureString) and grants the shared Lambda handler read/write permissions.
@@ -20,7 +23,7 @@ export { AppSettingErrors } from './errors.js';
  *   or with a customer-managed key when `kmsKeyArn` is provided (the handler is
  *   then granted `kms:Decrypt`/`Encrypt` on that specific key ARN).
  */
-export class AppSetting extends Scope {
+export class AppSetting extends BuildingBlockScope {
     /**
      * Reference an SSM parameter that is created and owned **outside this stack**
      * (e.g. a connection string seeded by `ensureSecrets` before deploy). The
@@ -39,7 +42,7 @@ export class AppSetting extends Scope {
         return new AppSetting(scope, id, opts);
     }
     constructor(scope, id, options) {
-        super(id, { parent: scope });
+        super(id, { parent: scope, vpc: { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SSM] } });
         // `external` is package-internal (set only by fromExisting), not on the
         // public AppSettingOptions — read it via the internal options type.
         const external = options.external ?? false;
@@ -287,7 +290,7 @@ function registerSecret(stack, parameterName, logRetention, keyId) {
     const provider = new cr.Provider(stack, 'BlocksSecretProvider', {
         onEventHandler: secretInitFn,
     });
-    new cdk.CustomResource(stack, 'BlocksSecretsBulk', {
+    new cdk.CustomResource(stack, SECRETS_BULK_CONSTRUCT_ID, {
         serviceToken: provider.serviceToken,
         properties: {
             Parameters: cdk.Lazy.any({ produce: () => state.params }),

package/dist/index.mock.d.ts

@@ -4,6 +4,7 @@ import type { AppSettingOptions } from './types.js';
 import type { ChildLogger } from '@aws-blocks/bb-logger';
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 /**
  * A single application configuration value backed by SSM Parameter Store.
  *

package/dist/index.mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsCpD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAyBzE;;;;;;;;;;;OAWG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IAWvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}
+{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAsC9D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAyBzE;;;;;;;;;;;OAWG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IAWvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/index.mock.js

@@ -10,6 +10,7 @@ import { Logger } from '@aws-blocks/bb-logger';
 import { BB_NAME, BB_VERSION } from './version.js';
 // Re-export public types
 export { AppSettingErrors } from './errors.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 // ── Helpers ─────────────────────────────────────────────────────────────────
 const MAX_VALUE_BYTES = 4096; // SSM standard-tier 4 KB limit
 function readSettings(scope) {

package/dist/secrets-bulk.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Construct id of the shared, per-stack custom resource that writes every
+ * `secret: true` `AppSetting`'s SecureString value at deploy time (created
+ * lazily by the first secret AppSetting; a direct child of the stack).
+ *
+ * Exported so sibling blocks that must order a resource *after* the secret
+ * values are written — e.g. `bb-auth-oidc`'s IdP-registration custom resource —
+ * can locate it via `Stack.of(x).node.tryFindChild(SECRETS_BULK_CONSTRUCT_ID)`
+ * without hard-coding the string. This is the single source of truth for the id:
+ * the CDK layer creates the construct with it, so a rename here moves both the
+ * producer and every consumer together and the cross-package coupling can't
+ * drift silently.
+ */
+export declare const SECRETS_BULK_CONSTRUCT_ID = "BlocksSecretsBulk";
+//# sourceMappingURL=secrets-bulk.d.ts.map

package/dist/secrets-bulk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-bulk.d.ts","sourceRoot":"","sources":["../src/secrets-bulk.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,sBAAsB,CAAC"}

package/dist/secrets-bulk.js

@@ -0,0 +1,16 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Construct id of the shared, per-stack custom resource that writes every
+ * `secret: true` `AppSetting`'s SecureString value at deploy time (created
+ * lazily by the first secret AppSetting; a direct child of the stack).
+ *
+ * Exported so sibling blocks that must order a resource *after* the secret
+ * values are written — e.g. `bb-auth-oidc`'s IdP-registration custom resource —
+ * can locate it via `Stack.of(x).node.tryFindChild(SECRETS_BULK_CONSTRUCT_ID)`
+ * without hard-coding the string. This is the single source of truth for the id:
+ * the CDK layer creates the construct with it, so a rename here moves both the
+ * producer and every consumer together and the cross-package coupling can't
+ * drift silently.
+ */
+export const SECRETS_BULK_CONSTRUCT_ID = 'BlocksSecretsBulk';

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const BB_NAME = "AppSetting";
-export declare const BB_VERSION = "0.2.1";
+export declare const BB_VERSION = "0.3.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'AppSetting';
-export const BB_VERSION = '0.2.1';
+export const BB_VERSION = '0.3.0';

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "@aws-blocks/bb-app-setting",
-  "version": "0.2.1",
+  "version": "0.3.0",
+  "keywords": [
+    "aws-blocks",
+    "configuration",
+    "ssm",
+    "parameter-store",
+    "secrets"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
@@ -39,8 +46,8 @@
     "test": "node --test --test-concurrency=1 dist/**/*.test.js"
   },
   "dependencies": {
-    "@aws-blocks/core": "^0.4.0",
-    "@aws-blocks/bb-logger": "^0.1.6",
+    "@aws-blocks/core": "^0.5.0",
+    "@aws-blocks/bb-logger": "^0.2.0",
     "@aws-sdk/client-ssm": "^3.0.0",
     "@standard-schema/spec": "^1.1.0"
   },

package/src/index.aws.ts

@@ -18,6 +18,7 @@ import type { ChildLogger } from '@aws-blocks/bb-logger';
 // Re-export public types from types module (canonical source)
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 

package/src/index.browser.ts

@@ -2,6 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Browser stub - AppSetting runs server-side only
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
+
 export class AppSetting {
 	static fromExisting(...args: any[]): any {
 		return new AppSetting();

package/src/index.cdk.ts

@@ -7,13 +7,17 @@ import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 import { LogGroup, type RetentionDays } from 'aws-cdk-lib/aws-logs';
 import * as cr from 'aws-cdk-lib/custom-resources';
-import { Scope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import { BuildingBlockScope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
 import type { ScopeParent } from '@aws-blocks/core';
 import { AppSettingErrors } from './errors.js';
 import type { AppSettingOptions, InternalAppSettingOptions } from './types.js';
 
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
+
+import { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 
 /**
  * CDK construct for AppSetting. Creates a single SSM parameter (String or
@@ -26,7 +30,7 @@ export type { AppSettingOptions } from './types.js';
  *   or with a customer-managed key when `kmsKeyArn` is provided (the handler is
  *   then granted `kms:Decrypt`/`Encrypt` on that specific key ARN).
  */
-export class AppSetting<T = string> extends Scope {
+export class AppSetting<T = string> extends BuildingBlockScope {
 	/**
 	 * Reference an SSM parameter that is created and owned **outside this stack**
 	 * (e.g. a connection string seeded by `ensureSecrets` before deploy). The
@@ -50,7 +54,7 @@ export class AppSetting<T = string> extends Scope {
 	}
 
 	constructor(scope: ScopeParent, id: string, options: AppSettingOptions<T>) {
-		super(id, { parent: scope });
+		super(id, { parent: scope, vpc: { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SSM] } });
 
 		// `external` is package-internal (set only by fromExisting), not on the
 		// public AppSettingOptions — read it via the internal options type.
@@ -347,7 +351,7 @@ function registerSecret(stack: cdk.Stack, parameterName: string, logRetention: R
 		onEventHandler: secretInitFn,
 	});
 
-	new cdk.CustomResource(stack, 'BlocksSecretsBulk', {
+	new cdk.CustomResource(stack, SECRETS_BULK_CONSTRUCT_ID, {
 		serviceToken: provider.serviceToken,
 		properties: {
 			Parameters: cdk.Lazy.any({ produce: () => state!.params }),

package/src/index.mock.ts

@@ -17,6 +17,7 @@ import { BB_NAME, BB_VERSION } from './version.js';
 // Re-export public types
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 

package/src/secrets-bulk.ts

@@ -0,0 +1,17 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Construct id of the shared, per-stack custom resource that writes every
+ * `secret: true` `AppSetting`'s SecureString value at deploy time (created
+ * lazily by the first secret AppSetting; a direct child of the stack).
+ *
+ * Exported so sibling blocks that must order a resource *after* the secret
+ * values are written — e.g. `bb-auth-oidc`'s IdP-registration custom resource —
+ * can locate it via `Stack.of(x).node.tryFindChild(SECRETS_BULK_CONSTRUCT_ID)`
+ * without hard-coding the string. This is the single source of truth for the id:
+ * the CDK layer creates the construct with it, so a rename here moves both the
+ * producer and every consumer together and the cross-package coupling can't
+ * drift silently.
+ */
+export const SECRETS_BULK_CONSTRUCT_ID = 'BlocksSecretsBulk';

package/src/version.ts

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'AppSetting';
-export const BB_VERSION = '0.2.1';
+export const BB_VERSION = '0.3.0';