@go-to-k/cdkd 0.221.9 → 0.221.10

package/dist/{deploy-engine-alFrHerE.js → deploy-engine-U63EpLKn.js}

@@ -6609,6 +6609,13 @@ var IntrinsicFunctionResolver = class {
 	* SECRET_ID can be a simple name or an ARN (arn:aws:secretsmanager:REGION:ACCOUNT:secret:NAME)
 	* which contains colons, so we cannot simply split on ':'.
 	* Instead, we find ':SecretString:' or ':SecretBinary:' as the delimiter.
+	*
+	* The whole-secret form omits everything after the type segment and carries no trailing
+	* colon: "secretsmanager:SECRET_ID:SecretString" (returns the full secret string). We detect
+	* it with an end-anchored check so that, for the whole-secret form, a SECRET_ID that merely
+	* contains ":SecretString" mid-name is not split incorrectly. (The end-anchored fallback only
+	* runs when no mid-string ":SecretString:" delimiter is present, so the json-key / version
+	* forms are unaffected.)
 	*/
 	async resolveSecretsManagerReference(inner) {
 		const afterService = inner.substring(15);
@@ -6616,10 +6623,20 @@ var IntrinsicFunctionResolver = class {
 		let jsonKey = "";
 		let versionStage = "";
 		let versionId = "";
-		const secretStringIdx = afterService.indexOf(":SecretString:");
-		const secretBinaryIdx = afterService.indexOf(":SecretBinary:");
+		let secretStringIdx = afterService.indexOf(":SecretString:");
+		let secretBinaryIdx = afterService.indexOf(":SecretBinary:");
+		let delimiterLenAtBinary = 14;
+		let delimiterLenAtString = 14;
+		if (secretStringIdx < 0 && afterService.endsWith(":SecretString")) {
+			secretStringIdx = afterService.length - 13;
+			delimiterLenAtString = 13;
+		}
+		if (secretBinaryIdx < 0 && afterService.endsWith(":SecretBinary")) {
+			secretBinaryIdx = afterService.length - 13;
+			delimiterLenAtBinary = 13;
+		}
 		const delimiterIdx = secretStringIdx >= 0 && secretBinaryIdx >= 0 ? Math.min(secretStringIdx, secretBinaryIdx) : secretStringIdx >= 0 ? secretStringIdx : secretBinaryIdx;
-		const delimiterLen = delimiterIdx >= 0 && delimiterIdx === secretBinaryIdx ? 14 : 14;
+		const delimiterLen = delimiterIdx >= 0 && delimiterIdx === secretBinaryIdx ? delimiterLenAtBinary : delimiterLenAtString;
 		if (delimiterIdx >= 0) {
 			secretId = afterService.substring(0, delimiterIdx);
 			const remainingParts = afterService.substring(delimiterIdx + delimiterLen).split(":");
@@ -13078,4 +13095,4 @@ var DeployEngine = class {
 
 //#endregion
 export { AssemblyReader as $, shouldRetainResource as A, getDefaultStateBucketName as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, formatDockerLoginError as F, resolveStateBucketWithDefault as G, resolveApp as H, getDockerCmd as I, CFN_TEMPLATE_BODY_LIMIT as J, resolveStateBucketWithDefaultAndSource as K, runDockerForeground as L, stringifyValue as M, WorkGraph as N, S3StateBackend as O, buildDockerImage as P, uploadCfnTemplate as Q, runDockerStreaming as R, IntrinsicFunctionResolver as S, DagBuilder as T, resolveCaptureObservedState as U, getLegacyStateBucketName as V, resolveSkipPrefix as W, MIGRATE_TMP_PREFIX as X, CFN_TEMPLATE_URL_LIMIT as Y, findLargeInlineResources as Z, IAMRoleProvider as _, withRetry as a, findActionableSilentDrops as b, computeImplicitDeleteEdges as c, bold as d, clearBucketRegionCache as et, cyan as f, yellow as g, red as h, withResourceDeadline as i, AssetPublisher as j, rebuildClientForBucketRegion as k, extractDeploymentEventError as l, green as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, gray as p, warnDeprecatedNoPrefixCliFlag as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveBucketRegion as tt, formatResourceLine as u, collectInlinePolicyNamesManagedBySiblings as v, DiffCalculator as w, CloudControlProvider as x, ProviderRegistry as y, Synthesizer as z };
-//# sourceMappingURL=deploy-engine-alFrHerE.js.map
+//# sourceMappingURL=deploy-engine-U63EpLKn.js.map