@go-to-k/cdkd 0.283.20 → 0.283.21

package/dist/{deploy-engine-ISOKkuun.js → deploy-engine-ISSt01TI.js}

@@ -11494,6 +11494,29 @@ const cachedAvailabilityZones = {};
 */
 const cachedDynamicReferences = {};
 /**
+* The `{{resolve:ssm:...}}` expressions this process has PROVEN point at a
+* `SecureString` parameter (issue #1901).
+*
+* A plain `ssm` reference is not a secret by SPELLING the way `secretsmanager`
+* is — whether it resolves to public config or to a decrypted secret depends on
+* the parameter's `Type`, which is only knowable from the `GetParameter`
+* response. So secret-ness is discovered on the first resolution and remembered
+* here, keyed by the full `{{resolve:...}}` expression, for the same lifetime as
+* {@link cachedDynamicReferences}.
+*
+* Two consumers need it AFTER the lookup that populated it: the cache-hit arm
+* (which must re-record the value as a secret for the current resolution pass)
+* and the diff / no-op path (which must leave a SecureString reference
+* unresolved without paying a lookup at all once the type is known). A
+* reference NOT in this set is only "not known to be secure" — never "proven
+* public" — so every arm that would leak still asks AWS for the type first.
+*
+* Only the TYPE is remembered, never the decrypted value: on the diff path the
+* lookup is made with `WithDecryption: false`, so the plaintext is never
+* fetched at all there.
+*/
+const secureStringSsmReferences = /* @__PURE__ */ new Set();
+/**
 * Cache for EC2 instance attributes that require a live DescribeInstances
 * lookup (PrivateIp / PublicIp / PrivateDnsName / PublicDnsName /
 * AvailabilityZone). Keyed by `${physicalId}#${attributeName}`. The IP /
@@ -13304,25 +13327,35 @@ var IntrinsicFunctionResolver = class {
 		});
 		for (const { fullMatch, inner } of matches) {
 			const service = inner.split(":")[0];
-			const isSecret = service === "secretsmanager";
-			if (isSecret && context?.skipDynamicReferences) continue;
+			const isKnownSecret = service === "secretsmanager" || secureStringSsmReferences.has(fullMatch);
+			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			if (fullMatch in cachedDynamicReferences) {
 				const cached = cachedDynamicReferences[fullMatch];
-				if (isSecret && cached) context?.recordedSecretValues?.set(cached, fullMatch);
-				result = result.replace(fullMatch, cached);
+				if (isKnownSecret && cached) context?.recordedSecretValues?.set(cached, fullMatch);
+				result = result.replace(fullMatch, () => cached);
 				continue;
 			}
 			const parts = inner.split(":");
 			let resolved;
+			let isSecret = isKnownSecret;
 			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner);
-			else if (service === "ssm") resolved = await this.resolveSSMReference(parts);
-			else {
+			else if (service === "ssm") {
+				const decrypt = context?.skipDynamicReferences !== true;
+				const param = await this.resolveSSMReference(parts, decrypt);
+				if (param.type === "SecureString") secureStringSsmReferences.add(fullMatch);
+				else if (!param.secure) secureStringSsmReferences.delete(fullMatch);
+				isSecret = param.secure;
+				if (param.secure) {
+					if (!decrypt) continue;
+				}
+				resolved = param.value;
+			} else {
 				this.logger.warn(`Unsupported dynamic reference service: ${service}`);
 				continue;
 			}
 			cachedDynamicReferences[fullMatch] = resolved;
 			if (isSecret && resolved) context?.recordedSecretValues?.set(resolved, fullMatch);
-			result = result.replace(fullMatch, resolved);
+			result = result.replace(fullMatch, () => resolved);
 		}
 		return result;
 	}
@@ -13475,18 +13508,44 @@ var IntrinsicFunctionResolver = class {
 		for (let i = 7; i >= 0; i--) parts.push((n >> BigInt(i * 16) & BigInt(65535)).toString(16));
 		return parts.join(":");
 	}
-	async resolveSSMReference(parts) {
+	/**
+	* Resolve an `{{resolve:ssm:...}}` dynamic reference, reporting whether the
+	* parameter is a `SecureString` (issue #1901).
+	*
+	* `secure` is read off the SAME `GetParameter` response that carries the
+	* value, so classifying a reference costs no extra API call — which is what
+	* makes it affordable on the comparison path too.
+	*
+	* `decrypt` maps straight to `WithDecryption`. SSM ignores it for `String` /
+	* `StringList` (their `Value` is identical either way), so the only thing it
+	* changes is whether a `SecureString`'s `Value` comes back as plaintext or as
+	* its encrypted blob. Callers that only need the TYPE pass `false` and MUST
+	* discard the value when `secure` is set — it is ciphertext, not the resolved
+	* reference.
+	*/
+	async resolveSSMReference(parts, decrypt = true) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error("Dynamic reference: ssm PARAMETER_NAME is required");
 		this.logger.debug(`Resolving dynamic reference: ssm:${parameterName}`);
 		const client = getAwsClients().ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
-			WithDecryption: true
+			WithDecryption: decrypt
 		});
-		const paramValue = (await client.send(command)).Parameter?.Value;
+		const response = await client.send(command);
+		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
-		return paramValue;
+		const paramType = response.Parameter?.Type;
+		const secure = paramType !== "String" && paramType !== "StringList";
+		if (secure && paramType !== "SecureString") {
+			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
+			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:ssm:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
+		}
+		return {
+			value: paramValue,
+			secure,
+			type: paramType
+		};
 	}
 };
 
@@ -14321,7 +14380,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-k-TEX_Ej.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DKjoomrX.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -20892,9 +20951,13 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 * resolve-for-provider + redact-for-state split the deploy engine applies at its
 * save choke point. A bag with no `{{resolve:...}}` string resolves to a
 * structural copy of itself (secrets stays empty), so the non-secret rollback
-* path is behaviourally unchanged. Only secretsmanager references are recorded
-* (plain `ssm` is public config, stored resolved — it never appears as an
-* expression in the journal), matching the resolver's own `isSecret` gate.
+* path is behaviourally unchanged. Which references are RECORDED is the
+* resolver's own secret gate: every `secretsmanager` one, plus an `ssm` one
+* whose parameter is a `SecureString` (issue #1901 — that form decrypts to a
+* real secret, so it is redacted into the journal and must be re-resolved here
+* exactly like a secretsmanager reference). An ssm reference to a `String` /
+* `StringList` parameter is public config, stored resolved, and never appears
+* as an expression in the journal.
 */
 async function resolveReplayProps(props, resolver, secrets) {
 	if (props === void 0) return void 0;
@@ -21490,7 +21553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.20";
+	return "0.283.21";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -23825,4 +23888,4 @@ var DeployEngine = class {
 
 //#endregion
 export { coerceCfnBoolean as $, resolveCaptureObservedState as $t, cyan as A, LocalStartServiceError as An, rewriteTemplateAssetReferences as At, findSilentDropProperties as B, StateError as Bn, buildDockerImage as Bt, makeCanonicalizePropertiesFn as C, AssetError as Cn, shouldRetainResource as Ct, renderStatefulReason as D, DeployCancelledError as Dn, buildAssetRedirectMap as Dt, isStatefulRecreateTargetSync as E, DependencyError as En, WorkGraph as Et, IAMRoleProvider as F, ProvisioningError as Fn, getBootstrapMarkerKey as Ft, IntrinsicFunctionResolver as G, withErrorHandling as Gn, AssetManifestLoader as Gt, slowCcOperationTimeoutMs as H, formatError as Hn, getDockerCmd as Ht, collectInlinePolicyNamesManagedBySiblings as I, ResourceTimeoutError as In, parseBootstrapMarker as It, refStateLookupFromResource as J, isThrottlingError as Jn, synthesisStatusMessage as Jt, cfnRefValueFromPhysicalId as K, isMarkedNonRetryable as Kn, getDockerImageBySourceHash as Kt, clearOnUpdateRemoval as L, ResourceUpdateNotSupportedError as Ln, validateAssetBucketName as Lt, green as M, MissingCdkCliError as Mn, AssetModeResolver as Mt, red as N, NestedStackChildDirectDestroyError as Nn, BOOTSTRAP_MARKER_PREFIX as Nt, formatResourceLine as O, LocalInvokeBuildError as On, createAssetRedirectResolver as Ot, yellow as P, PartialFailureError as Pn, ensureAssetStorage as Pt, assertRegionMatch as Q, resolveAutoAssetStorage as Qt, ProviderRegistry as R, StackHasActiveImportsError as Rn, validateContainerRepoName as Rt, unsupportedFinalSnapshotError as S, setAwsClients as Sn, rebuildClientForBucketRegion as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, ConfigError as Tn, stringifyValue as Tt, disableInstanceApiTermination as U, isCdkdError as Un, runDockerForeground as Ut, CloudControlProvider as V, SynthesisError as Vn, formatDockerLoginError as Vt, isTerminationProtectionPropagationError as W, normalizeAwsError as Wn, runDockerStreaming as Wt, normalizeAwsTagsToCfn as X, __exportAll as Xn, getLegacyStateBucketName as Xt, WAFv2WebACLProvider as Y, markNonRetryable as Yn, getDefaultStateBucketName as Yt, resolveExplicitPhysicalId as Z, resolveApp as Zt, buildFinalSnapshotIdentifier as _, clearBucketRegionCache as _n, withRetry as _t, DeploymentEventsStore as a, warnDeprecatedNoPrefixCliFlag as an, requireConfigObject as at, isFinalSnapshotError as b, getAwsClients as bn, LockManager as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as cn, scrubResourceRecord as ct, deleteSkipReason as d, expectedOwnerParam as dn, s3BucketDualStackDomainName as dt, resolveSkipPrefix as en, configBooleanRefusal as et, withResourceDeadline as f, PARTITION_TABLE as fn, s3BucketRegionalDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, processStackMessages as gn, describeTypeWithThrottleRetry as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, AssemblyReader as hn, DiffCalculator as ht, DeploymentEventsReader as i, stateBucketExistenceConfirmed as in, requireConfigArray as it, gray as j, LockError as jn, escapeRegExp$1 as jt, bold as k, LocalMigrateError as kn, loadPublishableAssetManifest as kt, replayRollback as l, findLargeInlineResources as ln, s3BucketArn as lt, computeImplicitDeleteEdges as m, derivePartitionAndUrlSuffix as mn, applyRoleArnIfSet as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveStateBucketWithDefaultAndSource as nn, readConfigString as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, canonicalizeRegion as pn, s3BucketWebsiteUrl as pt, getAccountInfo as q, isRetryableTransientError as qn, Synthesizer as qt, DeployEngine as r, resolveUseCdkBootstrapAssets as rn, replayWarn as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sn, redactSecretsForState as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefault as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, uploadCfnTemplate as un, s3BucketDomainName as ut, ccRoutedFinalSnapshotError as v, resolveBucketRegion as vn, DagBuilder as vt, extractDeploymentEventError as w, CdkdError as wn, AssetPublisher as wt, refusesFinalSnapshot as x, resetAwsClients as xn, S3StateBackend as xt, createPreDeleteFinalSnapshot as y, AwsClients as yn, TemplateParser as yt, findActionableSilentDrops as z, StackTerminationProtectionError as zn, buildDenyExternalAccessPolicy as zt };
-//# sourceMappingURL=deploy-engine-ISOKkuun.js.map
+//# sourceMappingURL=deploy-engine-ISSt01TI.js.map