@go-to-k/cdkd 0.285.13 → 0.285.14

package/dist/{deploy-engine-DhMm2M33.js → deploy-engine-CA50haPO.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-FLW4rE5A.js";
+import { t as getCdkdVersion } from "./version-DP5kGlzj.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9608,6 +9608,99 @@ var LockManager = class {
 /** Fixed marker substituted for a secret value in log / error output. */
 const SECRET_MASK = "***";
 /**
+* The UNCOLLAPSED companion of a {@link RecordedSecretValues} map: for each map
+* instance, every `expression -> plaintext` pair the resolver recorded INTO IT,
+* keyed by EXPRESSION (issue [#2485](https://github.com/go-to-k/cdkd/issues/2485)).
+*
+* WHY IT EXISTS. The map is keyed by PLAINTEXT, so two expressions resolving to
+* one value keep ONE entry — whichever the resolver recorded last. A WHOLE-token
+* leaf is immune (the position pass copies its own source), but a leaf that
+* EMBEDS a token in a literal string is redacted by the value scan, which can
+* only write the map's surviving expression: the versioned sibling's, for a
+* template that spells the un-versioned one, and the next deploy diffs that
+* leaf forever. Recovering the losing expression needs evidence the map has
+* discarded, and it has to be PASS-LOCAL: `recordedSecretExpressions` is
+* process-wide and says only that an expression IS secret, never what it
+* resolved to in THIS resource — so it cannot tell "the source token lost the
+* map slot to its sibling" from "the source token was never resolved here"
+* (a previous generation's bag, where writing today's expression over the
+* framed value would record something that was never deployed).
+*
+* Keyed by the map INSTANCE, so the evidence is exactly as pass-local as the
+* map itself: a map the resolver populated (the deploy's `perResourceSecrets`
+* entry, and equally the map drift / scrub / import hand their own resolution)
+* carries the pairs of THAT resolution, while a map the resolver did not
+* populate — a derived needle map, a nested-stack inheritance copy, a
+* `new Map(secrets)` copy — starts with no entries here and takes the
+* pre-#2485 fall-through, the safe direction. A copy loses the evidence
+* deliberately: a copy is not the pass that resolved anything.
+*
+* `CONFLICTING_PLAINTEXT` marks an expression this map saw resolve to TWO
+* values (a region-pinned re-resolution of one spelling, say); it then vouches
+* for nothing, which is the same "answer nothing you cannot prove" rule
+* {@link plaintextIndexOf} applies to the collapsed map's reverse index.
+*/
+const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
+/**
+* Record that `expression` resolved to `plaintext` in the pass that owns
+* `secrets` — the resolver's recording seam calls this beside its
+* `secrets.set(plaintext, expression)`, so the two never disagree about which
+* pass the evidence belongs to. Mask-only map entries (value `SECRET_MASK`)
+* never pass through that seam — they came from no `{{resolve:...}}` token —
+* so nothing here special-cases the mask string: a secret whose plaintext
+* happens to BE `***` is a secret like any other.
+*/
+function recordResolvedPair(secrets, expression, plaintext) {
+	let pairs = resolvedPairsOf.get(secrets);
+	if (pairs === void 0) {
+		pairs = /* @__PURE__ */ new Map();
+		resolvedPairsOf.set(secrets, pairs);
+	}
+	const previous = pairs.get(expression);
+	if (previous === void 0) pairs.set(expression, plaintext);
+	else if (previous !== plaintext) pairs.set(expression, CONFLICTING_PLAINTEXT);
+}
+/**
+* Carry the resolved pairs of `from` into `to`, for the one copy of a
+* resolver-populated map that POSITIONS anything: the deploy engine accumulates
+* each stack's output resolution into its `outputSecrets` bag entry by entry,
+* and without this the copy would keep the collapsed entries while dropping the
+* evidence — so a literal `Output` embedding one of two same-plaintext
+* references would fall back to the value scan and persist the sibling's
+* expression. The engine's other entry-by-entry copy — an `Export.Name`'s
+* secrets into the pass map — deliberately does NOT call this: a name never
+* positions a leaf, a value re-using the same token records its own pair at
+* the seam, and the only thing the merge could add is a CONFLICT (a
+* non-cacheable `{{resolve:ssm:X}}` whose value moved between the value pass
+* and the name's resolution), which would destroy positioning the value pass
+* had earned. A pair that conflicts across the two maps is marked conflicting
+* in `to`, the same rule {@link recordResolvedPair} applies within one map.
+*
+* Deliberately NOT a general "copy the map" helper: every other new map is a
+* different PASS, and starting it without evidence is the safe direction.
+*/
+function mergeResolvedPairs(from, to) {
+	const pairs = resolvedPairsOf.get(from);
+	if (pairs === void 0) return;
+	for (const [expression, plaintext] of pairs) if (typeof plaintext === "string") recordResolvedPair(to, expression, plaintext);
+	else {
+		let target = resolvedPairsOf.get(to);
+		if (target === void 0) {
+			target = /* @__PURE__ */ new Map();
+			resolvedPairsOf.set(to, target);
+		}
+		target.set(expression, CONFLICTING_PLAINTEXT);
+	}
+}
+/**
+* The plaintext `expression` resolved to in the pass that owns `secrets`, or
+* `undefined` when that pass recorded nothing for it (or two different values).
+*/
+function resolvedPlaintextOf(secrets, expression) {
+	const recorded = resolvedPairsOf.get(secrets)?.get(expression);
+	return typeof recorded === "string" ? recorded : void 0;
+}
+/**
 * Every `{{resolve:...}}` expression this process has PROVEN resolves to a
 * secret, as a SET — uncollapsed by resolved value (issue #1910).
 *
@@ -10618,8 +10711,9 @@ function isKnownSecretExpression(expression, secretExpressions) {
 	return isSecretExpressionByVerdictOrSpelling(expression) || secretExpressions.has(expression);
 }
 /**
-* The two arms of {@link isKnownSecretExpression} that need NO pass-local set:
-* `secretsmanager` by SPELLING, and anything this process PROVED secret.
+* The arms of {@link isKnownSecretExpression} that need NO pass-local set:
+* `secretsmanager` / `ssm-secure` by SPELLING, and anything this process
+* PROVED secret.
 *
 * Split out so the resolver can ask the same question at the issue #2059
 * recording seam, where no `secretExpressions` set is in hand. It must not
@@ -10644,7 +10738,7 @@ function isKnownSecretExpression(expression, secretExpressions) {
 * change to a store this function only reads.
 */
 function isSecretExpressionByVerdictOrSpelling(expression) {
-	return expression.startsWith("{{resolve:secretsmanager:") || isRecordedSecretExpression(expression);
+	return expression.startsWith("{{resolve:secretsmanager:") || expression.startsWith("{{resolve:ssm-secure:") || isRecordedSecretExpression(expression);
 }
 /**
 * The character class a `{{resolve:...}}` reference's INNER text is built from,
@@ -11188,6 +11282,124 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	return matched;
 }
 /**
+* The ONE-span frame shared by {@link positionByEmbeddedSpan} and
+* {@link learnMixedLeafNeedle}: a source holding exactly one `{{resolve:...}}`
+* token, and a bag that starts with the source's prefix and ends with its
+* suffix with something non-empty between them that is NOT itself a complete
+* token (an already-redacted record is a persisted answer, not a plaintext).
+* `undefined` for any other shape. One helper rather than two copies so the
+* two refusals cannot drift apart.
+*/
+function singleSpanFrame(bag, source) {
+	const spans = dynamicReferenceSpans(source);
+	if (spans.length !== 1) return void 0;
+	const [span] = spans;
+	const token = source.slice(span.start, span.end);
+	const prefix = source.slice(0, span.start);
+	const suffix = source.slice(span.end);
+	if (bag.length <= prefix.length + suffix.length) return void 0;
+	if (!bag.startsWith(prefix) || !bag.endsWith(suffix)) return void 0;
+	const middle = bag.slice(prefix.length, bag.length - suffix.length);
+	if (isSingleDynamicReferenceToken(middle)) return void 0;
+	return {
+		token,
+		prefix,
+		suffix,
+		middle
+	};
+}
+/**
+* Position a literal source leaf that EMBEDS exactly one `{{resolve:...}}`
+* token — `postgres://app-svc:{{resolve:ssm-secure:NAME}}@db/app` — by the
+* span the source states, writing `prefix + token + suffix` (issue
+* [#2485](https://github.com/go-to-k/cdkd/issues/2485)).
+*
+* WHY THE VALUE SCAN IS NOT ENOUGH HERE. The scan writes the map's surviving
+* expression for a plaintext, and the map keeps one expression per plaintext:
+* a whole-value `NAME:1` sibling that resolved LAST leaves `NAME:1` as the only
+* expression for the value, so the embedded leaf persists the versioned
+* spelling for a template that spells `NAME`, and the deploy diff — expression
+* against expression — reports that leaf on every run. The whole-token arm of
+* {@link redactByPath} is immune because it copies its own source; this arm
+* gives the one-span literal leaf the same immunity.
+*
+* THE EVIDENCE, and why the shape of the frame is not enough on its own: the
+* frame check (`bag` starts with the source's prefix and ends with its suffix,
+* with something between) is what {@link learnMixedLeafNeedle} already uses to
+* LEARN a needle, and it proves only that the bag has the source's shape. The
+* bag can also be a PREVIOUS generation's (`cdkd scrub`, a state-sourced walk)
+* with an earlier plaintext framed exactly like this, and writing today's
+* token over it would record an expression that was never deployed at that
+* position — the hazard `sourceIsSameGeneration` exists for on the whole-token
+* arm. So the middle must EQUAL what THIS pass recorded the source token
+* resolving to ({@link recordResolvedPair}, per map instance): that is evidence
+* of this resolution, not of shape, and it is absent by construction for every
+* bag this pass did not produce. It is also what keeps a PUBLIC `ssm` token
+* resolved (issue #1901) — the resolver records only secret verdicts — and what
+* keeps a mask-only `NoEcho` value out (never recorded).
+*
+* WHAT THIS EVIDENCE DOES NOT CLAIM, stated because a reviewer asked: it does
+* not prove the bag was produced FROM this source. A previous generation's bag
+* whose framed middle happens to EQUAL a plaintext this pass resolved the
+* source token to (`cdkd scrub` walking an old record against today's template,
+* or a failed deploy persisting an old bag) takes this arm and persists TODAY's
+* expression at that position. That is not a new claim: the value scan the
+* arm replaces rewrites that same plaintext onto one of THIS pass's expressions
+* regardless of generation — the map holds no other — so the class of answer
+* is unchanged and only the choice within it improves (the source's own
+* token rather than the map's survivor). The generation hazard this arm must
+* not create is the whole-token arm's: a middle that is ALREADY an expression
+* (a persisted answer from another generation), which the token refusal below
+* keeps out — and, by the same argument, any leaf the value scan would NOT
+* rewrite to exactly `prefix + survivor + suffix`: a middle shorter than the
+* scan's needle floor (an embedded 1-3 character secret stays the scan's
+* documented residual — issue #2516 tracks closing it with a bound that
+* proves the bag's generation, which this evidence does not), a whole leaf
+* that is itself another recorded plaintext, a needle starting in the prefix
+* and overlapping the middle. The
+* arm checks that equivalence against the scan's own answer rather than
+* re-deriving the scan's rules. Pinned by the cross-generation cases in
+* `secret-redaction-embedded-span.test.ts`.
+*
+* One shape reaches this arm that a reader may not expect: a WHOLE-token
+* source that FAILED the whole-token arm's `isKnownSecretExpression` gate (an
+* `ssm` token whose type came back unclassifiable and which lost the map slot
+* to a sibling). Its "frame" is empty, and if this pass recorded it resolving
+* to the bag it is written back as itself — an expression, and the leaf's own,
+* where the scan wrote the survivor. Stated so it is not mistaken for a leak.
+*
+* Everything else keeps the pre-#2485 fall-through: two or more spans (which
+* span produced which value is genuinely ambiguous when they share one), an
+* `Fn::Sub` / `Fn::Join` source (an object, not this arm at all — issue #2320's
+* placeholder primitive), a frame mismatch, a middle that is itself a complete
+* token (an already-redacted record, per the same refusal
+* {@link learnMixedLeafNeedle} makes), and a middle this pass cannot vouch for.
+*
+* The frame is copied from the SOURCE, not scanned. A needle occurring in the
+* literal frame would be a reference the template never had at that offset —
+* the fabricated-baseline direction {@link preferPositionDecisions} refuses —
+* and the whole-token arm returns its source unscanned for the same reason.
+*
+* RETURNS THE VALUE SCAN'S ANSWER ON EVERY REFUSAL, not `undefined`: the scan
+* is computed once, here, for `(bag, secrets)` — the arm's bound below compares
+* against it, and every fall-through IS it — so the compared value provably
+* comes from the same bag and map the arm positions. An earlier revision took
+* the scan as a parameter, which left the bound one wrong caller away from
+* comparing against a scan of some other bag with no type error.
+*/
+function positionByEmbeddedSpan(bag, source, secrets) {
+	const scanned = redactSecretsForState(bag, secrets);
+	const frame = singleSpanFrame(bag, source);
+	if (frame === void 0) return scanned;
+	const { token, prefix, suffix, middle } = frame;
+	const recorded = resolvedPlaintextOf(secrets, token);
+	if (recorded === void 0 || recorded !== middle) return scanned;
+	const survivor = secrets.get(middle);
+	if (survivor === void 0) return scanned;
+	if (scanned !== prefix + survivor + suffix) return scanned;
+	return prefix + token + suffix;
+}
+/**
 * Keys tried, in order, when pairing two arrays whose ORDER cannot be trusted
 * (issue #1915).
 *
@@ -11387,7 +11599,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
 			return source;
 		}
-		return redactSecretsForState(bag, secrets);
+		return positionByEmbeddedSpan(bag, source, secrets);
 	}
 	if (typeof bag === "string" && isPlainObject$2(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
@@ -11505,12 +11717,13 @@ function subtreeHasDynamicReference(value) {
 * Widening it changes one answer, in the SAFE direction for BOTH readers.
 *
 * `drift.ts`'s `survivingDynamicReferences` is the reader that is easy to
-* forget, because it lives in another file — it feeds `isSecretBySpelling`,
-* so seeing MORE tokens can only mask more, never less. Do not shorten this
-* to "the only reader": that sentence is what a later editor uses to bound
-* the blast radius of touching the class, and getting it wrong points them
-* away from the report / `--json` / `--accept` path where an unmasked
-* `ssm-secure` survivor would surface.
+* forget, because it lives in another file — it feeds the survivor REPORT
+* (`onUnresolved`, and through it the `unresolvedToken` cause), so seeing MORE
+* tokens can only report more, never less. Do not shorten this to "the only
+* reader": that sentence is what a later editor uses to bound the blast
+* radius of touching the class, and getting it wrong points them away from
+* the report / `--json` / `--accept` path where an unreported survivor would
+* surface.
 *
 * The other reader is the DECLARED direction for issue #1901:
 * {@link mixedLeafMayCarryPublicReference}, which asks whether a MIXED leaf
@@ -11916,9 +12129,9 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 * from one the pass decided IN FAVOUR of the value already there. Two shapes
 * hit it, both fabricating a baseline `cdkd drift --revert` then pushes:
 *
-* - the resolver's unsupported-service arm leaves an `{{resolve:ssm-secure:`
-*   token LITERAL, so AWS echoes it back and the source leaf EQUALS the bag
-*   leaf. The string arm returns `source` — a decision — and the equality made
+* - the resolver's unsupported-service arm leaves a `{{resolve:...}}` token it
+*   has no arm for LITERAL (`ssm-secure:` was one until issue #2482), so AWS
+*   echoes it back and the source leaf EQUALS the bag leaf. The string arm returns `source` — a decision — and the equality made
 *   it look like no decision at all. (A BARE such token takes the whole-token
 *   arm and one embedded in text takes the mixed-leaf arm; both decide, and
 *   both were misread.)
@@ -12102,7 +12315,8 @@ function learnWholeTokenNeedle(collector, bag, source) {
 *   would then contain a whole `{{resolve:...}}` token and a resolved readback
 *   cannot end with one. The shape it genuinely decides is a second reference
 *   that survives LITERALLY in the readback — the resolver's
-*   unsupported-service arm (`ssm-secure:`) produces exactly that — where the
+*   unsupported-service arm produces exactly that (`ssm-secure:` did until
+*   issue #2482; a spelling with no arm still does) — where the
 *   extraction would in fact be right and is declined anyway. Measured: a
 *   both-resolved fixture leaves this line unfenced.
 * - the source's literal PREFIX and SUFFIX must both be present at the ends of
@@ -12116,17 +12330,10 @@ function learnWholeTokenNeedle(collector, bag, source) {
 * correctly, while an `indexOf` scan would cut it short.
 */
 function learnMixedLeafNeedle(collector, bag, source) {
-	const spans = dynamicReferenceSpans(source);
-	if (spans.length !== 1) return;
-	const [span] = spans;
-	const token = source.slice(span.start, span.end);
+	const frame = singleSpanFrame(bag, source);
+	if (frame === void 0) return;
+	const { token, middle: plaintext } = frame;
 	if (!expressionMaySeedANeedle(token)) return;
-	const prefix = source.slice(0, span.start);
-	const suffix = source.slice(span.end);
-	if (bag.length <= prefix.length + suffix.length) return;
-	if (!bag.startsWith(prefix) || !bag.endsWith(suffix)) return;
-	const plaintext = bag.slice(prefix.length, bag.length - suffix.length);
-	if (isSingleDynamicReferenceToken(plaintext)) return;
 	learnNeedle(collector, plaintext, token);
 }
 /**
@@ -15382,17 +15589,22 @@ function s3BucketWebsiteUrl(bucketName, region) {
 /**
 * The `{{resolve:<service>:...}}` families whose value can be a SECRET, and
 * therefore the only ones the region question below is asked about: every
-* `secretsmanager` reference by spelling, and every `ssm` one, which is secret
-* exactly when its parameter is a `SecureString` (issue #1901).
-*
-* Every OTHER service is `local` because cdkd cannot resolve it at all, NOT
-* because it is public. `ssm-secure` is the live example and is emphatically
-* not public: `resolveDynamicReferences` has no arm for it, so the literal
-* token is passed through to AWS and CloudFormation resolves it SERVER-side.
-* cdkd never holds its value, so there is no region for cdkd to get wrong —
-* which is the only reason it can be waved through here.
-*/
-const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set(["secretsmanager", "ssm"]);
+* `secretsmanager` reference by spelling, every `ssm-secure` one by spelling
+* (issue #2482 — it is resolved through the same `GetParameter` as `ssm`, so
+* the wrong region answers it in exactly the same way), and every `ssm` one,
+* which is secret exactly when its parameter is a `SecureString` (issue #1901).
+*
+* Every OTHER service is `local` because cdkd cannot resolve it at all — the
+* resolver's unsupported-service arm leaves such a token in place, so there
+* is no lookup for a region to get wrong. None of CloudFormation's three
+* services is in that position any more; the arm exists for a spelling that
+* is not a dynamic reference at all, or one AWS adds later.
+*/
+const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set([
+	"secretsmanager",
+	"ssm",
+	"ssm-secure"
+]);
 /**
 * Split a `{{resolve:secretsmanager:...}}` inner body into its SECRET_ID.
 *
@@ -15428,7 +15640,7 @@ function secretsManagerSecretId(inner) {
 *    a different thing in the refusal message than the one that would be read.
 */
 function ssmParameterName(inner) {
-	return inner.substring(4);
+	return inner.substring(inner.indexOf(":") + 1);
 }
 /**
 * The region an ARN names, or `undefined` for anything that is not an ARN with
@@ -20488,7 +20700,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		});
 		for (const { fullMatch, inner } of matches) {
 			const service = inner.split(":")[0];
-			const isKnownSecret = service === "secretsmanager" || recordedSecretExpressions.has(fullMatch);
+			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
 			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${fullMatch}: it names '${regionVerdict.secretName}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
@@ -20499,7 +20711,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			const cached = this.cachedDynamicReferences.get(fullMatch);
 			if (cached) {
-				if (cached.secret && cached.value) context?.recordedSecretValues?.set(cached.value, fullMatch);
+				if (cached.secret && cached.value) {
+					context?.recordedSecretValues?.set(cached.value, fullMatch);
+					if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, cached.value);
+				}
 				result = result.replace(fullMatch, () => cached.value);
 				continue;
 			}
@@ -20531,6 +20746,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					if (!decrypt) continue;
 				}
 				resolved = param.value;
+			} else if (service === "ssm-secure") {
+				const param = await this.resolveSSMReference(parts, true, "ssm-secure");
+				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${fullMatch}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+				isSecret = true;
+				resolved = param.value;
 			} else {
 				this.logger.warn(`Unsupported dynamic reference service: ${service}`);
 				continue;
@@ -20541,7 +20761,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			});
 			if (isSecret && resolved) {
 				context?.recordedSecretValues?.set(resolved, fullMatch);
-				if (service === "secretsmanager") this.pinSecretVerdict(fullMatch, true);
+				if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, resolved);
+				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
 			}
 			result = result.replace(fullMatch, () => resolved);
 		}
@@ -20751,16 +20972,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* discard the value when `secure` is set — it is ciphertext, not the resolved
 	* reference.
 	*/
-	async resolveSSMReference(parts, decrypt = true) {
+	async resolveSSMReference(parts, decrypt = true, service = "ssm") {
 		const parameterName = parts.slice(1).join(":");
-		if (!parameterName) throw new Error("Dynamic reference: ssm PARAMETER_NAME is required");
-		this.logger.debug(`Resolving dynamic reference: ssm:${parameterName}`);
+		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
+		this.logger.debug(`Resolving dynamic reference: ${service}:${parameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), `ssm:${parameterName}`);
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${parameterName}`);
 		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
@@ -20768,7 +20989,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
 			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
-			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:ssm:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
+			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
 		return {
 			value: paramValue,
@@ -21903,7 +22124,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DcFgnQQO.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BvIH9Ivw.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -34007,7 +34228,10 @@ var DeployEngine = class {
 			}
 			outputsPassCompleted = true;
 		} finally {
-			if (context.recordedSecretValues) for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
+			if (context.recordedSecretValues) {
+				for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
+				mergeResolvedPairs(context.recordedSecretValues, this.outputSecrets);
+			}
 			if (!outputsPassCompleted) this.outputsSourceUsable = false;
 		}
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
@@ -34028,5 +34252,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { DEFAULT_STATE_PREFIX as $, resolveUseCdkBootstrapAssets as $n, __exportAll as $r, isSingleDynamicReferenceToken as $t, bold as A, validateAssetBucketName as An, LocalStartServiceError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, runDockerStreaming as Bn, StateError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, BOOTSTRAP_MARKER_PREFIX as Cn, ConfigError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, isCrossRegionRedirect as Dn, DynamicReferenceRegionAmbiguousError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, getBootstrapMarkerKey as En, DeployCancelledError as Er, configStringRefusal as Et, yellow as F, dockerSpawnEnvWithSensitive as Fn, ProvisioningError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, getDefaultStateBucketName as Gn, withErrorHandling as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, getDockerImageBySourceHash as Hn, formatError as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, formatDockerLoginError as In, ResourceTimeoutError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveAutoAssetStorage as Jn, isThrottlingError as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, getLegacyStateBucketName as Kn, isMarkedNonRetryable as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, getDockerCmd as Ln, ResourceUpdateNotSupportedError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDenyExternalAccessPolicy as Mn, MissingCdkCliError as Mr, classifyReplaySecretRegion as Mt, green as N, describeAwsFailure as Nn, NestedStackChildDirectDestroyError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, parseBootstrapMarker as On, LocalInvokeBuildError as Or, replayWarn as Ot, red as P, buildDockerImage as Pn, PartialFailureError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, resolveStateBucketWithDefaultAndSource as Qn, retryClassificationText as Qr, errorCauseChain as Qt, exportAliasCollisionScrubWarning as R, partitionSensitiveEnv as Rn, StackHasActiveImportsError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, AssetModeResolver as Sn, CdkdError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, ensureAssetStorage as Tn, DependencyError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, Synthesizer as Un, isCdkdError as Ur, withRetry as Ut, stateKeySecretExposure as V, AssetManifestLoader as Vn, SynthesisError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, synthesisStatusMessage as Wn, normalizeAwsError as Wr, DagBuilder as Wt, maskDeep as X, resolveSkipPrefix as Xn, markNonRetryable as Xr, createSecretMasker as Xt, createMaskedRetryLogger as Y, resolveCaptureObservedState as Yn, isTransientServerError as Yr, carriesSecretMask as Yt, maskerOrIdentity as Z, resolveStateBucketWithDefault as Zn, markRedactedCause as Zr, dynamicReferenceTokens as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, createAssetRedirectResolver as _n, AwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, scrubResourceRecord as an, findLargeInlineResources as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, escapeRegExp$1 as bn, setAwsClients as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, rebuildClientForBucketRegion as cn, displaySafe as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, importableOutputs as dn, canonicalizeRegion as dr, isTerminationProtectionPropagationError as dt, maskSecretsInError as en, stateBucketExistenceConfirmed as er, beginCommandInterruptScope as et, withResourceDeadline as f, shouldRetainResource as fn, derivePartitionAndUrlSuffix as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, buildAssetRedirectMap as gn, resolveBucketRegion as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, WorkGraph as hn, clearBucketRegionCache as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, redactSecretsForState as in, MIGRATE_TMP_PREFIX as ir, startInterruptWatch as it, cyan as j, validateContainerRepoName as jn, LockError as jr, requireConfigString as jt, formatResourceLine as k, readBootstrapMarkerBody as kn, LocalMigrateError as kr, requireConfigArray as kt, replayRollback as l, exportNamesCarriedFrom as ln, expectedOwnerParam as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, stringifyValue as mn, processStackMessages as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, recordMaskOnlyValue as nn, CFN_TEMPLATE_BODY_LIMIT as nr, interruptWatchListenerCount as nt, planFailedOps as o, LockManager as on, uploadCfnTemplate as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, AssetPublisher as pn, AssemblyReader as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveApp as qn, isRetryableTransientError as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, recoverMaskedOutput as rn, CFN_TEMPLATE_URL_LIMIT as rr, isInterruptedWaitError as rt, planRollback as s, S3StateBackend as sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, maskSecretsInText as tn, warnDeprecatedNoPrefixCliFlag as tr, endCommandInterruptScope as tt, updatePartialMessage as u, importableOutputKeys as un, PARTITION_TABLE as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, loadPublishableAssetManifest as vn, getAwsClients as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, assertAssetBucketRegion as wn, CrossAccountSecretRefusalError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, stripControlChars as xn, AssetError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, rewriteTemplateAssetReferences as yn, resetAwsClients as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, runDockerForeground as zn, StackTerminationProtectionError as zr, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-DhMm2M33.js.map
+export { DEFAULT_STATE_PREFIX as $, resolveUseCdkBootstrapAssets as $n, retryClassificationText as $r, isSingleDynamicReferenceToken as $t, bold as A, validateAssetBucketName as An, LocalMigrateError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, runDockerStreaming as Bn, StackTerminationProtectionError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, BOOTSTRAP_MARKER_PREFIX as Cn, ConfigError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, isCrossRegionRedirect as Dn, DynamicReferenceRegionAmbiguousError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, getBootstrapMarkerKey as En, DeployCancelledError as Er, configStringRefusal as Et, yellow as F, dockerSpawnEnvWithSensitive as Fn, PartialFailureError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, getDefaultStateBucketName as Gn, normalizeAwsError as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, getDockerImageBySourceHash as Hn, SynthesisError as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, formatDockerLoginError as In, ProvisioningError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveAutoAssetStorage as Jn, isRetryableTransientError as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, getLegacyStateBucketName as Kn, withErrorHandling as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, getDockerCmd as Ln, ResourceTimeoutError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDenyExternalAccessPolicy as Mn, LockError as Mr, classifyReplaySecretRegion as Mt, green as N, describeAwsFailure as Nn, MissingCdkCliError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, parseBootstrapMarker as On, IntrinsicResolutionRefusalError as Or, replayWarn as Ot, red as P, buildDockerImage as Pn, NestedStackChildDirectDestroyError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, resolveStateBucketWithDefaultAndSource as Qn, markRedactedCause as Qr, errorCauseChain as Qt, exportAliasCollisionScrubWarning as R, partitionSensitiveEnv as Rn, ResourceUpdateNotSupportedError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, AssetModeResolver as Sn, CdkdError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, ensureAssetStorage as Tn, DependencyError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, Synthesizer as Un, formatError as Ur, withRetry as Ut, stateKeySecretExposure as V, AssetManifestLoader as Vn, StateError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, synthesisStatusMessage as Wn, isCdkdError as Wr, DagBuilder as Wt, maskDeep as X, resolveSkipPrefix as Xn, isTransientServerError as Xr, createSecretMasker as Xt, createMaskedRetryLogger as Y, resolveCaptureObservedState as Yn, isThrottlingError as Yr, carriesSecretMask as Yt, maskerOrIdentity as Z, resolveStateBucketWithDefault as Zn, markNonRetryable as Zr, dynamicReferenceTokens as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, createAssetRedirectResolver as _n, AwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, scrubResourceRecord as an, findLargeInlineResources as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, escapeRegExp$1 as bn, setAwsClients as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, rebuildClientForBucketRegion as cn, displaySafe as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, importableOutputs as dn, canonicalizeRegion as dr, isTerminationProtectionPropagationError as dt, __exportAll as ei, maskSecretsInError as en, stateBucketExistenceConfirmed as er, beginCommandInterruptScope as et, withResourceDeadline as f, shouldRetainResource as fn, derivePartitionAndUrlSuffix as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, buildAssetRedirectMap as gn, resolveBucketRegion as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, WorkGraph as hn, clearBucketRegionCache as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, redactSecretsForState as in, MIGRATE_TMP_PREFIX as ir, startInterruptWatch as it, cyan as j, validateContainerRepoName as jn, LocalStartServiceError as jr, requireConfigString as jt, formatResourceLine as k, readBootstrapMarkerBody as kn, LocalInvokeBuildError as kr, requireConfigArray as kt, replayRollback as l, exportNamesCarriedFrom as ln, expectedOwnerParam as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, stringifyValue as mn, processStackMessages as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, recordMaskOnlyValue as nn, CFN_TEMPLATE_BODY_LIMIT as nr, interruptWatchListenerCount as nt, planFailedOps as o, LockManager as on, uploadCfnTemplate as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, AssetPublisher as pn, AssemblyReader as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveApp as qn, isMarkedNonRetryable as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, recoverMaskedOutput as rn, CFN_TEMPLATE_URL_LIMIT as rr, isInterruptedWaitError as rt, planRollback as s, S3StateBackend as sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, maskSecretsInText as tn, warnDeprecatedNoPrefixCliFlag as tr, endCommandInterruptScope as tt, updatePartialMessage as u, importableOutputKeys as un, PARTITION_TABLE as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, loadPublishableAssetManifest as vn, getAwsClients as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, assertAssetBucketRegion as wn, CrossAccountSecretRefusalError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, stripControlChars as xn, AssetError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, rewriteTemplateAssetReferences as yn, resetAwsClients as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, runDockerForeground as zn, StackHasActiveImportsError as zr, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-CA50haPO.js.map