@cdkd/cli 0.324.0 → 0.326.1

package/dist/{program-CcdJAeR0.js → program-DXF0ILBM.js}

@@ -1,9 +1,9 @@
-import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-DWpHZk2l.js";
+import { a as runWithStackAwsClients, i as resetAwsClients, l as s3ClientDefaults, o as setAwsClients, s as resolveS3ClientDefaults, t as AwsClients, u as setS3ClientDefaultsDebugLog } from "./aws-clients-ez_oXu6x.js";
 import { $ as safeMsg, B as SAFE_MSG_ALTERED_CHAR, G as cutMarker, H as STACK_REF_MAX_CODE_POINTS, I as withSkipPrefix, J as displaySafe, K as displayAwsMessage, L as withStackScope, Q as plainIdentOr, S as explicitNamePropertyFor, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, W as asIsMessage, X as isPasteableIdent, Y as displayStackName, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, c as isStdoutReservedForPayload, d as runStackBuffered, et as stringifyJsonPayload, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, j as isNameGeneration, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, nt as truncateCodePoints, q as displayIdent, s as getLogger, tt as terminalSafe, w as generateResourceName, x as derivesPatternBName } from "./aws-failure-text-DiHodi76.js";
-import { $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, Bn as formatError, Dn as LocalStartServiceError, Dr as retryClassificationText, En as LocalInvokeBuildError$1, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Gn as TIMEOUT_FLAG_RESOURCE_TYPE, I as VALUE_NOT_SHOWN, In as StackHasActiveImportsError, Ln as StackTerminationProtectionError, M as RESOURCE_NOT_FOUND, Mn as PartialFailureError, N as isMarkedNotGone, Nn as ProvisioningError, Ot as resourceTypeShown, Pn as ResourceTimeoutError, Qn as pasteableCommand, Qt as forceQuitRecoveryClause, Rn as StateError, Sn as DeployCancelledError, Sr as isAmbiguousOutcomeError, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, U as remedyLogicalId, Un as normalizeAwsError, Wn as withErrorHandling, Xt as buildForceUnlockCommand, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, Zt as buildLockContentionMessage, _r as stripControlChars, _t as beginCommandInterruptScope, an as DEFAULT_STATE_PREFIX, ar as setPasteableRunFlags, bn as CrossAccountSecretRefusalError, bt as isInterruptedWaitError, c as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, cn as producerCoordinateKey, dn as withPasteableAwsProfile, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, gn as AccountIdUnavailableError, gr as escapeRegExp, hn as credentialFingerprint, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, jn as NestedStackChildDirectDestroyError, jr as markNonRetryable, kr as isMarkedNonRetryable, ln as producerRecordKey, mn as clientDefaultsFor, nr as shellBoundedDisplay, on as injectiveKey, or as setPasteableVerbFlags, p as readRecordedPrincipals, pn as ambientCredentialConfig, qn as SHELL_ACTIVE_WHY, rr as shellQuote, s as IAM_PRINCIPAL_NAME, tn as formatLockOwner, tr as quotedOrDescribed, un as setPasteableAwsProfile, ut as isAwsCliLiteral, vn as CdkdError, vr as stripForDisplay, vt as endCommandInterruptScope, wn as DynamicReferenceRegionAmbiguousError, yt as interruptWatchListenerCount, zn as SynthesisError } from "./created-resource-sink-CmrPwGge.js";
+import { $t as formatLockExpiry, An as MalformedProducerRecordRefusalError, Ar as isThrottlingError, Bn as formatError, Dn as LocalStartServiceError, Dr as retryClassificationText, En as LocalInvokeBuildError$1, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Gn as TIMEOUT_FLAG_RESOURCE_TYPE, I as VALUE_NOT_SHOWN, In as StackHasActiveImportsError, Ln as StackTerminationProtectionError, M as RESOURCE_NOT_FOUND, Mn as PartialFailureError, N as isMarkedNotGone, Nn as ProvisioningError, Ot as resourceTypeShown, Pn as ResourceTimeoutError, Qn as pasteableCommand, Qt as forceQuitRecoveryClause, Rn as StateError, Sn as DeployCancelledError, Sr as isAmbiguousOutcomeError, Tn as IntrinsicResolutionRefusalError, Tr as isRetryableTransientError, U as remedyLogicalId, Un as normalizeAwsError, Wn as withErrorHandling, Xt as buildForceUnlockCommand, Yn as commandHole, Yt as UNREPRODUCIBLE_LOCK_CLAUSE, Zn as isInertUnquoted, Zt as buildLockContentionMessage, _r as stripControlChars, _t as beginCommandInterruptScope, an as DEFAULT_STATE_PREFIX, ar as setPasteableRunFlags, bn as CrossAccountSecretRefusalError, bt as isInterruptedWaitError, c as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, cn as producerCoordinateKey, dn as withPasteableAwsProfile, en as formatLockOperation, er as plainOrDescribed, fn as ambientClientDefaults, gn as AccountIdUnavailableError, gr as escapeRegExp, hn as credentialFingerprint, in as CUSTOM_RESOURCE_RESPONSE_PREFIX, ir as withheldTargetClause, it as runDeleteAttempt, jn as NestedStackChildDirectDestroyError, jr as markNonRetryable, kr as isMarkedNonRetryable, ln as producerRecordKey, mn as clientDefaultsFor, nr as shellBoundedDisplay, on as injectiveKey, or as setPasteableVerbFlags, p as readRecordedPrincipals, pn as ambientCredentialConfig, qn as SHELL_ACTIVE_WHY, rr as shellQuote, s as IAM_PRINCIPAL_NAME, tn as formatLockOwner, tr as quotedOrDescribed, un as setPasteableAwsProfile, ut as isAwsCliLiteral, vn as CdkdError, vr as stripForDisplay, vt as endCommandInterruptScope, wn as DynamicReferenceRegionAmbiguousError, yt as interruptWatchListenerCount, zn as SynthesisError } from "./created-resource-sink-DMf6WEao.js";
 import { a as setAssumedRoleCredentials, d as formatAuthority, i as getPreAssumeEnvCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as runInStackAwsScope } from "./aws-client-defaults-BLXFsfMa.js";
-import { $a as recordedReferenceRegions, $c as createUnionSecretMasker, $l as exportNamesCarriedFrom, $n as nameGenerationCarriedFrom, $o as malformedOrphanRecordsWarning, $r as addSuperseded, $s as findReplacedReadersOfRecreateTargets, $t as deleteJournaledOrphans, $u as synthesisStatusMessage, Ad as defineOwnKey, Ai as createPreDeleteFinalSnapshot, Al as recordMaskOnlyValue, An as equalModuloMarkedMask, Ao as parameterInputsFor, Ar as formatDestructiveChange, As as refuseMalformedResourcePropertiesForExport, At as isSecretBearingReferenceString, Au as validateContainerRepoName, Ba as poisonRenderedSpellingsCollidingIn, Bc as noEchoLeavesOf, Bd as injectAwsRegion, Bi as DeploymentEventsReader, Bl as S3StateBackend, Bn as replacementNeverSwapped, Bo as displayLogicalId, Br as proposeRenames, Bs as repairMalformedResourcePropertiesForReadOnly, Bt as NESTED_PENDING_PARENT_REASON, Bu as getDockerCmd, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Ci as secretNamedRecordNeedles, Cn as replayFailedOperations, Co as AWS_NO_VALUE, Cr as isExportAliasCollision, Cs as refuseMalformedResourceEntriesForDeploy, Ct as conditionInputsFrom, Cu as assertAssetBucketRegion, Dd as describeJsonParseFailure, Di as PRE_DELETE_SNAPSHOT_TYPES, Dl as splitGetAttStringForm, Dn as settleUnsettledPrevious, Do as refStateLookupFromResource, Dr as maskingRetryLogger, Ds as refuseMalformedResourceEntriesForOrphan, Du as parseBootstrapMarker, Ed as processStackMessages, Ei as ATOMIC_FINAL_SNAPSHOT_TYPES, El as recordPhysicalNameCopy, En as recordAfterRollbackUpdate, Eo as lacksRecordedTableArn, Er as DEFAULT_RESOURCE_WARN_AFTER_MS, Es as refuseMalformedResourceEntriesForImportSave, Eu as isCrossRegionRedirect, Fa as unsettledItemsOf, Fc as maskAtCoordinates, Fd as absoluteAssemblyPathEscape, Fl as wholeStringLeavesOf, Fn as isReplacementOrphan, Fo as STATE_RESOURCES_MALFORMED, Fr as withMovedTo, Fs as refuseMalformedState, Ft as planOrphanAdoption, Fu as describeDockerExecFailure, Gc as recordedNoEchoValuesOf, Gl as crossPrefixDeniedWarning, Go as isReadableResourceEntry, Gr as withStackRecords, Gs as withheldAccountClause, Gt as nestedChildStackName$1, Gu as redactedCause, Hi as extractDeploymentEventError, Hl as CrossPrefixReadError, Hn as seedsDeleteFirstGuard, Ho as hasReadableOutputs, Hs as unpreviewableOrphanRecords, Ht as displacedPhysicalIdShown, Hu as isMalformedEnvKey, Ia as unsettledPropertiesOf, Ic as maskReadbackAtCoordinates, Id as describeFileReadFailure, Ii as ledgerForStack, Il as WHOLE_DYNAMIC_REFERENCE_PATTERN, In as planFailedOps, Io as UNREADABLE_ORPHANS_CONTAINER_ROW, Ir as isPairableType, Is as repairMalformedOrphanRecordsForReadOnly, It as pendingRequestCount, Iu as describeDockerFailure, Ja as producerLookupOver, Jl as stackInstanceIdOf, Jo as malformedExportSourceWarning, Jr as cyan, Jt as revertedNestedRowIds, Ju as runDockerStreaming, Kc as valueAtCoordinate, Kl as isAccessDenied, Kn as inheritProducerRegions, Ko as malformedDriftResourcePropertiesWarning, Ks as findActionableSdkUnwired, Kt as recordDisplacedSkips, Ku as redactedDockerCause, La as withUnsettledProperties, Lc as maskWholeValue, Ld as displayAssemblyPath, Ll as isSingleDynamicReferenceToken, Ln as planRollback, Lo as UNREADABLE_RESOURCES_MAP_ROW, Lr as looselyEqual, Ls as repairMalformedOrphansForReadOnly, Lt as resolvePendingCloudControlRequests, Lu as dockerSpawnEnvWithSensitive, Ma as INTRINSIC_KEYS, Mc as TemplateParser, Md as hasPlainPrototype, Mi as isFinalSnapshotError, Ml as recordNoEchoAttributeValues, Mn as undeclaredEmptyObservedKeys, Mo as declaresNoEcho, Mr as hintSidesOf, Ms as refuseMalformedResourcesForDeploy, Mt as mergeNoChangeOutputs, Mu as buildDockerImage, Nc as canonicalCoordinates, Nd as nullPrototypeRecord, Ni as refusesFinalSnapshot, Nl as recordNoEchoParameterFreshValue, Nn as demoteSupersededOrphans, No as JSON_LISTING_HOLE_VALUE, Nr as movedToHint, Ns as refuseMalformedResourcesForDestroy, Nt as makeCanonicalizePropertiesFn, Nu as resolveDockerContextDirectory, Od as parseFailureDebugDetail, Oi as buildFinalSnapshotIdentifier, Ol as carriesSecretMask, On as withUnprovenUnsettled, Or as constructPathOf$1, Os as refuseMalformedResourcePropertiesForDestroy, Ot as withResourceDeadline, Ou as readBootstrapMarkerBody, Pa as unsettledItemsField, Pc as isMarkedCoordinate, Pd as ownValue, Pi as unsupportedFinalSnapshotError, Pl as recordProvenPublicExpression, Pn as isJournaledOrphan, Po as STATE_REGION_DIVERGED, Pr as rollbackOrphanIds, Ps as refuseMalformedResourcesForExport, Pt as makeSiblingClaimReader, Pu as describeDockerCapturedOutput, Qa as recordedOutputReferenceRegions, Qc as carryLogOnlyValues, Ql as describeRegionValueKind, Qn as updatePartialReason, Qo as malformedOrphanRecordsRefusalMessage, Qr as yellow, Qs as hasNoCloudControlHandlers, Qt as withNestedStackContext, Qu as Synthesizer, Ra as withoutUnsettledProperties, Rc as maskedLeafCoordinatesOf, Rd as renderAssemblyPathEscape, Ri as withCreateTokenLedger, Rl as LockManager, Rn as recheckFailedPlan, Ro as accountArgs, Rr as mappingPairs, Rs as repairMalformedOutputsForReadOnly, Rt as keptForRetainedRecord, Ru as finchSecretArgvRefusal, Sa as deleteSkipReason, Sc as describeTypeWithThrottleRetry, Sd as canonicalizeRegion, Sl as recordNestedStackParameterExpressions, Sn as refusePendingMovesOut, So as keepsSecretReferenceToken, Sr as collectPublishedOutputNames, Ss as refuseMalformedResourceEntries, St as conditionFingerprint, Su as BOOTSTRAP_MARKER_PREFIX, Td as StageLoadError, Ti as storedSecretNameNeedles, Tn as removeProtectionTypeList, To as isStalePlaceholderArnAttribute, Tr as DEFAULT_RESOURCE_TIMEOUT_MS, Ts as refuseMalformedResourceEntriesForImport, Tt as readRecordedConditionVerdicts, Tu as getBootstrapMarkerKey, Uc as readbackPathFor, Ud as resolveBucketRegion, Ul as CrossPrefixScanCache, Un as orphanNeedsIdentity, Uo as hasReadableResources, Ur as destroyStackRecordsView, Us as unreadableOrphanRecords, Ut as dropSettledNestedJournals, Uu as partitionSensitiveEnv, Vc as noEchoOutputsComparison, Vd as injectedAwsRegionValue, Vi as DeploymentEventsStore, Vl as rebuildClientForBucketRegion, Vn as resolveReplacementOldType, Vo as hasReadableOrphans, Vs as repairMalformedResourcesForReadOnly, Vt as displacedOpClause, Vu as isDockerClientEnvKey, Wc as readsNoEchoSource, Wl as applyCrossPrefixScan, Wn as findNestedStackTypeChanges, Wo as isReadableOrphanRecord, Ws as unreadableResourceEntries, Wu as redactDockerArgvValues, Xa as keepHeldTokenProvenance, Xl as splitImportedOps, Xo as malformedLocalResourceEntriesWarning, Xr as green, Xt as collectNestedChildUnaddressed, Xu as AssetManifestLoader, Ya as refuseUnreadableCdkCrossAccountRefs, Yc as redactForState, Yl as withStackInstanceIdWithheld, Yo as malformedLocalOutputsWarning, Yr as gray, Ys as unwrittenCreateOnlyReplacement, Yt as withNestedRevertRun, Yu as warnFinchArgvExposure, Zl as acceptedCreateOnlyDropsOf, Zn as updatePartialMessage, Zo as malformedLocalResourcesWarning, Zr as red, Zs as NO_CC_HANDLERS_REASON, Zt as getCurrentNestedStackContext, Zu as getDockerImageBySourceHash, _d as uploadCfnTemplate, _i as maskEventTextWithBoundBags, _l as isUncertifiedBaselineMaskPosition, _n as sameMove, _o as getAccountInfo, _r as exportNameNoEchoParameters, _s as refuseMalformedOrphansForDestroy, _t as findNestedTemplateTreeDefect, _u as buildAssetRedirectMap, a as isProtectionValueActive, ad as resolveCaptureObservedState, ai as supersededHeldByOtherTypeWarning, al as recordLogOnlyValue, an as makeForeignHolderScan, ao as sendableAssumeRoleCommand, ar as withNameGenerationReached, as as malformedRenderedContainersWarning, au as isReadableBag, ba as deleteIndeterminateGuards, bc as prefetchCreateOnlyPropertyPaths, bd as expectedOwnerParam, bi as secretNamePrintingBag, bl as identityKeyFor, bn as pendingMovesOutOf, bo as carriesFetchableDynamicReference, br as noEchoParameterValueSeed, bs as refuseMalformedOutputsForDestroy, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, ca as isCustomResourceType$1, cd as resolveStateBucketWithDefaultAndSource, ci as withoutSuperseded, cl as createSecretMasker, co as callerEnvCredentials, cr as reachableDivergentParameters, cs as malformedResourcesWarning, cu as shouldRetainResource, da as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, dd as warnDeprecatedNoPrefixCliFlag, di as noEchoExactEchoLeavesOf, dl as maskSecretsInText, do as classifyReplaySecretRegion, dr as displayTextOrWithheld, ds as previewableOrphanRecords, dt as crossStackOutputProvenanceSource, du as renderPhaseTimings, ea as CC_BROKEN_REASON, ec as shownType, ed as getDefaultStateBucketName, ei as deleteSupersededEntry, el as hasMaskableValues, en as dropFailedCommands, eo as applyRoleArnIfSet, er as nameGenerationHighWaterOf, es as malformedOrphanRowsKeptWarning, eu as hasReadableExportSet, fa as applyCustomResourceResponseExpiration, fd as ssmResolvedValueType, fi as noEchoParameterNamesOf, fl as scrubResourceRecord, fn as readRefactorMarker, fo as producerRegionsFromState, fr as exportAliasCollisionScrubWarning, fs as refuseDivergentRecordRegionForDestroy, ft as inheritedProvenanceForChildDiff, fu as timePhase, gd as findLargeInlineResources, gi as journaledOrphanPrintingBag, gl as dynamicReferenceTokens, gn as refuseRefactorMarker, go as parameterTypeMayLoseSecretIdentity, gr as carriedExportAliasExposure, gs as refuseMalformedOrphans, gt as childTemplateLoader, gu as WorkGraph, ha as slowCcOperationTimeoutMs, hd as MIGRATE_TMP_PREFIX, hi as completedReplayEntries, hl as DYNAMIC_REFERENCE_TOKEN_SCAN, hn as refactorMarkerRefusalMessage, ho as isUnboundTemplateParameter, hr as secretSafeKeyDisplay, hs as refuseMalformedOrphanRecordsForDestroy, ht as serviceTokenBlockingReason, hu as stringifyValue, i as PROTECTION_PROPERTY_BY_TYPE, ia as wouldReturnToSdkProvider, ic as renderStatefulReason, id as resolveAutoAssetStorage, ii as supersededAfterRollback, il as recordLogOnlyParameterValue, in as loadJournaledOrphans, io as isIamRoleArn, ir as retiredNameGenerationsLeaving, is as malformedOutputsWarning, iu as importableOutputs, j as setResolvedResourceTimeouts, ja as DiffCalculator, jc as DagBuilder, jd as hasOwnKey, ji as effectiveDeletionPolicy, jl as recordMaskOnlyValuesIn, jn as equalModuloMask, jr as findRefactorHints, js as refuseMalformedResourcePropertiesForOrphan, jt as keptWholeReasonText, ju as buildDenyExternalAccessPolicy, kd as utf8ByteLength, ki as ccRoutedFinalSnapshotError, kl as provenPublicValue, kn as calculateResourceDrift, ko as withSharedDrainBudget, kr as findDestructiveChanges, ks as refuseMalformedResourcePropertiesForDrift, kt as diffSecurity, ku as validateAssetBucketName, ld as resolveUseCdkBootstrapAssets, li as noEchoAttributeNamesOf, ll as errorCauseChain, lo as envCredentialsAreAssumedRole, lr as resourcesNamingDeclaredParameter, ls as malformedScrubResourceEntriesRefusalMessage, lt as IMPLICIT_DELETE_DEPENDENCIES, lu as stackInstanceIdCarriedFrom, ma as CloudControlProvider, md as CFN_TEMPLATE_URL_LIMIT, mi as createReadOnlyAttributeHealerFactory, mn as refactorMarkerMovesOf, mo as coerceParameterTypedValue, mr as secretBearingStateKeyWarning, ms as refuseMalformedOrphanRecords, mt as findServiceTokenRefusals, mu as isSensitiveAttributeName, n as recordedProtectionEvidence, na as ccBrokenReason, nc as isStatefulRecreateTargetForReplace, nd as loadCdkJson, ni as isSupersededResourceRecord, nl as logOnlyValueCount, nn as isHandledOrphan, no as assertSendableRoleArn, nr as retiredAfterRollback, ns as malformedOrphansWarning, nu as hasUnverifiableParameterRefusal, o as perType, oa as TemplateNoEchoReresolver, od as resolveSkipPrefix, oi as supersededHolderOf, ol as shareLogOnlyValues, on as sameJournaledOrphans, oo as AWS_CREDENTIAL_ENV_KEYS, or as computeParameterTaint, os as malformedResourceEntriesWarning, ou as orphansAfterRollback, pa as customResourceResponseExpirationWarning, pd as CFN_TEMPLATE_BODY_LIMIT, pi as withAttemptedItemsMasked, pl as withPhysicalNameCopies, pn as readRefactorMarkerOnce, po as regionLessSecretName, pr as secretBearing, pt as deferredServiceTokenWarning, pu as AssetPublisher, qa as resolveDynamicReferences, qc as liveMatchesUnresolvedTokenFrame, ql as isNotImplemented, qo as malformedExportNamesWarning, qr as bold, qs as findHandledUnwrittenCreateOnly, qu as runDockerForeground, r as recordedProtectionNote, ra as isCustomResource, rc as isStatefulRecreateTargetSync, rd as resolveApp, ri as removeSuperseded, rl as printingCorpusOf, rn as journaledOrphanLines, ro as explicitRoleArnOrThrow, rr as retiredNameGenerationsAfter, rs as malformedOutputsRefusalMessage, ru as importableOutputKeys, s as readProtection, sa as readsNoEchoDeleteValues, sd as resolveStateBucketWithDefault, si as supersededResourcesOf, sl as unionOfSecretBags, sn as formatResourceLine, so as applyCallerIdentityCredentials, sr as namesAnyDeclaredParameter, ss as malformedResourcePropertiesWarning, su as orphansCarriedFrom, t as DeployEngine, ta as ProviderRegistry, tc as MULTI_REGION_RECREATE_BLOCKED_TYPES, td as getLegacyStateBucketName, ti as holdsSupersededResources, tl as literalSplitDelimitersOf, tn as dropFailedHint, to as assertFlagRoleArn, tr as nameScopeOf, ts as malformedOrphansRefusalMessage, tu as hasReasonlessBaselineRefusal, ua as withPrintingSecrets, ud as stateBucketExistenceConfirmed, ui as noEchoComparisonForTemplate, ul as maskSecretsInError, uo as classifyRecordedSecretRegion, ur as WITHHELD_NAME_DISPLAY, us as malformedStateRefusalMessage, ut as computeImplicitDeleteEdges, uu as PhaseClock, va as RollbackInlinePolicyWriters, vd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vi as namingSecretsWithRecordedNoEcho, vl as pathCrossesDottedKey, vn as updateRefactorMarker, vo as isImpossibleEmptyStoredAttribute, vr as exportNameSecretExposure, vs as refuseMalformedOrphansForOrphan, vt as isAbsoluteAssetPath, vu as createAssetRedirectResolver, wa as isWaitAbandonedError, wd as AssemblyReader, wi as stateSecretNameNeedles, wl as physicalNameCopiesOf, wn as replayRollback, wo as cfnRefValueFromPhysicalId, wr as bindingSkippedOutputs, ws as refuseMalformedResourceEntriesForDestroy, wt as parentSuppliedValues, wu as ensureAssetStorage, xa as deleteLeftInPlace, xc as templateResourceTypes, xd as PARTITION_TABLE, xi as secretNamePrintingBags, xl as inheritNestedStackParameterAssociations, xn as pendingMovesRefusalMessage, xo as isNamelessDynamicReferenceError, xr as collectDeclaredOutputNames, xs as refuseMalformedResourceAttributesForOrphan, xt as templateIdentity, xu as AssetModeResolver, ya as UNSPECIFIED_SKIP_REASON, yd as decodeListingKey, yi as orphanRecordsPrintingBag, yl as spelledKeysOf, yn as hasPendingMovesOut, yo as carriesDynamicReference, yr as isWholeDynamicReferenceValue, ys as refuseMalformedOutputs, yt as listNestedTemplateRows, yu as loadPublishableAssetManifest, za as IntrinsicFunctionResolver, zc as noEchoCoordinatesOf, zd as resolveAssemblyPath, zl as isLockInfoExpired, zn as recordUnderIdIsNotOwn, zo as deployRefusesOrphanRowsReason, zr as parseMappingFile, zs as repairMalformedResourceEntriesForReadOnly, zt as recordRetainedForReadoption, zu as formatDockerLoginError } from "./deploy-engine-B32kQ3SO.js";
-import { t as getCdkdVersion } from "./version-h1THYe6R.js";
+import { $a as recordedReferenceRegions, $c as createUnionSecretMasker, $l as exportNamesCarriedFrom, $n as nameGenerationCarriedFrom, $o as malformedOrphanRecordsWarning, $r as addSuperseded, $s as findReplacedReadersOfRecreateTargets, $t as deleteJournaledOrphans, $u as synthesisStatusMessage, Ad as defineOwnKey, Ai as createPreDeleteFinalSnapshot, Al as recordMaskOnlyValue, An as equalModuloMarkedMask, Ao as parameterInputsFor, Ar as formatDestructiveChange, As as refuseMalformedResourcePropertiesForExport, At as isSecretBearingReferenceString, Au as validateContainerRepoName, Ba as poisonRenderedSpellingsCollidingIn, Bc as noEchoLeavesOf, Bd as injectAwsRegion, Bi as DeploymentEventsReader, Bl as S3StateBackend, Bn as replacementNeverSwapped, Bo as displayLogicalId, Br as proposeRenames, Bs as repairMalformedResourcePropertiesForReadOnly, Bt as NESTED_PENDING_PARENT_REASON, Bu as getDockerCmd, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Ci as secretNamedRecordNeedles, Cn as replayFailedOperations, Co as AWS_NO_VALUE, Cr as isExportAliasCollision, Cs as refuseMalformedResourceEntriesForDeploy, Ct as conditionInputsFrom, Cu as assertAssetBucketRegion, Dd as describeJsonParseFailure, Di as PRE_DELETE_SNAPSHOT_TYPES, Dl as splitGetAttStringForm, Dn as settleUnsettledPrevious, Do as refStateLookupFromResource, Dr as maskingRetryLogger, Ds as refuseMalformedResourceEntriesForOrphan, Du as parseBootstrapMarker, Ed as processStackMessages, Ei as ATOMIC_FINAL_SNAPSHOT_TYPES, El as recordPhysicalNameCopy, En as recordAfterRollbackUpdate, Eo as lacksRecordedTableArn, Er as DEFAULT_RESOURCE_WARN_AFTER_MS, Es as refuseMalformedResourceEntriesForImportSave, Eu as isCrossRegionRedirect, Fa as unsettledItemsOf, Fc as maskAtCoordinates, Fd as absoluteAssemblyPathEscape, Fl as wholeStringLeavesOf, Fn as isReplacementOrphan, Fo as STATE_RESOURCES_MALFORMED, Fr as withMovedTo, Fs as refuseMalformedState, Ft as planOrphanAdoption, Fu as describeDockerExecFailure, Gc as recordedNoEchoValuesOf, Gl as crossPrefixDeniedWarning, Go as isReadableResourceEntry, Gr as withStackRecords, Gs as withheldAccountClause, Gt as nestedChildStackName$1, Gu as redactedCause, Hi as extractDeploymentEventError, Hl as CrossPrefixReadError, Hn as seedsDeleteFirstGuard, Ho as hasReadableOutputs, Hs as unpreviewableOrphanRecords, Ht as displacedPhysicalIdShown, Hu as isMalformedEnvKey, Ia as unsettledPropertiesOf, Ic as maskReadbackAtCoordinates, Id as describeFileReadFailure, Ii as ledgerForStack, Il as WHOLE_DYNAMIC_REFERENCE_PATTERN, In as planFailedOps, Io as UNREADABLE_ORPHANS_CONTAINER_ROW, Ir as isPairableType, Is as repairMalformedOrphanRecordsForReadOnly, It as pendingRequestCount, Iu as describeDockerFailure, Ja as producerLookupOver, Jl as stackInstanceIdOf, Jo as malformedExportSourceWarning, Jr as cyan, Jt as revertedNestedRowIds, Ju as runDockerStreaming, Kc as valueAtCoordinate, Kl as isAccessDenied, Kn as inheritProducerRegions, Ko as malformedDriftResourcePropertiesWarning, Ks as findActionableSdkUnwired, Kt as recordDisplacedSkips, Ku as redactedDockerCause, La as withUnsettledProperties, Lc as maskWholeValue, Ld as displayAssemblyPath, Ll as isSingleDynamicReferenceToken, Ln as planRollback, Lo as UNREADABLE_RESOURCES_MAP_ROW, Lr as looselyEqual, Ls as repairMalformedOrphansForReadOnly, Lt as resolvePendingCloudControlRequests, Lu as dockerSpawnEnvWithSensitive, Ma as INTRINSIC_KEYS, Mc as TemplateParser, Md as hasPlainPrototype, Mi as isFinalSnapshotError, Ml as recordNoEchoAttributeValues, Mn as undeclaredEmptyObservedKeys, Mo as declaresNoEcho, Mr as hintSidesOf, Ms as refuseMalformedResourcesForDeploy, Mt as mergeNoChangeOutputs, Mu as buildDockerImage, Nc as canonicalCoordinates, Nd as nullPrototypeRecord, Ni as refusesFinalSnapshot, Nl as recordNoEchoParameterFreshValue, Nn as demoteSupersededOrphans, No as JSON_LISTING_HOLE_VALUE, Nr as movedToHint, Ns as refuseMalformedResourcesForDestroy, Nt as makeCanonicalizePropertiesFn, Nu as resolveDockerContextDirectory, Od as parseFailureDebugDetail, Oi as buildFinalSnapshotIdentifier, Ol as carriesSecretMask, On as withUnprovenUnsettled, Or as constructPathOf$1, Os as refuseMalformedResourcePropertiesForDestroy, Ot as withResourceDeadline, Ou as readBootstrapMarkerBody, Pa as unsettledItemsField, Pc as isMarkedCoordinate, Pd as ownValue, Pi as unsupportedFinalSnapshotError, Pl as recordProvenPublicExpression, Pn as isJournaledOrphan, Po as STATE_REGION_DIVERGED, Pr as rollbackOrphanIds, Ps as refuseMalformedResourcesForExport, Pt as makeSiblingClaimReader, Pu as describeDockerCapturedOutput, Qa as recordedOutputReferenceRegions, Qc as carryLogOnlyValues, Ql as describeRegionValueKind, Qn as updatePartialReason, Qo as malformedOrphanRecordsRefusalMessage, Qr as yellow, Qs as hasNoCloudControlHandlers, Qt as withNestedStackContext, Qu as Synthesizer, Ra as withoutUnsettledProperties, Rc as maskedLeafCoordinatesOf, Rd as renderAssemblyPathEscape, Ri as withCreateTokenLedger, Rl as LockManager, Rn as recheckFailedPlan, Ro as accountArgs, Rr as mappingPairs, Rs as repairMalformedOutputsForReadOnly, Rt as keptForRetainedRecord, Ru as finchSecretArgvRefusal, Sa as deleteSkipReason, Sc as describeTypeWithThrottleRetry, Sd as canonicalizeRegion, Sl as recordNestedStackParameterExpressions, Sn as refusePendingMovesOut, So as keepsSecretReferenceToken, Sr as collectPublishedOutputNames, Ss as refuseMalformedResourceEntries, St as conditionFingerprint, Su as BOOTSTRAP_MARKER_PREFIX, Td as StageLoadError, Ti as storedSecretNameNeedles, Tn as removeProtectionTypeList, To as isStalePlaceholderArnAttribute, Tr as DEFAULT_RESOURCE_TIMEOUT_MS, Ts as refuseMalformedResourceEntriesForImport, Tt as readRecordedConditionVerdicts, Tu as getBootstrapMarkerKey, Uc as readbackPathFor, Ud as resolveBucketRegion, Ul as CrossPrefixScanCache, Un as orphanNeedsIdentity, Uo as hasReadableResources, Ur as destroyStackRecordsView, Us as unreadableOrphanRecords, Ut as dropSettledNestedJournals, Uu as partitionSensitiveEnv, Vc as noEchoOutputsComparison, Vd as injectedAwsRegionValue, Vi as DeploymentEventsStore, Vl as rebuildClientForBucketRegion, Vn as resolveReplacementOldType, Vo as hasReadableOrphans, Vs as repairMalformedResourcesForReadOnly, Vt as displacedOpClause, Vu as isDockerClientEnvKey, Wc as readsNoEchoSource, Wl as applyCrossPrefixScan, Wn as findNestedStackTypeChanges, Wo as isReadableOrphanRecord, Ws as unreadableResourceEntries, Wu as redactDockerArgvValues, Xa as keepHeldTokenProvenance, Xl as splitImportedOps, Xo as malformedLocalResourceEntriesWarning, Xr as green, Xt as collectNestedChildUnaddressed, Xu as AssetManifestLoader, Ya as refuseUnreadableCdkCrossAccountRefs, Yc as redactForState, Yl as withStackInstanceIdWithheld, Yo as malformedLocalOutputsWarning, Yr as gray, Ys as unwrittenCreateOnlyReplacement, Yt as withNestedRevertRun, Yu as warnFinchArgvExposure, Zl as acceptedCreateOnlyDropsOf, Zn as updatePartialMessage, Zo as malformedLocalResourcesWarning, Zr as red, Zs as NO_CC_HANDLERS_REASON, Zt as getCurrentNestedStackContext, Zu as getDockerImageBySourceHash, _d as uploadCfnTemplate, _i as maskEventTextWithBoundBags, _l as isUncertifiedBaselineMaskPosition, _n as sameMove, _o as getAccountInfo, _r as exportNameNoEchoParameters, _s as refuseMalformedOrphansForDestroy, _t as findNestedTemplateTreeDefect, _u as buildAssetRedirectMap, a as isProtectionValueActive, ad as resolveCaptureObservedState, ai as supersededHeldByOtherTypeWarning, al as recordLogOnlyValue, an as makeForeignHolderScan, ao as sendableAssumeRoleCommand, ar as withNameGenerationReached, as as malformedRenderedContainersWarning, au as isReadableBag, ba as deleteIndeterminateGuards, bc as prefetchCreateOnlyPropertyPaths, bd as expectedOwnerParam, bi as secretNamePrintingBag, bl as identityKeyFor, bn as pendingMovesOutOf, bo as carriesFetchableDynamicReference, br as noEchoParameterValueSeed, bs as refuseMalformedOutputsForDestroy, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, ca as isCustomResourceType$1, cd as resolveStateBucketWithDefaultAndSource, ci as withoutSuperseded, cl as createSecretMasker, co as callerEnvCredentials, cr as reachableDivergentParameters, cs as malformedResourcesWarning, cu as shouldRetainResource, da as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, dd as warnDeprecatedNoPrefixCliFlag, di as noEchoExactEchoLeavesOf, dl as maskSecretsInText, do as classifyReplaySecretRegion, dr as displayTextOrWithheld, ds as previewableOrphanRecords, dt as crossStackOutputProvenanceSource, du as renderPhaseTimings, ea as CC_BROKEN_REASON, ec as shownType, ed as getDefaultStateBucketName, ei as deleteSupersededEntry, el as hasMaskableValues, en as dropFailedCommands, eo as applyRoleArnIfSet, er as nameGenerationHighWaterOf, es as malformedOrphanRowsKeptWarning, eu as hasReadableExportSet, fa as applyCustomResourceResponseExpiration, fd as ssmResolvedValueType, fi as noEchoParameterNamesOf, fl as scrubResourceRecord, fn as readRefactorMarker, fo as producerRegionsFromState, fr as exportAliasCollisionScrubWarning, fs as refuseDivergentRecordRegionForDestroy, ft as inheritedProvenanceForChildDiff, fu as timePhase, gd as findLargeInlineResources, gi as journaledOrphanPrintingBag, gl as dynamicReferenceTokens, gn as refuseRefactorMarker, go as parameterTypeMayLoseSecretIdentity, gr as carriedExportAliasExposure, gs as refuseMalformedOrphans, gt as childTemplateLoader, gu as WorkGraph, ha as slowCcOperationTimeoutMs, hd as MIGRATE_TMP_PREFIX, hi as completedReplayEntries, hl as DYNAMIC_REFERENCE_TOKEN_SCAN, hn as refactorMarkerRefusalMessage, ho as isUnboundTemplateParameter, hr as secretSafeKeyDisplay, hs as refuseMalformedOrphanRecordsForDestroy, ht as serviceTokenBlockingReason, hu as stringifyValue, i as PROTECTION_PROPERTY_BY_TYPE, ia as wouldReturnToSdkProvider, ic as renderStatefulReason, id as resolveAutoAssetStorage, ii as supersededAfterRollback, il as recordLogOnlyParameterValue, in as loadJournaledOrphans, io as isIamRoleArn, ir as retiredNameGenerationsLeaving, is as malformedOutputsWarning, iu as importableOutputs, j as setResolvedResourceTimeouts, ja as DiffCalculator, jc as DagBuilder, jd as hasOwnKey, ji as effectiveDeletionPolicy, jl as recordMaskOnlyValuesIn, jn as equalModuloMask, jr as findRefactorHints, js as refuseMalformedResourcePropertiesForOrphan, jt as keptWholeReasonText, ju as buildDenyExternalAccessPolicy, kd as utf8ByteLength, ki as ccRoutedFinalSnapshotError, kl as provenPublicValue, kn as calculateResourceDrift, ko as withSharedDrainBudget, kr as findDestructiveChanges, ks as refuseMalformedResourcePropertiesForDrift, kt as diffSecurity, ku as validateAssetBucketName, ld as resolveUseCdkBootstrapAssets, li as noEchoAttributeNamesOf, ll as errorCauseChain, lo as envCredentialsAreAssumedRole, lr as resourcesNamingDeclaredParameter, ls as malformedScrubResourceEntriesRefusalMessage, lt as IMPLICIT_DELETE_DEPENDENCIES, lu as stackInstanceIdCarriedFrom, ma as CloudControlProvider, md as CFN_TEMPLATE_URL_LIMIT, mi as createReadOnlyAttributeHealerFactory, mn as refactorMarkerMovesOf, mo as coerceParameterTypedValue, mr as secretBearingStateKeyWarning, ms as refuseMalformedOrphanRecords, mt as findServiceTokenRefusals, mu as isSensitiveAttributeName, n as recordedProtectionEvidence, na as ccBrokenReason, nc as isStatefulRecreateTargetForReplace, nd as loadCdkJson, ni as isSupersededResourceRecord, nl as logOnlyValueCount, nn as isHandledOrphan, no as assertSendableRoleArn, nr as retiredAfterRollback, ns as malformedOrphansWarning, nu as hasUnverifiableParameterRefusal, o as perType, oa as TemplateNoEchoReresolver, od as resolveSkipPrefix, oi as supersededHolderOf, ol as shareLogOnlyValues, on as sameJournaledOrphans, oo as AWS_CREDENTIAL_ENV_KEYS, or as computeParameterTaint, os as malformedResourceEntriesWarning, ou as orphansAfterRollback, pa as customResourceResponseExpirationWarning, pd as CFN_TEMPLATE_BODY_LIMIT, pi as withAttemptedItemsMasked, pl as withPhysicalNameCopies, pn as readRefactorMarkerOnce, po as regionLessSecretName, pr as secretBearing, pt as deferredServiceTokenWarning, pu as AssetPublisher, qa as resolveDynamicReferences, qc as liveMatchesUnresolvedTokenFrame, ql as isNotImplemented, qo as malformedExportNamesWarning, qr as bold, qs as findHandledUnwrittenCreateOnly, qu as runDockerForeground, r as recordedProtectionNote, ra as isCustomResource, rc as isStatefulRecreateTargetSync, rd as resolveApp, ri as removeSuperseded, rl as printingCorpusOf, rn as journaledOrphanLines, ro as explicitRoleArnOrThrow, rr as retiredNameGenerationsAfter, rs as malformedOutputsRefusalMessage, ru as importableOutputKeys, s as readProtection, sa as readsNoEchoDeleteValues, sd as resolveStateBucketWithDefault, si as supersededResourcesOf, sl as unionOfSecretBags, sn as formatResourceLine, so as applyCallerIdentityCredentials, sr as namesAnyDeclaredParameter, ss as malformedResourcePropertiesWarning, su as orphansCarriedFrom, t as DeployEngine, ta as ProviderRegistry, tc as MULTI_REGION_RECREATE_BLOCKED_TYPES, td as getLegacyStateBucketName, ti as holdsSupersededResources, tl as literalSplitDelimitersOf, tn as dropFailedHint, to as assertFlagRoleArn, tr as nameScopeOf, ts as malformedOrphansRefusalMessage, tu as hasReasonlessBaselineRefusal, ua as withPrintingSecrets, uc as coerceCfnBoolean, ud as stateBucketExistenceConfirmed, ui as noEchoComparisonForTemplate, ul as maskSecretsInError, uo as classifyRecordedSecretRegion, ur as WITHHELD_NAME_DISPLAY, us as malformedStateRefusalMessage, ut as computeImplicitDeleteEdges, uu as PhaseClock, va as RollbackInlinePolicyWriters, vd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vi as namingSecretsWithRecordedNoEcho, vl as pathCrossesDottedKey, vn as updateRefactorMarker, vo as isImpossibleEmptyStoredAttribute, vr as exportNameSecretExposure, vs as refuseMalformedOrphansForOrphan, vt as isAbsoluteAssetPath, vu as createAssetRedirectResolver, wa as isWaitAbandonedError, wd as AssemblyReader, wi as stateSecretNameNeedles, wl as physicalNameCopiesOf, wn as replayRollback, wo as cfnRefValueFromPhysicalId, wr as bindingSkippedOutputs, ws as refuseMalformedResourceEntriesForDestroy, wt as parentSuppliedValues, wu as ensureAssetStorage, xa as deleteLeftInPlace, xc as templateResourceTypes, xd as PARTITION_TABLE, xi as secretNamePrintingBags, xl as inheritNestedStackParameterAssociations, xn as pendingMovesRefusalMessage, xo as isNamelessDynamicReferenceError, xr as collectDeclaredOutputNames, xs as refuseMalformedResourceAttributesForOrphan, xt as templateIdentity, xu as AssetModeResolver, ya as UNSPECIFIED_SKIP_REASON, yd as decodeListingKey, yi as orphanRecordsPrintingBag, yl as spelledKeysOf, yn as hasPendingMovesOut, yo as carriesDynamicReference, yr as isWholeDynamicReferenceValue, ys as refuseMalformedOutputs, yt as listNestedTemplateRows, yu as loadPublishableAssetManifest, za as IntrinsicFunctionResolver, zc as noEchoCoordinatesOf, zd as resolveAssemblyPath, zl as isLockInfoExpired, zn as recordUnderIdIsNotOwn, zo as deployRefusesOrphanRowsReason, zr as parseMappingFile, zs as repairMalformedResourceEntriesForReadOnly, zt as recordRetainedForReadoption, zu as formatDockerLoginError } from "./deploy-engine-D75VMGMz.js";
+import { t as getCdkdVersion } from "./version-DzOlXh8b.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -695,6 +695,7 @@ async function bootstrapDestroyCommand(options) {
 	if (regionNeedsReconciliation(effective)) {
 		const probeBackend = new S3StateBackend(new S3Client({
 			...awsClientDefaults({ profile: options.profile }),
+			...s3ClientDefaults(),
 			region: effective.region,
 			...options.profile && { profile: options.profile }
 		}), {
@@ -724,6 +725,7 @@ async function bootstrapDestroyCommand(options) {
 	setAwsClients(awsClients);
 	const markerS3Client = new S3Client({
 		...awsClientDefaults({ profile: options.profile }),
+		...s3ClientDefaults(),
 		region,
 		...options.profile && { profile: options.profile }
 	});
@@ -885,6 +887,7 @@ async function bootstrapCommand(options) {
 	if (regionNeedsReconciliation(effective)) {
 		const probeBackend = new S3StateBackend(new S3Client({
 			...awsClientDefaults({ profile: options.profile }),
+			...s3ClientDefaults(),
 			region: effective.region,
 			...options.profile && { profile: options.profile }
 		}), {
@@ -993,6 +996,7 @@ async function bootstrapCommand(options) {
 			});
 			const markerS3Client = new S3Client({
 				...awsClientDefaults({ profile: options.profile }),
+				...s3ClientDefaults(),
 				region,
 				...options.profile && { profile: options.profile }
 			});
@@ -2686,7 +2690,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 // src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CZnJcera.js");
+	providerClasses ??= import("./provider-classes-Cvc4LfXM.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -10042,6 +10046,22 @@ function redactDriftChanges(changes, secrets, secretPaths, maskPaths) {
 		maskedPaths
 	};
 }
+const UNDECLARED_UNCOMPARED_KEYS = { "AWS::S3::Bucket": ["NotificationConfiguration"] };
+function undeclaredUncomparedDriftKeys(resourceType, properties) {
+	const keys = hasOwnKey(UNDECLARED_UNCOMPARED_KEYS, resourceType) ? UNDECLARED_UNCOMPARED_KEYS[resourceType] : [];
+	if (keys.length === 0) return [];
+	if (typeof properties !== "object" || properties === null || Array.isArray(properties)) return [];
+	return keys.filter((key) => !hasOwnKey(properties, key));
+}
+function preFixBaselineUncomparedDriftKeys(resourceType, observed, properties, aws) {
+	if (resourceType !== "AWS::Lambda::EventSourceMapping") return [];
+	if (observed === void 0) return [];
+	if (typeof properties !== "object" || properties === null || Array.isArray(properties)) return [];
+	const declared = hasOwnKey(properties, "Enabled") ? coerceCfnBoolean(properties["Enabled"]) : void 0;
+	const recorded = hasOwnKey(observed, "Enabled") ? coerceCfnBoolean(observed["Enabled"]) : void 0;
+	const live = hasOwnKey(aws, "Enabled") ? aws["Enabled"] : void 0;
+	return recorded === false && declared !== false && live === true ? ["Enabled"] : [];
+}
 async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode, nestedChildRecord, refusalRecovery) {
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
@@ -10271,8 +10291,15 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					const paired = provider.canonicalizeDriftPair ? await provider.canonicalizeDriftPair(resource.resourceType, canonicalized.baseline, canonicalized.aws, resource.properties ?? {}) : canonicalized;
 					const nameBaseline = canonicalizeDerivedPatternBName(resource.resourceType, paired.baseline, paired.aws);
 					const comparedBaseline = useObserved ? withAbsentDefaultKeys(nameBaseline, paired.aws, driftAbsentMeansDefaultKeys(provider, resource.resourceType, resource.properties)) : nameBaseline;
+					const ownedIgnorePaths = undeclaredUncomparedDriftKeys(resource.resourceType, resource.properties);
+					const preFixIgnorePaths = preFixBaselineUncomparedDriftKeys(resource.resourceType, resource.observedProperties, resource.properties, aws);
 					const noEchoPartitioned = partitionNoEchoParameterChanges(calculateResourceDrift(comparedBaseline, paired.aws, {
-						ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
+						ignorePaths: observedIgnorePaths.length || ownedIgnorePaths.length || preFixIgnorePaths.length ? [
+							...ignorePaths,
+							...observedIgnorePaths,
+							...ownedIgnorePaths,
+							...preFixIgnorePaths
+						] : ignorePaths,
 						unionWalkObjects: useObserved,
 						unorderedPaths
 					}), resource, baseline);
@@ -14451,6 +14478,7 @@ async function stateMigrateCommand(options) {
 		const probeRegion = "us-east-1";
 		const probe = new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			region: probeRegion
 		});
 		let legacyBucket;
@@ -14485,6 +14513,7 @@ async function stateMigrateCommand(options) {
 		logger.info(`  source bucket actual region: ${legacyRegion}`);
 		const legacyS3 = new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			region: legacyRegion
 		});
 		try {
@@ -14603,6 +14632,7 @@ async function assertNoActiveLocks(s3, bucket) {
 async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 	const probe = new S3Client({
 		...ambientClientDefaults(),
+		...s3ClientDefaults(),
 		region
 	});
 	let exists;
@@ -14617,12 +14647,14 @@ async function ensureDestinationBucket(bucketName, region, accountId, logger) {
 		if (actual !== region) logger.warn(`Destination bucket lives in ${actual}, but source is in ${region}. Cross-region copy is supported but slower; objects will be replicated to ${actual}.`);
 		return new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			region: actual
 		});
 	}
 	logger.info(`Creating destination bucket ${bucketName} in ${region}...`);
 	const s3 = new S3Client({
 		...ambientClientDefaults(),
+		...s3ClientDefaults(),
 		region
 	});
 	const createParams = { Bucket: bucketName };
@@ -20948,6 +20980,7 @@ async function gcCommand(options) {
 	const bucketName = options.stateBucket ?? getDefaultStateBucketName(accountId);
 	const markerS3Client = new S3Client({
 		...awsClientDefaults({ profile: options.profile }),
+		...s3ClientDefaults(),
 		region: effective.region,
 		...options.profile && { profile: options.profile }
 	});
@@ -25308,6 +25341,7 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	if (user !== void 0) out.user = user;
 	if (privileged !== void 0) out.privileged = privileged;
 	if (readonlyRootFilesystem !== void 0) out.readonlyRootFilesystem = readonlyRootFilesystem;
+	if (droppedSecretKeys.length > 0) out.droppedSecretNames = droppedSecretKeys.map((d) => d.key);
 	return out;
 }
 function buildSubstitutionContextFromImageContext(context) {
@@ -25607,6 +25641,7 @@ async function applyCrossStackResolverToTask(task, context) {
 					valueFrom: sub.value
 				});
 				resolvedSecretNames.add(sName);
+				if (container.droppedSecretNames) container.droppedSecretNames = container.droppedSecretNames.filter((n) => n !== sName);
 			}
 		}
 		if (resolvedEnvKeys.size > 0 || resolvedSecretNames.size > 0) {
@@ -28211,6 +28246,7 @@ function createLocalStartApiCommand() {
 const execFileAsync$2 = promisify(execFile);
 const METADATA_ENDPOINT_IMAGE = "amazon/amazon-ecs-local-container-endpoints:latest-amd64";
 const METADATA_ENDPOINT_IP = "169.254.170.2";
+const TASK_ROLE_CREDENTIALS_PATH = "/creds";
 const DEFAULT_METADATA_ENDPOINT_SUBNET = "169.254.170.0/24";
 function buildEndpointSubnet(subnetOctet) {
 	if (subnetOctet < 1 || subnetOctet > 254 || !Number.isInteger(subnetOctet)) throw new Error(`buildEndpointSubnet: subnetOctet must be an integer in 1..254 (got ${subnetOctet}).`);
@@ -28236,7 +28272,7 @@ async function createNetworkAndSidecar(args) {
 	try {
 		await execFileAsync$2(getDockerCmd(), createArgs);
 	} catch (err) {
-		throw new DockerRunnerError(`docker network create failed: ${describeDockerFailure(err, createArgs)}. Hint: another cdkd run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`cdkd local start-service\` shares one network across every service in the run; bare \`cdkd local run-task\` uses a per-task network so only one run can be active at a time.`);
+		throw new DockerRunnerError(`docker network create failed: ${describeDockerFailure(err, createArgs)}. Hint: another cdkd run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`cdkd local run-task\` always uses 169.254.170.0/24, where AWS SDKs read task-role credentials, as does a \`cdkd local start-service\` / \`start-alb\` run with \`--assume-role\`, so only one of them can be active at a time.`);
 	}
 	const sidecarArgs = [
 		"run",
@@ -28304,7 +28340,10 @@ function buildMetadataEnv(opts) {
 		ECS_CONTAINER_METADATA_URI_V4: `http://${ip}/v4/${opts.containerName}`,
 		ECS_CONTAINER_METADATA_URI: `http://${ip}/v3/${opts.containerName}`
 	};
-	if (opts.roleArn) env["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"] = `/role/${encodeURIComponent(opts.roleArn)}`;
+	if (opts.roleArn) {
+		if (ip !== "169.254.170.2") throw new DockerRunnerError(`A task role needs the metadata sidecar at ${METADATA_ENDPOINT_IP} (SDKs read task-role credentials only from there), but this task's network put it at ${ip}.`);
+		env["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"] = TASK_ROLE_CREDENTIALS_PATH;
+	}
 	if (opts.region) env["AWS_REGION"] = opts.region;
 	return env;
 }
@@ -28582,6 +28621,7 @@ async function runEcsTask(task, options, state) {
 	for (const c of task.containers) {
 		const refusal = finchSecretArgvRefusal([
 			...c.secrets.map((s) => s.name),
+			...(c.droppedSecretNames ?? []).filter((n) => overriddenEnvKeys(options.envOverrides, c.name).includes(n)),
 			...c.resolvedDynamicReferenceKeys ?? [],
 			...dynamicReferenceEnvKeys(c, options.envOverrides)
 		].filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), `Container ${displayIdent(c.name)}`);
@@ -28601,11 +28641,20 @@ async function runEcsTask(task, options, state) {
 	const imagePlan = options.imagePlanByContainer ?? /* @__PURE__ */ new Map();
 	if (!options.imagePlanByContainer) await prepareImages(task, imagePlan, options);
 	const allSecrets = [];
-	for (const c of task.containers) for (const s of c.secrets) allSecrets.push({
-		containerName: c.name,
-		name: s.name,
-		valueFrom: s.valueFrom
-	});
+	for (const c of task.containers) {
+		const overridden = new Set(overriddenEnvKeys(options.envOverrides, c.name));
+		for (const s of c.secrets) {
+			if (overridden.has(s.name)) {
+				logger.debug(safeMsg`Secret ${displayIdent(c.name)}.${displayIdent(s.name)} not fetched: --env-vars gives this key.`);
+				continue;
+			}
+			allSecrets.push({
+				containerName: c.name,
+				name: s.name,
+				valueFrom: s.valueFrom
+			});
+		}
+	}
 	const secretsByContainer = groupSecretsByContainer(await resolveEcsSecrets(allSecrets, { ...options.region !== void 0 && { region: options.region } }));
 	const dynamicEnvByContainer = /* @__PURE__ */ new Map();
 	const dynamicRefs = createCallerDynamicReferenceResolver(options.profile);
@@ -28637,7 +28686,7 @@ async function runEcsTask(task, options, state) {
 		};
 		if (options.taskCredentials) netCreateOpts.credentials = options.taskCredentials;
 		if (options.cluster) netCreateOpts.cluster = options.cluster;
-		if (options.subnetOctet !== void 0) netCreateOpts.subnetOctet = options.subnetOctet;
+		if (options.subnetOctet !== void 0 && !options.taskRoleArn) netCreateOpts.subnetOctet = options.subnetOctet;
 		await runDockerStep(state, () => createTaskNetwork(netCreateOpts), (net) => {
 			state.network = net;
 		}, () => destroyTaskNetwork({
@@ -29076,6 +29125,8 @@ function buildDockerRunArgs(opts) {
 	const sensitiveKeys = /* @__PURE__ */ new Set([
 		...SENSITIVE_ENV_KEYS,
 		...secrets.map((s) => s.name),
+		...container.secrets.map((s) => s.name),
+		...container.droppedSecretNames ?? [],
 		...opts.plaintextEnvKeys ?? []
 	]);
 	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, sensitiveKeys, { subject: `Container '${container.name}'` });
@@ -31501,7 +31552,8 @@ function createLocalCommand() {
 function buildProgram() {
 	const program = new Command();
 	program.name("cdkd").description("Drop-in CDK CLI for existing CDK apps - up to 15x faster deploys via direct AWS SDK calls instead of CloudFormation").version(getCdkdVersion());
-	program.hook("preAction", (_thisCommand, actionCommand) => {
+	setS3ClientDefaultsDebugLog((message) => getLogger().debug(message));
+	program.hook("preAction", async (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		setPasteableAwsProfile(profile);
 		const { stateBucket, roleArn } = actionCommand.optsWithGlobals();
@@ -31513,6 +31565,7 @@ function buildProgram() {
 			roleArn: roleArn !== void 0
 		});
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;
+		await resolveS3ClientDefaults({ profile });
 	});
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
@@ -31551,4 +31604,4 @@ function collectVerbFlags(program) {
 }
 
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CcdJAeR0.js.map
+//# sourceMappingURL=program-DXF0ILBM.js.map